19 package org.sleuthkit.datamodel;
21 import com.mchange.v2.c3p0.ComboPooledDataSource;
22 import com.mchange.v2.c3p0.DataSources;
23 import com.mchange.v2.c3p0.PooledDataSource;
24 import java.beans.PropertyVetoException;
25 import java.io.BufferedInputStream;
26 import java.io.BufferedOutputStream;
28 import java.io.FileInputStream;
29 import java.io.FileOutputStream;
30 import java.io.IOException;
31 import java.io.InputStream;
32 import java.io.OutputStream;
33 import java.io.UnsupportedEncodingException;
34 import java.net.InetAddress;
35 import java.net.URLEncoder;
36 import java.nio.charset.StandardCharsets;
37 import java.nio.file.Paths;
38 import java.sql.Connection;
39 import java.sql.DriverManager;
40 import java.sql.PreparedStatement;
41 import java.sql.ResultSet;
42 import java.sql.SQLException;
43 import java.sql.Statement;
44 import java.text.SimpleDateFormat;
45 import java.util.ArrayList;
46 import java.util.Arrays;
47 import java.util.Collection;
48 import java.util.Collections;
49 import java.util.Date;
50 import java.util.EnumMap;
51 import java.util.HashMap;
52 import java.util.HashSet;
53 import java.util.LinkedHashMap;
54 import java.util.List;
56 import java.util.MissingResourceException;
57 import java.util.ResourceBundle;
59 import java.util.UUID;
60 import java.util.concurrent.ConcurrentHashMap;
61 import java.util.concurrent.locks.ReentrantReadWriteLock;
62 import java.util.logging.Level;
63 import java.util.logging.Logger;
64 import org.postgresql.util.PSQLException;
65 import org.postgresql.util.PSQLState;
80 import org.sqlite.SQLiteConfig;
81 import org.sqlite.SQLiteDataSource;
82 import org.sqlite.SQLiteJDBCLoader;
101 private static final ResourceBundle
bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
112 private final Map<Long, FileSystem>
fileSystemIdMap =
new HashMap<Long, FileSystem>();
129 private final ReentrantReadWriteLock
rwLock =
new ReentrantReadWriteLock(
true);
143 Class.forName(
"org.sqlite.JDBC");
147 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
148 this.databaseName = dbFile.
getName();
174 this.databaseName = dbName;
182 private void init() throws Exception {
216 Statement statement = null;
217 ResultSet resultSet = null;
219 statement = connection.createStatement();
222 statement.execute(
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES (" + type.getTypeID() +
" , '" + type.getLabel() +
"', '" + type.getDisplayName() +
"')");
223 }
catch (SQLException ex) {
224 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_artifact_types WHERE artifact_type_id = '" + type.getTypeID() +
"'");
226 if (resultSet.getLong(
"count") == 0) {
236 int newPrimaryKeyIndex = Collections.max(Arrays.asList(
ARTIFACT_TYPE.values())).getTypeID() + 1;
237 statement.execute(
"ALTER SEQUENCE blackboard_artifact_types_artifact_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
255 Statement statement = null;
256 ResultSet resultSet = null;
258 statement = connection.createStatement();
261 statement.execute(
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES (" + type.getTypeID() +
", '" + type.getLabel() +
"', '" + type.getDisplayName() +
"', '" + type.getValueType().getType() +
"')");
262 }
catch (SQLException ex) {
263 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types WHERE attribute_type_id = '" + type.getTypeID() +
"'");
265 if (resultSet.getLong(
"count") == 0) {
275 int newPrimaryKeyIndex = Collections.max(Arrays.asList(
ATTRIBUTE_TYPE.values())).getTypeID() + 1;
276 statement.execute(
"ALTER SEQUENCE blackboard_attribute_types_attribute_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
296 Statement statement = null;
297 ResultSet resultSet = null;
299 statement = connection.createStatement();
300 resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
302 this.nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
303 if (this.nextArtifactId == 1) {
321 String bookmarkDisplayName = bundle.getString(
"SleuthkitCase.initStandardTagNames.bookmark.text");
323 Statement statement = null;
324 ResultSet resultSet = null;
326 statement = connection.createStatement();
327 statement.execute(
"INSERT INTO tag_names (display_name, description, color) VALUES ('" + bookmarkDisplayName +
"', '', '" +
TagName.
HTML_COLOR.
NONE.getName() +
"');");
328 }
catch (SQLException ex) {
334 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM tag_names WHERE display_name = '" + bookmarkDisplayName +
"'");
336 if (resultSet.getLong(
"count") == 0) {
354 Statement statement = null;
355 ResultSet resultSet = null;
357 statement = connection.createStatement();
360 statement.execute(
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
361 }
catch (SQLException ex) {
362 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
364 if (resultSet.getLong(
"count") == 0) {
385 Statement statement = null;
386 ResultSet resultSet = null;
388 statement = connection.createStatement();
391 statement.execute(
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
392 }
catch (SQLException ex) {
393 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
395 if (resultSet.getLong(
"count") == 0) {
415 Statement statement = null;
416 ResultSet resultSet = null;
418 statement = connection.createStatement();
421 statement.execute(
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
422 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')");
423 }
catch (SQLException ex) {
424 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
426 if (resultSet.getLong(
"count") == 0) {
447 Statement statement = null;
448 ResultSet resultSet = null;
450 statement = connection.createStatement();
453 statement.execute(
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')");
454 }
catch (SQLException ex) {
455 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
457 if (resultSet.getLong(
"count") == 0) {
481 ResultSet resultSet = null;
482 Statement statement = null;
484 connection.beginTransaction();
486 boolean hasMinorVersion =
false;
487 ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null,
"tsk_db_info",
"schema%");
488 while (columns.next()) {
489 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
490 hasMinorVersion =
true;
495 int dbSchemaMajorVersion;
496 int dbSchemaMinorVersion = 0;
498 statement = connection.createStatement();
499 resultSet = connection.executeQuery(statement,
"SELECT schema_ver"
500 + (hasMinorVersion ?
", schema_minor_ver" :
"")
501 +
" FROM tsk_db_info");
502 if (resultSet.next()) {
503 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver");
504 if (hasMinorVersion) {
506 dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver");
526 if (null != dbPath) {
529 String backupFilePath = dbPath +
".schemaVer" + dbSchemaVersion.
toString() +
".backup";
531 dbBackupPath = backupFilePath;
546 statement = connection.createStatement();
547 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.
getMajor() +
", schema_minor_ver = " + dbSchemaVersion.
getMinor());
552 connection.commitTransaction();
553 }
catch (Exception ex) {
554 connection.rollbackTransaction();
572 public void copyCaseDB(String newDBPath)
throws IOException {
573 if (dbPath.isEmpty()) {
574 throw new IOException(
"Copying case database files is not supported for this type of case database");
576 InputStream in = null;
577 OutputStream out = null;
580 InputStream inFile =
new FileInputStream(dbPath);
581 in =
new BufferedInputStream(inFile);
582 OutputStream outFile =
new FileOutputStream(newDBPath);
583 out =
new BufferedOutputStream(outFile);
584 int bytesRead = in.read();
585 while (bytesRead != -1) {
586 out.write(bytesRead);
587 bytesRead = in.read();
598 }
catch (IOException e) {
599 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
611 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
612 ?
"native" :
"pure-java"));
613 }
catch (Exception ex) {
631 @SuppressWarnings(
"deprecation")
633 if (schemaVersion.getMajor() != 2) {
634 return schemaVersion;
636 Statement statement = null;
637 Statement updateStatement = null;
638 ResultSet resultSet = null;
640 statement = connection.createStatement();
643 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
644 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
645 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
648 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
651 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
652 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
653 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
656 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
659 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
664 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
665 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
666 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
667 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
668 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
669 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
670 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
671 +
"arts.artifact_type_id AS artifact_type_id "
672 +
"FROM blackboard_attributes AS attrs "
673 +
"INNER JOIN blackboard_artifacts AS arts "
674 +
"WHERE attrs.artifact_id = arts.artifact_id;");
675 updateStatement = connection.createStatement();
676 while (resultSet.next()) {
677 long artifactId = resultSet.getLong(
"artifact_id");
678 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
679 updateStatement.executeUpdate(
680 "UPDATE blackboard_attributes "
681 +
"SET artifact_type_id = " + artifactTypeId
682 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
691 HashMap<String, TagName> tagNames =
new HashMap<String, TagName>();
699 name = attribute.getValueString();
701 comment = attribute.getValueString();
704 if (!name.isEmpty()) {
706 if (tagNames.containsKey(name)) {
707 tagName = tagNames.get(name);
710 tagNames.put(name, tagName);
716 long taggedArtifactId = -1;
722 name = attribute.getValueString();
724 comment = attribute.getValueString();
726 taggedArtifactId = attribute.getValueLong();
729 if (taggedArtifactId != -1 && !name.isEmpty()) {
731 if (tagNames.containsKey(name)) {
732 tagName = tagNames.get(name);
735 tagNames.put(name, tagName);
741 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
742 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
746 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
773 if (schemaVersion.getMajor() != 3) {
774 return schemaVersion;
777 Statement statement = null;
778 ResultSet resultSet = null;
779 Statement queryStatement = null;
780 ResultSet queryResultSet = null;
781 Statement updateStatement = null;
785 statement = connection.createStatement();
786 updateStatement = connection.createStatement();
787 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
788 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
789 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
790 +
"WHERE files.obj_id = arts.obj_id AND "
791 +
"arts.artifact_id = attrs.artifact_id AND "
792 +
"arts.artifact_type_id = 1 AND "
793 +
"attrs.attribute_type_id = 62");
794 while (resultSet.next()) {
795 updateStatement.executeUpdate(
797 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
798 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
803 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
804 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
805 while (resultSet.next()) {
806 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
807 String attributeLabel = resultSet.getString(
"type_name");
808 if (attributeTypeId < MIN_USER_DEFINED_TYPE_ID) {
809 updateStatement.executeUpdate(
810 "UPDATE blackboard_attribute_types "
812 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
818 queryStatement = connection.createStatement();
819 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
820 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
821 while (resultSet.next()) {
822 long objectId = resultSet.getLong(
"obj_id");
823 String timeZone =
"";
824 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
825 if (queryResultSet.next()) {
826 timeZone = queryResultSet.getString(
"tzone");
828 queryResultSet.close();
829 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
830 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
844 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
845 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
846 while (resultSet.next()) {
847 long fileId = resultSet.getLong(
"obj_id");
849 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
852 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
853 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
855 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
856 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
858 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
859 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
862 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
891 if (schemaVersion.getMajor() != 4) {
892 return schemaVersion;
895 Statement statement = null;
898 statement = connection.createStatement();
899 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
912 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
925 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
948 if (schemaVersion.getMajor() != 5) {
949 return schemaVersion;
956 Statement statement = null;
957 ResultSet resultSet = null;
962 statement = connection.createStatement();
963 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
965 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
967 if (resultSet.getLong(
"count") == 0) {
1001 if (schemaVersion.getMajor() != 6) {
1002 return schemaVersion;
1008 Statement statement = null;
1009 Statement updstatement = null;
1010 ResultSet resultSet = null;
1012 statement = connection.createStatement();
1013 updstatement = connection.createStatement();
1014 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
1016 resultSet = connection.executeQuery(statement,
"SELECT obj_id,name FROM tsk_files");
1017 while (resultSet.next()) {
1018 long objID = resultSet.getLong(
"obj_id");
1019 String name = resultSet.getString(
"name");
1020 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" +
escapeSingleQuotes(extractExtension(name)) +
"' "
1021 +
"WHERE obj_id = " + objID);
1024 statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
1027 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
1052 if (schemaVersion.getMajor() != 7) {
1053 return schemaVersion;
1056 if(schemaVersion.getMinor() != 0){
1057 return schemaVersion;
1063 Statement statement = null;
1064 ResultSet resultSet = null;
1066 statement = connection.createStatement();
1069 if (schemaVersion.getMinor() == 0) {
1070 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
1087 static String extractExtension(
final String fileName) {
1089 int i = fileName.lastIndexOf(
".");
1091 if ((i > 0) && ((i + 1) < fileName.length())) {
1092 ext = fileName.substring(i + 1);
1103 return ext.toLowerCase();
1122 if (info.getHost() == null || info.getHost().isEmpty()) {
1123 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
1124 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
1125 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
1126 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
1127 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
1128 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
1129 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
1133 Class.forName(
"org.postgresql.Driver");
1134 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
1138 }
catch (SQLException ex) {
1140 String sqlState = ex.getSQLState().toLowerCase();
1141 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
1143 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
1145 result = bundle.getString(
"DatabaseConnectionCheck.Port");
1147 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
1149 }
catch (IOException any) {
1151 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
1152 }
catch (MissingResourceException any) {
1154 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
1156 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
1157 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
1158 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
1159 result = bundle.getString(
"DatabaseConnectionCheck.Access");
1160 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
1161 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
1162 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
1163 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
1164 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
1165 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
1167 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
1170 }
catch (ClassNotFoundException ex) {
1171 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
1258 rwLock.writeLock().lock();
1269 rwLock.writeLock().unlock();
1280 rwLock.readLock().lock();
1291 rwLock.readLock().unlock();
1311 }
catch (Exception ex) {
1312 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
1342 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(),
caseHandle, caseDir, info.getDbType());
1343 }
catch (PropertyVetoException exp) {
1349 }
catch (Exception exp) {
1368 }
catch (Exception ex) {
1369 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
1404 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
1406 }
catch (PropertyVetoException exp) {
1409 }
catch (Exception exp) {
1426 if (!candidateDbName.isEmpty()) {
1430 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
1435 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
1440 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
1445 dbName = dbName.toLowerCase();
1451 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
1452 dbName =
"_" + dbName;
1460 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
1472 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
1473 Date date =
new Date();
1474 dbName = dbName +
"_" + dateFormat.format(date);
1497 return this.
caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath);
1512 ResultSet rs = null;
1514 s = connection.createStatement();
1515 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
1516 +
"WHERE par_obj_id IS NULL");
1517 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
1519 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
1522 List<Content> rootObjs =
new ArrayList<Content>();
1523 for (ObjectInfo i : infos) {
1524 if (null != i.type) {
1535 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
1539 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
1544 }
catch (SQLException ex) {
1545 throw new TskCoreException(
"Error getting root objects", ex);
1573 ResultSet rs = null;
1575 s = connection.createStatement();
1576 rs = connection.executeQuery(s,
"SELECT obj_id, device_id, time_zone FROM data_source_info");
1577 List<DataSource> dataSources =
new ArrayList<DataSource>();
1579 dataSources.add(
new AbstractDataSource(rs.getLong(
"obj_id"), rs.getString(
"device_id"), rs.getString(
"time_zone")));
1582 }
catch (SQLException ex) {
1583 throw new TskCoreException(
"Error getting data sources", ex);
1614 ResultSet rs = null;
1616 s = connection.createStatement();
1617 rs = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objectId);
1619 return new AbstractDataSource(objectId, rs.getString(
"device_id"), rs.getString(
"time_zone"));
1621 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
1623 }
catch (SQLException ex) {
1624 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
1644 return getArtifactsHelper(
"blackboard_artifacts.artifact_type_id = " + artifactTypeID);
1660 ResultSet rs = null;
1664 statement.clearParameters();
1665 statement.setLong(1, objId);
1666 rs = connection.executeQuery(statement);
1669 count = rs.getLong(
"count");
1672 }
catch (SQLException ex) {
1673 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
1694 ResultSet rs = null;
1698 statement.clearParameters();
1699 statement.setInt(1, artifactTypeID);
1700 rs = connection.executeQuery(statement);
1703 count = rs.getLong(
"count");
1706 }
catch (SQLException ex) {
1707 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
1733 ResultSet rs = null;
1735 s = connection.createStatement();
1736 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1737 +
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
1738 +
"types.type_name AS type_name, types.display_name AS display_name, "
1739 +
" arts.review_status_id AS review_status_id "
1740 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1741 +
"WHERE arts.artifact_id = attrs.artifact_id "
1742 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1743 +
" AND attrs.value_text = '" + value +
"'"
1744 +
" AND types.artifact_type_id=arts.artifact_type_id"
1746 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1748 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
1749 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1753 }
catch (SQLException ex) {
1754 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
1781 String valSubStr =
"%" + subString;
1782 if (startsWith ==
false) {
1788 ResultSet rs = null;
1790 s = connection.createStatement();
1791 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1792 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
1793 +
" types.type_name AS type_name, types.display_name AS display_name, "
1794 +
" arts.review_status_id AS review_status_id "
1795 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1796 +
" WHERE arts.artifact_id = attrs.artifact_id "
1797 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1798 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
1799 +
" AND types.artifact_type_id=arts.artifact_type_id "
1801 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1803 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
1804 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1808 }
catch (SQLException ex) {
1809 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
1836 ResultSet rs = null;
1838 s = connection.createStatement();
1839 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1840 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
1841 +
" types.type_name AS type_name, types.display_name AS display_name, "
1842 +
" arts.review_status_id AS review_status_id "
1843 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1844 +
"WHERE arts.artifact_id = attrs.artifact_id "
1845 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1846 +
" AND attrs.value_int32 = " + value
1847 +
" AND types.artifact_type_id=arts.artifact_type_id "
1849 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1851 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
1852 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1856 }
catch (SQLException ex) {
1857 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
1884 ResultSet rs = null;
1886 s = connection.createStatement();
1887 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1888 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
1889 +
" types.type_name AS type_name, types.display_name AS display_name, "
1890 +
" arts.review_status_id AS review_status_id "
1891 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1892 +
" WHERE arts.artifact_id = attrs.artifact_id "
1893 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1894 +
" AND attrs.value_int64 = " + value
1895 +
" AND types.artifact_type_id=arts.artifact_type_id "
1897 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1899 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
1900 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1904 }
catch (SQLException ex) {
1905 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
1932 ResultSet rs = null;
1934 s = connection.createStatement();
1935 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1936 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
1937 +
" types.type_name AS type_name, types.display_name AS display_name, "
1938 +
" arts.review_status_id AS review_status_id "
1939 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1940 +
" WHERE arts.artifact_id = attrs.artifact_id "
1941 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1942 +
" AND attrs.value_double = " + value
1943 +
" AND types.artifact_type_id=arts.artifact_type_id "
1945 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1947 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
1948 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
1952 }
catch (SQLException ex) {
1953 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
1980 ResultSet rs = null;
1982 s = connection.createStatement();
1983 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
1984 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
1985 +
" types.type_name AS type_name, types.display_name AS display_name, "
1986 +
" arts.review_status_id AS review_status_id "
1987 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
1988 +
" WHERE arts.artifact_id = attrs.artifact_id "
1989 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
1990 +
" AND attrs.value_byte = " + value
1991 +
" AND types.artifact_type_id=arts.artifact_type_id "
1993 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
1995 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
1996 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2000 }
catch (SQLException ex) {
2001 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
2021 ResultSet rs = null;
2023 s = connection.createStatement();
2024 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types");
2028 rs.getString(
"type_name"), rs.getString(
"display_name")));
2030 return artifactTypes;
2031 }
catch (SQLException ex) {
2032 throw new TskCoreException(
"Error getting artifact types", ex);
2050 String typeIdList =
"";
2057 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
2058 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
2062 ResultSet rs = null;
2064 s = connection.createStatement();
2065 rs = connection.executeQuery(s, query);
2071 }
catch (SQLException ex) {
2072 throw new TskCoreException(
"Error getting artifact types in use", ex);
2095 ResultSet rs = null;
2097 s = connection.createStatement();
2098 rs = connection.executeQuery(s,
2099 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
2100 +
"types.type_name AS type_name, types.display_name AS display_name "
2101 +
"FROM blackboard_artifact_types AS types "
2102 +
"INNER JOIN blackboard_artifacts AS arts "
2103 +
"ON arts.artifact_type_id = types.artifact_type_id");
2107 rs.getString(
"type_name"), rs.getString(
"display_name")));
2109 return uniqueArtifactTypes;
2110 }
catch (SQLException ex) {
2111 throw new TskCoreException(
"Error getting attribute types", ex);
2131 ResultSet rs = null;
2133 s = connection.createStatement();
2134 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
2140 return attribute_types;
2141 }
catch (SQLException ex) {
2142 throw new TskCoreException(
"Error getting attribute types", ex);
2166 ResultSet rs = null;
2168 s = connection.createStatement();
2169 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
2172 count = rs.getInt(
"count");
2175 }
catch (SQLException ex) {
2176 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
2200 ResultSet rs = null;
2202 Statement statement = connection.createStatement();
2203 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
2204 +
"blackboard_artifacts.obj_id AS obj_id, "
2205 +
"blackboard_artifacts.artifact_obj_id AS artifact_obj_id, "
2206 +
"blackboard_artifact_types.artifact_type_id AS artifact_type_id, "
2207 +
"blackboard_artifact_types.type_name AS type_name, "
2208 +
"blackboard_artifact_types.display_name AS display_name, "
2209 +
"blackboard_artifacts.review_status_id AS review_status_id "
2210 +
"FROM blackboard_artifacts, blackboard_artifact_types "
2211 +
"WHERE blackboard_artifacts.artifact_type_id = blackboard_artifact_types.artifact_type_id "
2213 +
" AND " + whereClause;
2214 rs = connection.executeQuery(statement, query);
2215 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
2217 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
2218 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2222 }
catch (SQLException ex) {
2223 throw new TskCoreException(
"Error getting or creating a blackboard artifact", ex);
2246 ResultSet rs = null;
2250 statement.clearParameters();
2251 statement.setLong(1, obj_id);
2252 statement.setInt(2, artifactTypeID);
2253 rs = connection.executeQuery(statement);
2256 count = rs.getLong(
"count");
2259 }
catch (SQLException ex) {
2281 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
2297 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID +
";");
2329 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
2330 if (artifactTypeID == -1) {
2380 return getArtifactsHelper(
"blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
2395 return getArtifactsHelper(
"blackboard_artifact_types.artifact_type_id = " + artifactType.getTypeID() +
";");
2415 ResultSet rs = null;
2417 s = connection.createStatement();
2418 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
2419 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
2420 +
"types.type_name AS type_name, types.display_name AS display_name,"
2421 +
"arts.review_status_id AS review_status_id "
2422 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
2423 +
"WHERE arts.artifact_id = attrs.artifact_id "
2424 +
"AND attrs.attribute_type_id = " + attrType.getTypeID()
2425 +
" AND arts.artifact_type_id = " + artifactType.getTypeID()
2426 +
" AND attrs.value_text = '" + value +
"'"
2427 +
" AND types.artifact_type_id=arts.artifact_type_id"
2429 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
2431 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
2432 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2436 }
catch (SQLException ex) {
2437 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
2459 ResultSet rs = null;
2462 s = connection.createStatement();
2463 rs = connection.executeQuery(s,
"SELECT arts.artifact_id AS artifact_id, "
2464 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.artifact_type_id AS artifact_type_id, "
2465 +
"types.type_name AS type_name, types.display_name AS display_name,"
2466 +
"arts.review_status_id AS review_status_id "
2467 +
"FROM blackboard_artifacts AS arts, blackboard_artifact_types AS types "
2468 +
"WHERE arts.artifact_id = " + artifactID
2469 +
" AND arts.artifact_type_id = types.artifact_type_id");
2471 return new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
2472 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2480 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
2482 }
catch (SQLException ex) {
2483 throw new TskCoreException(
"Error getting a blackboard artifact. " + ex.getMessage(), ex);
2504 }
catch (SQLException ex) {
2505 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
2525 connection.beginTransaction();
2529 connection.commitTransaction();
2530 }
catch (SQLException ex) {
2531 connection.rollbackTransaction();
2540 PreparedStatement statement;
2541 switch (attr.getAttributeType().getValueType()) {
2544 statement.clearParameters();
2545 statement.setString(7, attr.getValueString());
2549 statement.clearParameters();
2550 statement.setBytes(7, attr.getValueBytes());
2554 statement.clearParameters();
2555 statement.setInt(7, attr.getValueInt());
2559 statement.clearParameters();
2560 statement.setLong(7, attr.getValueLong());
2564 statement.clearParameters();
2565 statement.setDouble(7, attr.getValueDouble());
2569 statement.clearParameters();
2570 statement.setLong(7, attr.getValueLong());
2575 statement.setLong(1, attr.getArtifactID());
2576 statement.setInt(2, artifactTypeId);
2577 statement.setString(3, attr.getSourcesCSV());
2578 statement.setString(4,
"");
2579 statement.setInt(5, attr.getAttributeType().getTypeID());
2580 statement.setLong(6, attr.getAttributeType().getValueType().getType());
2581 connection.executeUpdate(statement);
2602 if (null == source || source.isEmpty()) {
2603 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
2605 CaseDbConnection connection = connections.getConnection();
2607 Statement queryStmt = null;
2608 Statement updateStmt = null;
2609 ResultSet result = null;
2610 String newSources =
"";
2612 connection.beginTransaction();
2613 String valueClause =
"";
2614 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
2615 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
2616 switch (valueType) {
2621 valueClause =
" value_int32 = " + attr.getValueInt();
2625 valueClause =
" value_int64 = " + attr.getValueLong();
2628 valueClause =
" value_double = " + attr.getValueDouble();
2631 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
2633 String query =
"SELECT source FROM blackboard_attributes WHERE"
2634 +
" artifact_id = " + attr.getArtifactID()
2635 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
2636 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
2637 +
" AND " + valueClause +
";";
2638 queryStmt = connection.createStatement();
2639 updateStmt = connection.createStatement();
2640 result = connection.executeQuery(queryStmt, query);
2647 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
2648 statement.clearParameters();
2649 statement.setLong(1, attr.getArtifactID());
2650 statement.setLong(2, attr.getAttributeType().getTypeID());
2651 statement.setBytes(3, attr.getValueBytes());
2652 result = connection.executeQuery(statement);
2654 while (result.next()) {
2655 String oldSources = result.getString(
"source");
2656 if (null != oldSources && !oldSources.isEmpty()) {
2657 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
2658 if (!uniqueSources.contains(source)) {
2659 newSources = oldSources +
"," + source;
2661 newSources = oldSources;
2664 newSources = source;
2666 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
2667 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
2668 +
" artifact_id = " + attr.getArtifactID()
2669 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
2670 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
2671 +
" AND " + valueClause +
";";
2672 connection.executeUpdate(updateStmt, update);
2679 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
2680 statement.clearParameters();
2681 statement.setString(1, newSources);
2682 statement.setLong(2, attr.getArtifactID());
2683 statement.setLong(3, attr.getAttributeType().getTypeID());
2684 statement.setBytes(4, attr.getValueBytes());
2685 connection.executeUpdate(statement);
2688 connection.commitTransaction();
2690 }
catch (SQLException ex) {
2691 connection.rollbackTransaction();
2692 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
2720 ResultSet rs = null;
2722 connection.beginTransaction();
2723 s = connection.createStatement();
2724 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeString +
"'");
2727 rs = connection.executeQuery(s,
"SELECT MAX(attribute_type_id) AS highest_id FROM blackboard_attribute_types");
2730 maxID = rs.getInt(
"highest_id");
2731 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
2737 connection.executeUpdate(s,
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES ('" + maxID +
"', '" + attrTypeString +
"', '" + displayName +
"', '" + valueType.getType() +
"')");
2741 connection.commitTransaction();
2744 throw new TskDataException(
"The attribute type that was added was already within the system.");
2747 }
catch (SQLException ex) {
2748 connection.rollbackTransaction();
2775 ResultSet rs = null;
2777 s = connection.createStatement();
2778 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
2787 }
catch (SQLException ex) {
2814 ResultSet rs = null;
2816 s = connection.createStatement();
2817 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE attribute_type_id = " + typeID +
"");
2826 }
catch (SQLException ex) {
2853 ResultSet rs = null;
2855 s = connection.createStatement();
2856 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE type_name = '" + artTypeName +
"'");
2860 rs.getString(
"type_name"), rs.getString(
"display_name"));
2865 }
catch (SQLException ex) {
2866 throw new TskCoreException(
"Error getting artifact type from the database", ex);
