19 package org.sleuthkit.datamodel;
21 import com.mchange.v2.c3p0.ComboPooledDataSource;
22 import com.mchange.v2.c3p0.DataSources;
23 import com.mchange.v2.c3p0.PooledDataSource;
24 import java.beans.PropertyVetoException;
25 import java.io.BufferedInputStream;
26 import java.io.BufferedOutputStream;
28 import java.io.FileInputStream;
29 import java.io.FileOutputStream;
30 import java.io.IOException;
31 import java.io.InputStream;
32 import java.io.OutputStream;
33 import java.io.UnsupportedEncodingException;
34 import java.net.InetAddress;
35 import java.net.URLEncoder;
36 import java.nio.charset.StandardCharsets;
37 import java.nio.file.Paths;
38 import java.sql.Connection;
39 import java.sql.DriverManager;
40 import java.sql.PreparedStatement;
41 import java.sql.ResultSet;
42 import java.sql.SQLException;
43 import java.sql.Statement;
44 import java.text.SimpleDateFormat;
45 import java.util.ArrayList;
46 import java.util.Arrays;
47 import java.util.Collection;
48 import java.util.Collections;
49 import java.util.Date;
50 import java.util.EnumMap;
51 import java.util.HashMap;
52 import java.util.HashSet;
53 import java.util.LinkedHashMap;
54 import java.util.List;
56 import java.util.MissingResourceException;
57 import java.util.ResourceBundle;
59 import java.util.UUID;
60 import java.util.concurrent.ConcurrentHashMap;
61 import java.util.concurrent.locks.ReentrantReadWriteLock;
62 import java.util.logging.Level;
63 import java.util.logging.Logger;
64 import org.postgresql.util.PSQLException;
65 import org.postgresql.util.PSQLState;
80 import org.sqlite.SQLiteConfig;
81 import org.sqlite.SQLiteDataSource;
82 import org.sqlite.SQLiteJDBCLoader;
94 private static final ResourceBundle
bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
105 private final Map<Long, FileSystem>
fileSystemIdMap =
new HashMap<Long, FileSystem>();
123 private final ReentrantReadWriteLock
rwLock =
new ReentrantReadWriteLock(
true);
141 if (info.getHost() == null || info.getHost().isEmpty()) {
142 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
143 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
144 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
145 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
146 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
147 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
148 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
152 Class.forName(
"org.postgresql.Driver");
153 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
157 }
catch (SQLException ex) {
159 String sqlState = ex.getSQLState().toLowerCase();
160 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
162 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
164 result = bundle.getString(
"DatabaseConnectionCheck.Port");
166 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
168 }
catch (IOException any) {
170 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
171 }
catch (MissingResourceException any) {
173 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
175 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
176 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
177 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
178 result = bundle.getString(
"DatabaseConnectionCheck.Access");
179 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
180 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
181 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
182 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
183 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
184 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
186 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
189 }
catch (ClassNotFoundException ex) {
190 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
206 Class.forName(
"org.sqlite.JDBC");
210 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
211 this.databaseName = dbFile.
getName();
237 this.databaseName = dbName;
245 private void init() throws Exception {
279 Statement statement = null;
280 ResultSet resultSet = null;
282 statement = connection.createStatement();
285 statement.execute(
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES (" + type.getTypeID() +
" , '" + type.getLabel() +
"', '" + type.getDisplayName() +
"')");
286 }
catch (SQLException ex) {
287 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_artifact_types WHERE artifact_type_id = '" + type.getTypeID() +
"'");
289 if (resultSet.getLong(
"count") == 0) {
299 int newPrimaryKeyIndex = Collections.max(Arrays.asList(
ARTIFACT_TYPE.values())).getTypeID() + 1;
300 statement.execute(
"ALTER SEQUENCE blackboard_artifact_types_artifact_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
318 Statement statement = null;
319 ResultSet resultSet = null;
321 statement = connection.createStatement();
324 statement.execute(
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES (" + type.getTypeID() +
", '" + type.getLabel() +
"', '" + type.getDisplayName() +
"', '" + type.getValueType().getType() +
"')");
325 }
catch (SQLException ex) {
326 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types WHERE attribute_type_id = '" + type.getTypeID() +
"'");
328 if (resultSet.getLong(
"count") == 0) {
338 int newPrimaryKeyIndex = Collections.max(Arrays.asList(
ATTRIBUTE_TYPE.values())).getTypeID() + 1;
339 statement.execute(
"ALTER SEQUENCE blackboard_attribute_types_attribute_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
359 Statement statement = null;
360 ResultSet resultSet = null;
362 statement = connection.createStatement();
363 resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
365 this.nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
366 if (this.nextArtifactId == 1) {
384 String bookmarkDisplayName = bundle.getString(
"SleuthkitCase.initStandardTagNames.bookmark.text");
386 Statement statement = null;
387 ResultSet resultSet = null;
389 statement = connection.createStatement();
390 statement.execute(
"INSERT INTO tag_names (display_name, description, color) VALUES ('" + bookmarkDisplayName +
"', '', '" +
TagName.
HTML_COLOR.
NONE.getName() +
"');");
391 }
catch (SQLException ex) {
397 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM tag_names WHERE display_name = '" + bookmarkDisplayName +
"'");
399 if (resultSet.getLong(
"count") == 0) {
417 Statement statement = null;
418 ResultSet resultSet = null;
420 statement = connection.createStatement();
423 statement.execute(
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
424 }
catch (SQLException ex) {
425 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
427 if (resultSet.getLong(
"count") == 0) {
448 Statement statement = null;
449 ResultSet resultSet = null;
451 statement = connection.createStatement();
454 statement.execute(
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
455 }
catch (SQLException ex) {
456 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
458 if (resultSet.getLong(
"count") == 0) {
478 Statement statement = null;
479 ResultSet resultSet = null;
481 statement = connection.createStatement();
484 statement.execute(
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
485 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')");
486 }
catch (SQLException ex) {
487 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
489 if (resultSet.getLong(
"count") == 0) {
510 Statement statement = null;
511 ResultSet resultSet = null;
513 statement = connection.createStatement();
516 statement.execute(
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')");
517 }
catch (SQLException ex) {
518 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
520 if (resultSet.getLong(
"count") == 0) {
541 ResultSet resultSet = null;
542 Statement statement = null;
544 connection.beginTransaction();
548 statement = connection.createStatement();
549 resultSet = connection.executeQuery(statement,
"SELECT schema_ver FROM tsk_db_info");
550 if (resultSet.next()) {
551 schemaVersionNumber = resultSet.getInt(
"schema_ver");
559 if (SCHEMA_VERSION_NUMBER != schemaVersionNumber) {
560 if (null != dbPath) {
563 String backupFilePath = dbPath +
".schemaVer" + schemaVersionNumber +
".backup";
565 dbBackupPath = backupFilePath;
578 statement = connection.createStatement();
579 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + schemaVersionNumber);
583 versionNumber = schemaVersionNumber;
585 connection.commitTransaction();
586 }
catch (Exception ex) {
587 connection.rollbackTransaction();
605 public void copyCaseDB(String newDBPath)
throws IOException {
606 if (dbPath.isEmpty()) {
607 throw new IOException(
"Copying case database files is not supported for this type of case database");
609 InputStream in = null;
610 OutputStream out = null;
613 InputStream inFile =
new FileInputStream(dbPath);
614 in =
new BufferedInputStream(inFile);
615 OutputStream outFile =
new FileOutputStream(newDBPath);
616 out =
new BufferedOutputStream(outFile);
617 int bytesRead = in.read();
618 while (bytesRead != -1) {
619 out.write(bytesRead);
620 bytesRead = in.read();
631 }
catch (IOException e) {
632 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
644 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
645 ?
"native" :
"pure-java"));
646 }
catch (Exception ex) {
665 @SuppressWarnings(
"deprecation")
667 if (schemaVersionNumber != 2) {
668 return schemaVersionNumber;
670 Statement statement = null;
671 Statement updateStatement = null;
672 ResultSet resultSet = null;
674 statement = connection.createStatement();
677 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
678 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
679 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
682 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
685 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
686 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
687 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
690 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
693 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
698 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
699 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
700 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
701 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
702 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
703 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
704 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
705 +
"arts.artifact_type_id AS artifact_type_id "
706 +
"FROM blackboard_attributes AS attrs "
707 +
"INNER JOIN blackboard_artifacts AS arts "
708 +
"WHERE attrs.artifact_id = arts.artifact_id;");
709 updateStatement = connection.createStatement();
710 while (resultSet.next()) {
711 long artifactId = resultSet.getLong(
"artifact_id");
712 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
713 updateStatement.executeUpdate(
714 "UPDATE blackboard_attributes "
715 +
"SET artifact_type_id = " + artifactTypeId
716 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
725 HashMap<String, TagName> tagNames =
new HashMap<String, TagName>();
733 name = attribute.getValueString();
735 comment = attribute.getValueString();
738 if (!name.isEmpty()) {
740 if (tagNames.containsKey(name)) {
741 tagName = tagNames.get(name);
744 tagNames.put(name, tagName);
750 long taggedArtifactId = -1;
756 name = attribute.getValueString();
758 comment = attribute.getValueString();
760 taggedArtifactId = attribute.getValueLong();
763 if (taggedArtifactId != -1 && !name.isEmpty()) {
765 if (tagNames.containsKey(name)) {
766 tagName = tagNames.get(name);
769 tagNames.put(name, tagName);
775 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
776 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
780 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
808 if (schemaVersionNumber != 3) {
809 return schemaVersionNumber;
812 Statement statement = null;
813 ResultSet resultSet = null;
814 Statement queryStatement = null;
815 ResultSet queryResultSet = null;
816 Statement updateStatement = null;
820 statement = connection.createStatement();
821 updateStatement = connection.createStatement();
822 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
823 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
824 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
825 +
"WHERE files.obj_id = arts.obj_id AND "
826 +
"arts.artifact_id = attrs.artifact_id AND "
827 +
"arts.artifact_type_id = 1 AND "
828 +
"attrs.attribute_type_id = 62");
829 while (resultSet.next()) {
830 updateStatement.executeUpdate(
832 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
833 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
838 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
839 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
840 while (resultSet.next()) {
841 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
842 String attributeLabel = resultSet.getString(
"type_name");
843 if (attributeTypeId < MIN_USER_DEFINED_TYPE_ID) {
844 updateStatement.executeUpdate(
845 "UPDATE blackboard_attribute_types "
847 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
853 queryStatement = connection.createStatement();
854 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
855 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
856 while (resultSet.next()) {
857 long objectId = resultSet.getLong(
"obj_id");
858 String timeZone =
"";
859 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
860 if (queryResultSet.next()) {
861 timeZone = queryResultSet.getString(
"tzone");
863 queryResultSet.close();
864 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
865 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
879 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
880 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
881 while (resultSet.next()) {
882 long fileId = resultSet.getLong(
"obj_id");
884 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
887 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
888 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
890 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
891 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
893 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
894 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
897 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
927 if (schemaVersionNumber != 4) {
928 return schemaVersionNumber;
931 Statement statement = null;
934 statement = connection.createStatement();
935 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
948 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
961 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
985 if (schemaVersionNumber != 5) {
986 return schemaVersionNumber;
993 Statement statement = null;
994 ResultSet resultSet = null;
999 statement = connection.createStatement();
1000 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1002 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
1004 if (resultSet.getLong(
"count") == 0) {
1092 rwLock.writeLock().lock();
1103 rwLock.writeLock().unlock();
1114 rwLock.readLock().lock();
1125 rwLock.readLock().unlock();
1142 }
catch (Exception ex) {
1143 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
1173 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(),
caseHandle, caseDir, info.getDbType());
1174 }
catch (PropertyVetoException exp) {
1177 }
catch (Exception exp) {
1196 }
catch (Exception ex) {
1197 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
1232 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
1234 }
catch (PropertyVetoException exp) {
1237 }
catch (Exception exp) {
1254 if (!candidateDbName.isEmpty()) {
1258 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
1263 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
1268 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
1273 dbName = dbName.toLowerCase();
1279 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
1280 dbName =
"_" + dbName;
1288 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
1300 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
1301 Date date =
new Date();
1302 dbName = dbName +
"_" + dateFormat.format(date);
1323 String imageWriterPath) {
1324 return this.
caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans, imageWriterPath);
1339 ResultSet rs = null;
1341 s = connection.createStatement();
1342 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
1343 +
"WHERE par_obj_id IS NULL");
1344 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
1346 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
1349 List<Content> rootObjs =
new ArrayList<Content>();
1350 for (ObjectInfo i : infos) {
1351 if (null != i.type) {
1362 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
1366 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
1371 }
catch (SQLException ex) {
1372 throw new TskCoreException(
"Error getting root objects", ex);
1400 ResultSet rs = null;
1402 s = connection.createStatement();
1403 rs = connection.executeQuery(s,
"SELECT obj_id, device_id, time_zone FROM data_source_info");
1404 List<DataSource> dataSources =
new ArrayList<DataSource>();
1406 dataSources.add(
new AbstractDataSource(rs.getLong(
"obj_id"), rs.getString(
"device_id"), rs.getString(
"time_zone")));
1409 }
catch (SQLException ex) {
1410 throw new TskCoreException(
"Error getting data sources", ex);
1441 ResultSet rs = null;
1443 s = connection.createStatement();
1444 rs = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objectId);
1446 return new AbstractDataSource(objectId, rs.getString(
"device_id"), rs.getString(
"time_zone"));
1448 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
1450 }
catch (SQLException ex) {
1451 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
1471 return getArtifactsHelper(
"blackboard_artifacts.artifact_type_id = " + artifactTypeID);
1487 ResultSet rs = null;
1491 statement.clearParameters();
1492 statement.setLong(1, objId);
1493 rs = connection.executeQuery(statement);
1496 count = rs.getLong(
"count");
1499 }
catch (SQLException ex) {
1500 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
1521 ResultSet rs = null;
1525 statement.clearParameters();
1526 statement.setInt(1, artifactTypeID);
1527 rs = connection.executeQuery(statement);
1530 count = rs.getLong(
"count");
1533 }
catch (SQLException ex) {
1534 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
1560 ResultSet rs = null;
1562 s = connection.createStatement();
1563 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1564 +
"arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
1565 +
"types.type_name AS type_name, types.display_name AS display_name, "
1566 +
" arts.review_status_id AS review_status_id "
1567 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1568 +
"WHERE arts.artifact_id = attrs.artifact_id "
1569 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1570 +
" AND attrs.value_text = '" + value +
"'"
1571 +
" AND types.artifact_type_id=arts.artifact_type_id"
1573 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1575 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
1576 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1580 }
catch (SQLException ex) {
1581 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
1608 String valSubStr =
"%" + subString;
1609 if (startsWith ==
false) {
1615 ResultSet rs = null;
1617 s = connection.createStatement();
1618 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1619 +
" arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
1620 +
" types.type_name AS type_name, types.display_name AS display_name, "
1621 +
" arts.review_status_id AS review_status_id "
1622 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1623 +
" WHERE arts.artifact_id = attrs.artifact_id "
1624 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1625 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
1626 +
" AND types.artifact_type_id=arts.artifact_type_id "
1628 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1630 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
1631 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1635 }
catch (SQLException ex) {
1636 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
1663 ResultSet rs = null;
1665 s = connection.createStatement();
1666 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1667 +
" arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
1668 +
" types.type_name AS type_name, types.display_name AS display_name, "
1669 +
" arts.review_status_id AS review_status_id "
1670 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1671 +
"WHERE arts.artifact_id = attrs.artifact_id "
1672 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1673 +
" AND attrs.value_int32 = " + value
1674 +
" AND types.artifact_type_id=arts.artifact_type_id "
1676 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1678 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
1679 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1683 }
catch (SQLException ex) {
1684 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
1711 ResultSet rs = null;
1713 s = connection.createStatement();
1714 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1715 +
" arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
1716 +
" types.type_name AS type_name, types.display_name AS display_name, "
1717 +
" arts.review_status_id AS review_status_id "
1718 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1719 +
" WHERE arts.artifact_id = attrs.artifact_id "
1720 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1721 +
" AND attrs.value_int64 = " + value
1722 +
" AND types.artifact_type_id=arts.artifact_type_id "
1724 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1726 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
1727 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1731 }
catch (SQLException ex) {
1732 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
1759 ResultSet rs = null;
1761 s = connection.createStatement();
1762 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1763 +
" arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
1764 +
" types.type_name AS type_name, types.display_name AS display_name, "
1765 +
" arts.review_status_id AS review_status_id "
1766 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1767 +
" WHERE arts.artifact_id = attrs.artifact_id "
1768 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1769 +
" AND attrs.value_double = " + value
1770 +
" AND types.artifact_type_id=arts.artifact_type_id "
1772 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1774 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
1775 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1779 }
catch (SQLException ex) {
1780 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
1807 ResultSet rs = null;
1809 s = connection.createStatement();
1810 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1811 +
" arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
1812 +
" types.type_name AS type_name, types.display_name AS display_name, "
1813 +
" arts.review_status_id AS review_status_id "
1814 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1815 +
" WHERE arts.artifact_id = attrs.artifact_id "
1816 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1817 +
" AND attrs.value_byte = " + value
1818 +
" AND types.artifact_type_id=arts.artifact_type_id "
1820 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1822 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
1823 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1827 }
catch (SQLException ex) {
1828 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
1848 ResultSet rs = null;
1850 s = connection.createStatement();
1851 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types");
1855 rs.getString(
"type_name"), rs.getString(
"display_name")));
1857 return artifactTypes;
1858 }
catch (SQLException ex) {
1859 throw new TskCoreException(
"Error getting artifact types", ex);
1877 String typeIdList =
"";
1884 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
1885 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
1889 ResultSet rs = null;
1891 s = connection.createStatement();
1892 rs = connection.executeQuery(s, query);
1898 }
catch (SQLException ex) {
1899 throw new TskCoreException(
"Error getting artifact types in use", ex);
1922 ResultSet rs = null;
1924 s = connection.createStatement();
1925 rs = connection.executeQuery(s,
1926 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
1927 +
"types.type_name AS type_name, types.display_name AS display_name "
1928 +
"FROM blackboard_artifact_types AS types "
1929 +
"INNER JOIN blackboard_artifacts AS arts "
1930 +
"ON arts.artifact_type_id = types.artifact_type_id");
1934 rs.getString(
"type_name"), rs.getString(
"display_name")));
1936 return uniqueArtifactTypes;
1937 }
catch (SQLException ex) {
1938 throw new TskCoreException(
"Error getting attribute types", ex);
1958 ResultSet rs = null;
1960 s = connection.createStatement();
1961 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
1967 return attribute_types;
1968 }
catch (SQLException ex) {
1969 throw new TskCoreException(
"Error getting attribute types", ex);
1993 ResultSet rs = null;
1995 s = connection.createStatement();
1996 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
1999 count = rs.getInt(
"count");
2002 }
catch (SQLException ex) {
2003 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
2027 ResultSet rs = null;
2029 Statement statement = connection.createStatement();
2030 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
2031 +
"blackboard_artifacts.obj_id AS obj_id, "
2032 +
"blackboard_artifact_types.artifact_type_id AS artifact_type_id, "
2033 +
"blackboard_artifact_types.type_name AS type_name, "
2034 +
"blackboard_artifact_types.display_name AS display_name, "
2035 +
"blackboard_artifacts.review_status_id AS review_status_id "
2036 +
"FROM blackboard_artifacts, blackboard_artifact_types "
2037 +
"WHERE blackboard_artifacts.artifact_type_id = blackboard_artifact_types.artifact_type_id "
2039 +
" AND " + whereClause;
2040 rs = connection.executeQuery(statement, query);
2041 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
2043 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
2044 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2048 }
catch (SQLException ex) {
2049 throw new TskCoreException(
"Error getting or creating a blackboard artifact", ex);
2072 ResultSet rs = null;
2076 statement.clearParameters();
2077 statement.setLong(1, obj_id);
2078 statement.setInt(2, artifactTypeID);
2079 rs = connection.executeQuery(statement);
2082 count = rs.getLong(
"count");
2085 }
catch (SQLException ex) {
2107 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
2123 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID +
";");
2155 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
2156 if (artifactTypeID == -1) {
2206 return getArtifactsHelper(
"blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
2221 return getArtifactsHelper(
"blackboard_artifact_types.artifact_type_id = " + artifactType.getTypeID() +
";");
2241 ResultSet rs = null;
2243 s = connection.createStatement();
2244 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
2245 +
"arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
2246 +
"types.type_name AS type_name, types.display_name AS display_name,"
2247 +
"arts.review_status_id AS review_status_id "
2248 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
2249 +
"WHERE arts.artifact_id = attrs.artifact_id "
2250 +
"AND attrs.attribute_type_id = " + attrType.getTypeID()
2251 +
" AND arts.artifact_type_id = " + artifactType.getTypeID()
2252 +
" AND attrs.value_text = '" + value +
"'"
2253 +
" AND types.artifact_type_id=arts.artifact_type_id"
2255 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
2257 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
2258 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2262 }
catch (SQLException ex) {
2263 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
2285 ResultSet rs = null;
2288 s = connection.createStatement();
2289 rs = connection.executeQuery(s,
"SELECT arts.artifact_id AS artifact_id, "
2290 +
"arts.obj_id AS obj_id, arts.artifact_type_id AS artifact_type_id, "
2291 +
"types.type_name AS type_name, types.display_name AS display_name,"
2292 +
"arts.review_status_id AS review_status_id "
2293 +
"FROM blackboard_artifacts AS arts, blackboard_artifact_types AS types "
2294 +
"WHERE arts.artifact_id = " + artifactID
2295 +
" AND arts.artifact_type_id = types.artifact_type_id");
2298 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2306 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
2308 }
catch (SQLException ex) {
2309 throw new TskCoreException(
"Error getting a blackboard artifact. " + ex.getMessage(), ex);
2330 }
catch (SQLException ex) {
2331 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
2351 connection.beginTransaction();
2355 connection.commitTransaction();
2356 }
catch (SQLException ex) {
2357 connection.rollbackTransaction();
2366 PreparedStatement statement;
2367 switch (attr.getAttributeType().getValueType()) {
2370 statement.clearParameters();
2371 statement.setString(7, attr.getValueString());
2375 statement.clearParameters();
2376 statement.setBytes(7, attr.getValueBytes());
2380 statement.clearParameters();
2381 statement.setInt(7, attr.getValueInt());
2385 statement.clearParameters();
2386 statement.setLong(7, attr.getValueLong());
2390 statement.clearParameters();
2391 statement.setDouble(7, attr.getValueDouble());
2395 statement.clearParameters();
2396 statement.setLong(7, attr.getValueLong());
2401 statement.setLong(1, attr.getArtifactID());
2402 statement.setInt(2, artifactTypeId);
2403 statement.setString(3, attr.getSourcesCSV());
2404 statement.setString(4,
"");
2405 statement.setInt(5, attr.getAttributeType().getTypeID());
2406 statement.setLong(6, attr.getAttributeType().getValueType().getType());
2407 connection.executeUpdate(statement);
2428 if (null == source || source.isEmpty()) {
2429 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
2431 CaseDbConnection connection = connections.getConnection();
2433 Statement queryStmt = null;
2434 Statement updateStmt = null;
2435 ResultSet result = null;
2436 String newSources =
"";
2438 connection.beginTransaction();
2439 String valueClause =
"";
2440 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
2441 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
2442 switch (valueType) {
2447 valueClause =
" value_int32 = " + attr.getValueInt();
2451 valueClause =
" value_int64 = " + attr.getValueLong();
2454 valueClause =
" value_double = " + attr.getValueDouble();
2457 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
2459 String query =
"SELECT source FROM blackboard_attributes WHERE"
2460 +
" artifact_id = " + attr.getArtifactID()
2461 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
2462 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
2463 +
" AND " + valueClause +
";";
2464 queryStmt = connection.createStatement();
2465 updateStmt = connection.createStatement();
2466 result = connection.executeQuery(queryStmt, query);
2473 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
2474 statement.clearParameters();
2475 statement.setLong(1, attr.getArtifactID());
2476 statement.setLong(2, attr.getAttributeType().getTypeID());
2477 statement.setBytes(3, attr.getValueBytes());
2478 result = connection.executeQuery(statement);
2480 while (result.next()) {
2481 String oldSources = result.getString(
"source");
2482 if (null != oldSources && !oldSources.isEmpty()) {
2483 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
2484 if (!uniqueSources.contains(source)) {
2485 newSources = oldSources +
"," + source;
2487 newSources = oldSources;
2490 newSources = source;
2492 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
2493 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
2494 +
" artifact_id = " + attr.getArtifactID()
2495 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
2496 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
2497 +
" AND " + valueClause +
";";
2498 connection.executeUpdate(updateStmt, update);
2505 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
2506 statement.clearParameters();
2507 statement.setString(1, newSources);
2508 statement.setLong(2, attr.getArtifactID());
2509 statement.setLong(3, attr.getAttributeType().getTypeID());
2510 statement.setBytes(4, attr.getValueBytes());
2511 connection.executeUpdate(statement);
2514 connection.commitTransaction();
2516 }
catch (SQLException ex) {
2517 connection.rollbackTransaction();
2518 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
2546 ResultSet rs = null;
2548 connection.beginTransaction();
2549 s = connection.createStatement();
2550 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeString +
"'");
2553 rs = connection.executeQuery(s,
"SELECT MAX(attribute_type_id) AS highest_id FROM blackboard_attribute_types");
2556 maxID = rs.getInt(
"highest_id");
2557 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
2563 connection.executeUpdate(s,
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES ('" + maxID +
"', '" + attrTypeString +
"', '" + displayName +
"', '" + valueType.getType() +
"')");
2567 connection.commitTransaction();
2570 throw new TskDataException(
"The attribute type that was added was already within the system.");
2573 }
catch (SQLException ex) {
