19 package org.sleuthkit.datamodel;
21 import com.google.common.collect.ImmutableSet;
22 import com.google.common.eventbus.EventBus;
23 import com.mchange.v2.c3p0.ComboPooledDataSource;
24 import com.mchange.v2.c3p0.DataSources;
25 import com.mchange.v2.c3p0.PooledDataSource;
26 import com.zaxxer.sparsebits.SparseBitSet;
27 import java.beans.PropertyVetoException;
28 import java.io.BufferedInputStream;
29 import java.io.BufferedOutputStream;
31 import java.io.FileInputStream;
32 import java.io.FileOutputStream;
33 import java.io.IOException;
34 import java.io.InputStream;
35 import java.io.OutputStream;
36 import java.io.UnsupportedEncodingException;
37 import java.net.InetAddress;
38 import java.net.URLEncoder;
39 import java.nio.charset.StandardCharsets;
40 import java.nio.file.Paths;
41 import java.sql.Connection;
42 import java.sql.DriverManager;
43 import java.sql.PreparedStatement;
44 import java.sql.ResultSet;
45 import java.sql.SQLException;
46 import java.sql.Statement;
47 import java.text.SimpleDateFormat;
48 import java.util.ArrayList;
49 import java.util.Arrays;
50 import java.util.Collection;
51 import java.util.Collections;
52 import java.util.Date;
53 import java.util.EnumMap;
54 import java.util.HashMap;
55 import java.util.HashSet;
56 import java.util.LinkedHashMap;
57 import java.util.List;
59 import java.util.MissingResourceException;
60 import java.util.ResourceBundle;
62 import java.util.UUID;
63 import java.util.concurrent.ConcurrentHashMap;
64 import java.util.concurrent.locks.ReentrantReadWriteLock;
65 import java.util.logging.Level;
66 import java.util.logging.Logger;
67 import org.postgresql.util.PSQLState;
83 import org.sqlite.SQLiteConfig;
84 import org.sqlite.SQLiteDataSource;
85 import org.sqlite.SQLiteJDBCLoader;
93 private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
102 private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE;
103 private static final Logger logger = Logger.getLogger(
SleuthkitCase.class.getName());
104 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
105 private static final int IS_REACHABLE_TIMEOUT_MS = 1000;
106 private static final String SQL_ERROR_CONNECTION_GROUP =
"08";
107 private static final String SQL_ERROR_AUTHENTICATION_GROUP =
"28";
108 private static final String SQL_ERROR_PRIVILEGE_GROUP =
"42";
109 private static final String SQL_ERROR_RESOURCE_GROUP =
"53";
110 private static final String SQL_ERROR_LIMIT_GROUP =
"54";
111 private static final String SQL_ERROR_INTERNAL_GROUP =
"xx";
112 private static final int MIN_USER_DEFINED_TYPE_ID = 10000;
114 private static final Set<String> CORE_TABLE_NAMES = ImmutableSet.of(
116 "tsk_event_descriptions",
129 "tsk_files_derived_method",
132 "blackboard_artifact_tags",
133 "blackboard_artifacts",
134 "blackboard_attributes",
135 "blackboard_artifact_types",
136 "blackboard_attribute_types",
138 "file_encoding_types",
139 "ingest_module_types",
140 "ingest_job_status_types",
143 "ingest_job_modules",
146 "account_relationships",
150 private static final Set<String> CORE_INDEX_NAMES = ImmutableSet.of(
154 "artifact_artifact_objID",
159 "relationships_account1",
160 "relationships_account2",
161 "relationships_relationship_source_obj_id",
162 "relationships_date_time",
163 "relationships_relationship_type",
164 "relationships_data_source_obj_id",
167 "events_data_source_obj_id",
168 "events_file_obj_id",
169 "events_artifact_id");
171 private static final String TSK_VERSION_KEY =
"TSK_VER";
172 private static final String SCHEMA_MAJOR_VERSION_KEY =
"SCHEMA_MAJOR_VERSION";
173 private static final String SCHEMA_MINOR_VERSION_KEY =
"SCHEMA_MINOR_VERSION";
174 private static final String CREATION_SCHEMA_MAJOR_VERSION_KEY =
"CREATION_SCHEMA_MAJOR_VERSION";
175 private static final String CREATION_SCHEMA_MINOR_VERSION_KEY =
"CREATION_SCHEMA_MINOR_VERSION";
177 private final ConnectionPool connections;
178 private final Map<Long, VirtualDirectory> rootIdsToCarvedFileDirs =
new HashMap<>();
179 private final Map<Long, FileSystem> fileSystemIdMap =
new HashMap<>();
180 private final List<ErrorObserver> sleuthkitCaseErrorObservers =
new ArrayList<>();
181 private final String databaseName;
182 private final String dbPath;
183 private final DbType dbType;
184 private final String caseDirPath;
186 private String dbBackupPath;
197 private final Map<Long, SparseBitSet> hasChildrenBitSetMap =
new HashMap<>();
199 private long nextArtifactId;
204 private final ReentrantReadWriteLock rwLock =
new ReentrantReadWriteLock(
true);
211 private final Map<String, Set<Long>> deviceIdToDatasourceObjIdMap =
new HashMap<>();
213 private final EventBus eventBus =
new EventBus(
"SleuthkitCase-EventBus");
216 eventBus.register(listener);
220 eventBus.unregister(listener);
223 void fireTSKEvent(Object event) {
224 eventBus.post(event);
228 private final Map<Long, Content> frequentlyUsedContentMap =
new HashMap<>();
230 private Examiner cachedCurrentExaminer = null;
248 if (info.getHost() == null || info.getHost().isEmpty()) {
249 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
250 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
251 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
252 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
253 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
254 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
255 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
259 Class.forName(
"org.postgresql.Driver");
260 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
264 }
catch (SQLException ex) {
266 String sqlState = ex.getSQLState().toLowerCase();
267 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
269 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
271 result = bundle.getString(
"DatabaseConnectionCheck.Port");
273 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
275 }
catch (IOException | MissingResourceException any) {
277 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
279 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
280 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
281 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
282 result = bundle.getString(
"DatabaseConnectionCheck.Access");
283 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
284 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
285 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
286 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
287 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
288 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
290 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
293 }
catch (ClassNotFoundException ex) {
294 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
310 Class.forName(
"org.sqlite.JDBC");
311 this.dbPath = dbPath;
312 this.dbType = dbType;
314 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
315 this.databaseName = dbFile.