2889 CaseDbConnection connection = connections.getConnection();
2892 ResultSet rs = null;
2894 s = connection.createStatement();
2895 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE artifact_type_id = " + artTypeId +
"");
2896 BlackboardArtifact.Type type = null;
2898 type =
new BlackboardArtifact.Type(rs.getInt(
"artifact_type_id"),
2899 rs.getString(
"type_name"), rs.getString(
"display_name"));
2904 }
catch (SQLException ex) {
2905 throw new TskCoreException(
"Error getting artifact type from the database", ex);
2930 ResultSet rs = null;
2932 connection.beginTransaction();
2933 s = connection.createStatement();
2934 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
2937 rs = connection.executeQuery(s,
"SELECT MAX(artifact_type_id) AS highest_id FROM blackboard_artifact_types");
2940 maxID = rs.getInt(
"highest_id");
2941 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
2947 connection.executeUpdate(s,
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES ('" + maxID +
"', '" + artifactTypeName +
"', '" + displayName +
"')");
2951 connection.commitTransaction();
2954 throw new TskDataException(
"The attribute type that was added was already within the system.");
2956 }
catch (SQLException ex) {
2957 connection.rollbackTransaction();
2970 ResultSet rs = null;
2972 Statement statement = connection.createStatement();
2973 rs = connection.executeQuery(statement,
"SELECT attrs.artifact_id AS artifact_id, "
2974 +
"attrs.source AS source, attrs.context AS context, attrs.attribute_type_id AS attribute_type_id, "
2975 +
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, "
2976 +
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, "
2977 +
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, "
2978 +
"types.type_name AS type_name, types.display_name AS display_name "
2979 +
"FROM blackboard_attributes AS attrs, blackboard_attribute_types AS types WHERE attrs.artifact_id = " + artifact.getArtifactID()
2980 +
" AND attrs.attribute_type_id = types.attribute_type_id");
2981 ArrayList<BlackboardAttribute> attributes =
new ArrayList<BlackboardAttribute>();
2983 int attributeTypeId = rs.getInt(
"attribute_type_id");
2984 String attributeTypeName = rs.getString(
"type_name");
2990 rs.getString(
"display_name"),
2997 rs.getLong(
"artifact_id"),
2999 rs.getString(
"source"),
3000 rs.getString(
"context"),
3001 rs.getInt(
"value_int32"),
3002 rs.getLong(
"value_int64"),
3003 rs.getDouble(
"value_double"),
3004 rs.getString(
"value_text"),
3005 rs.getBytes(
"value_byte"), this
3007 attributes.add(attr);
3010 }
catch (SQLException ex) {
3011 throw new TskCoreException(
"Error getting attributes for artifact, artifact id = " + artifact.getArtifactID(), ex);
3035 ResultSet rs = null;
3037 s = connection.createStatement();
3038 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
3039 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
3040 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
3041 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
3042 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
3043 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
3044 +
"FROM blackboard_attributes " + whereClause);
3045 ArrayList<BlackboardAttribute> matches =
new ArrayList<BlackboardAttribute>();
3051 rs.getLong(
"artifact_id"),
3053 rs.getString(
"source"),
3054 rs.getString(
"context"),
3055 rs.getInt(
"value_int32"),
3056 rs.getLong(
"value_int64"),
3057 rs.getDouble(
"value_double"),
3058 rs.getString(
"value_text"),
3059 rs.getBytes(
"value_byte"), this
3064 }
catch (SQLException ex) {
3065 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
3088 ResultSet rs = null;
3091 s = connection.createStatement();
3092 rs = connection.executeQuery(s,
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
3093 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
3094 +
"blackboard_artifacts.review_status_id AS review_status_id "
3095 +
"FROM blackboard_artifacts " + whereClause);
3096 ArrayList<BlackboardArtifact> matches =
new ArrayList<BlackboardArtifact>();
3102 type.getTypeID(), type.getTypeName(), type.getDisplayName(),
3104 matches.add(artifact);
3107 }
catch (SQLException ex) {
3108 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
3147 return newBlackboardArtifact(artifactType.getTypeID(), obj_id, artifactType.getLabel(), artifactType.getDisplayName());
3153 ResultSet resultSet = null;
3157 statement.clearParameters();
3158 statement.setLong(1, obj_id);
3160 connection.executeUpdate(statement);
3161 resultSet = statement.getGeneratedKeys();
3163 long artifact_obj_id = resultSet.getLong(1);
3167 statement.clearParameters();
3168 statement.setLong(1, obj_id);
3169 statement.setLong(2, artifact_obj_id);
3170 statement.setInt(3, artifact_type_id);
3174 statement.clearParameters();
3175 this.nextArtifactId++;
3176 statement.setLong(1, this.nextArtifactId);
3177 statement.setLong(2, obj_id);
3178 statement.setLong(3, artifact_obj_id);
3179 statement.setInt(4, artifact_type_id);
3182 connection.executeUpdate(statement);
3183 resultSet = statement.getGeneratedKeys();
3187 }
catch (SQLException ex) {
3209 CaseDbConnection connection = connections.getConnection();
3211 ResultSet rs = null;
3214 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
3215 statement.clearParameters();
3216 statement.setLong(1, content.getId());
3217 rs = connection.executeQuery(statement);
3218 boolean hasChildren =
false;
3220 hasChildren = rs.getInt(
"count") > 0;
3223 }
catch (SQLException e) {
3224 throw new TskCoreException(
"Error checking for children of parent " + content, e);
3244 int getContentChildrenCount(Content content)
throws TskCoreException {
3245 CaseDbConnection connection = connections.getConnection();
3247 ResultSet rs = null;
3250 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
3251 statement.clearParameters();
3252 statement.setLong(1, content.getId());
3253 rs = connection.executeQuery(statement);
3254 int countChildren = -1;
3256 countChildren = rs.getInt(
"count");
3258 return countChildren;
3259 }
catch (SQLException e) {
3260 throw new TskCoreException(
"Error checking for children of parent " + content, e);
3279 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
3280 CaseDbConnection connection = connections.getConnection();
3282 ResultSet rs = null;
3284 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
3285 statement.clearParameters();
3286 long parentId = parent.getId();
3287 statement.setLong(1, parentId);
3288 statement.setShort(2, type.getFileType());
3289 rs = connection.executeQuery(statement);
3290 return fileChildren(rs, connection, parentId);
3291 }
catch (SQLException ex) {
3292 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3309 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
3310 CaseDbConnection connection = connections.getConnection();
3312 ResultSet rs = null;
3314 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
3315 statement.clearParameters();
3316 long parentId = parent.getId();
3317 statement.setLong(1, parentId);
3318 rs = connection.executeQuery(statement);
3319 return fileChildren(rs, connection, parentId);
3320 }
catch (SQLException ex) {
3321 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3340 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
3341 CaseDbConnection connection = connections.getConnection();
3343 ResultSet rs = null;
3345 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
3346 statement.clearParameters();
3347 statement.setLong(1, parent.getId());
3348 statement.setShort(2, type.getFileType());
3349 rs = connection.executeQuery(statement);
3350 List<Long> children =
new ArrayList<Long>();
3352 children.add(rs.getLong(
"obj_id"));
3355 }
catch (SQLException ex) {
3356 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3373 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
3374 CaseDbConnection connection = connections.getConnection();
3376 ResultSet rs = null;
3378 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
3379 statement.clearParameters();
3380 statement.setLong(1, parent.getId());
3381 rs = connection.executeQuery(statement);
3382 List<Long> children =
new ArrayList<Long>();
3384 children.add(rs.getLong(
"obj_id"));
3387 }
catch (SQLException ex) {
3388 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
3406 List<Long> getBlackboardArtifactChildrenIds(Content parent)
throws TskCoreException {
3407 CaseDbConnection connection = connections.getConnection();
3409 ResultSet rs = null;
3411 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
3412 statement.clearParameters();
3413 statement.setLong(1, parent.getId());
3414 rs = connection.executeQuery(statement);
3415 List<Long> children =
new ArrayList<Long>();
3417 children.add(rs.getLong(
"obj_id"));
3420 }
catch (SQLException ex) {
3421 throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
3438 List<Content> getBlackboardArtifactChildren(Content parent)
throws TskCoreException {
3440 long parentId = parent.getId();
3441 ArrayList<BlackboardArtifact> artsArray =
getArtifactsHelper(
"blackboard_artifacts.obj_id = " + parentId +
";");
3443 List<Content> lc =
new ArrayList<Content>();
3444 lc.addAll(artsArray);
3456 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
3457 CaseDbConnection connection = connections.getConnection();
3460 ResultSet rs = null;
3462 s = connection.createStatement();
3463 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
3464 +
"FROM tsk_objects LEFT JOIN tsk_files "
3465 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
3466 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
3467 +
" ORDER BY tsk_objects.obj_id");
3468 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
3470 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
3473 }
catch (SQLException ex) {
3474 throw new TskCoreException(
"Error getting Children Info for Content", ex);
3493 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
3496 CaseDbConnection connection = connections.getConnection();
3499 ResultSet rs = null;
3501 s = connection.createStatement();
3502 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
3503 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
3504 +
"ON child.par_obj_id = parent.obj_id "
3505 +
"WHERE child.obj_id = " + c.getId());
3507 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
3509 throw new TskCoreException(
"Given content (id: " + c.getId() +
") has no parent");
3511 }
catch (SQLException ex) {
3512 throw new TskCoreException(
"Error getting Parent Info for Content", ex);
3531 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
3534 CaseDbConnection connection = connections.getConnection();
3537 ResultSet rs = null;
3539 s = connection.createStatement();
3540 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
3541 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
3542 +
"ON child.par_obj_id = parent.obj_id "
3543 +
"WHERE child.obj_id = " + contentId);
3545 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
3547 throw new TskCoreException(
"Given content (id: " + contentId +
") has no parent.");
3549 }
catch (SQLException ex) {
3550 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
3569 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
3573 throw new TskCoreException(
"Given FsContent (id: " + fsc.getId() +
") is a root object (can't have parent directory).");
3575 ObjectInfo parentInfo = getParentInfo(fsc);
3576 Directory parent = null;
3577 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
3578 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
3580 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
3601 ResultSet rs = null;
3603 s = connection.createStatement();
3604 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
3610 long parentId = rs.getLong(
"par_obj_id");
3617 content = getVolumeSystemById(
id, parentId);
3620 content = getVolumeById(
id, parentId);
3623 content = getFileSystemById(
id, parentId);
3632 throw new TskCoreException(
"Could not obtain Content object with ID: " +
id);
3635 }
catch (SQLException ex) {
3652 String getFilePath(
long id) {
3653 CaseDbConnection connection;
3655 connection = connections.getConnection();
3656 }
catch (TskCoreException ex) {
3657 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
3660 String filePath = null;
3662 ResultSet rs = null;
3664 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
3665 statement.clearParameters();
3666 statement.setLong(1,
id);
3667 rs = connection.executeQuery(statement);
3669 filePath = rs.getString(
"path");
3671 }
catch (SQLException ex) {
3672 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
3688 TskData.EncodingType getEncodingType(
long id) {
3689 CaseDbConnection connection;
3691 connection = connections.getConnection();
3692 }
catch (TskCoreException ex) {
3693 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
3696 TskData.EncodingType type = TskData.EncodingType.NONE;
3698 ResultSet rs = null;
3700 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
3701 statement.clearParameters();
3702 statement.setLong(1,
id);
3703 rs = connection.executeQuery(statement);
3705 type = TskData.EncodingType.valueOf(rs.getInt(1));
3707 }
catch (SQLException ex) {
3708 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
3725 String getFileParentPath(
long objectId, CaseDbConnection connection) {
3726 String parentPath = null;
3728 ResultSet rs = null;
3730 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
3731 statement.clearParameters();
3732 statement.setLong(1, objectId);
3733 rs = connection.executeQuery(statement);
3735 parentPath = rs.getString(
"parent_path");
3737 }
catch (SQLException ex) {
3738 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
3754 String getFileName(
long objectId, CaseDbConnection connection) {
3755 String fileName = null;
3757 ResultSet rs = null;
3759 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
3760 statement.clearParameters();
3761 statement.setLong(1, objectId);
3762 rs = connection.executeQuery(statement);
3764 fileName = rs.getString(
"name");
3766 }
catch (SQLException ex) {
3767 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
3785 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
3786 CaseDbConnection connection = connections.getConnection();
3787 DerivedFile.DerivedMethod method = null;
3789 ResultSet rs1 = null;
3790 ResultSet rs2 = null;
3792 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
3793 statement.clearParameters();
3794 statement.setLong(1,
id);
3795 rs1 = connection.executeQuery(statement);
3797 int method_id = rs1.getInt(
"derived_id");
3798 String rederive = rs1.getString(
"rederive");
3799 method =
new DerivedFile.DerivedMethod(method_id, rederive);
3800 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
3801 statement.clearParameters();
3802 statement.setInt(1, method_id);
3803 rs2 = connection.executeQuery(statement);
3805 method.setToolName(rs2.getString(
"tool_name"));
3806 method.setToolVersion(rs2.getString(
"tool_version"));
3807 method.setOther(rs2.getString(
"other"));
3810 }
catch (SQLException e) {
3811 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
3834 ResultSet rs = null;
3837 statement.clearParameters();
3838 statement.setLong(1,
id);
3839 rs = connection.executeQuery(statement);
3841 if (files.size() > 0) {
3842 return files.get(0);
3846 }
catch (SQLException ex) {
3868 ResultSet rs = null;
3871 statement.clearParameters();
3872 statement.setLong(1,
id);
3873 rs = connection.executeQuery(statement);
3875 if (artifacts.size() > 0) {
3876 return artifacts.get(0);
3880 }
catch (SQLException ex) {
3881 throw new TskCoreException(
"Error getting artifacts by id, id = " +
id, ex);
3903 ResultSet rs = null;
3907 statement.clearParameters();
3908 statement.setLong(1, fileId);
3909 rs = connection.executeQuery(statement);
3911 ret = rs.getLong(
"fs_obj_id");
3916 }
catch (SQLException e) {
3917 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
3937 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
3940 Statement statement = null;
3941 ResultSet resultSet = null;
3943 statement = connection.createStatement();
3944 resultSet = connection.executeQuery(statement, query);
3946 return (resultSet.getLong(
"count") > 0L);
3947 }
catch (SQLException ex) {
3948 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
3969 List<AbstractFile> files =
new ArrayList<AbstractFile>();
3972 ResultSet resultSet = null;
3975 statement.clearParameters();
3976 statement.setString(1, fileName.toLowerCase());
3977 statement.setLong(2, dataSource.getId());
3978 resultSet = connection.executeQuery(statement);
3980 }
catch (SQLException e) {
3981 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
4004 List<AbstractFile> files =
new ArrayList<AbstractFile>();
4007 ResultSet resultSet = null;
4010 statement.clearParameters();
4011 statement.setString(1, fileName.toLowerCase());
4012 statement.setString(2,
"%" + dirName.toLowerCase() +
"%");
4013 statement.setLong(3, dataSource.getId());
4014 resultSet = connection.executeQuery(statement);
4016 }
catch (SQLException e) {
4017 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
4048 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4074 if (transaction == null) {
4079 ResultSet resultSet = null;
4083 String parentPath = getFileParentPath(parentId, connection);
4084 if (parentPath == null) {
4087 String parentName = getFileName(parentId, connection);
4088 if (parentName != null && !parentName.isEmpty()) {
4089 parentPath = parentPath + parentName +
"/";
4095 statement.clearParameters();
4096 if (parentId != 0) {
4097 statement.setLong(1, parentId);
4099 statement.setNull(1, java.sql.Types.BIGINT);
4102 connection.executeUpdate(statement);
4103 resultSet = statement.getGeneratedKeys();
4105 long newObjId = resultSet.getLong(1);
4112 statement.clearParameters();
4113 statement.setLong(1, newObjId);
4116 if (0 != parentId) {
4118 if (parentFs != -1) {
4119 statement.setLong(2, parentFs);
4121 statement.setNull(2, java.sql.Types.BIGINT);
4124 statement.setNull(2, java.sql.Types.BIGINT);
4128 statement.setString(3, directoryName);
4132 statement.setShort(5, (
short) 1);
4136 statement.setShort(6, dirType.