2574 connection.rollbackTransaction();
2601 ResultSet rs = null;
2603 s = connection.createStatement();
2604 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
2613 }
catch (SQLException ex) {
2640 ResultSet rs = null;
2642 s = connection.createStatement();
2643 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE attribute_type_id = " + typeID +
"");
2652 }
catch (SQLException ex) {
2679 ResultSet rs = null;
2681 s = connection.createStatement();
2682 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE type_name = '" + artTypeName +
"'");
2686 rs.getString(
"type_name"), rs.getString(
"display_name"));
2691 }
catch (SQLException ex) {
2692 throw new TskCoreException(
"Error getting artifact type from the database", ex);
2715 CaseDbConnection connection = connections.getConnection();
2718 ResultSet rs = null;
2720 s = connection.createStatement();
2721 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE artifact_type_id = " + artTypeId +
"");
2722 BlackboardArtifact.Type type = null;
2724 type =
new BlackboardArtifact.Type(rs.getInt(
"artifact_type_id"),
2725 rs.getString(
"type_name"), rs.getString(
"display_name"));
2730 }
catch (SQLException ex) {
2731 throw new TskCoreException(
"Error getting artifact type from the database", ex);
2756 ResultSet rs = null;
2758 connection.beginTransaction();
2759 s = connection.createStatement();
2760 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
2763 rs = connection.executeQuery(s,
"SELECT MAX(artifact_type_id) AS highest_id FROM blackboard_artifact_types");
2766 maxID = rs.getInt(
"highest_id");
2767 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
2773 connection.executeUpdate(s,
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES ('" + maxID +
"', '" + artifactTypeName +
"', '" + displayName +
"')");
2777 connection.commitTransaction();
2780 throw new TskDataException(
"The attribute type that was added was already within the system.");
2782 }
catch (SQLException ex) {
2783 connection.rollbackTransaction();
2796 ResultSet rs = null;
2798 Statement statement = connection.createStatement();
2799 rs = connection.executeQuery(statement,
"SELECT attrs.artifact_id AS artifact_id, "
2800 +
"attrs.source AS source, attrs.context AS context, attrs.attribute_type_id AS attribute_type_id, "
2801 +
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, "
2802 +
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, "
2803 +
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, "
2804 +
"types.type_name AS type_name, types.display_name AS display_name "
2805 +
"FROM blackboard_attributes AS attrs, blackboard_attribute_types AS types WHERE attrs.artifact_id = " + artifact.getArtifactID()
2806 +
" AND attrs.attribute_type_id = types.attribute_type_id");
2807 ArrayList<BlackboardAttribute> attributes =
new ArrayList<BlackboardAttribute>();
2810 rs.getLong(
"artifact_id"),
2813 rs.getString(
"source"),
2814 rs.getString(
"context"),
2815 rs.getInt(
"value_int32"),
2816 rs.getLong(
"value_int64"),
2817 rs.getDouble(
"value_double"),
2818 rs.getString(
"value_text"),
2819 rs.getBytes(
"value_byte"), this
2821 attributes.add(attr);
2824 }
catch (SQLException ex) {
2825 throw new TskCoreException(
"Error getting attributes for artifact, artifact id = " + artifact.getArtifactID(), ex);
2849 ResultSet rs = null;
2851 s = connection.createStatement();
2852 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
2853 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
2854 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
2855 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
2856 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
2857 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
2858 +
"FROM blackboard_attributes " + whereClause);
2859 ArrayList<BlackboardAttribute> matches =
new ArrayList<BlackboardAttribute>();
2865 rs.getLong(
"artifact_id"),
2867 rs.getString(
"source"),
2868 rs.getString(
"context"),
2869 rs.getInt(
"value_int32"),
2870 rs.getLong(
"value_int64"),
2871 rs.getDouble(
"value_double"),
2872 rs.getString(
"value_text"),
2873 rs.getBytes(
"value_byte"), this
2878 }
catch (SQLException ex) {
2879 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
2902 ResultSet rs = null;
2905 s = connection.createStatement();
2906 rs = connection.executeQuery(s,
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
2907 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
2908 +
"blackboard_artifacts.review_status_id AS review_status_id "
2909 +
"FROM blackboard_artifacts " + whereClause);
2910 ArrayList<BlackboardArtifact> matches =
new ArrayList<BlackboardArtifact>();
2916 rs.getLong(
"obj_id"), type.getTypeID(), type.getTypeName(), type.getDisplayName(),
2918 matches.add(artifact);
2921 }
catch (SQLException ex) {
2922 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
2961 return newBlackboardArtifact(artifactType.getTypeID(), obj_id, artifactType.getLabel(), artifactType.getDisplayName());
2967 ResultSet rs = null;
2969 PreparedStatement statement;
2972 statement.clearParameters();
2973 statement.setLong(1, obj_id);
2974 statement.setInt(2, artifact_type_id);
2977 statement.clearParameters();
2978 this.nextArtifactId++;
2979 statement.setLong(1, this.nextArtifactId);
2980 statement.setLong(2, obj_id);
2981 statement.setInt(3, artifact_type_id);
2983 connection.executeUpdate(statement);
2984 rs = statement.getGeneratedKeys();
2988 }
catch (SQLException ex) {
3010 CaseDbConnection connection = connections.getConnection();
3012 ResultSet rs = null;
3015 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
3016 statement.clearParameters();
3017 statement.setLong(1, content.getId());
3018 rs = connection.executeQuery(statement);
3019 boolean hasChildren =
false;
3021 hasChildren = rs.getInt(
"count") > 0;
3024 }
catch (SQLException e) {
3025 throw new TskCoreException(
"Error checking for children of parent " + content, e);
3045 int getContentChildrenCount(Content content)
throws TskCoreException {
3046 CaseDbConnection connection = connections.getConnection();
3048 ResultSet rs = null;
3051 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
3052 statement.clearParameters();
3053 statement.setLong(1, content.getId());
3054 rs = connection.executeQuery(statement);
3055 int countChildren = -1;
3057 countChildren = rs.getInt(
"count");
3059 return countChildren;
3060 }
catch (SQLException e) {
3061 throw new TskCoreException(
"Error checking for children of parent " + content, e);
3080 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
3081 CaseDbConnection connection = connections.getConnection();
3083 ResultSet rs = null;
3085 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
3086 statement.clearParameters();
3087 long parentId = parent.getId();
3088 statement.setLong(1, parentId);
3089 statement.setShort(2, type.getFileType());
3090 rs = connection.executeQuery(statement);
3091 return fileChildren(rs, connection, parentId);
3092 }
catch (SQLException ex) {
3093 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3110 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
3111 CaseDbConnection connection = connections.getConnection();
3113 ResultSet rs = null;
3115 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
3116 statement.clearParameters();
3117 long parentId = parent.getId();
3118 statement.setLong(1, parentId);
3119 rs = connection.executeQuery(statement);
3120 return fileChildren(rs, connection, parentId);
3121 }
catch (SQLException ex) {
3122 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3141 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
3142 CaseDbConnection connection = connections.getConnection();
3144 ResultSet rs = null;
3146 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
3147 statement.clearParameters();
3148 statement.setLong(1, parent.getId());
3149 statement.setShort(2, type.getFileType());
3150 rs = connection.executeQuery(statement);
3151 List<Long> children =
new ArrayList<Long>();
3153 children.add(rs.getLong(
"obj_id"));
3156 }
catch (SQLException ex) {
3157 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3174 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
3175 CaseDbConnection connection = connections.getConnection();
3177 ResultSet rs = null;
3179 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
3180 statement.clearParameters();
3181 statement.setLong(1, parent.getId());
3182 rs = connection.executeQuery(statement);
3183 List<Long> children =
new ArrayList<Long>();
3185 children.add(rs.getLong(
"obj_id"));
3188 }
catch (SQLException ex) {
3189 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3205 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
3206 CaseDbConnection connection = connections.getConnection();
3209 ResultSet rs = null;
3211 s = connection.createStatement();
3212 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
3213 +
"FROM tsk_objects LEFT JOIN tsk_files "
3214 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
3215 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
3216 +
" ORDER BY tsk_objects.obj_id");
3217 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
3219 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
3222 }
catch (SQLException ex) {
3223 throw new TskCoreException(
"Error getting Children Info for Content", ex);
3242 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
3245 CaseDbConnection connection = connections.getConnection();
3248 ResultSet rs = null;
3250 s = connection.createStatement();
3251 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
3252 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
3253 +
"ON child.par_obj_id = parent.obj_id "
3254 +
"WHERE child.obj_id = " + c.getId());
3256 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
3258 throw new TskCoreException(
"Given content (id: " + c.getId() +
") has no parent");
3260 }
catch (SQLException ex) {
3261 throw new TskCoreException(
"Error getting Parent Info for Content", ex);
3280 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
3283 CaseDbConnection connection = connections.getConnection();
3286 ResultSet rs = null;
3288 s = connection.createStatement();
3289 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
3290 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
3291 +
"ON child.par_obj_id = parent.obj_id "
3292 +
"WHERE child.obj_id = " + contentId);
3294 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
3296 throw new TskCoreException(
"Given content (id: " + contentId +
") has no parent.");
3298 }
catch (SQLException ex) {
3299 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
3318 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
3322 throw new TskCoreException(
"Given FsContent (id: " + fsc.getId() +
") is a root object (can't have parent directory).");
3324 ObjectInfo parentInfo = getParentInfo(fsc);
3325 Directory parent = null;
3326 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
3327 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
3329 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
3350 ResultSet rs = null;
3352 s = connection.createStatement();
3353 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
3359 long parentId = rs.getLong(
"par_obj_id");
3366 content = getVolumeSystemById(
id, parentId);
3369 content = getVolumeById(
id, parentId);
3372 content = getFileSystemById(
id, parentId);
3378 throw new TskCoreException(
"Could not obtain Content object with ID: " +
id);
3381 }
catch (SQLException ex) {
3398 String getFilePath(
long id) {
3399 CaseDbConnection connection;
3401 connection = connections.getConnection();
3402 }
catch (TskCoreException ex) {
3403 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
3406 String filePath = null;
3408 ResultSet rs = null;
3410 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
3411 statement.clearParameters();
3412 statement.setLong(1,
id);
3413 rs = connection.executeQuery(statement);
3415 filePath = rs.getString(
"path");
3417 }
catch (SQLException ex) {
3418 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
3434 TskData.EncodingType getEncodingType(
long id) {
3435 CaseDbConnection connection;
3437 connection = connections.getConnection();
3438 }
catch (TskCoreException ex) {
3439 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
3442 TskData.EncodingType type = TskData.EncodingType.NONE;
3444 ResultSet rs = null;
3446 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
3447 statement.clearParameters();
3448 statement.setLong(1,
id);
3449 rs = connection.executeQuery(statement);
3451 type = TskData.EncodingType.valueOf(rs.getInt(1));
3453 }
catch (SQLException ex) {
3454 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
3471 String getFileParentPath(
long objectId, CaseDbConnection connection) {
3472 String parentPath = null;
3474 ResultSet rs = null;
3476 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
3477 statement.clearParameters();
3478 statement.setLong(1, objectId);
3479 rs = connection.executeQuery(statement);
3481 parentPath = rs.getString(
"parent_path");
3483 }
catch (SQLException ex) {
3484 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
3500 String getFileName(
long objectId, CaseDbConnection connection) {
3501 String fileName = null;
3503 ResultSet rs = null;
3505 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
3506 statement.clearParameters();
3507 statement.setLong(1, objectId);
3508 rs = connection.executeQuery(statement);
3510 fileName = rs.getString(
"name");
3512 }
catch (SQLException ex) {
3513 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
3531 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
3532 CaseDbConnection connection = connections.getConnection();
3533 DerivedFile.DerivedMethod method = null;
3535 ResultSet rs1 = null;
3536 ResultSet rs2 = null;
3538 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
3539 statement.clearParameters();
3540 statement.setLong(1,
id);
3541 rs1 = connection.executeQuery(statement);
3543 int method_id = rs1.getInt(
"derived_id");
3544 String rederive = rs1.getString(
"rederive");
3545 method =
new DerivedFile.DerivedMethod(method_id, rederive);
3546 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
3547 statement.clearParameters();
3548 statement.setInt(1, method_id);
3549 rs2 = connection.executeQuery(statement);
3551 method.setToolName(rs2.getString(
"tool_name"));
3552 method.setToolVersion(rs2.getString(
"tool_version"));
3553 method.setOther(rs2.getString(
"other"));
3556 }
catch (SQLException e) {
3557 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
3580 ResultSet rs = null;
3583 statement.clearParameters();
3584 statement.setLong(1,
id);
3585 rs = connection.executeQuery(statement);
3587 if (files.size() > 0) {
3588 return files.get(0);
3592 }
catch (SQLException ex) {
3615 ResultSet rs = null;
3619 statement.clearParameters();
3620 statement.setLong(1, fileId);
3621 rs = connection.executeQuery(statement);
3623 ret = rs.getLong(
"fs_obj_id");
3628 }
catch (SQLException e) {
3629 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
3649 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
3652 Statement statement = null;
3653 ResultSet resultSet = null;
3655 statement = connection.createStatement();
3656 resultSet = connection.executeQuery(statement, query);
3658 return (resultSet.getLong(
"count") > 0L);
3659 }
catch (SQLException ex) {
3660 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
3681 List<AbstractFile> files =
new ArrayList<AbstractFile>();
3684 ResultSet resultSet = null;
3687 statement.clearParameters();
3688 statement.setString(1, fileName.toLowerCase());
3689 statement.setLong(2, dataSource.getId());
3690 resultSet = connection.executeQuery(statement);
3692 }
catch (SQLException e) {
3693 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
3716 List<AbstractFile> files =
new ArrayList<AbstractFile>();
3719 ResultSet resultSet = null;
3722 statement.clearParameters();
3723 statement.setString(1, fileName.toLowerCase());
3724 statement.setString(2,
"%" + dirName.toLowerCase() +
"%");
3725 statement.setLong(3, dataSource.getId());
3726 resultSet = connection.executeQuery(statement);
3728 }
catch (SQLException e) {
3729 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
3760 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
3786 if (transaction == null) {
3791 ResultSet resultSet = null;
3795 String parentPath = getFileParentPath(parentId, connection);
3796 if (parentPath == null) {
3799 String parentName = getFileName(parentId, connection);
3800 if (parentName != null && !parentName.isEmpty()) {
3801 parentPath = parentPath + parentName +
"/";
3807 statement.clearParameters();
3808 if (parentId != 0) {
3809 statement.setLong(1, parentId);
3811 statement.setNull(1, java.sql.Types.BIGINT);
3814 connection.executeUpdate(statement);
3815 resultSet = statement.getGeneratedKeys();
3817 long newObjId = resultSet.getLong(1);
3824 statement.clearParameters();
3825 statement.setLong(1, newObjId);
3828 if (0 != parentId) {
3830 if (parentFs != -1) {
3831 statement.setLong(2, parentFs);
3833 statement.setNull(2, java.sql.Types.BIGINT);
3836 statement.setNull(2, java.sql.Types.BIGINT);
3840 statement.setString(3, directoryName);
3844 statement.setShort(5, (
short) 1);
3848 statement.setShort(6, dirType.