getName();
316 this.connections =
new SQLiteConnections(dbPath);
317 this.caseHandle = caseHandle;
319 logSQLiteJDBCDriverInfo();
339 private SleuthkitCase(String host,
int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType)
throws Exception {
341 this.databaseName = dbName;
342 this.dbType = dbType;
343 this.caseDirPath = caseDirPath;
344 this.connections =
new PostgreSQLConnections(host, port, dbName, userName, password);
345 this.caseHandle = caseHandle;
349 private void init() throws Exception {
350 typeIdToArtifactTypeMap =
new ConcurrentHashMap<>();
351 typeIdToAttributeTypeMap =
new ConcurrentHashMap<>();
352 typeNameToArtifactTypeMap =
new ConcurrentHashMap<>();
353 typeNameToAttributeTypeMap =
new ConcurrentHashMap<>();
359 initBlackboardArtifactTypes();
360 initBlackboardAttributeTypes();
361 initNextArtifactId();
362 updateDatabaseSchema(null);
364 try (CaseDbConnection connection = connections.getConnection()) {
365 initIngestModuleTypes(connection);
366 initIngestStatusTypes(connection);
367 initReviewStatuses(connection);
368 initEncodingTypes(connection);
369 populateHasChildrenMap(connection);
370 updateExaminers(connection);
371 initDBSchemaCreationVersion(connection);
374 blackboard =
new Blackboard(
this);
375 communicationsMgr =
new CommunicationsManager(
this);
376 timelineMgr =
new TimelineManager(
this);
377 dbAccessManager =
new CaseDbAccessManager(
this);
385 static Set<String> getCoreTableNames() {
386 return CORE_TABLE_NAMES;
394 static Set<String> getCoreIndexNames() {
395 return CORE_INDEX_NAMES;
406 boolean getHasChildren(Content content) {
407 long objId = content.getId();
408 long mapIndex = objId / Integer.MAX_VALUE;
409 int mapValue = (int) (objId % Integer.MAX_VALUE);
411 synchronized (hasChildrenBitSetMap) {
412 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
413 return hasChildrenBitSetMap.get(mapIndex).get(mapValue);
424 private void setHasChildren(Long objId) {
425 long mapIndex = objId / Integer.MAX_VALUE;
426 int mapValue = (int) (objId % Integer.MAX_VALUE);
428 synchronized (hasChildrenBitSetMap) {
429 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
430 hasChildrenBitSetMap.get(mapIndex).set(mapValue);
432 SparseBitSet bitSet =
new SparseBitSet();
433 bitSet.set(mapValue);
434 hasChildrenBitSetMap.put(mapIndex, bitSet);
447 return communicationsMgr;
478 return dbAccessManager;
487 private void initBlackboardArtifactTypes() throws SQLException,
TskCoreException {
488 CaseDbConnection connection = connections.getConnection();
489 Statement statement = null;
490 ResultSet resultSet = null;
493 statement = connection.createStatement();
496 statement.execute(
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES (" + type.getTypeID() +
" , '" + type.getLabel() +
"', '" + type.getDisplayName() +
"')");
497 }
catch (SQLException ex) {
498 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_artifact_types WHERE artifact_type_id = '" + type.getTypeID() +
"'");
500 if (resultSet.getLong(
"count") == 0) {
506 this.typeIdToArtifactTypeMap.put(type.getTypeID(),
new BlackboardArtifact.Type(type));
507 this.typeNameToArtifactTypeMap.put(type.getLabel(),
new BlackboardArtifact.Type(type));
510 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ARTIFACT_TYPE.values())).getTypeID() + 1;
511 statement.execute(
"ALTER SEQUENCE blackboard_artifact_types_artifact_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
514 closeResultSet(resultSet);
515 closeStatement(statement);
528 private void initBlackboardAttributeTypes() throws SQLException, TskCoreException {
529 CaseDbConnection connection = connections.getConnection();
530 Statement statement = null;
531 ResultSet resultSet = null;
534 statement = connection.createStatement();
535 for (ATTRIBUTE_TYPE type : ATTRIBUTE_TYPE.values()) {
537 statement.execute(
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES (" + type.getTypeID() +
", '" + type.getLabel() +
"', '" + type.getDisplayName() +
"', '" + type.getValueType().getType() +
"')");
538 }
catch (SQLException ex) {
539 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types WHERE attribute_type_id = '" + type.getTypeID() +
"'");
541 if (resultSet.getLong(
"count") == 0) {
547 this.typeIdToAttributeTypeMap.put(type.getTypeID(),
new BlackboardAttribute.Type(type));
548 this.typeNameToAttributeTypeMap.put(type.getLabel(),
new BlackboardAttribute.Type(type));
551 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ATTRIBUTE_TYPE.values())).getTypeID() + 1;
552 statement.execute(
"ALTER SEQUENCE blackboard_attribute_types_attribute_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
555 closeResultSet(resultSet);
556 closeStatement(statement);
571 private void initNextArtifactId() throws SQLException, TskCoreException {
572 CaseDbConnection connection = connections.getConnection();
573 Statement statement = null;
574 ResultSet resultSet = null;
577 statement = connection.createStatement();
578 resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
580 this.nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
581 if (this.nextArtifactId == 1) {
582 this.nextArtifactId = BASE_ARTIFACT_ID;
585 closeResultSet(resultSet);
586 closeStatement(statement);
599 private void initIngestModuleTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
600 Statement statement = null;
601 ResultSet resultSet = null;
604 statement = connection.createStatement();
605 for (IngestModuleType type : IngestModuleType.values()) {
607 statement.execute(
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
608 }
catch (SQLException ex) {
609 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
611 if (resultSet.getLong(
"count") == 0) {
619 closeResultSet(resultSet);
620 closeStatement(statement);
632 private void initIngestStatusTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
633 Statement statement = null;
634 ResultSet resultSet = null;
637 statement = connection.createStatement();
638 for (IngestJobStatusType type : IngestJobStatusType.values()) {
640 statement.execute(
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
641 }
catch (SQLException ex) {
642 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
644 if (resultSet.getLong(
"count") == 0) {
652 closeResultSet(resultSet);
653 closeStatement(statement);
664 private void initReviewStatuses(CaseDbConnection connection)
throws SQLException, TskCoreException {
665 Statement statement = null;
666 ResultSet resultSet = null;
669 statement = connection.createStatement();
670 for (BlackboardArtifact.ReviewStatus status : BlackboardArtifact.ReviewStatus.values()) {
672 statement.execute(
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
673 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')");
674 }
catch (SQLException ex) {
675 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
677 if (resultSet.getLong(
"count") == 0) {
685 closeResultSet(resultSet);
686 closeStatement(statement);
698 private void initEncodingTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
699 Statement statement = null;
700 ResultSet resultSet = null;
703 statement = connection.createStatement();
704 for (TskData.EncodingType type : TskData.EncodingType.values()) {
706 statement.execute(
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')");
707 }
catch (SQLException ex) {
708 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
710 if (resultSet.getLong(
"count") == 0) {
718 closeResultSet(resultSet);
719 closeStatement(statement);
732 private void updateExaminers(CaseDbConnection connection)
throws SQLException, TskCoreException {
734 String loginName = System.getProperty(
"user.name");
735 if (loginName.isEmpty()) {
736 logger.log(Level.SEVERE,
"Cannot determine logged in user name");
741 Statement statement = connection.createStatement();
743 String query =
"INTO tsk_examiners (login_name) VALUES ('" + loginName +
"')";
746 query =
"INSERT " + query +
" ON CONFLICT DO NOTHING";
749 query =
"INSERT OR IGNORE " + query;
752 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
755 statement.execute(query);
756 }
catch (SQLException ex) {
757 throw new TskCoreException(
"Error inserting row in tsk_examiners", ex);
759 closeStatement(statement);
771 private void populateHasChildrenMap(CaseDbConnection connection)
throws TskCoreException {
772 long timestamp = System.currentTimeMillis();
774 Statement statement = null;
775 ResultSet resultSet = null;
778 statement = connection.createStatement();
779 resultSet = statement.executeQuery(
"select distinct par_obj_id from tsk_objects");
781 synchronized (hasChildrenBitSetMap) {
782 while (resultSet.next()) {
783 setHasChildren(resultSet.getLong(
"par_obj_id"));
786 long delay = System.currentTimeMillis() - timestamp;
787 logger.log(Level.INFO,
"Time to initialize parent node cache: {0} ms", delay);
788 }
catch (SQLException ex) {
789 throw new TskCoreException(
"Error populating parent node cache", ex);
791 closeResultSet(resultSet);
792 closeStatement(statement);
803 void addDataSourceToHasChildrenMap() throws TskCoreException {
805 CaseDbConnection connection = connections.getConnection();
807 populateHasChildrenMap(connection);
809 if (connection != null) {
824 private void updateDatabaseSchema(String dbPath)
throws Exception {
825 CaseDbConnection connection = connections.getConnection();
826 ResultSet resultSet = null;
827 Statement statement = null;
830 connection.beginTransaction();
832 boolean hasMinorVersion =
false;
833 ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null,
"tsk_db_info",
"schema%");
834 while (columns.next()) {
835 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
836 hasMinorVersion =
true;
841 int dbSchemaMajorVersion;
842 int dbSchemaMinorVersion = 0;
844 statement = connection.createStatement();
845 resultSet = connection.executeQuery(statement,
"SELECT schema_ver"
846 + (hasMinorVersion ?