getValue());
4138 statement.setShort(7, metaType.
getValue());
4142 statement.setShort(8, dirFlag.
getValue());
4145 statement.setShort(9, metaFlags);
4148 statement.setLong(10, 0);
4151 statement.setNull(11, java.sql.Types.BIGINT);
4152 statement.setNull(12, java.sql.Types.BIGINT);
4153 statement.setNull(13, java.sql.Types.BIGINT);
4154 statement.setNull(14, java.sql.Types.BIGINT);
4157 statement.setString(15, parentPath);
4160 long dataSourceObjectId;
4161 if (0 == parentId) {
4162 dataSourceObjectId = newObjId;
4166 statement.setLong(16, dataSourceObjectId);
4169 statement.setString(17, null);
4170 connection.executeUpdate(statement);
4172 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
4175 }
catch (SQLException e) {
4176 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
4206 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4232 if (transaction == null) {
4237 ResultSet resultSet = null;
4241 String parentPath = getFileParentPath(parentId, connection);
4242 if (parentPath == null) {
4245 String parentName = getFileName(parentId, connection);
4246 if (parentName != null && !parentName.isEmpty()) {
4247 parentPath = parentPath + parentName +
"/";
4253 statement.clearParameters();
4254 if (parentId != 0) {
4255 statement.setLong(1, parentId);
4257 statement.setNull(1, java.sql.Types.BIGINT);
4260 connection.executeUpdate(statement);
4261 resultSet = statement.getGeneratedKeys();
4263 long newObjId = resultSet.getLong(1);
4270 statement.clearParameters();
4271 statement.setLong(1, newObjId);
4274 statement.setNull(2, java.sql.Types.BIGINT);
4277 statement.setString(3, directoryName);
4281 statement.setShort(5, (
short) 1);
4285 statement.setShort(6, dirType.
getValue());
4287 statement.setShort(7, metaType.
getValue());
4291 statement.setShort(8, dirFlag.
getValue());
4294 statement.setShort(9, metaFlags);
4297 statement.setLong(10, 0);
4300 statement.setNull(11, java.sql.Types.BIGINT);
4301 statement.setNull(12, java.sql.Types.BIGINT);
4302 statement.setNull(13, java.sql.Types.BIGINT);
4303 statement.setNull(14, java.sql.Types.BIGINT);
4306 statement.setString(15, parentPath);
4310 statement.setLong(16, dataSourceObjectId);
4313 statement.setString(17, null);
4315 connection.executeUpdate(statement);
4317 return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
4320 }
catch (SQLException e) {
4321 throw new TskCoreException(
"Error creating local directory '" + directoryName +
"'", e);
4349 Statement statement = null;
4350 ResultSet resultSet = null;
4357 preparedStatement.clearParameters();
4358 preparedStatement.setNull(1, java.sql.Types.BIGINT);
4360 connection.executeUpdate(preparedStatement);
4361 resultSet = preparedStatement.getGeneratedKeys();
4363 long newObjId = resultSet.getLong(1);
4369 statement = connection.createStatement();
4370 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
4371 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"');");
4381 preparedStatement.clearParameters();
4382 preparedStatement.setLong(1, newObjId);
4383 preparedStatement.setNull(2, java.sql.Types.BIGINT);
4384 preparedStatement.setString(3, rootDirectoryName);
4386 preparedStatement.setShort(5, (
short) 1);
4390 preparedStatement.setShort(7, metaType.
getValue());
4392 preparedStatement.setShort(8, dirFlag.
getValue());
4395 preparedStatement.setShort(9, metaFlags);
4396 preparedStatement.setLong(10, 0);
4397 preparedStatement.setNull(11, java.sql.Types.BIGINT);
4398 preparedStatement.setNull(12, java.sql.Types.BIGINT);
4399 preparedStatement.setNull(13, java.sql.Types.BIGINT);
4400 preparedStatement.setNull(14, java.sql.Types.BIGINT);
4401 String parentPath =
"/";
4402 preparedStatement.setString(15, parentPath);
4403 preparedStatement.setLong(16, newObjId);
4404 preparedStatement.setString(17, null);
4405 connection.executeUpdate(preparedStatement);
4408 newObjId, newObjId, rootDirectoryName,
4409 dirType, metaType, dirFlag, metaFlags, null,
4413 }
catch (SQLException ex) {
4414 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
4434 ResultSet rs = null;
4436 s = connection.createStatement();
4437 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
4439 +
" AND obj_id = data_source_obj_id"
4440 +
" ORDER BY dir_type, LOWER(name)");
4441 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
4443 virtDirRootIds.add(virtualDirectory(rs));
4445 return virtDirRootIds;
4446 }
catch (SQLException ex) {
4447 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
4469 assert (null != fileRanges);
4470 if (null == fileRanges) {
4474 assert (null != parent);
4475 if (null == parent) {
4480 Statement statement = null;
4481 ResultSet resultSet = null;
4488 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<LayoutFile>();
4496 prepStmt.clearParameters();
4497 prepStmt.setLong(1, parent.getId());
4499 connection.executeUpdate(prepStmt);
4500 resultSet = prepStmt.getGeneratedKeys();
4502 long fileRangeId = resultSet.getLong(1);
4503 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
4513 prepStmt.clearParameters();
4514 prepStmt.setLong(1, fileRangeId);
4515 prepStmt.setNull(2, java.sql.Types.BIGINT);
4516 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
4518 prepStmt.setNull(5, java.sql.Types.BIGINT);
4523 prepStmt.setLong(10, fileRange.getByteLen());
4524 prepStmt.setNull(11, java.sql.Types.BIGINT);
4525 prepStmt.setNull(12, java.sql.Types.BIGINT);
4526 prepStmt.setNull(13, java.sql.Types.BIGINT);
4527 prepStmt.setNull(14, java.sql.Types.BIGINT);
4528 prepStmt.setNull(15, java.sql.Types.VARCHAR);
4529 prepStmt.setLong(16, parent.getId());
4532 prepStmt.setString(17, null);
4533 connection.executeUpdate(prepStmt);
4541 prepStmt.clearParameters();
4542 prepStmt.setLong(1, fileRangeId);
4543 prepStmt.setLong(2, fileRange.getByteStart());
4544 prepStmt.setLong(3, fileRange.getByteLen());
4545 prepStmt.setLong(4, fileRange.getSequence());
4546 connection.executeUpdate(prepStmt);
4551 fileRangeLayoutFiles.add(
new LayoutFile(
this,
4554 Long.toString(fileRange.getSequence()),
4560 fileRange.getByteLen(),
4563 parent.getUniquePath(),
4568 return fileRangeLayoutFiles;
4570 }
catch (SQLException ex) {
4571 if (null != transaction) {
4575 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4578 throw new TskCoreException(
"Failed to add layout files to case database", ex);
4581 if (null != transaction) {
4585 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4609 assert (null != carvingResult);
4610 if (null == carvingResult) {
4613 assert (null != carvingResult.getParent());
4614 if (null == carvingResult.getParent()) {
4617 assert (null != carvingResult.getCarvedFiles());
4618 if (null == carvingResult.getCarvedFiles()) {
4622 Statement statement = null;
4623 ResultSet resultSet = null;
4625 long newCacheKey = 0;
4637 while (null != root) {
4652 if (null == carvedFilesDir) {
4653 List<Content> rootChildren;
4655 rootChildren = ((FileSystem) root).getRootDirectory().
getChildren();
4659 for (
Content child : rootChildren) {
4665 if (null == carvedFilesDir) {
4666 long parId = root.
getId();
4668 if (root instanceof FileSystem) {
4669 Content rootDir = ((FileSystem) root).getRootDirectory();
4670 parId = rootDir.
getId();
4674 newCacheKey = root.
getId();
4675 rootIdsToCarvedFileDirs.put(newCacheKey, carvedFilesDir);
4682 String parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
4683 List<LayoutFile> carvedFiles =
new ArrayList<LayoutFile>();
4690 prepStmt.clearParameters();
4691 prepStmt.setLong(1, carvedFilesDir.
getId());
4693 connection.executeUpdate(prepStmt);
4694 resultSet = prepStmt.getGeneratedKeys();
4696 long carvedFileId = resultSet.getLong(1);
4707 prepStmt.clearParameters();
4708 prepStmt.setLong(1, carvedFileId);
4710 prepStmt.setLong(2, root.
getId());
4712 prepStmt.setNull(2, java.sql.Types.BIGINT);
4714 prepStmt.setString(3, carvedFile.getName());
4716 prepStmt.setShort(5, (
short) 1);
4721 prepStmt.setLong(10, carvedFile.getSizeInBytes());
4722 prepStmt.setNull(11, java.sql.Types.BIGINT);
4723 prepStmt.setNull(12, java.sql.Types.BIGINT);
4724 prepStmt.setNull(13, java.sql.Types.BIGINT);
4725 prepStmt.setNull(14, java.sql.Types.BIGINT);
4726 prepStmt.setString(15, parentPath);
4727 prepStmt.setLong(16, carvedFilesDir.getDataSourceObjectId());
4729 prepStmt.setString(17, extractExtension(carvedFile.getName()));
4730 connection.executeUpdate(prepStmt);
4738 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
4739 prepStmt.clearParameters();
4740 prepStmt.setLong(1, carvedFileId);
4741 prepStmt.setLong(2, tskFileRange.getByteStart());
4742 prepStmt.setLong(3, tskFileRange.getByteLen());
4743 prepStmt.setLong(4, tskFileRange.getSequence());
4744 connection.executeUpdate(prepStmt);
4752 carvedFilesDir.getDataSourceObjectId(),
4753 carvedFile.getName(),
4759 carvedFile.getSizeInBytes(),
4769 }
catch (SQLException ex) {
4770 if (null != transaction) {
4774 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4776 if (0 != newCacheKey) {
4777 rootIdsToCarvedFileDirs.remove(newCacheKey);
4780 throw new TskCoreException(
"Failed to add carved files to case database", ex);
4783 if (null != transaction) {
4787 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
4789 if (0 != newCacheKey) {
4790 rootIdsToCarvedFileDirs.remove(newCacheKey);
4833 long size,
long ctime,
long crtime,
long atime,
long mtime,
4834 boolean isFile,
Content parentObj,
4835 String rederiveDetails, String toolName, String toolVersion,
4839 ResultSet rs = null;
4841 connection.beginTransaction();
4843 final long parentId = parentObj.
getId();
4844 String parentPath =
"";
4848 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() +
'/';
4854 statement.clearParameters();
4855 statement.setLong(1, parentId);
4857 connection.executeUpdate(statement);
4858 rs = statement.getGeneratedKeys();
4860 long newObjId = rs.getLong(1);
4869 statement.clearParameters();
4870 statement.setLong(1, newObjId);
4874 if (fsObjId != -1) {
4875 statement.setLong(2, fsObjId);
4877 statement.setNull(2, java.sql.Types.BIGINT);
4879 statement.setString(3, fileName);
4883 statement.setShort(5, (
short) 1);
4887 statement.setShort(6, dirType.