getValue());
3850 statement.setShort(7, metaType.
getValue());
3854 statement.setShort(8, dirFlag.
getValue());
3857 statement.setShort(9, metaFlags);
3860 statement.setLong(10, 0);
3863 statement.setNull(11, java.sql.Types.BIGINT);
3864 statement.setNull(12, java.sql.Types.BIGINT);
3865 statement.setNull(13, java.sql.Types.BIGINT);
3866 statement.setNull(14, java.sql.Types.BIGINT);
3869 statement.setString(15, parentPath);
3872 long dataSourceObjectId;
3873 if (0 == parentId) {
3874 dataSourceObjectId = newObjId;
3878 statement.setLong(16, dataSourceObjectId);
3880 connection.executeUpdate(statement);
3882 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
3885 }
catch (SQLException e) {
3886 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
3914 Statement statement = null;
3915 ResultSet resultSet = null;
3922 preparedStatement.clearParameters();
3923 preparedStatement.setNull(1, java.sql.Types.BIGINT);
3925 connection.executeUpdate(preparedStatement);
3926 resultSet = preparedStatement.getGeneratedKeys();
3928 long newObjId = resultSet.getLong(1);
3934 statement = connection.createStatement();
3935 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
3936 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"');");
3946 preparedStatement.clearParameters();
3947 preparedStatement.setLong(1, newObjId);
3948 preparedStatement.setNull(2, java.sql.Types.BIGINT);
3949 preparedStatement.setString(3, rootDirectoryName);
3951 preparedStatement.setShort(5, (
short) 1);
3955 preparedStatement.setShort(7, metaType.
getValue());
3957 preparedStatement.setShort(8, dirFlag.
getValue());
3960 preparedStatement.setShort(9, metaFlags);
3961 preparedStatement.setLong(10, 0);
3962 preparedStatement.setNull(11, java.sql.Types.BIGINT);
3963 preparedStatement.setNull(12, java.sql.Types.BIGINT);
3964 preparedStatement.setNull(13, java.sql.Types.BIGINT);
3965 preparedStatement.setNull(14, java.sql.Types.BIGINT);
3966 String parentPath =
"/";
3967 preparedStatement.setString(15, parentPath);
3968 preparedStatement.setLong(16, newObjId);
3969 connection.executeUpdate(preparedStatement);
3972 newObjId, newObjId, rootDirectoryName,
3973 dirType, metaType, dirFlag, metaFlags, null,
3977 }
catch (SQLException ex) {
3978 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
3998 ResultSet rs = null;
4000 s = connection.createStatement();
4001 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
4003 +
" AND obj_id = data_source_obj_id"
4004 +
" ORDER BY dir_type, LOWER(name)");
4005 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
4007 virtDirRootIds.add(virtualDirectory(rs));
4009 return virtDirRootIds;
4010 }
catch (SQLException ex) {
4011 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
4033 assert (null != fileRanges);
4034 if (null == fileRanges) {
4038 assert (null != parent);
4039 if (null == parent) {
4044 Statement statement = null;
4045 ResultSet resultSet = null;
4052 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<LayoutFile>();
4060 prepStmt.clearParameters();
4061 prepStmt.setLong(1, parent.getId());
4063 connection.executeUpdate(prepStmt);
4064 resultSet = prepStmt.getGeneratedKeys();
4066 long fileRangeId = resultSet.getLong(1);
4067 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
4076 prepStmt.clearParameters();
4077 prepStmt.setLong(1, fileRangeId);
4078 prepStmt.setNull(2, java.sql.Types.BIGINT);
4079 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
4081 prepStmt.setNull(5, java.sql.Types.BIGINT);
4086 prepStmt.setLong(10, fileRange.getByteLen());
4087 prepStmt.setNull(11, java.sql.Types.BIGINT);
4088 prepStmt.setNull(12, java.sql.Types.BIGINT);
4089 prepStmt.setNull(13, java.sql.Types.BIGINT);
4090 prepStmt.setNull(14, java.sql.Types.BIGINT);
4091 prepStmt.setNull(15, java.sql.Types.VARCHAR);
4092 prepStmt.setLong(16, parent.getId());
4093 connection.executeUpdate(prepStmt);
4101 prepStmt.clearParameters();
4102 prepStmt.setLong(1, fileRangeId);
4103 prepStmt.setLong(2, fileRange.getByteStart());
4104 prepStmt.setLong(3, fileRange.getByteLen());
4105 prepStmt.setLong(4, fileRange.getSequence());
4106 connection.executeUpdate(prepStmt);
4111 fileRangeLayoutFiles.add(
new LayoutFile(
this,
4114 Long.toString(fileRange.getSequence()),
4120 fileRange.getByteLen(),
4123 parent.getUniquePath(),
4128 return fileRangeLayoutFiles;
4130 }
catch (SQLException ex) {
4131 if (null != transaction) {
4135 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4138 throw new TskCoreException(
"Failed to add layout files to case database", ex);
4141 if (null != transaction) {
4145 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4169 assert (null != carvingResult);
4170 if (null == carvingResult) {
4173 assert (null != carvingResult.getParent());
4174 if (null == carvingResult.getParent()) {
4177 assert (null != carvingResult.getCarvedFiles());
4178 if (null == carvingResult.getCarvedFiles()) {
4182 Statement statement = null;
4183 ResultSet resultSet = null;
4185 long newCacheKey = 0;
4197 while (null != root) {
4212 if (null == carvedFilesDir) {
4213 List<Content> rootChildren;
4215 rootChildren = ((FileSystem) root).getRootDirectory().
getChildren();
4219 for (
Content child : rootChildren) {
4225 if (null == carvedFilesDir) {
4226 long parId = root.
getId();
4228 if (root instanceof FileSystem) {
4229 Content rootDir = ((FileSystem) root).getRootDirectory();
4230 parId = rootDir.
getId();
4234 newCacheKey = root.
getId();
4235 rootIdsToCarvedFileDirs.put(newCacheKey, carvedFilesDir);
4242 String parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
4243 List<LayoutFile> carvedFiles =
new ArrayList<LayoutFile>();
4250 prepStmt.clearParameters();
4251 prepStmt.setLong(1, carvedFilesDir.
getId());
4253 connection.executeUpdate(prepStmt);
4254 resultSet = prepStmt.getGeneratedKeys();
4256 long carvedFileId = resultSet.getLong(1);
4266 prepStmt.clearParameters();
4267 prepStmt.setLong(1, carvedFileId);
4269 prepStmt.setLong(2, root.
getId());
4271 prepStmt.setNull(2, java.sql.Types.BIGINT);
4273 prepStmt.setString(3, carvedFile.getName());
4275 prepStmt.setShort(5, (
short) 1);
4280 prepStmt.setLong(10, carvedFile.getSizeInBytes());
4281 prepStmt.setNull(11, java.sql.Types.BIGINT);
4282 prepStmt.setNull(12, java.sql.Types.BIGINT);
4283 prepStmt.setNull(13, java.sql.Types.BIGINT);
4284 prepStmt.setNull(14, java.sql.Types.BIGINT);
4285 prepStmt.setString(15, parentPath);
4286 prepStmt.setLong(16, carvedFilesDir.getDataSourceObjectId());
4287 connection.executeUpdate(prepStmt);
4295 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
4296 prepStmt.clearParameters();
4297 prepStmt.setLong(1, carvedFileId);
4298 prepStmt.setLong(2, tskFileRange.getByteStart());
4299 prepStmt.setLong(3, tskFileRange.getByteLen());
4300 prepStmt.setLong(4, tskFileRange.getSequence());
4301 connection.executeUpdate(prepStmt);
4309 carvedFilesDir.getDataSourceObjectId(),
4310 carvedFile.getName(),
4316 carvedFile.getSizeInBytes(),
4326 }
catch (SQLException ex) {
4327 if (null != transaction) {
4331 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4333 if (0 != newCacheKey) {
4334 rootIdsToCarvedFileDirs.remove(newCacheKey);
4337 throw new TskCoreException(
"Failed to add carved files to case database", ex);
4340 if (null != transaction) {
4344 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4346 if (0 != newCacheKey) {
4347 rootIdsToCarvedFileDirs.remove(newCacheKey);
4390 long size,
long ctime,
long crtime,
long atime,
long mtime,
4392 String rederiveDetails, String toolName, String toolVersion,
4396 ResultSet rs = null;
4398 connection.beginTransaction();
4400 final long parentId = parentFile.
getId();
4406 statement.clearParameters();
4407 statement.setLong(1, parentId);
4409 connection.executeUpdate(statement);
4410 rs = statement.getGeneratedKeys();
4412 long newObjId = rs.getLong(1);
4421 statement.clearParameters();
4422 statement.setLong(1, newObjId);
4426 if (fsObjId != -1) {
4427 statement.setLong(2, fsObjId);
4429 statement.setNull(2, java.sql.Types.BIGINT);
4431 statement.setString(3, fileName);
4435 statement.setShort(5, (
short) 1);
4439 statement.setShort(6, dirType.
getValue());
4441 statement.setShort(7, metaType.
getValue());
4445 statement.setShort(8, dirFlag.
getValue());
4448 statement.setShort(9, metaFlags);
4451 statement.setLong(10, size);
4455 statement.setLong(11, ctime);
4456 statement.setLong(12, crtime);
4457 statement.setLong(13, atime);
4458 statement.setLong(14, mtime);
4461 statement.setString(15, parentPath);
4465 statement.setLong(16, dataSourceObjId);
4467 connection.executeUpdate(statement);
4470 addFilePath(connection, newObjId, localPath, encodingType);
4472 connection.commitTransaction();
4475 return new DerivedFile(
this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
4476 size, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType);
4477 }
catch (SQLException ex) {
4478 connection.rollbackTransaction();
4479 throw new TskCoreException(
"Failed to add derived file to case database", ex);
4507 long size,
long ctime,
long crtime,
long atime,
long mtime,
4513 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
4520 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4553 long size,
long ctime,
long crtime,
long atime,
long mtime,
4559 Statement queryStatement = null;
4560 ResultSet resultSet = null;
4566 statement.clearParameters();
4567 statement.setLong(1, parent.getId());
4569 connection.executeUpdate(statement);
4570 resultSet = statement.getGeneratedKeys();
4571 if (!resultSet.next()) {
4572 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_objects table", fileName, localPath, parent.getId()));
4574 long objectId = resultSet.getLong(1);
4583 statement.clearParameters();
4584 statement.setLong(1, objectId);
4585 statement.setNull(2, java.sql.Types.BIGINT);
4586 statement.setString(3, fileName);
4588 statement.setShort(5, (
short) 1);
4590 statement.setShort(6, dirType.
getValue());
4592 statement.setShort(7, metaType.
getValue());
4594 statement.setShort(8, dirFlag.