", schema_minor_ver" :
"")
847 +
" FROM tsk_db_info");
848 if (resultSet.next()) {
849 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver");
850 if (hasMinorVersion) {
852 dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver");
855 throw new TskCoreException();
857 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(dbSchemaMajorVersion, dbSchemaMinorVersion);
864 if (
false == CURRENT_DB_SCHEMA_VERSION.
isCompatible(dbSchemaVersion)) {
866 throw new TskUnsupportedSchemaVersionException(
867 "Unsupported DB schema version " + dbSchemaVersion +
", the highest supported schema version is " + CURRENT_DB_SCHEMA_VERSION.
getMajor() +
".X");
868 }
else if (dbSchemaVersion.compareTo(CURRENT_DB_SCHEMA_VERSION) < 0) {
871 if (null != dbPath) {
874 String backupFilePath = dbPath +
".schemaVer" + dbSchemaVersion.toString() +
".backup";
876 dbBackupPath = backupFilePath;
883 dbSchemaVersion = updateFromSchema2toSchema3(dbSchemaVersion, connection);
884 dbSchemaVersion = updateFromSchema3toSchema4(dbSchemaVersion, connection);
885 dbSchemaVersion = updateFromSchema4toSchema5(dbSchemaVersion, connection);
886 dbSchemaVersion = updateFromSchema5toSchema6(dbSchemaVersion, connection);
887 dbSchemaVersion = updateFromSchema6toSchema7(dbSchemaVersion, connection);
888 dbSchemaVersion = updateFromSchema7toSchema7dot1(dbSchemaVersion, connection);
889 dbSchemaVersion = updateFromSchema7dot1toSchema7dot2(dbSchemaVersion, connection);
890 dbSchemaVersion = updateFromSchema7dot2toSchema8dot0(dbSchemaVersion, connection);
891 dbSchemaVersion = updateFromSchema8dot0toSchema8dot1(dbSchemaVersion, connection);
892 dbSchemaVersion = updateFromSchema8dot1toSchema8dot2(dbSchemaVersion, connection);
893 dbSchemaVersion = updateFromSchema8dot2toSchema8dot3(dbSchemaVersion, connection);
894 dbSchemaVersion = updateFromSchema8dot3toSchema8dot4(dbSchemaVersion, connection);
895 statement = connection.createStatement();
896 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.getMajor() +
", schema_minor_ver = " + dbSchemaVersion.getMinor());
897 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMajor() +
" WHERE name = '" + SCHEMA_MAJOR_VERSION_KEY +
"'");
898 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMinor() +
" WHERE name = '" + SCHEMA_MINOR_VERSION_KEY +
"'");
903 connection.commitTransaction();
904 }
catch (Exception ex) {
905 connection.rollbackTransaction();
908 closeResultSet(resultSet);
909 closeStatement(statement);
922 private void initDBSchemaCreationVersion(CaseDbConnection connection)
throws SQLException {
924 Statement statement = null;
925 ResultSet resultSet = null;
926 String createdSchemaMajorVersion =
"0";
927 String createdSchemaMinorVersion =
"0";
930 statement = connection.createStatement();
931 resultSet = connection.executeQuery(statement,
"SELECT name, value FROM tsk_db_info_extended");
932 while (resultSet.next()) {
933 String name = resultSet.getString(
"name");
934 if (name.equals(CREATION_SCHEMA_MAJOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MAJOR_VERSION")) {
935 createdSchemaMajorVersion = resultSet.getString(
"value");
936 }
else if (name.equals(CREATION_SCHEMA_MINOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MINOR_VERSION")) {
937 createdSchemaMinorVersion = resultSet.getString(
"value");
942 closeResultSet(resultSet);
943 closeStatement(statement);
947 caseDBSchemaCreationVersion =
new CaseDbSchemaVersionNumber(Integer.parseInt(createdSchemaMajorVersion), Integer.parseInt(createdSchemaMinorVersion));
959 public void copyCaseDB(String newDBPath)
throws IOException {
960 if (dbPath.isEmpty()) {
961 throw new IOException(
"Copying case database files is not supported for this type of case database");
963 InputStream in = null;
964 OutputStream out = null;
967 InputStream inFile =
new FileInputStream(dbPath);
968 in =
new BufferedInputStream(inFile);
969 OutputStream outFile =
new FileOutputStream(newDBPath);
970 out =
new BufferedOutputStream(outFile);
971 int bytesRead = in.read();
972 while (bytesRead != -1) {
973 out.write(bytesRead);
974 bytesRead = in.read();
985 }
catch (IOException e) {
986 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
995 private void logSQLiteJDBCDriverInfo() {
997 SleuthkitCase.logger.info(String.format(
"sqlite-jdbc version %s loaded in %s mode",
998 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
999 ?
"native" :
"pure-java"));
1000 }
catch (Exception ex) {
1001 SleuthkitCase.logger.log(Level.SEVERE,
"Error querying case database mode", ex);
1018 @SuppressWarnings(
"deprecation")
1019 private CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
1020 if (schemaVersion.getMajor() != 2) {
1021 return schemaVersion;
1023 Statement statement = null;
1024 Statement updateStatement = null;
1025 ResultSet resultSet = null;
1028 statement = connection.createStatement();
1031 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
1032 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
1033 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
1036 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
1039 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
1040 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
1041 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
1044 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
1047 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
1052 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
1053 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
1054 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
1055 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
1056 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
1057 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
1058 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
1059 +
"arts.artifact_type_id AS artifact_type_id "
1060 +
"FROM blackboard_attributes AS attrs "
1061 +
"INNER JOIN blackboard_artifacts AS arts "
1062 +
"WHERE attrs.artifact_id = arts.artifact_id;");
1063 updateStatement = connection.createStatement();
1064 while (resultSet.next()) {
1065 long artifactId = resultSet.getLong(
"artifact_id");
1066 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
1067 updateStatement.executeUpdate(
1068 "UPDATE blackboard_attributes "
1069 +
"SET artifact_type_id = " + artifactTypeId
1070 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
1079 HashMap<String, TagName> tagNames =
new HashMap<String, TagName>();
1083 String comment =
"";
1085 for (BlackboardAttribute attribute : attributes) {
1086 if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
1087 name = attribute.getValueString();
1088 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
1089 comment = attribute.getValueString();
1092 if (!name.isEmpty()) {
1094 if (tagNames.containsKey(name)) {
1095 tagName = tagNames.get(name);
1097 tagName =
addTagName(name,
"", TagName.HTML_COLOR.NONE);
1098 tagNames.put(name, tagName);
1100 addContentTag(content, tagName, comment, 0, content.getSize() - 1);
1104 long taggedArtifactId = -1;
1106 String comment =
"";
1108 for (BlackboardAttribute attribute : attributes) {
1109 if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
1110 name = attribute.getValueString();
1111 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
1112 comment = attribute.getValueString();
1113 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()) {
1114 taggedArtifactId = attribute.getValueLong();
1117 if (taggedArtifactId != -1 && !name.isEmpty()) {
1119 if (tagNames.containsKey(name)) {
1120 tagName = tagNames.get(name);
1122 tagName =
addTagName(name,
"", TagName.HTML_COLOR.NONE);
1123 tagNames.put(name, tagName);
1129 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
1130 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
1131 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1132 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
");");
1134 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
1135 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1136 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
";");
1138 return new CaseDbSchemaVersionNumber(3, 0);
1140 closeStatement(updateStatement);
1141 closeResultSet(resultSet);
1142 closeStatement(statement);