getValue());
4889 statement.setShort(7, metaType.
getValue());
4893 statement.setShort(8, dirFlag.
getValue());
4896 statement.setShort(9, metaFlags);
4899 statement.setLong(10, size);
4903 statement.setLong(11, ctime);
4904 statement.setLong(12, crtime);
4905 statement.setLong(13, atime);
4906 statement.setLong(14, mtime);
4909 statement.setString(15, parentPath);
4913 statement.setLong(16, dataSourceObjId);
4914 final String extension = extractExtension(fileName);
4916 statement.setString(17, extension);
4918 connection.executeUpdate(statement);
4921 addFilePath(connection, newObjId, localPath, encodingType);
4923 connection.commitTransaction();
4926 return new DerivedFile(
this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
4927 size, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
4928 }
catch (SQLException ex) {
4929 connection.rollbackTransaction();
4930 throw new TskCoreException(
"Failed to add derived file to case database", ex);
4958 long size,
long ctime,
long crtime,
long atime,
long mtime,
4964 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
4971 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
5004 long size,
long ctime,
long crtime,
long atime,
long mtime,
5010 Statement queryStatement = null;
5011 ResultSet resultSet = null;
5017 statement.clearParameters();
5018 statement.setLong(1, parent.getId());
5020 connection.executeUpdate(statement);
5021 resultSet = statement.getGeneratedKeys();
5022 if (!resultSet.next()) {
5023 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_objects table", fileName, localPath, parent.getId()));
5025 long objectId = resultSet.getLong(1);
5034 statement.clearParameters();
5035 statement.setLong(1, objectId);
5036 statement.setNull(2, java.sql.Types.BIGINT);
5037 statement.setString(3, fileName);
5039 statement.setShort(5, (
short) 1);
5041 statement.setShort(6, dirType.
getValue());
5043 statement.setShort(7, metaType.
getValue());
5045 statement.setShort(8, dirFlag.
getValue());
5047 statement.setShort(9, metaFlags);
5048 statement.setLong(10, size);
5049 statement.setLong(11, ctime);
5050 statement.setLong(12, crtime);
5051 statement.setLong(13, atime);
5052 statement.setLong(14, mtime);
5053 String parentPath = parent.getParentPath() + parent.getName() +
"/";
5054 statement.setString(15, parentPath);
5056 statement.setLong(16, dataSourceObjId);
5057 final String extension = extractExtension(fileName);
5058 statement.setString(17, extension);
5060 connection.executeUpdate(statement);
5061 addFilePath(connection, objectId, localPath, encodingType);
5071 ctime, crtime, atime, mtime,
5073 parent.getId(), parentPath,
5076 encodingType, extension);
5078 }
catch (SQLException ex) {
5079 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
5101 Statement statement = null;
5102 ResultSet resultSet = null;
5104 statement = connection.createStatement();
5105 long dataSourceObjId;
5106 long ancestorId = objectId;
5108 dataSourceObjId = ancestorId;
5109 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
5110 resultSet = statement.executeQuery(query);
5111 if (resultSet.next()) {
5112 ancestorId = resultSet.getLong(
"par_obj_id");
5114 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
5118 }
while (0 != ancestorId);
5119 return dataSourceObjId;
5120 }
catch (SQLException ex) {
5121 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
5142 statement.clearParameters();
5143 statement.setLong(1, objId);
5144 statement.setString(2, path);
5145 statement.setInt(3, type.getType());
5146 connection.executeUpdate(statement);
5165 return findFiles(dataSource, fileName, parentFile.getName());
5183 ResultSet rs = null;
5185 s = connection.createStatement();
5186 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
5188 return rs.getLong(
"count");
5189 }
catch (SQLException e) {
5190 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
5220 ResultSet rs = null;
5222 s = connection.createStatement();
5223 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
5225 }
catch (SQLException e) {
5226 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
5251 ResultSet rs = null;
5253 s = connection.createStatement();
5254 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
5255 List<Long> ret =
new ArrayList<Long>();
5257 ret.add(rs.getLong(
"obj_id"));
5260 }
catch (SQLException e) {
5261 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
5288 int lastSlash = path.lastIndexOf(
'/');
5291 if (lastSlash == path.length()) {
5292 path = path.substring(0, lastSlash - 1);
5293 lastSlash = path.lastIndexOf(
'/');
5296 String parentPath = path.substring(0, lastSlash);
5297 String fileName = path.substring(lastSlash);
5299 return findFiles(dataSource, fileName, parentPath);
5316 ResultSet rs = null;
5318 s = connection.createStatement();
5319 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
5320 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
5323 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
5327 }
catch (SQLException ex) {
5328 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
5350 Statement s1 = null;
5351 ResultSet rs1 = null;
5352 Statement s2 = null;
5353 ResultSet rs2 = null;
5355 s1 = connection.createStatement();
5356 rs1 = connection.executeQuery(s1,
"SELECT * FROM tsk_image_info WHERE obj_id = " +
id);
5358 s2 = connection.createStatement();
5359 rs2 = connection.executeQuery(s2,
"SELECT * FROM tsk_image_names WHERE obj_id = " + rs1.getLong(
"obj_id"));
5360 List<String> imagePaths =
new ArrayList<String>();
5361 while (rs2.next()) {
5362 imagePaths.add(rs2.getString(
"name"));
5364 long obj_id = rs1.getLong(
"obj_id");
5365 long type = rs1.getLong(
"type");
5366 long ssize = rs1.getLong(
"ssize");
5367 String tzone = rs1.getString(
"tzone");
5368 String md5 = rs1.getString(
"md5");
5369 String name = rs1.getString(
"display_name");
5371 if (imagePaths.size() > 0) {
5372 String path = imagePaths.get(0);
5373 name = (
new java.io.File(path)).getName();
5378 long size = rs1.getLong(
"size");
5379 return new Image(
this, obj_id, type, ssize, name,
5380 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, size);
5384 }
catch (SQLException ex) {
5408 CaseDbConnection connection = connections.getConnection();
5411 ResultSet rs = null;
5413 s = connection.createStatement();
5414 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
5415 +
"where obj_id = " +
id);
5417 long type = rs.getLong(
"vs_type");
5418 long imgOffset = rs.getLong(
"img_offset");
5419 long blockSize = rs.getLong(
"block_size");
5421 vs.setParent(parent);
5424 throw new TskCoreException(
"No volume system found for id:" +
id);
5426 }
catch (SQLException ex) {
5427 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
5444 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
5445 VolumeSystem vs = getVolumeSystemById(
id, null);
5446 vs.setParentId(parentId);
5461 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
5473 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
5475 FileSystem fs = getFileSystemById(
id, vol);
5476 fs.setParentId(parentId);
5491 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
5511 if (fileSystemIdMap.containsKey(
id)) {
5512 return fileSystemIdMap.get(
id);
5518 ResultSet rs = null;
5520 s = connection.createStatement();
5521 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
5522 +
"where obj_id = " +
id);
5526 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
5527 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
5528 fs.setParent(parent);
5531 fileSystemIdMap.put(
id, fs);
5537 }
catch (SQLException ex) {
5559 CaseDbConnection connection = connections.getConnection();
5562 ResultSet rs = null;
5564 s = connection.createStatement();
5565 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
5566 +
"where obj_id = " +
id);
5577 description = rs.getString(
"desc");
5578 }
catch (Exception ex) {
5579 description = rs.getString(
"descr");
5581 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
5582 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
5584 vol.setParent(parent);
5587 throw new TskCoreException(
"No volume found for id:" +
id);
5589 }
catch (SQLException ex) {
5590 throw new TskCoreException(
"Error getting Volume by ID", ex);
5607 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
5608 Volume vol = getVolumeById(
id, null);
5609 vol.setParentId(parentId);
5624 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
5625 CaseDbConnection connection = connections.getConnection();
5628 ResultSet rs = null;
5630 s = connection.createStatement();
5631 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
5632 +
"WHERE obj_id = " +
id);
5633 Directory temp = null;
5635 final short type = rs.getShort(
"type");
5636 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
5637 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
5638 || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
5639 temp = directory(rs, parentFs);
5641 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
5642 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
5645 throw new TskCoreException(
"No Directory found for id:" +
id);
5648 }
catch (SQLException ex) {
5649 throw new TskCoreException(
"Error getting Directory by ID", ex);
5666 List<FileSystem> fileSystems =
new ArrayList<FileSystem>();
5669 connection = connections.getConnection();
5671 logger.log(Level.SEVERE,
"Error getting file systems for image " + image.
getId(), ex);
5676 ResultSet rs = null;
5678 s = connection.createStatement();
5681 List<FileSystem> allFileSystems =
new ArrayList<FileSystem>();
5683 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info");
5687 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
5688 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
5690 allFileSystems.add(fs);
5692 }
catch (SQLException ex) {
5693 logger.log(Level.SEVERE,
"There was a problem while trying to obtain all file systems", ex);
5703 Long imageID = null;
5704 Long currentObjID = fs.getId();
5705 while (imageID == null) {
5707 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE tsk_objects.obj_id = " + currentObjID);
5709 currentObjID = rs.getLong(
"par_obj_id");
5711 imageID = rs.getLong(
"obj_id");
5713 }
catch (SQLException ex) {
5714 logger.log(Level.SEVERE,
"There was a problem while trying to obtain this image's file systems", ex);
5722 if (imageID == image.
getId()) {
5723 fileSystems.add(fs);
5726 }
catch (SQLException ex) {
5727 logger.log(Level.SEVERE,
"Error getting case database connection", ex);
5748 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
5749 List<Content> children =
new ArrayList<Content>();
5750 for (ObjectInfo info : childInfos) {
5752 children.add(getVolumeSystemById(info.id, img));
5753 }
else if (info.type == ObjectType.FS) {
5754 children.add(getFileSystemById(info.id, img));
5755 }
else if (info.type == ObjectType.ABSTRACTFILE) {
5760 }
else if (info.type == ObjectType.ARTIFACT) {
5766 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
5782 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
5783 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
5784 List<Long> children =
new ArrayList<Long>();
5785 for (ObjectInfo info : childInfos) {
5786 if (info.type == ObjectType.VS
5787 || info.type == ObjectType.FS
5788 || info.type == ObjectType.ABSTRACTFILE
5789 || info.type == ObjectType.ARTIFACT) {
5790 children.add(info.id);
5792 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
5808 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
5809 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
5810 List<Content> children =
new ArrayList<Content>();
5811 for (ObjectInfo info : childInfos) {
5812 if (null != info.type) {
5813 switch (info.type) {
5815 children.add(getVolumeById(info.id, vs));
5830 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
5847 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
5848 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
5849 List<Long> children =
new ArrayList<Long>();
5850 for (ObjectInfo info : childInfos) {
5851 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
5852 children.add(info.id);
5854 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
5870 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
5871 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
5872 List<Content> children =
new ArrayList<Content>();
5873 for (ObjectInfo info : childInfos) {
5874 if (null != info.type) {
5875 switch (info.type) {
5877 children.add(getFileSystemById(info.id, vol));
5892 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
5909 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
5910 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
5911 final List<Long> children =
new ArrayList<Long>();
5912 for (ObjectInfo info : childInfos) {
5913 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
5914 children.add(info.id);
5916 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
5936 long imageId = this.
caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone);
5952 Statement s1 = null;
5953 Statement s2 = null;
5954 ResultSet rs1 = null;
5955 ResultSet rs2 = null;
5957 s1 = connection.createStatement();
5958 rs1 = connection.executeQuery(s1,
"SELECT obj_id FROM tsk_image_info");
5959 s2 = connection.createStatement();
5960 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
5961 while (rs1.next()) {
5962 long obj_id = rs1.getLong(
"obj_id");
5963 rs2 = connection.executeQuery(s2,
"SELECT * FROM tsk_image_names WHERE obj_id = " + obj_id);
5964 List<String> paths =
new ArrayList<String>();
5965 while (rs2.next()) {
5966 paths.add(rs2.getString(
"name"));
5970 imgPaths.put(obj_id, paths);
5973 }
catch (SQLException ex) {
5974 throw new TskCoreException(
"Error getting image paths.", ex);
5995 ResultSet rs = null;
5997 s = connection.createStatement();
5998 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
5999 Collection<Long> imageIDs =
new ArrayList<Long>();
6001 imageIDs.add(rs.getLong(
"obj_id"));
6003 List<Image> images =
new ArrayList<Image>();
6004 for (
long id : imageIDs) {
6008 }
catch (SQLException ex) {
6009 throw new TskCoreException(
"Error retrieving images.", ex);
6031 Statement statement = null;
6033 connection.beginTransaction();
6034 statement = connection.createStatement();
6035 connection.executeUpdate(statement,
"DELETE FROM tsk_image_names WHERE obj_id = " + obj_id);
6036 for (
int i = 0; i < paths.size(); i++) {
6037 connection.executeUpdate(statement,
"INSERT INTO tsk_image_names VALUES (" + obj_id +
", '" + paths.get(i) +
"', " + i +
")");
6039 connection.commitTransaction();
6040 }
catch (SQLException ex) {
6041 connection.rollbackTransaction();
6076 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
6079 final short type = rs.getShort(
"type");
6084 result = directory(rs, null);
6086 result = file(rs, null);
6088 results.add(result);
6092 results.add(virtDir);
6095 results.add(localDir);
6100 String parentPath = rs.getString(
"parent_path");
6101 if (parentPath == null) {
6105 rs.getLong(
"obj_id"),
6106 rs.getLong(
"data_source_obj_id"),
6107 rs.getString(
"name"),
6112 rs.getString(
"md5"),
FileKnown.
valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
6123 final SlackFile sf = slackFile(rs, null);
6127 }
catch (SQLException e) {
6128 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
6148 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
6150 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
6154 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
6155 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
6156 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
6158 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
6159 f.setFileSystem(fs);
6174 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
6175 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
6176 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
6177 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
6178 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
6179 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
6180 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
6181 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
6182 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
6183 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
6184 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
6185 rs.getString(
"parent_path"));
6186 dir.setFileSystem(fs);
6199 VirtualDirectory virtualDirectory(ResultSet rs)
throws SQLException {
6200 String parentPath = rs.getString(
"parent_path");
6201 if (parentPath == null) {
6204 final VirtualDirectory vd =
new VirtualDirectory(
this, rs.getLong(
"obj_id"),
6205 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
6206 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
6207 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
6208 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
6209 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
6210 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
6223 LocalDirectory localDirectory(ResultSet rs)
throws SQLException {
6224 String parentPath = rs.getString(
"parent_path");
6225 if (parentPath == null) {
6228 final LocalDirectory ld =
new LocalDirectory(
this, rs.getLong(
"obj_id"),
6229 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
6230 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
6231 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
6232 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
6233 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
6234 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
6252 boolean hasLocalPath = rs.getBoolean(
"has_path");
6253 long objId = rs.getLong(
"obj_id");
6254 String localPath = null;
6257 ResultSet rsFilePath = null;
6260 statement.clearParameters();
6261 statement.setLong(1, objId);
6262 rsFilePath = connection.executeQuery(statement);
6263 if (rsFilePath.next()) {
6264 localPath = rsFilePath.getString(
"path");
6267 }
catch (SQLException ex) {
6268 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
6273 String parentPath = rs.getString(
"parent_path");
6274 if (parentPath == null) {
6278 rs.getString(
"name"),
6283 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
6285 parentPath, localPath, parentId, rs.getString(
"mime_type"),
6286 encodingType, rs.getString(
"extension"));
6304 long objId = rs.getLong(
"obj_id");
6305 String localPath = null;
6307 if (rs.getBoolean(
"has_path")) {
6308 ResultSet rsFilePath = null;
6311 statement.clearParameters();
6312 statement.setLong(1, objId);
6313 rsFilePath = connection.executeQuery(statement);
6314 if (rsFilePath.next()) {
6315 localPath = rsFilePath.getString(
"path");
6318 }
catch (SQLException ex) {
6319 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
6324 String parentPath = rs.getString(
"parent_path");
6325 if (null == parentPath) {
6334 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
6335 rs.getString(
"mime_type"), rs.getString(
"md5"),
FileKnown.
valueOf(rs.getByte(
"known")),
6336 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
6337 localPath, encodingType, rs.getString(
"extension"));
6354 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
6356 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
6360 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
6361 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
6362 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
6364 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
6365 f.setFileSystem(fs);
6380 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
6381 List<Content> children =
new ArrayList<Content>();
6384 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
6389 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
6391 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
6392 result = directory(rs, null);
6394 result = file(rs, null);
6396 children.add(result);
6398 VirtualDirectory virtDir = virtualDirectory(rs);
6399 children.add(virtDir);
6403 VirtualDirectory virtDir = virtualDirectory(rs);
6404 children.add(virtDir);
6407 LocalDirectory localDir = localDirectory(rs);
6408 children.add(localDir);
6410 case UNALLOC_BLOCKS:
6413 String parentPath = rs.getString(
"parent_path");
6414 if (parentPath == null) {
6417 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
6418 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), type,
6419 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
6420 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
6421 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
6422 rs.getLong(
"size"), rs.getString(
"md5"),
6423 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
6428 final DerivedFile df =
derivedFile(rs, connection, parentId);
6432 final LocalFile lf =
localFile(rs, connection, parentId);
6437 final SlackFile sf = slackFile(rs, null);
6463 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
6466 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
6470 }
catch (SQLException e) {
6471 logger.log(Level.SEVERE,
"Error getting artifacts from result set", e);
6518 connections.close();
6520 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
6523 fileSystemIdMap.clear();
6531 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
6550 long id = file.
getId();
6552 if (currentKnown.compareTo(fileKnown) > 0) {
6557 Statement statement = null;
6559 statement = connection.createStatement();
6560 connection.executeUpdate(statement,
"UPDATE tsk_files "
6561 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
6562 +
"WHERE obj_id=" + id);
6563 file.setKnown(fileKnown);
6564 }
catch (SQLException ex) {
6585 Statement statement = null;
6586 ResultSet rs = null;
6589 statement = connection.createStatement();
6590 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.
getId()));
6591 file.setMIMEType(mimeType);
6592 }
catch (SQLException ex) {
6593 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.
getId()), ex);
6612 if (md5Hash == null) {
6615 long id = file.
getId();
6616 CaseDbConnection connection = connections.getConnection();
6619 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
6620 statement.clearParameters();
6621 statement.setString(1, md5Hash.toLowerCase());
6622 statement.setLong(2,
id);
6623 connection.executeUpdate(statement);
6624 file.setMd5Hash(md5Hash.toLowerCase());
6625 }
catch (SQLException ex) {
6626 throw new TskCoreException(
"Error setting MD5 hash", ex);
6644 if (newStatus == null) {
6649 Statement statement = null;
6651 statement = connection.createStatement();
6652 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
6653 +
" SET review_status_id=" + newStatus.getID()
6654 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
6655 }
catch (SQLException ex) {
6656 throw new TskCoreException(
"Error setting review status", ex);
6678 ResultSet rs = null;
6680 s = connection.createStatement();
6681 Short contentShort = contentType.getValue();
6682 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
6685 count = rs.getInt(
"count");
6688 }
catch (SQLException ex) {
6689 throw new TskCoreException(
"Error getting number of objects.", ex);
6707 String escapedText = null;
6709 escapedText = text.replaceAll(
"'",
"''");
6722 if (md5Hash == null) {
6727 connection = connections.getConnection();
6729 logger.log(Level.SEVERE,
"Error finding files by md5 hash " + md5Hash, ex);
6734 ResultSet rs = null;
6736 s = connection.createStatement();
6737 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
6738 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
6741 }
catch (SQLException ex) {
6742 logger.log(Level.WARNING,
"Error querying database.", ex);
6761 connection = connections.getConnection();
6763 logger.log(Level.SEVERE,
"Error checking md5 hashing status", ex);
6766 boolean allFilesAreHashed =
false;
6769 ResultSet rs = null;
6771 s = connection.createStatement();
6772 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
6774 +
"AND md5 IS NULL "
6775 +
"AND size > '0'");
6776 if (rs.next() && rs.getInt(
"count") == 0) {
6777 allFilesAreHashed =
true;
6779 }
catch (SQLException ex) {
6780 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
6787 return allFilesAreHashed;
6798 connection = connections.getConnection();
6800 logger.log(Level.SEVERE,
"Error getting database connection for hashed files count", ex);
6806 ResultSet rs = null;
6808 s = connection.createStatement();
6809 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
6810 +
"WHERE md5 IS NOT NULL "
6811 +
"AND size > '0'");
6813 count = rs.getInt(
"count");
6815 }
catch (SQLException ex) {
6816 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
6838 ResultSet resultSet = null;
6842 resultSet = connection.executeQuery(statement);
6843 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
6844 while (resultSet.next()) {
6845 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"), resultSet.getString(
"description"),
TagName.
HTML_COLOR.
getColorByName(resultSet.getString(
"color"))));
6848 }
catch (SQLException ex) {
6849 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
6870 ResultSet resultSet = null;
6874 resultSet = connection.executeQuery(statement);
6875 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
6876 while (resultSet.next()) {
6877 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"), resultSet.getString(
"description"),
TagName.
HTML_COLOR.
getColorByName(resultSet.getString(
"color"))));
6880 }
catch (SQLException ex) {
6881 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
6903 ResultSet resultSet = null;
6907 statement.clearParameters();
6908 statement.setString(1, displayName);
6909 statement.setString(2, description);
6910 statement.setString(3, color.getName());
6911 connection.executeUpdate(statement);
6912 resultSet = statement.getGeneratedKeys();
6914 return new TagName(resultSet.getLong(1),
6915 displayName, description, color);
6916 }
catch (SQLException ex) {
6917 throw new TskCoreException(
"Error adding row for " + displayName +
" tag name to tag_names table", ex);
6941 ResultSet resultSet = null;
6945 statement.clearParameters();
6946 statement.setLong(1, content.getId());
6947 statement.setLong(2, tagName.getId());
6948 statement.setString(3, comment);
6949 statement.setLong(4, beginByteOffset);
6950 statement.setLong(5, endByteOffset);
6951 connection.executeUpdate(statement);
6952 resultSet = statement.getGeneratedKeys();
6955 content, tagName, comment, beginByteOffset, endByteOffset);
6956 }
catch (SQLException ex) {
6957 throw new TskCoreException(
"Error adding row to content_tags table (obj_id = " + content.getId() +
", tag_name_id = " + tagName.getId() +
")", ex);
6976 statement.clearParameters();
6977 statement.setLong(1, tag.getId());
6978 connection.executeUpdate(statement);
6979 }
catch (SQLException ex) {
6980 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
6998 ResultSet resultSet = null;
7002 resultSet = connection.executeQuery(statement);
7003 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
7004 while (resultSet.next()) {
7005 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
7008 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
7009 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset")));
7012 }
catch (SQLException ex) {
7013 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
7032 if (tagName.getId() ==
Tag.ID_NOT_SET) {
7037 ResultSet resultSet = null;
7041 statement.clearParameters();
7042 statement.setLong(1, tagName.getId());
7043 resultSet = connection.executeQuery(statement);
7044 if (resultSet.next()) {
7045 return resultSet.getLong(
"count");
7047 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
7049 }
catch (SQLException ex) {
7050 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
7070 ResultSet resultSet = null;
7075 statement.clearParameters();
7076 statement.setLong(1, contentTagID);
7077 resultSet = connection.executeQuery(statement);
7079 while (resultSet.next()) {
7080 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
7083 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"));
7087 }
catch (SQLException ex) {
7088 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
7109 if (tagName.getId() ==
Tag.ID_NOT_SET) {
7114 ResultSet resultSet = null;
7118 statement.clearParameters();
7119 statement.setLong(1, tagName.getId());
7120 resultSet = connection.executeQuery(statement);
7121 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
7122 while (resultSet.next()) {
7124 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"));
7129 }
catch (SQLException ex) {
7130 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
7152 ResultSet resultSet = null;
7156 statement.clearParameters();
7157 statement.setLong(1, content.getId());
7158 resultSet = connection.executeQuery(statement);
7159 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
7160 while (resultSet.next()) {
7161 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
7164 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"));
7168 }
catch (SQLException ex) {
7169 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
7193 ResultSet resultSet = null;
7197 statement.clearParameters();
7198 statement.setLong(1, artifact.getArtifactID());
7199 statement.setLong(2, tagName.getId());
7200 statement.setString(3, comment);
7201 connection.executeUpdate(statement);
7202 resultSet = statement.getGeneratedKeys();
7205 artifact,
getContentById(artifact.getObjectID()), tagName, comment);
7206 }
catch (SQLException ex) {
7207 throw new TskCoreException(
"Error adding row to blackboard_artifact_tags table (obj_id = " + artifact.getArtifactID() +
", tag_name_id = " + tagName.getId() +
")", ex);
7226 statement.clearParameters();
7227 statement.setLong(1, tag.getId());
7228 connection.executeUpdate(statement);
7229 }
catch (SQLException ex) {
7230 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
7249 ResultSet resultSet = null;
7253 resultSet = connection.executeQuery(statement);
7254 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
7255 while (resultSet.next()) {
7256 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
7261 artifact, content, tagName, resultSet.getString(
"comment"));
7265 }
catch (SQLException ex) {
7266 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
7285 if (tagName.getId() ==
Tag.ID_NOT_SET) {
7290 ResultSet resultSet = null;
7294 statement.clearParameters();
7295 statement.setLong(1, tagName.getId());
7296 resultSet = connection.executeQuery(statement);
7297 if (resultSet.next()) {
7298 return resultSet.getLong(
"count");
7300 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
7302 }
catch (SQLException ex) {
7303 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
7323 if (tagName.getId() ==
Tag.ID_NOT_SET) {
7328 ResultSet resultSet = null;
7332 statement.clearParameters();
7333 statement.setLong(1, tagName.getId());
7334 resultSet = connection.executeQuery(statement);
7335 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
7336 while (resultSet.next()) {
7340 artifact, content, tagName, resultSet.getString(
"comment"));
7344 }
catch (SQLException ex) {
7345 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
7368 ResultSet resultSet = null;
7373 statement.clearParameters();
7374 statement.setLong(1, artifactTagID);
7375 resultSet = connection.executeQuery(statement);
7377 while (resultSet.next()) {
7378 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
7383 artifact, content, tagName, resultSet.getString(
"comment"));
7387 }
catch (SQLException ex) {
7388 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
7412 ResultSet resultSet = null;
7416 statement.clearParameters();
7417 statement.setLong(1, artifact.getArtifactID());
7418 resultSet = connection.executeQuery(statement);
7419 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
7420 while (resultSet.next()) {
7421 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
7425 artifact, content, tagName, resultSet.getString(
"comment"));
7429 }
catch (SQLException ex) {
7430 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
7452 statement.clearParameters();
7453 statement.setString(1, newPath);
7454 statement.setLong(2, objectId);
7455 connection.executeUpdate(statement);
7456 }
catch (SQLException ex) {
7457 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
7480 String relativePath =
"";
7490 String localPathLower = localPath.toLowerCase();
7491 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
7492 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
7493 }
catch (IllegalArgumentException ex) {
7494 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
7499 long createTime = 0;
7501 java.io.File tempFile =
new java.io.File(localPath);
7503 createTime = tempFile.lastModified() / 1000;
7504 }
catch (Exception ex) {
7505 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
7511 ResultSet resultSet = null;
7515 statement.clearParameters();
7516 statement.setString(1, relativePath);
7517 statement.setLong(2, createTime);
7518 statement.setString(3, sourceModuleName);
7519 statement.setString(4, reportName);
7520 connection.executeUpdate(statement);
7521 resultSet = statement.getGeneratedKeys();
7523 return new Report(resultSet.getLong(1),
7524 localPath, createTime, sourceModuleName, reportName);
7525 }
catch (SQLException ex) {
7526 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
7545 ResultSet resultSet = null;
7549 resultSet = connection.executeQuery(statement);
7550 ArrayList<Report> reports =
new ArrayList<Report>();
7551 while (resultSet.next()) {
7552 reports.add(
new Report(resultSet.getLong(
"report_id"),
7553 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
7554 resultSet.getLong(
"crtime"),
7555 resultSet.getString(
"src_module_name"),
7556 resultSet.getString(
"report_name")));
7559 }
catch (SQLException ex) {
7560 throw new TskCoreException(
"Error querying reports table", ex);
7581 statement.setLong(1, report.getId());
7582 connection.executeUpdate(statement);
7583 }
catch (SQLException ex) {
7591 if (resultSet != null) {
7594 }
catch (SQLException ex) {
7595 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
7601 if (statement != null) {
7604 }
catch (SQLException ex) {
7605 logger.log(Level.SEVERE,
"Error closing Statement", ex);
7619 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
7620 CaseDbConnection connection = connections.getConnection();
7623 Statement statement = connection.createStatement();
7624 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
7625 }
catch (SQLException ex) {
7626 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
7633 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
7634 CaseDbConnection connection = connections.getConnection();
7637 Statement statement = connection.createStatement();
7638 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
7639 }
catch (SQLException ex) {
7640 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
7666 ResultSet resultSet = null;
7667 Statement statement = null;
7669 connection.beginTransaction();
7670 statement = connection.createStatement();
7672 insertStatement.setLong(1, dataSource.getId());
7673 insertStatement.setString(2, hostName);
7674 insertStatement.setLong(3, jobStart.getTime());
7675 insertStatement.setLong(4, jobEnd.getTime());
7676 insertStatement.setInt(5, status.ordinal());
7677 insertStatement.setString(6, settingsDir);
7678 connection.executeUpdate(insertStatement);
7679 resultSet = insertStatement.getGeneratedKeys();
7681 long id = resultSet.getLong(1);
7682 for (
int i = 0; i < ingestModules.size(); i++) {
7684 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
7689 connection.commitTransaction();
7690 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
7691 }
catch (SQLException ex) {
7692 connection.rollbackTransaction();
7716 ResultSet resultSet = null;
7717 Statement statement = null;
7718 String uniqueName = factoryClassName +
"-" + displayName +
"-" + type.toString() +
"-" + version;
7720 statement = connection.createStatement();
7721 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
7722 if (!resultSet.next()) {
7726 insertStatement.setString(1, displayName);
7727 insertStatement.setString(2, uniqueName);
7728 insertStatement.setInt(3, type.ordinal());
7729 insertStatement.setString(4, version);
7730 connection.executeUpdate(insertStatement);
7731 resultSet = statement.getGeneratedKeys();
7733 long id = resultSet.getLong(1);
7738 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
7739 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
7741 }
catch (SQLException ex) {
7744 statement = connection.createStatement();
7745 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
7746 if (resultSet.next()) {
7747 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
7752 }
catch (SQLException ex1) {
7771 ResultSet resultSet = null;
7772 Statement statement = null;
7773 List<IngestJobInfo> ingestJobs =
new ArrayList<IngestJobInfo>();
7775 statement = connection.createStatement();
7776 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
7777 while (resultSet.next()) {
7778 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
7779 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
7781 resultSet.getString(
"settings_dir"), this.
getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
7784 }
catch (SQLException ex) {
7785 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
7804 ResultSet resultSet = null;
7805 Statement statement = null;
7806 List<IngestModuleInfo> ingestModules =
new ArrayList<IngestModuleInfo>();
7808 statement = connection.createStatement();
7809 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
7810 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
7811 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
7812 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
7813 +
"FROM ingest_job_modules, ingest_modules "
7814 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
7815 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
7816 +
"ORDER BY (ingest_job_modules.pipeline_position);");
7817 while (resultSet.next()) {
7818 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
7819 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
7821 return ingestModules;
7831 static class ObjectInfo {
7852 void execute()
throws SQLException;
7857 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
7858 +
"WHERE artifact_type_id = ?"),
7862 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
7863 +
"FROM tsk_objects INNER JOIN tsk_files "
7864 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7865 +
"WHERE (tsk_objects.par_obj_id = ? ) "
7866 +
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"),
7867 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
7868 +
"FROM tsk_objects INNER JOIN tsk_files "
7869 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7870 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
7871 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
7872 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
7873 +
"FROM tsk_objects INNER JOIN tsk_files "
7874 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7875 +
"WHERE (tsk_objects.par_obj_id = ?)"),
7876 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
7877 +
"FROM tsk_objects INNER JOIN tsk_files "
7878 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
7879 +
"WHERE (tsk_objects.par_obj_id = ? "
7880 +
"AND tsk_files.type = ? )"),
7883 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, artifact_type_id, review_status_id) "
7885 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, artifact_type_id, review_status_id) "
7887 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
7888 +
"VALUES (?,?,?,?,?,?,?)"),
7889 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
7890 +
"VALUES (?,?,?,?,?,?,?)"),
7891 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
7892 +
"VALUES (?,?,?,?,?,?,?)"),
7893 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
7894 +
"VALUES (?,?,?,?,?,?,?)"),
7895 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
7896 +
"VALUES (?,?,?,?,?,?,?)"),
7909 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, parent_path, data_source_obj_id,extension) "
7910 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,?)"),
7911 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
7912 +
"VALUES (?, ?, ?, ?)"),
7917 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
7918 +
"WHERE tag_name_id IN "
7919 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
7920 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color) VALUES (?, ?, ?)"),
7921 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset) VALUES (?, ?, ?, ?, ?)"),
7924 SELECT_CONTENT_TAGS(
"SELECT * FROM content_tags INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id"),
7926 SELECT_CONTENT_TAG_BY_ID(
"SELECT * FROM content_tags INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id WHERE tag_id = ?"),
7928 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment) VALUES (?, ?, ?)"),
7930 SELECT_ARTIFACT_TAGS(
"SELECT * FROM blackboard_artifact_tags INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id"),
7933 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT * FROM blackboard_artifact_tags INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id WHERE blackboard_artifact_tags.tag_id = ?"),
7934 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT * FROM blackboard_artifact_tags INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id WHERE blackboard_artifact_tags.artifact_id = ?"),
7936 INSERT_REPORT(
"INSERT INTO reports (path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?)"),
7938 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
7939 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
7940 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
7941 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
7943 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "
7944 +
"FROM tsk_objects INNER JOIN blackboard_artifacts "
7945 +
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "
7946 +
"WHERE (tsk_objects.par_obj_id = ?)");
7968 pooledDataSource = null;
7972 if (pooledDataSource == null) {
7973 throw new TskCoreException(
"Error getting case database connection - case is closed");
7976 return getPooledConnection();
7977 }
catch (SQLException exp) {
7978 throw new TskCoreException(exp.getMessage());
7982 void close() throws TskCoreException {
7983 if (pooledDataSource != null) {
7985 pooledDataSource.close();
7986 }
catch (SQLException exp) {
7987 throw new TskCoreException(exp.getMessage());
7989 pooledDataSource = null;
7994 abstract CaseDbConnection getPooledConnection() throws SQLException;
8014 configurationOverrides.put(
"acquireIncrement",
"2");
8015 configurationOverrides.put(
"initialPoolSize",
"5");
8016 configurationOverrides.put(
"maxPoolSize",
"20");
8017 configurationOverrides.put(
"minPoolSize",
"5");
8018 configurationOverrides.put(
"maxStatements",
"100");
8019 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
8021 SQLiteConfig config =
new SQLiteConfig();
8022 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
8023 config.setReadUncommited(
true);
8024 config.enforceForeignKeys(
true);
8025 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
8026 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
8027 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
8042 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
8043 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
8044 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
8045 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
8046 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
8047 comboPooledDataSource.setUser(userName);
8048 comboPooledDataSource.setPassword(password);
8049 comboPooledDataSource.setAcquireIncrement(2);
8050 comboPooledDataSource.setInitialPoolSize(5);
8051 comboPooledDataSource.setMaxPoolSize(20);
8052 comboPooledDataSource.setMinPoolSize(5);
8053 comboPooledDataSource.setMaxStatements(100);
8054 comboPooledDataSource.setMaxStatementsPerConnection(20);
8069 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
8071 final class CreateStatement
implements DbCommand {
8074 private Statement statement = null;
8076 CreateStatement(Connection connection) {
8080 Statement getStatement() {
8085 public void execute()
throws SQLException {
8086 statement = connection.createStatement();
8090 final class SetAutoCommit
implements DbCommand {
8093 private final boolean mode;
8095 SetAutoCommit(Connection connection,
boolean mode) {
8101 public void execute()
throws SQLException {
8102 connection.setAutoCommit(mode);
8106 final class Commit
implements DbCommand {
8110 Commit(Connection connection) {
8115 public void execute()
throws SQLException {
8116 connection.commit();
8120 final class ExecuteQuery
implements DbCommand {
8122 private final Statement statement;
8123 private final String query;
8124 private ResultSet resultSet;
8126 ExecuteQuery(Statement statement, String query) {
8127 this.statement = statement;
8131 ResultSet getResultSet() {
8136 public void execute()
throws SQLException {
8137 resultSet = statement.executeQuery(query);
8141 final class ExecutePreparedStatementQuery
implements DbCommand {
8143 private final PreparedStatement preparedStatement;
8144 private ResultSet resultSet;
8146 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
8147 this.preparedStatement = preparedStatement;
8150 ResultSet getResultSet() {
8155 public void execute()
throws SQLException {
8156 resultSet = preparedStatement.executeQuery();
8160 final class ExecutePreparedStatementUpdate
implements DbCommand {
8162 private final PreparedStatement preparedStatement;
8164 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
8165 this.preparedStatement = preparedStatement;
8169 public void execute()
throws SQLException {
8170 preparedStatement.executeUpdate();
8174 final class ExecuteStatementUpdate
implements DbCommand {
8176 private final Statement statement;
8177 private final String updateCommand;
8179 ExecuteStatementUpdate(Statement statement, String updateCommand) {
8180 this.statement = statement;
8181 this.updateCommand = updateCommand;
8185 public void execute()
throws SQLException {
8186 statement.executeUpdate(updateCommand);
8190 final class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
8192 private final Statement statement;
8193 private final int generateKeys;
8194 private final String updateCommand;
8196 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
8197 this.statement = statement;
8198 this.generateKeys = generateKeys;
8199 this.updateCommand = updateCommand;
8203 public void execute()
throws SQLException {
8204 statement.executeUpdate(updateCommand, generateKeys);
8208 final class PrepareStatement
implements DbCommand {
8211 private final String input;
8212 private PreparedStatement preparedStatement = null;
8214 PrepareStatement(Connection connection, String input) {
8219 PreparedStatement getPreparedStatement() {
8220 return preparedStatement;
8224 public void execute()
throws SQLException {
8225 preparedStatement = connection.prepareStatement(input);
8229 final class PrepareStatementGenerateKeys
implements DbCommand {
8232 private final String input;
8233 private final int generateKeys;
8234 private PreparedStatement preparedStatement = null;
8236 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
8239 this.generateKeys = generateKeysInput;
8242 PreparedStatement getPreparedStatement() {
8243 return preparedStatement;
8247 public void execute()
throws SQLException {
8248 preparedStatement = connection.prepareStatement(input, generateKeys);
8252 abstract void executeCommand(
DbCommand command)
throws SQLException;
8259 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(
PREPARED_STATEMENT.class);
8263 return this.connection != null;
8266 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
8267 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
8270 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
8272 PreparedStatement statement;
8273 if (this.preparedStatements.containsKey(statementKey)) {
8274 statement = this.preparedStatements.get(statementKey);
8276 statement = prepareStatement(statementKey.getSQL(), generateKeys);
8277 this.preparedStatements.put(statementKey, statement);
8282 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
8283 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
8284 executeCommand(prepareStatement);
8285 return prepareStatement.getPreparedStatement();
8288 Statement createStatement() throws SQLException {
8289 CreateStatement createStatement =
new CreateStatement(this.connection);
8290 executeCommand(createStatement);
8291 return createStatement.getStatement();
8294 void beginTransaction() throws SQLException {
8295 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
8296 executeCommand(setAutoCommit);
8299 void commitTransaction() throws SQLException {
8300 Commit commit =
new Commit(connection);
8301 executeCommand(commit);
8303 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
8304 executeCommand(setAutoCommit);
8312 void rollbackTransaction() {
8314 connection.rollback();
8315 }
catch (SQLException e) {
8316 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
8319 connection.setAutoCommit(
true);
8320 }
catch (SQLException e) {
8321 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
8332 void rollbackTransactionWithThrow() throws SQLException {
8334 connection.rollback();
8336 connection.setAutoCommit(
true);
8340 ResultSet executeQuery(Statement statement, String query)
throws SQLException {
8341 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
8342 executeCommand(queryCommand);
8343 return queryCommand.getResultSet();
8355 ResultSet executeQuery(PreparedStatement statement)
throws SQLException {
8356 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
8357 executeCommand(executePreparedStatementQuery);
8358 return executePreparedStatementQuery.getResultSet();
8361 void executeUpdate(Statement statement, String update)
throws SQLException {
8362 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
8365 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
8366 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
8367 executeCommand(executeStatementUpdate);
8370 void executeUpdate(PreparedStatement statement)
throws SQLException {
8371 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
8372 executeCommand(executePreparedStatementUpdate);
8381 }
catch (SQLException ex) {
8382 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
8386 Connection getConnection() {
8404 void executeCommand(
DbCommand command)
throws SQLException {
8409 }
catch (SQLException ex) {
8415 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
8416 }
catch (InterruptedException exp) {
8417 Logger.getLogger(
SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
8442 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
8443 ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
8444 executeCommand(executeStatementUpdateGenerateKeys);
8448 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
8449 PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
8450 executeCommand(prepareStatementGenerateKeys);
8451 return prepareStatementGenerateKeys.getPreparedStatement();
8455 void executeCommand(DbCommand command)
throws SQLException {
8456 for (
int retries = 0; retries <
MAX_RETRIES; retries++) {
8460 }
catch (SQLException ex) {
8461 String sqlState = ((PSQLException) ex).getSQLState();
8462 if (sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
8464 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
8465 }
catch (InterruptedException exp) {
8466 Logger.getLogger(
SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
8491 this.connection.beginTransaction();
8492 }
catch (SQLException ex) {
8493 throw new TskCoreException(
"Failed to create transaction on case database", ex);
8514 public void commit() throws TskCoreException {
8516 this.connection.commitTransaction();
8517 }
catch (SQLException ex) {
8518 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
8532 this.connection.rollbackTransactionWithThrow();
8533 }
catch (SQLException ex) {
8534 throw new TskCoreException(