getValue());
4596 statement.setShort(9, metaFlags);
4597 statement.setLong(10, size);
4598 statement.setLong(11, ctime);
4599 statement.setLong(12, crtime);
4600 statement.setLong(13, atime);
4601 statement.setLong(14, mtime);
4602 String parentPath = parent.getParentPath() + parent.getName() +
"/";
4603 statement.setString(15, parentPath);
4605 statement.setLong(16, dataSourceObjId);
4606 connection.executeUpdate(statement);
4607 addFilePath(connection, objectId, localPath, encodingType);
4617 ctime, crtime, atime, mtime,
4619 parent.getId(), parentPath,
4624 }
catch (SQLException ex) {
4625 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
4647 Statement statement = null;
4648 ResultSet resultSet = null;
4650 statement = connection.createStatement();
4651 long dataSourceObjId;
4652 long ancestorId = objectId;
4654 dataSourceObjId = ancestorId;
4655 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
4656 resultSet = statement.executeQuery(query);
4657 if (resultSet.next()) {
4658 ancestorId = resultSet.getLong(
"par_obj_id");
4660 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
4664 }
while (0 != ancestorId);
4665 return dataSourceObjId;
4666 }
catch (SQLException ex) {
4667 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
4687 statement.clearParameters();
4688 statement.setLong(1, objId);
4689 statement.setString(2, path);
4690 statement.setInt(3, type.getType());
4691 connection.executeUpdate(statement);
4710 return findFiles(dataSource, fileName, parentFile.getName());
4728 ResultSet rs = null;
4730 s = connection.createStatement();
4731 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
4733 return rs.getLong(
"count");
4734 }
catch (SQLException e) {
4735 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
4765 ResultSet rs = null;
4767 s = connection.createStatement();
4768 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
4770 }
catch (SQLException e) {
4771 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
4796 ResultSet rs = null;
4798 s = connection.createStatement();
4799 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
4800 List<Long> ret =
new ArrayList<Long>();
4802 ret.add(rs.getLong(
"obj_id"));
4805 }
catch (SQLException e) {
4806 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
4833 int lastSlash = path.lastIndexOf(
'/');
4836 if (lastSlash == path.length()) {
4837 path = path.substring(0, lastSlash - 1);
4838 lastSlash = path.lastIndexOf(
'/');
4841 String parentPath = path.substring(0, lastSlash);
4842 String fileName = path.substring(lastSlash);
4844 return findFiles(dataSource, fileName, parentPath);
4861 ResultSet rs = null;
4863 s = connection.createStatement();
4864 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
4865 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
4868 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
4872 }
catch (SQLException ex) {
4873 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
4895 Statement s1 = null;
4896 ResultSet rs1 = null;
4897 Statement s2 = null;
4898 ResultSet rs2 = null;
4900 s1 = connection.createStatement();
4901 rs1 = connection.executeQuery(s1,
"SELECT * FROM tsk_image_info WHERE obj_id = " +
id);
4903 s2 = connection.createStatement();
4904 rs2 = connection.executeQuery(s2,
"SELECT * FROM tsk_image_names WHERE obj_id = " + rs1.getLong(
"obj_id"));
4905 List<String> imagePaths =
new ArrayList<String>();
4906 while (rs2.next()) {
4907 imagePaths.add(rs2.getString(
"name"));
4909 long obj_id = rs1.getLong(
"obj_id");
4910 long type = rs1.getLong(
"type");
4911 long ssize = rs1.getLong(
"ssize");
4912 String tzone = rs1.getString(
"tzone");
4915 md5 = rs1.getString(
"md5");
4917 String name = rs1.getString(
"display_name");
4919 if (imagePaths.size() > 0) {
4920 String path = imagePaths.get(0);
4921 name = (
new java.io.File(path)).getName();
4926 return new Image(
this, obj_id, type, ssize, name,
4927 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5);
4931 }
catch (SQLException ex) {
4955 CaseDbConnection connection = connections.getConnection();
4958 ResultSet rs = null;
4960 s = connection.createStatement();
4961 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
4962 +
"where obj_id = " +
id);
4964 long type = rs.getLong(
"vs_type");
4965 long imgOffset = rs.getLong(
"img_offset");
4966 long blockSize = rs.getLong(
"block_size");
4968 vs.setParent(parent);
4971 throw new TskCoreException(
"No volume system found for id:" +
id);
4973 }
catch (SQLException ex) {
4974 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
4991 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
4992 VolumeSystem vs = getVolumeSystemById(
id, null);
4993 vs.setParentId(parentId);
5008 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
5020 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
5022 FileSystem fs = getFileSystemById(
id, vol);
5023 fs.setParentId(parentId);
5038 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
5058 if (fileSystemIdMap.containsKey(
id)) {
5059 return fileSystemIdMap.get(
id);
5065 ResultSet rs = null;
5067 s = connection.createStatement();
5068 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
5069 +
"where obj_id = " +
id);
5073 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
5074 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
5075 fs.setParent(parent);
5078 fileSystemIdMap.put(
id, fs);
5084 }
catch (SQLException ex) {
5106 CaseDbConnection connection = connections.getConnection();
5109 ResultSet rs = null;
5111 s = connection.createStatement();
5112 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
5113 +
"where obj_id = " +
id);
5124 description = rs.getString(
"desc");
5125 }
catch (Exception ex) {
5126 description = rs.getString(
"descr");
5128 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
5129 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
5131 vol.setParent(parent);
5134 throw new TskCoreException(
"No volume found for id:" +
id);
5136 }
catch (SQLException ex) {
5137 throw new TskCoreException(
"Error getting Volume by ID", ex);
5154 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
5155 Volume vol = getVolumeById(
id, null);
5156 vol.setParentId(parentId);
5171 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
5172 CaseDbConnection connection = connections.getConnection();
5175 ResultSet rs = null;
5177 s = connection.createStatement();
5178 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
5179 +
"WHERE obj_id = " +
id);
5180 Directory temp = null;
5182 final short type = rs.getShort(
"type");
5183 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
5184 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
5185 temp = directory(rs, parentFs);
5187 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
5188 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
5191 throw new TskCoreException(
"No Directory found for id:" +
id);
5194 }
catch (SQLException ex) {
5195 throw new TskCoreException(
"Error getting Directory by ID", ex);
5212 List<FileSystem> fileSystems =
new ArrayList<FileSystem>();
5215 connection = connections.getConnection();
5217 logger.log(Level.SEVERE,
"Error getting file systems for image " + image.
getId(), ex);
5222 ResultSet rs = null;
5224 s = connection.createStatement();
5227 List<FileSystem> allFileSystems =
new ArrayList<FileSystem>();
5229 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info");
5233 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
5234 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
5236 allFileSystems.add(fs);
5238 }
catch (SQLException ex) {
5239 logger.log(Level.SEVERE,
"There was a problem while trying to obtain all file systems", ex);
5249 Long imageID = null;
5250 Long currentObjID = fs.getId();
5251 while (imageID == null) {
5253 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE tsk_objects.obj_id = " + currentObjID);
5255 currentObjID = rs.getLong(
"par_obj_id");
5257 imageID = rs.getLong(
"obj_id");
5259 }
catch (SQLException ex) {
5260 logger.log(Level.SEVERE,
"There was a problem while trying to obtain this image's file systems", ex);
5268 if (imageID == image.
getId()) {
5269 fileSystems.add(fs);
5272 }
catch (SQLException ex) {
5273 logger.log(Level.SEVERE,
"Error getting case database connection", ex);
5294 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
5295 List<Content> children =
new ArrayList<Content>();
5296 for (ObjectInfo info : childInfos) {
5298 children.add(getVolumeSystemById(info.id, img));
5299 }
else if (info.type == ObjectType.FS) {
5300 children.add(getFileSystemById(info.id, img));
5301 }
else if (info.type == ObjectType.ABSTRACTFILE) {
5307 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
5323 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
5324 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
5325 List<Long> children =
new ArrayList<Long>();
5326 for (ObjectInfo info : childInfos) {
5327 if (info.type == ObjectType.VS
5328 || info.type == ObjectType.FS
5329 || info.type == ObjectType.ABSTRACTFILE) {
5330 children.add(info.id);
5332 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
5348 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
5349 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
5350 List<Content> children =
new ArrayList<Content>();
5351 for (ObjectInfo info : childInfos) {
5352 if (null != info.type) {
5353 switch (info.type) {
5355 children.add(getVolumeById(info.id, vs));
5364 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
5381 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
5382 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
5383 List<Long> children =
new ArrayList<Long>();
5384 for (ObjectInfo info : childInfos) {
5385 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE) {
5386 children.add(info.id);
5388 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
5404 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
5405 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
5406 List<Content> children =
new ArrayList<Content>();
5407 for (ObjectInfo info : childInfos) {
5408 if (null != info.type) {
5409 switch (info.type) {
5411 children.add(getFileSystemById(info.id, vol));
5420 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
5437 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
5438 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
5439 final List<Long> children =
new ArrayList<Long>();
5440 for (ObjectInfo info : childInfos) {
5441 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE) {
5442 children.add(info.id);
5444 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
5464 long imageId = this.
caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone);
5480 Statement s1 = null;
5481 Statement s2 = null;
5482 ResultSet rs1 = null;
5483 ResultSet rs2 = null;
5485 s1 = connection.createStatement();
5486 rs1 = connection.executeQuery(s1,
"SELECT obj_id FROM tsk_image_info");
5487 s2 = connection.createStatement();
5488 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
5489 while (rs1.next()) {
5490 long obj_id = rs1.getLong(
"obj_id");
5491 rs2 = connection.executeQuery(s2,
"SELECT * FROM tsk_image_names WHERE obj_id = " + obj_id);
5492 List<String> paths =
new ArrayList<String>();
5493 while (rs2.next()) {
5494 paths.add(rs2.getString(
"name"));
5498 imgPaths.put(obj_id, paths);
5501 }
catch (SQLException ex) {
5502 throw new TskCoreException(
"Error getting image paths.", ex);
5523 ResultSet rs = null;
5525 s = connection.createStatement();
5526 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
5527 Collection<Long> imageIDs =
new ArrayList<Long>();
5529 imageIDs.add(rs.getLong(
"obj_id"));
5531 List<Image> images =
new ArrayList<Image>();
5532 for (
long id : imageIDs) {
5536 }
catch (SQLException ex) {
5537 throw new TskCoreException(
"Error retrieving images.", ex);
5559 Statement statement = null;
5561 connection.beginTransaction();
5562 statement = connection.createStatement();
5563 connection.executeUpdate(statement,
"DELETE FROM tsk_image_names WHERE obj_id = " + obj_id);
5564 for (
int i = 0; i < paths.size(); i++) {
5565 connection.executeUpdate(statement,
"INSERT INTO tsk_image_names VALUES (" + obj_id +
", '" + paths.get(i) +
"', " + i +
")");
5567 connection.commitTransaction();
5568 }
catch (SQLException ex) {
5569 connection.rollbackTransaction();
5591 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
5594 final short type = rs.getShort(
"type");
5598 result = directory(rs, null);
5600 result = file(rs, null);
5602 results.add(result);
5605 results.add(virtDir);
5610 String parentPath = rs.getString(
"parent_path");
5611 if (parentPath == null) {
5615 rs.getLong(
"obj_id"),
5616 rs.getLong(
"data_source_obj_id"),
5617 rs.getString(
"name"),
5622 rs.getString(
"md5"),
FileKnown.
valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
5633 final SlackFile sf = slackFile(rs, null);
5637 }
catch (SQLException e) {
5638 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
5658 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
5660 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
5664 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
5665 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
5666 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
5668 rs.getString(
"parent_path"), rs.getString(
"mime_type"));
5669 f.setFileSystem(fs);
5684 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
5685 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
5686 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
5687 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
5688 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
5689 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
5690 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
5691 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
5692 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
5693 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
5694 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
5695 rs.getString(
"parent_path"));
5696 dir.setFileSystem(fs);
5709 VirtualDirectory virtualDirectory(ResultSet rs)
throws SQLException {
5710 String parentPath = rs.getString(
"parent_path");
5711 if (parentPath == null) {
5714 final VirtualDirectory vd =
new VirtualDirectory(
this, rs.getLong(
"obj_id"),
5715 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
5716 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
5717 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
5718 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
5719 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
5720 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
5734 DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
5735 boolean hasLocalPath = rs.getBoolean(
"has_path");
5736 long objId = rs.getLong(
"obj_id");
5737 String localPath = null;
5738 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
5740 ResultSet rsFilePath = null;
5742 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
5743 statement.clearParameters();
5744 statement.setLong(1, objId);
5745 rsFilePath = connection.executeQuery(statement);
5746 if (rsFilePath.next()) {
5747 localPath = rsFilePath.getString(
"path");
5748 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
5750 }
catch (SQLException ex) {
5751 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
5756 String parentPath = rs.getString(
"parent_path");
5757 if (parentPath == null) {
5760 final DerivedFile df =
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
5761 rs.getString(
"name"),
5762 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
5763 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
5764 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
5766 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
5767 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
5768 parentPath, localPath, parentId, rs.getString(
"mime_type"),
5784 LocalFile localFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
5785 long objId = rs.getLong(
"obj_id");
5786 String localPath = null;
5787 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
5788 if (rs.getBoolean(
"has_path")) {
5789 ResultSet rsFilePath = null;
5791 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
5792 statement.clearParameters();
5793 statement.setLong(1, objId);
5794 rsFilePath = connection.executeQuery(statement);
5795 if (rsFilePath.next()) {
5796 localPath = rsFilePath.getString(
"path");
5797 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
5799 }
catch (SQLException ex) {
5800 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
5805 String parentPath = rs.getString(
"parent_path");
5806 if (null == parentPath) {
5809 LocalFile file =
new LocalFile(
this, objId, rs.getString(
"name"),
5810 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")),
5811 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
5812 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
5813 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
5815 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
5816 rs.getString(
"mime_type"), rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
5817 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
5818 localPath, encodingType);
5835 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
5836 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
5837 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
5838 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
5839 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
5840 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
5841 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
5842 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
5843 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
5844 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
5845 rs.getString(
"parent_path"), rs.getString(
"mime_type"));
5846 f.setFileSystem(fs);
5861 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
5862 List<Content> children =
new ArrayList<Content>();
5865 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
5871 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
5872 result = directory(rs, null);
5874 result = file(rs, null);
5876 children.add(result);
5879 VirtualDirectory virtDir = virtualDirectory(rs);
5880 children.add(virtDir);
5882 case UNALLOC_BLOCKS:
5885 String parentPath = rs.getString(
"parent_path");
5886 if (parentPath == null) {
5889 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
5890 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), type,
5891 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
5892 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
5893 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
5894 rs.getLong(
"size"), rs.getString(
"md5"),
5895 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
5900 final DerivedFile df = derivedFile(rs, connection, parentId);
5904 final LocalFile lf = localFile(rs, connection, parentId);
5909 final SlackFile sf = slackFile(rs, null);
5960 fileSystemIdMap.clear();
5963 connections.close();
5965 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
5973 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
5992 long id = file.getId();
5993 FileKnown currentKnown = file.getKnown();
5994 if (currentKnown.compareTo(fileKnown) > 0) {
5999 Statement statement = null;
6001 statement = connection.createStatement();
6002 connection.executeUpdate(statement,
"UPDATE tsk_files "
6003 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
6004 +
"WHERE obj_id=" + id);
6005 file.setKnown(fileKnown);
6006 }
catch (SQLException ex) {
6027 Statement statement = null;
6028 ResultSet rs = null;
6031 statement = connection.createStatement();
6032 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
6033 file.setMIMEType(mimeType);
6034 }
catch (SQLException ex) {
6035 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
6054 if (md5Hash == null) {
6057 long id = file.getId();
6058 CaseDbConnection connection = connections.getConnection();
6061 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
6062 statement.clearParameters();
6063 statement.setString(1, md5Hash.toLowerCase());
6064 statement.setLong(2,
id);
6065 connection.executeUpdate(statement);
6066 file.setMd5Hash(md5Hash.toLowerCase());
6067 }
catch (SQLException ex) {
6068 throw new TskCoreException(
"Error setting MD5 hash", ex);
6086 if (newStatus == null) {
6091 Statement statement = null;
6093 statement = connection.createStatement();
6094 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
6095 +
" SET review_status_id=" + newStatus.getID()
6096 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
6097 }
catch (SQLException ex) {
6098 throw new TskCoreException(
"Error setting review status", ex);
6120 ResultSet rs = null;
6122 s = connection.createStatement();
6123 Short contentShort = contentType.getValue();
6124 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
6127 count = rs.getInt(
"count");
6130 }
catch (SQLException ex) {
6131 throw new TskCoreException(
"Error getting number of objects.", ex);
6149 String escapedText = null;
6151 escapedText = text.replaceAll(
"'",
"''");
6164 if (md5Hash == null) {
6169 connection = connections.getConnection();
6171 logger.log(Level.SEVERE,
"Error finding files by md5 hash " + md5Hash, ex);
6176 ResultSet rs = null;
6178 s = connection.createStatement();
6179 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
6180 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
6183 }
catch (SQLException ex) {
6184 logger.log(Level.WARNING,
"Error querying database.", ex);
6203 connection = connections.getConnection();
6205 logger.log(Level.SEVERE,
"Error checking md5 hashing status", ex);
6208 boolean allFilesAreHashed =
false;
6211 ResultSet rs = null;
6213 s = connection.createStatement();
6214 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
6216 +
"AND md5 IS NULL "
6217 +
"AND size > '0'");
6218 if (rs.next() && rs.getInt(
"count") == 0) {
6219 allFilesAreHashed =
true;
6221 }
catch (SQLException ex) {
6222 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
6229 return allFilesAreHashed;
6240 connection = connections.getConnection();
6242 logger.log(Level.SEVERE,
"Error getting database connection for hashed files count", ex);
6248 ResultSet rs = null;
6250 s = connection.createStatement();
6251 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
6252 +
"WHERE md5 IS NOT NULL "
6253 +
"AND size > '0'");
6255 count = rs.getInt(
"count");
6257 }
catch (SQLException ex) {
6258 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
6275 sleuthkitCaseErrorObservers.add(observer);
6284 int i = sleuthkitCaseErrorObservers.indexOf(observer);
6286 sleuthkitCaseErrorObservers.remove(i);
6297 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
6298 if (observer != null) {
6300 observer.receiveError(context, errorMessage);
6301 }
catch (Exception ex) {
6302 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
6319 ResultSet resultSet = null;
6323 resultSet = connection.executeQuery(statement);
6324 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
6325 while (resultSet.next()) {
6326 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"), resultSet.getString(
"description"),
TagName.
HTML_COLOR.
getColorByName(resultSet.getString(
"color"))));
6329 }
catch (SQLException ex) {
6330 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
6351 ResultSet resultSet = null;
6355 resultSet = connection.executeQuery(statement);
6356 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
6357 while (resultSet.next()) {
6358 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"), resultSet.getString(
"description"),
TagName.
HTML_COLOR.
getColorByName(resultSet.getString(
"color"))));
6361 }
catch (SQLException ex) {
6362 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
6384 ResultSet resultSet = null;
6388 statement.clearParameters();
6389 statement.setString(1, displayName);
6390 statement.setString(2, description);
6391 statement.setString(3, color.getName());
6392 connection.executeUpdate(statement);
6393 resultSet = statement.getGeneratedKeys();
6395 return new TagName(resultSet.getLong(1),
6396 displayName, description, color);
6397 }
catch (SQLException ex) {
6398 throw new TskCoreException(
"Error adding row for " + displayName +
" tag name to tag_names table", ex);
6422 ResultSet resultSet = null;
6426 statement.clearParameters();
6427 statement.setLong(1, content.getId());
6428 statement.setLong(2, tagName.getId());
6429 statement.setString(3, comment);
6430 statement.setLong(4, beginByteOffset);
6431 statement.setLong(5, endByteOffset);
6432 connection.executeUpdate(statement);
6433 resultSet = statement.getGeneratedKeys();
6436 content, tagName, comment, beginByteOffset, endByteOffset);
6437 }
catch (SQLException ex) {
6438 throw new TskCoreException(
"Error adding row to content_tags table (obj_id = " + content.getId() +
", tag_name_id = " + tagName.getId() +
")", ex);
6457 statement.clearParameters();
6458 statement.setLong(1, tag.getId());
6459 connection.executeUpdate(statement);
6460 }
catch (SQLException ex) {
6461 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
6479 ResultSet resultSet = null;
6483 resultSet = connection.executeQuery(statement);
6484 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
6485 while (resultSet.next()) {
6486 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
6489 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
6490 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset")));
6493 }
catch (SQLException ex) {
6494 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
6513 if (tagName.getId() ==
Tag.ID_NOT_SET) {
6518 ResultSet resultSet = null;
6522 statement.clearParameters();
6523 statement.setLong(1, tagName.getId());
6524 resultSet = connection.executeQuery(statement);
6525 if (resultSet.next()) {
6526 return resultSet.getLong(
"count");
6528 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
6530 }
catch (SQLException ex) {
6531 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
6551 ResultSet resultSet = null;
6556 statement.clearParameters();
6557 statement.setLong(1, contentTagID);
6558 resultSet = connection.executeQuery(statement);
6560 while (resultSet.next()) {
6561 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
6564 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"));
6568 }
catch (SQLException ex) {
6569 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
6590 if (tagName.getId() ==
Tag.ID_NOT_SET) {
6595 ResultSet resultSet = null;
6599 statement.clearParameters();
6600 statement.setLong(1, tagName.getId());
6601 resultSet = connection.executeQuery(statement);
6602 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
6603 while (resultSet.next()) {
6605 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"));
6610 }
catch (SQLException ex) {
6611 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
6633 ResultSet resultSet = null;
6637 statement.clearParameters();
6638 statement.setLong(1, content.getId());
6639 resultSet = connection.executeQuery(statement);
6640 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
6641 while (resultSet.next()) {
6642 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
6645 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"));
6649 }
catch (SQLException ex) {
6650 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
6674 ResultSet resultSet = null;
6678 statement.clearParameters();
6679 statement.setLong(1, artifact.getArtifactID());
6680 statement.setLong(2, tagName.getId());
6681 statement.setString(3, comment);
6682 connection.executeUpdate(statement);
6683 resultSet = statement.getGeneratedKeys();
6686 artifact,
getContentById(artifact.getObjectID()), tagName, comment);
6687 }
catch (SQLException ex) {
6688 throw new TskCoreException(
"Error adding row to blackboard_artifact_tags table (obj_id = " + artifact.getArtifactID() +
", tag_name_id = " + tagName.getId() +
")", ex);
6707 statement.clearParameters();
6708 statement.setLong(1, tag.getId());
6709 connection.executeUpdate(statement);
6710 }
catch (SQLException ex) {
6711 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
6730 ResultSet resultSet = null;
6734 resultSet = connection.executeQuery(statement);
6735 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
6736 while (resultSet.next()) {
6737 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
6742 artifact, content, tagName, resultSet.getString(
"comment"));
6746 }
catch (SQLException ex) {
6747 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
6766 if (tagName.getId() ==
Tag.ID_NOT_SET) {
6771 ResultSet resultSet = null;
6775 statement.clearParameters();
6776 statement.setLong(1, tagName.getId());
6777 resultSet = connection.executeQuery(statement);
6778 if (resultSet.next()) {
6779 return resultSet.getLong(
"count");
6781 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
6783 }
catch (SQLException ex) {
6784 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
6804 if (tagName.getId() ==
Tag.ID_NOT_SET) {
6809 ResultSet resultSet = null;
6813 statement.clearParameters();
6814 statement.setLong(1, tagName.getId());
6815 resultSet = connection.executeQuery(statement);
6816 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
6817 while (resultSet.next()) {
6821 artifact, content, tagName, resultSet.getString(
"comment"));
6825 }
catch (SQLException ex) {
6826 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
6849 ResultSet resultSet = null;
6854 statement.clearParameters();
6855 statement.setLong(1, artifactTagID);
6856 resultSet = connection.executeQuery(statement);
6858 while (resultSet.next()) {
6859 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
6864 artifact, content, tagName, resultSet.getString(
"comment"));
6868 }
catch (SQLException ex) {
6869 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
6893 ResultSet resultSet = null;
6897 statement.clearParameters();
6898 statement.setLong(1, artifact.getArtifactID());
6899 resultSet = connection.executeQuery(statement);
6900 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
6901 while (resultSet.next()) {
6902 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
6906 artifact, content, tagName, resultSet.getString(
"comment"));
6910 }
catch (SQLException ex) {
6911 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
6933 statement.clearParameters();
6934 statement.setString(1, newPath);
6935 statement.setLong(2, objectId);
6936 connection.executeUpdate(statement);
6937 }
catch (SQLException ex) {
6938 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
6961 String relativePath =
"";
6971 String localPathLower = localPath.toLowerCase();
6972 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
6973 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
6974 }
catch (IllegalArgumentException ex) {
6975 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
6980 long createTime = 0;
6982 java.io.File tempFile =
new java.io.File(localPath);
6984 createTime = tempFile.lastModified() / 1000;
6985 }
catch (Exception ex) {
6986 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
6992 ResultSet resultSet = null;
6996 statement.clearParameters();
6997 statement.setString(1, relativePath);
6998 statement.setLong(2, createTime);
6999 statement.setString(3, sourceModuleName);
7000 statement.setString(4, reportName);
7001 connection.executeUpdate(statement);
7002 resultSet = statement.getGeneratedKeys();
7004 return new Report(resultSet.getLong(1),
7005 localPath, createTime, sourceModuleName, reportName);
7006 }
catch (SQLException ex) {
7007 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
7026 ResultSet resultSet = null;
7030 resultSet = connection.executeQuery(statement);
7031 ArrayList<Report> reports =
new ArrayList<Report>();
7032 while (resultSet.next()) {
7033 reports.add(
new Report(resultSet.getLong(
"report_id"),
7034 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
7035 resultSet.getLong(
"crtime"),
7036 resultSet.getString(
"src_module_name"),
7037 resultSet.getString(
"report_name")));
7040 }
catch (SQLException ex) {
7041 throw new TskCoreException(
"Error querying reports table", ex);
7062 statement.setLong(1, report.getId());
7063 connection.executeUpdate(statement);
7064 }
catch (SQLException ex) {
7072 if (resultSet != null) {
7075 }
catch (SQLException ex) {
7076 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
7082 if (statement != null) {
7085 }
catch (SQLException ex) {
7086 logger.log(Level.SEVERE,
"Error closing Statement", ex);
7100 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
7101 CaseDbConnection connection = connections.getConnection();
7104 Statement statement = connection.createStatement();
7105 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
7106 }
catch (SQLException ex) {
7107 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
7114 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
7115 CaseDbConnection connection = connections.getConnection();
7118 Statement statement = connection.createStatement();
7119 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
7120 }
catch (SQLException ex) {
7121 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
7147 ResultSet resultSet = null;
7148 Statement statement = null;
7150 connection.beginTransaction();
7151 statement = connection.createStatement();
7153 insertStatement.setLong(1, dataSource.getId());
7154 insertStatement.setString(2, hostName);
7155 insertStatement.setLong(3, jobStart.getTime());
7156 insertStatement.setLong(4, jobEnd.getTime());
7157 insertStatement.setInt(5, status.ordinal());
7158 insertStatement.setString(6, settingsDir);
7159 connection.executeUpdate(insertStatement);
7160 resultSet = insertStatement.getGeneratedKeys();
7162 long id = resultSet.getLong(1);
7163 for (
int i = 0; i < ingestModules.size(); i++) {
7165 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
7170 connection.commitTransaction();
7171 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
7172 }
catch (SQLException ex) {
7173 connection.rollbackTransaction();
7197 ResultSet resultSet = null;
7198 Statement statement = null;
7199 String uniqueName = factoryClassName +
"-" + displayName +
"-" + type.toString() +
"-" + version;
7201 statement = connection.createStatement();
7202 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
7203 if (!resultSet.next()) {
7207 insertStatement.setString(1, displayName);
7208 insertStatement.setString(2, uniqueName);
7209 insertStatement.setInt(3, type.ordinal());
7210 insertStatement.setString(4, version);
7211 connection.executeUpdate(insertStatement);
7212 resultSet = statement.getGeneratedKeys();
7214 long id = resultSet.getLong(1);
7219 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
7220 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
7222 }
catch (SQLException ex) {
7225 statement = connection.createStatement();
7226 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
7227 if (resultSet.next()) {
7228 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
7233 }
catch (SQLException ex1) {
7252 ResultSet resultSet = null;
7253 Statement statement = null;
7254 List<IngestJobInfo> ingestJobs =
new ArrayList<IngestJobInfo>();
7256 statement = connection.createStatement();
7257 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
7258 while (resultSet.next()) {
7259 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
7260 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
7262 resultSet.getString(
"settings_dir"), this.
getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
7265 }
catch (SQLException ex) {
7266 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
7285 ResultSet resultSet = null;
7286 Statement statement = null;
7287 List<IngestModuleInfo> ingestModules =
new ArrayList<IngestModuleInfo>();
7289 statement = connection.createStatement();
7290 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
7291 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
7292 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
7293 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
7294 +
"FROM ingest_job_modules, ingest_modules "
7295 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
7296 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
7297 +
"ORDER BY (ingest_job_modules.pipeline_position);");
7298 while (resultSet.next()) {
7299 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
7300 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
7302 return ingestModules;
7334 this.contextString = context;
7338 return contextString;
7342 void receiveError(String context, String errorMessage);
7348 static class ObjectInfo {
7369 void execute()
throws SQLException;
7374 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
7375 +
"WHERE artifact_type_id = ?"),
7379 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
7380 +
"FROM tsk_objects INNER JOIN tsk_files "
7381 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7382 +
"WHERE (tsk_objects.par_obj_id = ? ) "
7383 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
7384 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
7385 +
"FROM tsk_objects INNER JOIN tsk_files "
7386 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7387 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
7388 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
7389 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
7390 +
"FROM tsk_objects INNER JOIN tsk_files "
7391 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7392 +
"WHERE (tsk_objects.par_obj_id = ?)"),
7393 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
7394 +
"FROM tsk_objects INNER JOIN tsk_files "
7395 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7396 +
"WHERE (tsk_objects.par_obj_id = ? "
7397 +
"AND tsk_files.type = ? )"),
7399 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_type_id, review_status_id) "
7401 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_type_id, review_status_id) "
7403 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
7404 +
"VALUES (?,?,?,?,?,?,?)"),
7405 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
7406 +
"VALUES (?,?,?,?,?,?,?)"),
7407 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
7408 +
"VALUES (?,?,?,?,?,?,?)"),
7409 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
7410 +
"VALUES (?,?,?,?,?,?,?)"),
7411 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
7412 +
"VALUES (?,?,?,?,?,?,?)"),
7425 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, parent_path, data_source_obj_id) "
7426 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
7427 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
7428 +
"VALUES (?, ?, ?, ?)"),
7433 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
7434 +
"WHERE tag_name_id IN "
7435 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
7436 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color) VALUES (?, ?, ?)"),
7437 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset) VALUES (?, ?, ?, ?, ?)"),
7440 SELECT_CONTENT_TAGS(
"SELECT * FROM content_tags INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id"),
7442 SELECT_CONTENT_TAG_BY_ID(
"SELECT * FROM content_tags INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id WHERE tag_id = ?"),
7444 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment) VALUES (?, ?, ?)"),
7446 SELECT_ARTIFACT_TAGS(
"SELECT * FROM blackboard_artifact_tags INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id"),
7449 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT * FROM blackboard_artifact_tags INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id WHERE blackboard_artifact_tags.tag_id = ?"),
7450 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT * FROM blackboard_artifact_tags INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id WHERE blackboard_artifact_tags.artifact_id = ?"),
7452 INSERT_REPORT(
"INSERT INTO reports (path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?)"),
7454 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
7455 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
7456 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
7457 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
7481 pooledDataSource = null;
7485 if (pooledDataSource == null) {
7486 throw new TskCoreException(
"Error getting case database connection - case is closed");
7489 return getPooledConnection();
7490 }
catch (SQLException exp) {
7491 throw new TskCoreException(exp.getMessage());
7495 void close() throws TskCoreException {
7496 if (pooledDataSource != null) {
7498 pooledDataSource.close();
7499 }
catch (SQLException exp) {
7500 throw new TskCoreException(exp.getMessage());
7502 pooledDataSource = null;
7507 abstract CaseDbConnection getPooledConnection() throws SQLException;
7527 configurationOverrides.put(
"acquireIncrement",
"2");
7528 configurationOverrides.put(
"initialPoolSize",
"5");
7529 configurationOverrides.put(
"maxPoolSize",
"20");
7530 configurationOverrides.put(
"minPoolSize",
"5");
7531 configurationOverrides.put(
"maxStatements",
"100");
7532 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
7534 SQLiteConfig config =
new SQLiteConfig();
7535 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
7536 config.setReadUncommited(
true);
7537 config.enforceForeignKeys(
true);
7538 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
7539 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
7540 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
7555 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
7556 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
7557 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
7558 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
7559 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
7560 comboPooledDataSource.setUser(userName);
7561 comboPooledDataSource.setPassword(password);
7562 comboPooledDataSource.setAcquireIncrement(2);
7563 comboPooledDataSource.setInitialPoolSize(5);
7564 comboPooledDataSource.setMaxPoolSize(20);
7565 comboPooledDataSource.setMinPoolSize(5);
7566 comboPooledDataSource.setMaxStatements(100);
7567 comboPooledDataSource.setMaxStatementsPerConnection(20);
7582 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
7584 final class CreateStatement
implements DbCommand {
7587 private Statement statement = null;
7589 CreateStatement(Connection connection) {
7593 Statement getStatement() {
7598 public void execute()
throws SQLException {
7599 statement = connection.createStatement();
7603 final class SetAutoCommit
implements DbCommand {
7606 private final boolean mode;
7608 SetAutoCommit(Connection connection,
boolean mode) {
7614 public void execute()
throws SQLException {
7615 connection.setAutoCommit(mode);
7619 final class Commit
implements DbCommand {
7623 Commit(Connection connection) {
7628 public void execute()
throws SQLException {
7629 connection.commit();
7633 final class ExecuteQuery
implements DbCommand {
7635 private final Statement statement;
7636 private final String query;
7637 private ResultSet resultSet;
7639 ExecuteQuery(Statement statement, String query) {
7640 this.statement = statement;
7644 ResultSet getResultSet() {
7649 public void execute()
throws SQLException {
7650 resultSet = statement.executeQuery(query);
7654 final class ExecutePreparedStatementQuery
implements DbCommand {
7656 private final PreparedStatement preparedStatement;
7657 private ResultSet resultSet;
7659 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
7660 this.preparedStatement = preparedStatement;
7663 ResultSet getResultSet() {
7668 public void execute()
throws SQLException {
7669 resultSet = preparedStatement.executeQuery();
7673 final class ExecutePreparedStatementUpdate
implements DbCommand {
7675 private final PreparedStatement preparedStatement;
7677 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
7678 this.preparedStatement = preparedStatement;
7682 public void execute()
throws SQLException {
7683 preparedStatement.executeUpdate();
7687 final class ExecuteStatementUpdate
implements DbCommand {
7689 private final Statement statement;
7690 private final String updateCommand;
7692 ExecuteStatementUpdate(Statement statement, String updateCommand) {
7693 this.statement = statement;
7694 this.updateCommand = updateCommand;
7698 public void execute()
throws SQLException {
7699 statement.executeUpdate(updateCommand);
7703 final class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
7705 private final Statement statement;
7706 private final int generateKeys;
7707 private final String updateCommand;
7709 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
7710 this.statement = statement;
7711 this.generateKeys = generateKeys;
7712 this.updateCommand = updateCommand;
7716 public void execute()
throws SQLException {
7717 statement.executeUpdate(updateCommand, generateKeys);
7721 final class PrepareStatement
implements DbCommand {
7724 private final String input;
7725 private PreparedStatement preparedStatement = null;
7727 PrepareStatement(Connection connection, String input) {
7732 PreparedStatement getPreparedStatement() {
7733 return preparedStatement;
7737 public void execute()
throws SQLException {
7738 preparedStatement = connection.prepareStatement(input);
7742 final class PrepareStatementGenerateKeys
implements DbCommand {
7745 private final String input;
7746 private final int generateKeys;
7747 private PreparedStatement preparedStatement = null;
7749 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
7752 this.generateKeys = generateKeysInput;
7755 PreparedStatement getPreparedStatement() {
7756 return preparedStatement;
7760 public void execute()
throws SQLException {
7761 preparedStatement = connection.prepareStatement(input, generateKeys);
7765 abstract void executeCommand(
DbCommand command)
throws SQLException;
7772 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(
PREPARED_STATEMENT.class);
7776 return this.connection != null;
7779 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
7780 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
7783 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
7785 PreparedStatement statement;
7786 if (this.preparedStatements.containsKey(statementKey)) {
7787 statement = this.preparedStatements.get(statementKey);
7789 statement = prepareStatement(statementKey.getSQL(), generateKeys);
7790 this.preparedStatements.put(statementKey, statement);
7795 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
7796 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
7797 executeCommand(prepareStatement);
7798 return prepareStatement.getPreparedStatement();
7801 Statement createStatement() throws SQLException {
7802 CreateStatement createStatement =
new CreateStatement(this.connection);
7803 executeCommand(createStatement);
7804 return createStatement.getStatement();
7807 void beginTransaction() throws SQLException {
7808 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
7809 executeCommand(setAutoCommit);
7812 void commitTransaction() throws SQLException {
7813 Commit commit =
new Commit(connection);
7814 executeCommand(commit);
7816 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
7817 executeCommand(setAutoCommit);
7825 void rollbackTransaction() {
7827 connection.rollback();
7828 }
catch (SQLException e) {
7829 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
7832 connection.setAutoCommit(
true);
7833 }
catch (SQLException e) {
7834 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
7845 void rollbackTransactionWithThrow() throws SQLException {
7847 connection.rollback();
7849 connection.setAutoCommit(
true);
7853 ResultSet executeQuery(Statement statement, String query)
throws SQLException {
7854 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
7855 executeCommand(queryCommand);
7856 return queryCommand.getResultSet();
7868 ResultSet executeQuery(PreparedStatement statement)
throws SQLException {
7869 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
7870 executeCommand(executePreparedStatementQuery);
7871 return executePreparedStatementQuery.getResultSet();
7874 void executeUpdate(Statement statement, String update)
throws SQLException {
7875 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
7878 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
7879 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
7880 executeCommand(executeStatementUpdate);
7883 void executeUpdate(PreparedStatement statement)
throws SQLException {
7884 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
7885 executeCommand(executePreparedStatementUpdate);
7894 }
catch (SQLException ex) {
7895 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
7899 Connection getConnection() {
7917 void executeCommand(
DbCommand command)
throws SQLException {
7922 }
catch (SQLException ex) {
7928 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
7929 }
catch (InterruptedException exp) {
7930 Logger.getLogger(
SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
7933 submitError(ErrorObserver.Context.DATABASE_READ_ERROR.getContextString(), ex.getMessage());
7956 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
7957 ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
7958 executeCommand(executeStatementUpdateGenerateKeys);
7962 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
7963 PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
7964 executeCommand(prepareStatementGenerateKeys);
7965 return prepareStatementGenerateKeys.getPreparedStatement();
7969 void executeCommand(DbCommand command)
throws SQLException {
7970 for (
int retries = 0; retries <
MAX_RETRIES; retries++) {
7974 }
catch (SQLException ex) {
7975 String sqlState = ((PSQLException) ex).getSQLState();
7976 if (sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
7978 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
7979 }
catch (InterruptedException exp) {
7980 Logger.getLogger(
SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
7983 submitError(ErrorObserver.Context.DATABASE_READ_ERROR.getContextString(), ex.getMessage());
8006 this.connection.beginTransaction();
8007 }
catch (SQLException ex) {