1161 private CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1162 if (schemaVersion.getMajor() != 3) {
1163 return schemaVersion;
1166 Statement statement = null;
1167 ResultSet resultSet = null;
1168 Statement queryStatement = null;
1169 ResultSet queryResultSet = null;
1170 Statement updateStatement = null;
1175 statement = connection.createStatement();
1176 updateStatement = connection.createStatement();
1177 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
1178 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
1179 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
1180 +
"WHERE files.obj_id = arts.obj_id AND "
1181 +
"arts.artifact_id = attrs.artifact_id AND "
1182 +
"arts.artifact_type_id = 1 AND "
1183 +
"attrs.attribute_type_id = 62");
1184 while (resultSet.next()) {
1185 updateStatement.executeUpdate(
1187 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
1188 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
1193 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
1194 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
1195 while (resultSet.next()) {
1196 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
1197 String attributeLabel = resultSet.getString(
"type_name");
1198 if (attributeTypeId < MIN_USER_DEFINED_TYPE_ID) {
1199 updateStatement.executeUpdate(
1200 "UPDATE blackboard_attribute_types "
1201 +
"SET value_type = " + ATTRIBUTE_TYPE.fromLabel(attributeLabel).getValueType().getType() +
" "
1202 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
1208 queryStatement = connection.createStatement();
1209 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
1210 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
1211 while (resultSet.next()) {
1212 long objectId = resultSet.getLong(
"obj_id");
1213 String timeZone =
"";
1214 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
1215 if (queryResultSet.next()) {
1216 timeZone = queryResultSet.getString(
"tzone");
1218 queryResultSet.close();
1219 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
1220 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
1234 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
1235 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
1236 while (resultSet.next()) {
1237 long fileId = resultSet.getLong(
"obj_id");
1238 long dataSourceId = getDataSourceObjectId(connection, fileId);
1239 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
1242 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1243 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1244 if (this.dbType.equals(DbType.SQLITE)) {
1245 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1246 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1248 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1249 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1252 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
1253 initIngestModuleTypes(connection);
1254 initIngestStatusTypes(connection);
1256 return new CaseDbSchemaVersionNumber(4, 0);
1259 closeResultSet(queryResultSet);
1260 closeStatement(queryStatement);
1261 closeStatement(updateStatement);
1262 closeResultSet(resultSet);
1263 closeStatement(statement);
1281 private CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1282 if (schemaVersion.getMajor() != 4) {
1283 return schemaVersion;
1286 Statement statement = null;
1290 statement = connection.createStatement();
1291 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1301 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1304 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
1305 initEncodingTypes(connection);
1312 initReviewStatuses(connection);
1317 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
1319 return new CaseDbSchemaVersionNumber(5, 0);
1322 closeStatement(statement);
1340 private CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1341 if (schemaVersion.getMajor() != 5) {
1342 return schemaVersion;
1349 Statement statement = null;
1350 ResultSet resultSet = null;
1356 statement = connection.createStatement();
1357 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1359 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
1361 if (resultSet.getLong(
"count") == 0) {
1370 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1373 return new CaseDbSchemaVersionNumber(6, 0);
1376 closeResultSet(resultSet);
1377 closeStatement(statement);
1395 private CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1396 if (schemaVersion.getMajor() != 6) {
1397 return schemaVersion;
1403 Statement statement = null;
1404 Statement updstatement = null;
1405 ResultSet resultSet = null;
1408 statement = connection.createStatement();
1409 updstatement = connection.createStatement();
1410 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
1412 resultSet = connection.executeQuery(statement,
"SELECT obj_id,name FROM tsk_files");
1413 while (resultSet.next()) {
1414 long objID = resultSet.getLong(
"obj_id");
1415 String name = resultSet.getString(
"name");
1416 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" +
escapeSingleQuotes(extractExtension(name)) +
"' "
1417 +
"WHERE obj_id = " + objID);
1420 statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
1423 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
1425 return new CaseDbSchemaVersionNumber(7, 0);
1428 closeResultSet(resultSet);
1429 closeStatement(statement);
1430 closeStatement(updstatement);
1448 private CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1449 if (schemaVersion.getMajor() != 7) {
1450 return schemaVersion;
1453 if (schemaVersion.getMinor() != 0) {
1454 return schemaVersion;
1460 Statement statement = null;
1461 ResultSet resultSet = null;
1464 statement = connection.createStatement();
1467 if (schemaVersion.getMinor() == 0) {
1469 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
1471 return new CaseDbSchemaVersionNumber(7, 1);
1474 closeResultSet(resultSet);
1475 closeStatement(statement);
1493 private CaseDbSchemaVersionNumber updateFromSchema7dot1toSchema7dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1494 if (schemaVersion.getMajor() != 7) {
1495 return schemaVersion;
1498 if (schemaVersion.getMinor() != 1) {
1499 return schemaVersion;
1502 Statement statement = null;
1503 Statement updstatement = null;
1504 ResultSet resultSet = null;
1508 statement = connection.createStatement();
1509 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1");
1512 updstatement = connection.createStatement();
1513 resultSet = connection.executeQuery(statement,
"SELECT artifact_id, obj_id FROM blackboard_artifacts");
1514 while (resultSet.next()) {
1515 long artifact_id = resultSet.getLong(
"artifact_id");
1516 long obj_id = resultSet.getLong(
"obj_id");
1517 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
1518 updstatement.executeUpdate(
"UPDATE blackboard_artifacts SET data_source_obj_id = " + data_source_obj_id +
" "
1519 +
"WHERE artifact_id = " + artifact_id);
1521 closeResultSet(resultSet);
1522 closeStatement(statement);
1523 closeStatement(updstatement);
1528 statement = connection.createStatement();
1529 statement.execute(
"ALTER TABLE tag_names ADD COLUMN knownStatus INTEGER NOT NULL DEFAULT " + TskData.FileKnown.UNKNOWN.getFileKnownValue());
1532 if (this.dbType.equals(DbType.SQLITE)) {
1533 statement.execute(
"CREATE TABLE account_types (account_type_id INTEGER PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1534 statement.execute(
"CREATE TABLE accounts (account_id INTEGER PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1535 statement.execute(
"CREATE TABLE account_relationships (relationship_id INTEGER PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time INTEGER, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1537 statement.execute(
"CREATE TABLE account_types (account_type_id BIGSERIAL PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1538 statement.execute(
"CREATE TABLE accounts (account_id BIGSERIAL PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1539 statement.execute(
"CREATE TABLE account_relationships (relationship_id BIGSERIAL PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time BIGINT, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1543 statement.execute(
"CREATE INDEX artifact_artifact_objID ON blackboard_artifacts(artifact_obj_id)");