"Case database transaction rollback failed", ex);
8545 this.connection.close();
8564 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
8565 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
8568 connection = connections.getConnection();
8569 }
catch (TskCoreException ex) {
8570 throw new TskCoreException(
"Error getting connection for query: ", ex);
8575 resultSet = connection.executeQuery(connection.createStatement(), query);
8576 }
catch (SQLException ex) {
8578 throw new TskCoreException(
"Error executing query: ", ex);
8592 public void close() throws TskCoreException {
8594 if (resultSet != null) {
8595 final Statement statement = resultSet.getStatement();
8596 if (statement != null) {
8602 }
catch (SQLException ex) {
8603 throw new TskCoreException(
"Error closing query: ", ex);
8619 sleuthkitCaseErrorObservers.add(observer);
8631 int i = sleuthkitCaseErrorObservers.indexOf(observer);
8633 sleuthkitCaseErrorObservers.remove(i);
8647 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
8648 if (observer != null) {
8650 observer.receiveError(context, errorMessage);
8651 }
catch (Exception ex) {
8652 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
8686 this.contextString = context;
8690 return contextString;
8694 void receiveError(String context, String errorMessage);
8713 CaseDbConnection connection = connections.getConnection();
8719 }
catch (TskCoreException ex) {
8720 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
8738 ResultSet rs = null;
8742 rs = connection.executeQuery(statement);
8745 id = rs.getLong(
"max_obj_id");
8748 }
catch (SQLException e) {
8749 throw new TskCoreException(
"Error getting last object id", e);
8771 public List<FsContent>
findFilesWhere(String sqlWhereClause)
throws TskCoreException {
8775 ResultSet rs = null;
8777 s = connection.createStatement();
8778 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
8779 List<FsContent> results =
new ArrayList<FsContent>();
8788 }
catch (SQLException e) {
8789 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
8814 ResultSet rs = null;
8816 s = connection.createStatement();
8817 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
8820 typeId = rs.getInt(
"artifact_type_id");
8823 }
catch (SQLException ex) {
8824 throw new TskCoreException(
"Error getting artifact type id", ex);
8861 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
8864 }
catch (TskDataException ex) {
8865 throw new TskCoreException(
"Failed to add artifact type.", ex);
8883 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
8886 }
catch (TskDataException ex) {
8887 throw new TskCoreException(
"Couldn't add new attribute type");
8906 ResultSet rs = null;
8908 s = connection.createStatement();
8909 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
8912 typeId = rs.getInt(
"attribute_type_id");
8915 }
catch (SQLException ex) {
8916 throw new TskCoreException(
"Error getting attribute type id", ex);
8942 ResultSet rs = null;
8944 s = connection.createStatement();
8945 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
8947 return rs.getString(
"type_name");
8949 throw new TskCoreException(
"No type with that id");
8951 }
catch (SQLException ex) {
8952 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
8978 ResultSet rs = null;
8980 s = connection.createStatement();
8981 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
8983 return rs.getString(
"display_name");
8985 throw new TskCoreException(
"No type with that id");
8987 }
catch (SQLException ex) {
8988 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
9027 public ResultSet
runQuery(String query)
throws SQLException {
9030 connection = connections.getConnection();
9031 }
catch (TskCoreException ex) {
9032 throw new SQLException(
"Error getting connection for ad hoc query", ex);
9036 return connection.executeQuery(connection.createStatement(), query);
9056 final Statement statement = resultSet.getStatement();
9058 if (statement != null) {
9080 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
9083 files.add(carvedFile);
9087 || parent instanceof
Volume
9088 || parent instanceof
Image) {
9091 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
9110 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
9114 carvedFiles.add(carvedFile);
9119 || parent instanceof
Volume
9120 || parent instanceof
Image) {
9123 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
9159 long size,
long ctime,
long crtime,
long atime,
long mtime,
9161 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
9162 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
9163 isFile, parentFile, rederiveDetails, toolName, toolVersion,
9193 long size,
long ctime,
long crtime,
long atime,
long mtime,
9196 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
9221 long size,
long ctime,
long crtime,
long atime,
long mtime,
9224 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
9246 return this.
caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"");
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
static ARTIFACT_TYPE fromID(int id)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
BlackboardArtifact getArtifactById(long id)
COUNT_CHILD_OBJECTS_BY_PARENT
PREPARED_STATEMENT(String sql)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
SleuthkitCase(String dbPath, SleuthkitJNI.CaseDbHandle caseHandle, DbType dbType)
int compareTo(VersionNumber vs)
final String SYSTEM_ERROR
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
final ArrayList< ErrorObserver > sleuthkitCaseErrorObservers
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
SELECT_CONTENT_TAGS_BY_CONTENT
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
PooledDataSource getPooledDataSource()
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
void logSQLiteJDBCDriverInfo()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
ArrayList< BlackboardArtifact > getArtifactsHelper(String whereClause)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
SELECT_FILE_DERIVATION_METHOD
CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
void setPooledDataSource(PooledDataSource pooledDataSource)
final String COMMUNICATION_ERROR
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
List< Content > getChildren()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
FileSystem getFileSystemByIdHelper(long id, Content parent)
final Map< Long, FileSystem > fileSystemIdMap
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbTransaction(CaseDbConnection connection)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
static String createCaseDataBaseName(String candidateDbName)
void addErrorObserver(ErrorObserver observer)
PooledDataSource pooledDataSource
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
LocalFile localFile(ResultSet rs, CaseDbConnection connection, long parentId)
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
synchronized void close()
void setFileMIMEType(AbstractFile file, String mimeType)
ObjectType(int objectType)
SELECT_LOCAL_PATH_FOR_FILE
UNALLOC
Metadata structure is currently in an unallocated state.
SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
SELECT_ATTR_BY_VALUE_BYTE
final ConnectionPool connections
SELECT_FILE_SYSTEM_BY_OBJECT
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
final Map< Long, VirtualDirectory > rootIdsToCarvedFileDirs
static TSK_FS_META_TYPE_ENUM valueOf(short metaType)
CaseDbConnection getPooledConnection()
final String UNKNOWN_STATE
static final String SQL_ERROR_RESOURCE_GROUP
static final int DATABASE_LOCKED_ERROR
SELECT_ARTIFACT_TAGS_BY_TAG_NAME
long getFileSystemId(long fileId, CaseDbConnection connection)
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
static final int MAX_RETRIES
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
List< AbstractFile > openFiles(Content dataSource, String filePath)
static final int IS_REACHABLE_TIMEOUT_MS
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
VersionNumber getDBSchemaVersion()
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
void initStandardTagNames()
static final String NAME_CARVED
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
final String databaseName
List< VirtualDirectory > getVirtualDirectoryRoots()
SLACK
Slack space for a single file.
static final int MIN_USER_DEFINED_TYPE_ID
static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP
SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID
static TSK_FS_ATTR_TYPE_ENUM valueOf(int val)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection, long parentId)
void updateDatabaseSchema(String dbPath)
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE
static final int SQLITE_BUSY_ERROR
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
List< AbstractFile > resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
COUNT_CONTENT_TAGS_BY_TAG_NAME
CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
BlackboardArtifact getBlackboardArtifact(long artifactID)
Map< Integer, BlackboardArtifact.Type > typeIdToArtifactTypeMap
static void closeResultSet(ResultSet resultSet)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
SELECT_ARTIFACT_TAGS_BY_ARTIFACT
SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME
COUNT_ARTIFACTS_FROM_SOURCE
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
static TSK_FS_NAME_FLAG_ENUM valueOf(int dirFlag)
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
long countFilesWhere(String sqlWhereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
final CaseDbConnection connection
CaseDbQuery(String query)
UPDATE_ATTR_BY_VALUE_BYTE
boolean isFileFromSource(Content dataSource, long fileId)
POSTGRESQL_INSERT_ARTIFACT
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
void initReviewStatuses(CaseDbConnection connection)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Image > getImages()
TskData.FileKnown getKnown()
CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
int getAttrTypeID(String attrTypeName)
Image getImageById(long id)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
static final CaseDbSchemaVersionNumber CURRENT_DB_SCHEMA_VERSION
LOCAL_DIR
Local directory that was added (not from a disk image)
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void closeRunQuery(ResultSet resultSet)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
SELECT_FILES_BY_DATA_SOURCE_AND_NAME
static EncodingType valueOf(int type)
List< ContentTag > getContentTagsByTagName(TagName tagName)
SELECT_ARTIFACT_TAG_BY_ID
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static final String SQL_ERROR_PRIVILEGE_GROUP
static String escapeSingleQuotes(String text)
final Map< String, String > configurationOverrides
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< TagName > getAllTagNames()
static TSK_FS_NAME_TYPE_ENUM valueOf(short dir_type)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
long getArtifactsCountHelper(int artifactTypeID, long obj_id)
void initNextArtifactId()
static HTML_COLOR getColorByName(String colorName)
final ReentrantReadWriteLock rwLock
static final String SQL_ERROR_CONNECTION_GROUP
List< AbstractFile > findFilesByMd5(String md5Hash)
BlackboardArtifact.Type getArtifactType(String artTypeName)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
BlackboardArtifact newBlackboardArtifact(ARTIFACT_TYPE artifactType, long obj_id)
Map< Integer, BlackboardAttribute.Type > typeIdToAttributeTypeMap
void initIngestModuleTypes(CaseDbConnection connection)
DERIVED
File derived from a parent file (i.e. from ZIP)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
void initEncodingTypes(CaseDbConnection connection)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
static final String SQL_ERROR_INTERNAL_GROUP
SELECT_CONTENT_TAGS_BY_TAG_NAME
void addFilePath(CaseDbConnection connection, long objId, String path, TskData.EncodingType type)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
static TSK_DB_FILES_TYPE_ENUM valueOf(short fileType)
List< Content > getRootObjects()
void initBlackboardArtifactTypes()
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirName)
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
void initIngestStatusTypes(CaseDbConnection connection)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
static ATTRIBUTE_TYPE fromLabel(String typeName)
void deleteContentTag(ContentTag tag)
static ObjectType valueOf(short objectType)
long getContentTagsCountByTagName(TagName tagName)
void updateImagePath(String newPath, long objectId)
long getDataSourceObjectId(CaseDbConnection connection, long objectId)
UNKNOWN
File marked as unknown by hash db.
Map< String, BlackboardArtifact.Type > typeNameToArtifactTypeMap
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
static void closeStatement(Statement statement)
static final ResourceBundle bundle
BlackboardAttribute.Type getAttributeType(int typeID)
static void tryConnect(CaseDbConnectionInfo info)
void receiveError(String context, String errorMessage)
static SleuthkitCase openCase(String dbPath)
static String createNonUniquePath(String uniquePath)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
void initBlackboardAttributeTypes()
List< IngestModuleInfo > getIngestModules(int ingestJobId, CaseDbConnection connection)
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
COUNT_ARTIFACTS_BY_TAG_NAME
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
SleuthkitCase(String host, int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType)
final String contextString
BlackboardArtifact newBlackboardArtifact(int artifact_type_id, long obj_id, String artifactTypeName, String artifactDisplayName)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
Map< String, BlackboardAttribute.Type > typeNameToAttributeTypeMap
static final long UNKNOWN_ID
static final long BASE_ARTIFACT_ID
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
CaseDbConnection getPooledConnection()
CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
final Map< PREPARED_STATEMENT, PreparedStatement > preparedStatements
List< FsContent > findFilesWhere(String sqlWhereClause)
static final Logger logger
static ReviewStatus withID(int id)
CaseDbConnection getConnection()
void copyCaseDB(String newDBPath)
void addBlackBoardAttribute(BlackboardAttribute attr, int artifactTypeId, CaseDbConnection connection)
ResultSet runQuery(String query)
CaseDbConnection connection
List< TskFileRange > getFileRanges(long id)
static final String SQL_ERROR_AUTHENTICATION_GROUP
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
UNUSED_BLOCKS
Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNAL...
static final String SQL_ERROR_LIMIT_GROUP
List< BlackboardArtifact > resultSetToArtifacts(ResultSet rs)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent, CaseDbTransaction transaction)
CaseDbQuery executeQuery(String query)
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
SleuthkitJNI.CaseDbHandle caseHandle
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
LocalDirectory addLocalDirectory(long parentId, String directoryName)
final Connection connection