8008 throw new TskCoreException(
"Failed to create transaction on case database", ex);
8029 public void commit() throws TskCoreException {
8031 this.connection.commitTransaction();
8032 }
catch (SQLException ex) {
8033 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
8047 this.connection.rollbackTransactionWithThrow();
8048 }
catch (SQLException ex) {
8049 throw new TskCoreException(
"Case database transaction rollback failed", ex);
8060 this.connection.close();
8079 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
8080 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
8083 connection = connections.getConnection();
8084 }
catch (TskCoreException ex) {
8085 throw new TskCoreException(
"Error getting connection for query: ", ex);
8090 resultSet = connection.executeQuery(connection.createStatement(), query);
8091 }
catch (SQLException ex) {
8093 throw new TskCoreException(
"Error executing query: ", ex);
8107 public void close() throws TskCoreException {
8109 if (resultSet != null) {
8110 final Statement statement = resultSet.getStatement();
8111 if (statement != null) {
8117 }
catch (SQLException ex) {
8118 throw new TskCoreException(
"Error closing query: ", ex);
8141 CaseDbConnection connection = connections.getConnection();
8147 }
catch (TskCoreException ex) {
8148 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
8166 ResultSet rs = null;
8170 rs = connection.executeQuery(statement);
8173 id = rs.getLong(
"max_obj_id");
8176 }
catch (SQLException e) {
8177 throw new TskCoreException(
"Error getting last object id", e);
8199 public List<FsContent>
findFilesWhere(String sqlWhereClause)
throws TskCoreException {
8203 ResultSet rs = null;
8205 s = connection.createStatement();
8206 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
8207 List<FsContent> results =
new ArrayList<FsContent>();
8216 }
catch (SQLException e) {
8217 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
8242 ResultSet rs = null;
8244 s = connection.createStatement();
8245 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
8248 typeId = rs.getInt(
"artifact_type_id");
8251 }
catch (SQLException ex) {
8252 throw new TskCoreException(
"Error getting artifact type id", ex);
8289 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
8292 }
catch (TskDataException ex) {
8293 throw new TskCoreException(
"Failed to add artifact type.", ex);
8311 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
8314 }
catch (TskDataException ex) {
8315 throw new TskCoreException(
"Couldn't add new attribute type");
8334 ResultSet rs = null;
8336 s = connection.createStatement();
8337 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
8340 typeId = rs.getInt(
"attribute_type_id");
8343 }
catch (SQLException ex) {
8344 throw new TskCoreException(
"Error getting attribute type id", ex);
8370 ResultSet rs = null;
8372 s = connection.createStatement();
8373 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
8375 return rs.getString(
"type_name");
8377 throw new TskCoreException(
"No type with that id");
8379 }
catch (SQLException ex) {
8380 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
8406 ResultSet rs = null;
8408 s = connection.createStatement();
8409 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
8411 return rs.getString(
"display_name");
8413 throw new TskCoreException(
"No type with that id");
8415 }
catch (SQLException ex) {
8416 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
8455 public ResultSet
runQuery(String query)
throws SQLException {
8458 connection = connections.getConnection();
8459 }
catch (TskCoreException ex) {
8460 throw new SQLException(
"Error getting connection for ad hoc query", ex);
8464 return connection.executeQuery(connection.createStatement(), query);
8484 final Statement statement = resultSet.getStatement();
8486 if (statement != null) {
8508 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
8511 files.add(carvedFile);
8515 || parent instanceof
Volume
8516 || parent instanceof
Image) {
8519 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
8538 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
8542 carvedFiles.add(carvedFile);
8547 || parent instanceof
Volume
8548 || parent instanceof
Image) {
8551 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
8587 long size,
long ctime,
long crtime,
long atime,
long mtime,
8589 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
8590 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
8591 isFile, parentFile, rederiveDetails, toolName, toolVersion,
8621 long size,
long ctime,
long crtime,
long atime,
long mtime,
8624 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
8649 long size,
long ctime,
long crtime,
long atime,
long mtime,
8652 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
8674 return this.
caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"");
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
int updateFromSchema4toSchema5(int schemaVersionNumber, CaseDbConnection connection)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
static final int SCHEMA_VERSION_NUMBER
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
COUNT_CHILD_OBJECTS_BY_PARENT
PREPARED_STATEMENT(String sql)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
SleuthkitCase(String dbPath, SleuthkitJNI.CaseDbHandle caseHandle, DbType dbType)
final String SYSTEM_ERROR
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
final ArrayList< ErrorObserver > sleuthkitCaseErrorObservers
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
SELECT_CONTENT_TAGS_BY_CONTENT
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
PooledDataSource getPooledDataSource()
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
void logSQLiteJDBCDriverInfo()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
ArrayList< BlackboardArtifact > getArtifactsHelper(String whereClause)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
SELECT_FILE_DERIVATION_METHOD
void setPooledDataSource(PooledDataSource pooledDataSource)
final String COMMUNICATION_ERROR
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
FileSystem getFileSystemByIdHelper(long id, Content parent)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageWriterPath)
final Map< Long, FileSystem > fileSystemIdMap
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbTransaction(CaseDbConnection connection)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
static String createCaseDataBaseName(String candidateDbName)
void addErrorObserver(ErrorObserver observer)
PooledDataSource pooledDataSource
int updateFromSchema5toSchema6(int schemaVersionNumber, CaseDbConnection connection)
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
void setFileMIMEType(AbstractFile file, String mimeType)
ObjectType(int objectType)
SELECT_LOCAL_PATH_FOR_FILE
UNALLOC
Metadata structure is currently in an unallocated state.
SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
static ARTIFACT_TYPE fromID(int ID)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
SELECT_ATTR_BY_VALUE_BYTE
final ConnectionPool connections
SELECT_FILE_SYSTEM_BY_OBJECT
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
final Map< Long, VirtualDirectory > rootIdsToCarvedFileDirs
static TSK_FS_META_TYPE_ENUM valueOf(short metaType)
CaseDbConnection getPooledConnection()
final String UNKNOWN_STATE
static final String SQL_ERROR_RESOURCE_GROUP
static final int DATABASE_LOCKED_ERROR
SELECT_ARTIFACT_TAGS_BY_TAG_NAME
long getFileSystemId(long fileId, CaseDbConnection connection)
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
static final int MAX_RETRIES
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
List< AbstractFile > openFiles(Content dataSource, String filePath)
static final int IS_REACHABLE_TIMEOUT_MS
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
void initStandardTagNames()
static final String NAME_CARVED
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
final String databaseName
List< VirtualDirectory > getVirtualDirectoryRoots()
SLACK
Slack space for a single file.
static final int MIN_USER_DEFINED_TYPE_ID
static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP
static TSK_FS_ATTR_TYPE_ENUM valueOf(int val)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
void updateDatabaseSchema(String dbPath)
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE
static final int SQLITE_BUSY_ERROR
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
List< AbstractFile > resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
COUNT_CONTENT_TAGS_BY_TAG_NAME
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
BlackboardArtifact getBlackboardArtifact(long artifactID)
Map< Integer, BlackboardArtifact.Type > typeIdToArtifactTypeMap
static void closeResultSet(ResultSet resultSet)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
SELECT_ARTIFACT_TAGS_BY_ARTIFACT
SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME
COUNT_ARTIFACTS_FROM_SOURCE
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
static TSK_FS_NAME_FLAG_ENUM valueOf(int dirFlag)
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
long countFilesWhere(String sqlWhereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
final CaseDbConnection connection
CaseDbQuery(String query)
UPDATE_ATTR_BY_VALUE_BYTE
boolean isFileFromSource(Content dataSource, long fileId)
POSTGRESQL_INSERT_ARTIFACT
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
void initReviewStatuses(CaseDbConnection connection)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Content > getChildren()
List< Image > getImages()
int getAttrTypeID(String attrTypeName)
int updateFromSchema3toSchema4(int schemaVersionNumber, CaseDbConnection connection)
Image getImageById(long id)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void closeRunQuery(ResultSet resultSet)
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
SELECT_FILES_BY_DATA_SOURCE_AND_NAME
List< ContentTag > getContentTagsByTagName(TagName tagName)
SELECT_ARTIFACT_TAG_BY_ID
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static final String SQL_ERROR_PRIVILEGE_GROUP
static String escapeSingleQuotes(String text)
final Map< String, String > configurationOverrides
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< TagName > getAllTagNames()
static TSK_FS_NAME_TYPE_ENUM valueOf(short dir_type)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
long getArtifactsCountHelper(int artifactTypeID, long obj_id)
void initNextArtifactId()
static HTML_COLOR getColorByName(String colorName)
final ReentrantReadWriteLock rwLock
static final String SQL_ERROR_CONNECTION_GROUP
TSK_TAG_ARTIFACT
tagged results/artifacts
List< AbstractFile > findFilesByMd5(String md5Hash)
BlackboardArtifact.Type getArtifactType(String artTypeName)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
BlackboardArtifact newBlackboardArtifact(ARTIFACT_TYPE artifactType, long obj_id)
Map< Integer, BlackboardAttribute.Type > typeIdToAttributeTypeMap
void initIngestModuleTypes(CaseDbConnection connection)
DERIVED
File derived from a parent file (i.e. from ZIP)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
void initEncodingTypes(CaseDbConnection connection)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
static final String SQL_ERROR_INTERNAL_GROUP
SELECT_CONTENT_TAGS_BY_TAG_NAME
void addFilePath(CaseDbConnection connection, long objId, String path, TskData.EncodingType type)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
static TSK_DB_FILES_TYPE_ENUM valueOf(short fileType)
List< Content > getRootObjects()
void initBlackboardArtifactTypes()
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirName)
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
void initIngestStatusTypes(CaseDbConnection connection)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
static ATTRIBUTE_TYPE fromLabel(String typeName)
void deleteContentTag(ContentTag tag)
static ObjectType valueOf(short objectType)
long getContentTagsCountByTagName(TagName tagName)
void updateImagePath(String newPath, long objectId)
long getDataSourceObjectId(CaseDbConnection connection, long objectId)
UNKNOWN
File marked as unknown by hash db.
Map< String, BlackboardArtifact.Type > typeNameToArtifactTypeMap
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
static void closeStatement(Statement statement)
static final ResourceBundle bundle
BlackboardAttribute.Type getAttributeType(int typeID)
static void tryConnect(CaseDbConnectionInfo info)
void receiveError(String context, String errorMessage)
static SleuthkitCase openCase(String dbPath)
static String createNonUniquePath(String uniquePath)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
int updateFromSchema2toSchema3(int schemaVersionNumber, CaseDbConnection connection)
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
void initBlackboardAttributeTypes()
List< IngestModuleInfo > getIngestModules(int ingestJobId, CaseDbConnection connection)
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
COUNT_ARTIFACTS_BY_TAG_NAME
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
SleuthkitCase(String host, int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType)
final String contextString
BlackboardArtifact newBlackboardArtifact(int artifact_type_id, long obj_id, String artifactTypeName, String artifactDisplayName)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
Map< String, BlackboardAttribute.Type > typeNameToAttributeTypeMap
static final long UNKNOWN_ID
static final long BASE_ARTIFACT_ID
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
CaseDbConnection getPooledConnection()
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
final Map< PREPARED_STATEMENT, PreparedStatement > preparedStatements
List< FsContent > findFilesWhere(String sqlWhereClause)
static final Logger logger
static ReviewStatus withID(int id)
CaseDbConnection getConnection()
void copyCaseDB(String newDBPath)
void addBlackBoardAttribute(BlackboardAttribute attr, int artifactTypeId, CaseDbConnection connection)
ResultSet runQuery(String query)
CaseDbConnection connection
List< TskFileRange > getFileRanges(long id)
static final String SQL_ERROR_AUTHENTICATION_GROUP
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
UNUSED_BLOCKS
Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNAL...
static final String SQL_ERROR_LIMIT_GROUP
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent, CaseDbTransaction transaction)
CaseDbQuery executeQuery(String query)
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
SleuthkitJNI.CaseDbHandle caseHandle
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
final Connection connection