1544 statement.execute(
"CREATE INDEX relationships_account1 ON account_relationships(account1_id)");
1545 statement.execute(
"CREATE INDEX relationships_account2 ON account_relationships(account2_id)");
1546 statement.execute(
"CREATE INDEX relationships_relationship_source_obj_id ON account_relationships(relationship_source_obj_id)");
1547 statement.execute(
"CREATE INDEX relationships_date_time ON account_relationships(date_time)");
1548 statement.execute(
"CREATE INDEX relationships_relationship_type ON account_relationships(relationship_type)");
1549 statement.execute(
"CREATE INDEX relationships_data_source_obj_id ON account_relationships(data_source_obj_id)");
1551 return new CaseDbSchemaVersionNumber(7, 2);
1553 closeResultSet(resultSet);
1554 closeStatement(statement);
1555 closeStatement(updstatement);
1573 private CaseDbSchemaVersionNumber updateFromSchema7dot2toSchema8dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1574 if (schemaVersion.getMajor() != 7) {
1575 return schemaVersion;
1578 if (schemaVersion.getMinor() != 2) {
1579 return schemaVersion;
1582 Statement updateSchemaStatement = connection.createStatement();
1583 Statement getExistingReportsStatement = connection.createStatement();
1584 ResultSet resultSet = null;
1585 ResultSet existingReports = null;
1593 updateSchemaStatement.execute(
"ALTER TABLE reports RENAME TO old_reports");
1596 updateSchemaStatement.execute(
"CREATE TABLE reports (obj_id BIGSERIAL PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id))");
1599 existingReports = getExistingReportsStatement.executeQuery(
"SELECT * FROM old_reports");
1600 while (existingReports.next()) {
1601 String path = existingReports.getString(2);
1602 long crtime = existingReports.getInt(3);
1603 String sourceModule = existingReports.getString(4);
1604 String reportName = existingReports.getString(5);
1606 PreparedStatement insertObjectStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
1607 insertObjectStatement.clearParameters();
1608 insertObjectStatement.setNull(1, java.sql.Types.BIGINT);
1609 insertObjectStatement.setLong(2, TskData.ObjectType.REPORT.getObjectType());
1610 connection.executeUpdate(insertObjectStatement);
1611 resultSet = insertObjectStatement.getGeneratedKeys();
1612 if (!resultSet.next()) {
1613 throw new TskCoreException(String.format(
"Failed to INSERT report %s (%s) in tsk_objects table", reportName, path));
1615 long objectId = resultSet.getLong(1);
1618 PreparedStatement insertReportStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
1619 insertReportStatement.clearParameters();
1620 insertReportStatement.setLong(1, objectId);
1621 insertReportStatement.setString(2, path);
1622 insertReportStatement.setLong(3, crtime);
1623 insertReportStatement.setString(4, sourceModule);
1624 insertReportStatement.setString(5, reportName);
1625 connection.executeUpdate(insertReportStatement);
1629 updateSchemaStatement.execute(
"DROP TABLE old_reports");
1631 return new CaseDbSchemaVersionNumber(8, 0);
1633 closeResultSet(resultSet);
1634 closeResultSet(existingReports);
1635 closeStatement(updateSchemaStatement);
1636 closeStatement(getExistingReportsStatement);
1654 private CaseDbSchemaVersionNumber updateFromSchema8dot0toSchema8dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1655 if (schemaVersion.getMajor() != 8) {
1656 return schemaVersion;
1659 if (schemaVersion.getMinor() != 0) {
1660 return schemaVersion;
1665 try (Statement statement = connection.createStatement();) {
1667 if (this.dbType.equals(DbType.SQLITE)) {
1668 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id INTEGER PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name) )");
1669 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1670 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1672 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id BIGSERIAL PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name))");
1673 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1674 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1677 return new CaseDbSchemaVersionNumber(8, 1);
1696 private CaseDbSchemaVersionNumber updateFromSchema8dot1toSchema8dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1697 if (schemaVersion.getMajor() != 8) {
1698 return schemaVersion;
1701 if (schemaVersion.getMinor() != 1) {
1702 return schemaVersion;
1707 try (Statement statement = connection.createStatement();) {
1708 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha1 TEXT DEFAULT NULL");
1709 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha256 TEXT DEFAULT NULL");
1711 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_details TEXT");
1719 statement.execute(
"CREATE TABLE tsk_db_info_extended (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
1720 ResultSet result = statement.executeQuery(
"SELECT tsk_ver FROM tsk_db_info");
1722 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + TSK_VERSION_KEY +
"', '" + result.getLong(
"tsk_ver") +
"')");
1723 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MAJOR_VERSION_KEY +
"', '8')");
1724 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MINOR_VERSION_KEY +
"', '2')");
1725 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MAJOR_VERSION_KEY +
"', '0')");
1726 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MINOR_VERSION_KEY +
"', '0')");
1728 String primaryKeyType;
1731 primaryKeyType =
"BIGSERIAL";
1734 primaryKeyType =
"INTEGER";
1737 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1741 statement.execute(
"CREATE TABLE tsk_event_types ("
1742 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1743 +
" display_name TEXT UNIQUE NOT NULL, "
1744 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1745 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1746 +
" values( 0, 'Event Types', null)");
1747 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1748 +
" values(1, 'File System', 0)");
1749 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1750 +
" values(2, 'Web Activity', 0)");
1751 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1752 +
" values(3, 'Misc Types', 0)");
1753 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1754 +
" values(4, 'Modified', 1)");
1755 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1756 +
" values(5, 'Accessed', 1)");
1757 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1758 +
" values(6, 'Created', 1)");
1759 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1760 +
" values(7, 'Changed', 1)");
1763 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1764 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1765 +
" full_description TEXT NOT NULL, "
1766 +
" med_description TEXT, "
1767 +
" short_description TEXT,"
1768 +
" data_source_obj_id BIGINT NOT NULL, "
1769 +
" file_obj_id BIGINT NOT NULL, "
1770 +
" artifact_id BIGINT, "
1771 +
" hash_hit INTEGER NOT NULL, "
1772 +
" tagged INTEGER NOT NULL, "
1773 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1774 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1775 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1778 statement.execute(
"CREATE TABLE tsk_events ( "
1779 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1780 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1781 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1782 +
" time INTEGER NOT NULL) "
1786 statement.execute(
"CREATE INDEX events_time ON tsk_events(time)");
1787 statement.execute(
"CREATE INDEX events_type ON tsk_events(event_type_id)");
1788 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1789 statement.execute(
"CREATE INDEX events_file_obj_id ON tsk_event_descriptions(file_obj_id) ");
1790 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1791 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1792 return new CaseDbSchemaVersionNumber(8, 2);
1812 private CaseDbSchemaVersionNumber updateFromSchema8dot2toSchema8dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1813 if (schemaVersion.getMajor() != 8) {
1814 return schemaVersion;
1817 if (schemaVersion.getMinor() != 2) {
1818 return schemaVersion;
1823 ResultSet resultSet = null;
1825 try (Statement statement = connection.createStatement();) {
1830 String primaryKeyType;
1833 primaryKeyType =
"BIGSERIAL";
1836 primaryKeyType =
"INTEGER";
1839 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1843 statement.execute(
"CREATE TABLE IF NOT EXISTS tsk_event_types ("
1844 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1845 +
" display_name TEXT UNIQUE NOT NULL, "
1846 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1848 resultSet = statement.executeQuery(
"SELECT * from tsk_event_types");
1852 if (!resultSet.next()) {
1854 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1855 +
" values( 0, 'Event Types', null)");
1856 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1857 +
" values(1, 'File System', 0)");
1858 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1859 +
" values(2, 'Web Activity', 0)");
1860 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1861 +
" values(3, 'Misc Types', 0)");
1862 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1863 +
" values(4, 'Modified', 1)");
1864 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1865 +
" values(5, 'Accessed', 1)");
1866 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1867 +
" values(6, 'Created', 1)");
1868 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1869 +
" values(7, 'Changed', 1)");
1874 statement.execute(
"DROP TABLE IF EXISTS tsk_events");
1878 statement.execute(
"DROP TABLE IF EXISTS tsk_event_descriptions");
1881 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1882 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1883 +
" full_description TEXT NOT NULL, "
1884 +
" med_description TEXT, "
1885 +
" short_description TEXT,"
1886 +
" data_source_obj_id BIGINT NOT NULL, "
1887 +
" file_obj_id BIGINT NOT NULL, "
1888 +
" artifact_id BIGINT, "
1889 +
" hash_hit INTEGER NOT NULL, "
1890 +
" tagged INTEGER NOT NULL, "
1891 +
" UNIQUE(full_description, file_obj_id, artifact_id), "
1892 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1893 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1894 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1898 statement.execute(
"CREATE TABLE tsk_events ( "
1899 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1900 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1901 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1902 +
" time INTEGER NOT NULL, "
1903 +
" UNIQUE (event_type_id, event_description_id, time))"
1907 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MAJOR_VERSION' WHERE name = 'CREATED_SCHEMA_MAJOR_VERSION'");
1908 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MINOR_VERSION' WHERE name = 'CREATED_SCHEMA_MINOR_VERSION'");
1912 return new CaseDbSchemaVersionNumber(8, 3);
1914 closeResultSet(resultSet);
1939 private CaseDbSchemaVersionNumber updateFromSchema8dot3toSchema8dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1940 if (schemaVersion.getMajor() != 8) {
1941 return schemaVersion;
1944 if (schemaVersion.getMinor() != 3) {
1945 return schemaVersion;
1948 Statement statement = connection.createStatement();
1949 ResultSet results = null;
1956 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1962 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
1963 +
"WHERE table_name='tsk_event_descriptions' and column_name='file_obj_id'");
1964 if (results.next()) {
1966 statement.execute(
"ALTER TABLE tsk_event_descriptions "
1967 +
"RENAME COLUMN file_obj_id TO content_obj_id");
1971 statement.execute(
"CREATE TABLE temp_tsk_events ( "
1972 +
" event_id BIGSERIAL PRIMARY KEY, "
1973 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1974 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id),"
1975 +
" time BIGINT NOT NULL, "
1976 +
" UNIQUE (event_type_id, event_description_id, time))"
1980 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
1981 +
"event_description_id, time) SELECT * FROM tsk_events");
1984 statement.execute(
"DROP TABLE tsk_events");
1987 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
1990 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1991 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
1992 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1993 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1994 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
1998 boolean hasMisnamedColumn =
false;
1999 results = statement.executeQuery(
"pragma table_info('tsk_event_descriptions')");
2000 while (results.next()) {
2001 if (results.getString(
"name") != null && results.getString(
"name").equals(
"file_obj_id")) {
2002 hasMisnamedColumn =
true;
2007 if (hasMisnamedColumn) {
2009 statement.execute(
"CREATE TABLE temp_tsk_event_descriptions ("
2010 +
" event_description_id INTEGER PRIMARY KEY, "
2011 +
" full_description TEXT NOT NULL, "
2012 +
" med_description TEXT, "
2013 +
" short_description TEXT,"
2014 +
" data_source_obj_id BIGINT NOT NULL, "
2015 +
" content_obj_id BIGINT NOT NULL, "
2016 +
" artifact_id BIGINT, "
2017 +
" hash_hit INTEGER NOT NULL, "
2018 +
" tagged INTEGER NOT NULL, "
2019 +
" UNIQUE(full_description, content_obj_id, artifact_id), "
2020 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2021 +
" FOREIGN KEY(content_obj_id) REFERENCES tsk_files(obj_id), "
2022 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2025 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2026 +
" event_id INTEGER PRIMARY KEY, "
2027 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2028 +
" event_description_id BIGINT NOT NULL REFERENCES temp_tsk_event_descriptions(event_description_id),"
2029 +
" time INTEGER NOT NULL, "
2030 +
" UNIQUE (event_type_id, event_description_id, time))"
2034 statement.execute(
"INSERT INTO temp_tsk_event_descriptions(event_description_id, full_description, "
2035 +
"med_description, short_description, data_source_obj_id, content_obj_id, artifact_id, "
2036 +
"hash_hit, tagged) SELECT * FROM tsk_event_descriptions");
2038 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2039 +
"event_description_id, time) SELECT * FROM tsk_events");
2042 statement.execute(
"DROP TABLE tsk_events");
2043 statement.execute(
"DROP TABLE tsk_event_descriptions");
2046 statement.execute(
"ALTER TABLE temp_tsk_event_descriptions RENAME TO tsk_event_descriptions");
2047 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2050 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2051 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2052 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2053 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2054 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2058 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2062 if (this.dbType.equals(DbType.SQLITE)) {
2063 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id INTEGER PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2065 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id BIGSERIAL PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2069 insertAccountTypeIfNotExists(statement,
"IMO",
"IMO");
2070 insertAccountTypeIfNotExists(statement,
"LINE",
"LINE");
2071 insertAccountTypeIfNotExists(statement,
"SKYPE",
"Skype");
2072 insertAccountTypeIfNotExists(statement,
"TANGO",
"Tango");
2073 insertAccountTypeIfNotExists(statement,
"TEXTNOW",
"TextNow");
2074 insertAccountTypeIfNotExists(statement,
"THREEMA",
"ThreeMa");
2075 insertAccountTypeIfNotExists(statement,
"VIBER",
"Viber");
2076 insertAccountTypeIfNotExists(statement,
"XENDER",
"Xender");
2077 insertAccountTypeIfNotExists(statement,
"ZAPYA",
"Zapya");
2078 insertAccountTypeIfNotExists(statement,
"SHAREIT",
"ShareIt");
2080 return new CaseDbSchemaVersionNumber(8, 4);
2082 closeResultSet(results);
2083 closeStatement(statement);
2099 private void insertAccountTypeIfNotExists(Statement statement, String type_name, String display_name)
throws TskCoreException, SQLException {
2101 String insertSQL = String.format(
"INTO account_types(type_name, display_name) VALUES ('%s', '%s')", type_name, display_name);
2104 insertSQL =
"INSERT " + insertSQL +
" ON CONFLICT DO NOTHING";
2107 insertSQL =
"INSERT OR IGNORE " + insertSQL;
2110 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
2112 statement.execute(insertSQL);
2121 static String extractExtension(
final String fileName) {
2123 int i = fileName.lastIndexOf(
".");
2125 if ((i > 0) && ((i + 1) < fileName.length())) {
2126 ext = fileName.substring(i + 1);
2137 return ext.toLowerCase();
2161 return CURRENT_DB_SCHEMA_VERSION;
2171 return caseDBSchemaCreationVersion;
2190 return dbBackupPath;
2213 return databaseName;
2233 rwLock.writeLock().lock();
2244 rwLock.writeLock().unlock();
2255 rwLock.readLock().lock();
2266 rwLock.readLock().unlock();
2286 }
catch (Exception ex) {
2287 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
2317 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType());
2318 }
catch (PropertyVetoException exp) {
2320 throw new TskCoreException(exp.getMessage(), exp);
2324 }
catch (Exception exp) {
2326 throw new TskCoreException(exp.getMessage(), exp);
2343 }
catch (Exception ex) {
2344 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
2364 String databaseName = createCaseDataBaseName(caseName);
2379 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
2380 databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType());
2381 }
catch (PropertyVetoException exp) {
2383 throw new TskCoreException(exp.getMessage(), exp);
2384 }
catch (Exception exp) {
2386 throw new TskCoreException(exp.getMessage(), exp);
2399 private static String createCaseDataBaseName(String candidateDbName) {
2401 if (!candidateDbName.isEmpty()) {
2405 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
2410 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
2415 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
2420 dbName = dbName.toLowerCase();
2426 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
2427 dbName =
"_" + dbName;
2434 if (dbName.length() > MAX_DB_NAME_LEN_BEFORE_TIMESTAMP) {
2435 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
2447 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
2448 Date date =
new Date();
2449 dbName = dbName +
"_" + dateFormat.format(date);
2464 if (cachedCurrentExaminer != null) {
2465 return cachedCurrentExaminer;
2467 String loginName = System.getProperty(
"user.name");
2468 if (loginName == null || loginName.isEmpty()) {
2469 throw new TskCoreException(
"Failed to determine logged in user name.");
2472 CaseDbConnection connection = connections.getConnection();
2474 ResultSet resultSet = null;
2476 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME);
2477 statement.clearParameters();
2478 statement.setString(1, loginName);
2479 resultSet = connection.executeQuery(statement);
2480 if (resultSet.next()) {
2481 cachedCurrentExaminer =
new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"display_name"));
2482 return cachedCurrentExaminer;
2484 throw new TskCoreException(
"Error getting examaminer for name = " + loginName);
2487 }
catch (SQLException ex) {
2488 throw new TskCoreException(
"Error getting examaminer for name = " + loginName, ex);
2490 closeResultSet(resultSet);
2506 Examiner getExaminerById(
long id)
throws TskCoreException {
2508 CaseDbConnection connection = connections.getConnection();
2510 ResultSet resultSet = null;
2512 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_ID);
2513 statement.clearParameters();
2514 statement.setLong(1,
id);
2515 resultSet = connection.executeQuery(statement);
2516 if (resultSet.next()) {
2517 return new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"full_name"));
2519 throw new TskCoreException(
"Error getting examaminer for id = " +
id);
2521 }
catch (SQLException ex) {
2522 throw new TskCoreException(
"Error getting examaminer for id = " +
id, ex);
2524 closeResultSet(resultSet);
2548 return this.caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath,
this);
2560 CaseDbConnection connection = connections.getConnection();
2563 ResultSet rs = null;
2565 s = connection.createStatement();
2566 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
2567 +
"WHERE par_obj_id IS NULL");
2568 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
2570 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
2573 List<Content> rootObjs =
new ArrayList<Content>();
2574 for (ObjectInfo i : infos) {
2575 if (null != i.type) {
2586 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
2592 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
2597 }
catch (SQLException ex) {
2598 throw new TskCoreException(
"Error getting root objects", ex);
2618 List<Long> getDataSourceObjIds(String deviceId)
throws TskCoreException {
2621 synchronized (deviceIdToDatasourceObjIdMap) {
2622 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
2623 return new ArrayList<Long>(deviceIdToDatasourceObjIdMap.get(deviceId));
2626 CaseDbConnection connection = connections.getConnection();
2629 ResultSet rs = null;
2631 s = connection.createStatement();
2632 rs = connection.executeQuery(s,
"SELECT obj_id FROM data_source_info WHERE device_id = '" + deviceId +
"'");
2633 List<Long> dataSourceObjIds =
new ArrayList<Long>();
2635 dataSourceObjIds.add(rs.getLong(
"obj_id"));
2638 long ds_obj_id = rs.getLong(
"obj_id");
2639 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
2640 deviceIdToDatasourceObjIdMap.get(deviceId).add(ds_obj_id);
2642 deviceIdToDatasourceObjIdMap.put(deviceId,
new HashSet<Long>(Arrays.asList(ds_obj_id)));
2645 return dataSourceObjIds;
2646 }
catch (SQLException ex) {
2647 throw new TskCoreException(
"Error getting data sources", ex);
2674 CaseDbConnection connection = connections.getConnection();
2676 Statement statement = null;
2677 ResultSet resultSet = null;
2678 Statement statement2 = null;
2679 ResultSet resultSet2 = null;
2681 statement = connection.createStatement();
2682 statement2 = connection.createStatement();
2683 resultSet = connection.executeQuery(statement,
2684 "SELECT ds.obj_id, ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
2685 +
"FROM data_source_info AS ds "
2686 +
"LEFT JOIN tsk_image_info AS img "
2687 +
"ON ds.obj_id = img.obj_id");
2689 List<DataSource> dataSourceList =
new ArrayList<DataSource>();
2692 while (resultSet.next()) {
2694 Long objectId = resultSet.getLong(
"obj_id");
2695 String deviceId = resultSet.getString(
"device_id");
2696 String timezone = resultSet.getString(
"time_zone");
2697 String type = resultSet.getString(
"type");
2705 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
2706 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
2714 String parentPath =
"/";
2715 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null,
FileKnown.
UNKNOWN, parentPath);
2720 Long ssize = resultSet.getLong(
"ssize");
2721 Long size = resultSet.getLong(
"size");
2722 String md5 = resultSet.getString(
"md5");
2723 String sha1 = resultSet.getString(
"sha1");
2724 String sha256 = resultSet.getString(
"sha256");
2725 String name = resultSet.getString(
"display_name");
2727 List<String> imagePaths = imagePathsMap.get(objectId);
2729 if (imagePaths.size() > 0) {
2730 String path = imagePaths.get(0);
2731 name = (
new java.io.File(path)).getName();
2737 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
2738 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
2741 dataSourceList.add(dataSource);
2744 return dataSourceList;
2746 }
catch (SQLException ex) {
2747 throw new TskCoreException(
"Error getting data sources", ex);
2749 closeResultSet(resultSet);
2750 closeStatement(statement);
2751 closeResultSet(resultSet2);
2752 closeStatement(statement2);
2779 CaseDbConnection connection = connections.getConnection();
2781 Statement statement = null;
2782 ResultSet resultSet = null;
2783 Statement statement2 = null;
2784 ResultSet resultSet2 = null;
2786 statement = connection.createStatement();
2787 statement2 = connection.createStatement();
2788 resultSet = connection.executeQuery(statement,
2789 "SELECT ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
2790 +
"FROM data_source_info AS ds "
2791 +
"LEFT JOIN tsk_image_info AS img "
2792 +
"ON ds.obj_id = img.obj_id "
2793 +
"WHERE ds.obj_id = " + objectId);
2794 if (resultSet.next()) {
2795 String deviceId = resultSet.getString(
"device_id");
2796 String timezone = resultSet.getString(
"time_zone");
2797 String type = resultSet.getString(
"type");
2805 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
2806 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
2813 String parentPath =
"/";
2814 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null,
FileKnown.
UNKNOWN, parentPath);
2819 Long ssize = resultSet.getLong(
"ssize");
2820 Long size = resultSet.getLong(
"size");
2821 String md5 = resultSet.getString(
"md5");
2822 String sha1 = resultSet.getString(
"sha1");
2823 String sha256 = resultSet.getString(
"sha256");
2824 String name = resultSet.getString(
"display_name");
2826 List<String> imagePaths = getImagePathsById(objectId);
2828 if (imagePaths.size() > 0) {
2829 String path = imagePaths.get(0);
2830 name = (
new java.io.File(path)).getName();
2836 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
2837 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
2840 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
2842 }
catch (SQLException ex) {
2843 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
2845 closeResultSet(resultSet);
2846 closeStatement(statement);
2847 closeResultSet(resultSet2);
2848 closeStatement(statement2);
2867 return getArtifactsHelper(
"blackboard_artifacts.artifact_type_id = " + artifactTypeID);
2881 CaseDbConnection connection = connections.getConnection();
2883 ResultSet rs = null;
2886 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE);
2887 statement.clearParameters();
2888 statement.setLong(1, objId);
2889 rs = connection.executeQuery(statement);
2892 count = rs.getLong(
"count");
2895 }
catch (SQLException ex) {
2896 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
2915 CaseDbConnection connection = connections.getConnection();
2917 ResultSet rs = null;
2920 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE);
2921 statement.clearParameters();
2922 statement.setInt(1, artifactTypeID);
2923 rs = connection.executeQuery(statement);
2926 count = rs.getLong(
"count");
2929 }
catch (SQLException ex) {
2930 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
2953 CaseDbConnection connection = connections.getConnection();
2956 ResultSet rs = null;
2958 s = connection.createStatement();
2959 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
2960 +
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
2961 +
"types.type_name AS type_name, types.display_name AS display_name, "
2962 +
" arts.review_status_id AS review_status_id "
2963 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
2964 +
"WHERE arts.artifact_id = attrs.artifact_id "
2965 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
2966 +
" AND attrs.value_text = '" + value +
"'"
2967 +
" AND types.artifact_type_id=arts.artifact_type_id"
2969 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
2971 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
2972 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
2976 }
catch (SQLException ex) {
2977 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3004 String valSubStr =
"%" + subString;
3005 if (startsWith ==
false) {
3008 CaseDbConnection connection = connections.getConnection();
3011 ResultSet rs = null;
3013 s = connection.createStatement();
3014 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3015 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3016 +
" types.type_name AS type_name, types.display_name AS display_name, "
3017 +
" arts.review_status_id AS review_status_id "
3018 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3019 +
" WHERE arts.artifact_id = attrs.artifact_id "
3020 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3021 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
3022 +
" AND types.artifact_type_id=arts.artifact_type_id "
3024 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3026 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3027 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3031 }
catch (SQLException ex) {
3032 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3056 CaseDbConnection connection = connections.getConnection();
3059 ResultSet rs = null;
3061 s = connection.createStatement();
3062 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3063 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3064 +
" types.type_name AS type_name, types.display_name AS display_name, "
3065 +
" arts.review_status_id AS review_status_id "
3066 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3067 +
"WHERE arts.artifact_id = attrs.artifact_id "
3068 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3069 +
" AND attrs.value_int32 = " + value
3070 +
" AND types.artifact_type_id=arts.artifact_type_id "
3072 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3074 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3075 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3079 }
catch (SQLException ex) {
3080 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3104 CaseDbConnection connection = connections.getConnection();
3107 ResultSet rs = null;
3109 s = connection.createStatement();
3110 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3111 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3112 +
" types.type_name AS type_name, types.display_name AS display_name, "
3113 +
" arts.review_status_id AS review_status_id "
3114 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3115 +
" WHERE arts.artifact_id = attrs.artifact_id "
3116 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3117 +
" AND attrs.value_int64 = " + value
3118 +
" AND types.artifact_type_id=arts.artifact_type_id "
3120 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3122 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3123 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3127 }
catch (SQLException ex) {
3128 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3152 CaseDbConnection connection = connections.getConnection();
3155 ResultSet rs = null;
3157 s = connection.createStatement();
3158 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3159 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3160 +
" types.type_name AS type_name, types.display_name AS display_name, "
3161 +
" arts.review_status_id AS review_status_id "
3162 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3163 +
" WHERE arts.artifact_id = attrs.artifact_id "
3164 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3165 +
" AND attrs.value_double = " + value
3166 +
" AND types.artifact_type_id=arts.artifact_type_id "
3168 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3170 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3171 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3175 }
catch (SQLException ex) {
3176 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3200 CaseDbConnection connection = connections.getConnection();
3203 ResultSet rs = null;
3205 s = connection.createStatement();
3206 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3207 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3208 +
" types.type_name AS type_name, types.display_name AS display_name, "
3209 +
" arts.review_status_id AS review_status_id "
3210 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3211 +
" WHERE arts.artifact_id = attrs.artifact_id "
3212 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3213 +
" AND attrs.value_byte = " + value
3214 +
" AND types.artifact_type_id=arts.artifact_type_id "
3216 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3218 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3219 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3223 }
catch (SQLException ex) {
3224 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3241 CaseDbConnection connection = connections.getConnection();
3244 ResultSet rs = null;
3246 s = connection.createStatement();
3247 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types");
3251 rs.getString(
"type_name"), rs.getString(
"display_name")));
3253 return artifactTypes;
3254 }
catch (SQLException ex) {
3255 throw new TskCoreException(
"Error getting artifact types", ex);
3273 String typeIdList =
"";
3280 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
3281 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
3282 CaseDbConnection connection = connections.getConnection();
3285 ResultSet rs = null;
3287 s = connection.createStatement();
3288 rs = connection.executeQuery(s, query);
3294 }
catch (SQLException ex) {
3295 throw new TskCoreException(
"Error getting artifact types in use", ex);
3315 CaseDbConnection connection = connections.getConnection();
3318 ResultSet rs = null;
3320 s = connection.createStatement();
3321 rs = connection.executeQuery(s,
3322 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
3323 +
"types.type_name AS type_name, types.display_name AS display_name "
3324 +
"FROM blackboard_artifact_types AS types "
3325 +
"INNER JOIN blackboard_artifacts AS arts "
3326 +
"ON arts.artifact_type_id = types.artifact_type_id");
3330 rs.getString(
"type_name"), rs.getString(
"display_name")));
3332 return uniqueArtifactTypes;
3333 }
catch (SQLException ex) {
3334 throw new TskCoreException(
"Error getting attribute types", ex);
3351 CaseDbConnection connection = connections.getConnection();
3354 ResultSet rs = null;
3356 s = connection.createStatement();
3357 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
3363 return attribute_types;
3364 }
catch (SQLException ex) {
3365 throw new TskCoreException(
"Error getting attribute types", ex);
3386 CaseDbConnection connection = connections.getConnection();
3389 ResultSet rs = null;
3391 s = connection.createStatement();
3392 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
3395 count = rs.getInt(
"count");
3398 }
catch (SQLException ex) {
3399 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
3420 ArrayList<BlackboardArtifact> getArtifactsHelper(String whereClause)
throws TskCoreException {
3421 CaseDbConnection connection = connections.getConnection();
3423 ResultSet rs = null;
3425 Statement statement = connection.createStatement();
3426 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
3427 +
"blackboard_artifacts.obj_id AS obj_id, "
3428 +
"blackboard_artifacts.artifact_obj_id AS artifact_obj_id, "
3429 +
"blackboard_artifacts.data_source_obj_id AS data_source_obj_id, "
3430 +
"blackboard_artifact_types.artifact_type_id AS artifact_type_id, "
3431 +
"blackboard_artifact_types.type_name AS type_name, "
3432 +
"blackboard_artifact_types.display_name AS display_name, "
3433 +
"blackboard_artifacts.review_status_id AS review_status_id "
3434 +
"FROM blackboard_artifacts, blackboard_artifact_types "
3435 +
"WHERE blackboard_artifacts.artifact_type_id = blackboard_artifact_types.artifact_type_id "
3437 +
" AND " + whereClause;
3438 rs = connection.executeQuery(statement, query);
3439 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3441 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3442 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3446 }
catch (SQLException ex) {
3447 throw new TskCoreException(
"Error getting or creating a blackboard artifact", ex);
3467 private long getArtifactsCountHelper(
int artifactTypeID,
long obj_id)
throws TskCoreException {
3468 CaseDbConnection connection = connections.getConnection();
3470 ResultSet rs = null;
3473 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE);
3474 statement.clearParameters();
3475 statement.setLong(1, obj_id);
3476 statement.setInt(2, artifactTypeID);
3477 rs = connection.executeQuery(statement);
3480 count = rs.getLong(
"count");
3483 }
catch (SQLException ex) {
3484 throw new TskCoreException(
"Error getting blackboard artifact count", ex);
3505 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
3521 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID +
";");
3553 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
3554 if (artifactTypeID == -1) {
3557 return getArtifactsCountHelper(artifactTypeID, obj_id);
3573 return getArtifactsCountHelper(artifactTypeID, obj_id);
3589 return getArtifactsCountHelper(artifactType.getTypeID(), obj_id);
3604 return getArtifactsHelper(
"blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
3619 return getArtifactsHelper(
"blackboard_artifact_types.artifact_type_id = " + artifactType.getTypeID() +
";");
3636 CaseDbConnection connection = connections.getConnection();
3639 ResultSet rs = null;
3641 s = connection.createStatement();
3642 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3643 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3644 +
"types.type_name AS type_name, types.display_name AS display_name,"
3645 +
"arts.review_status_id AS review_status_id "
3646 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3647 +
"WHERE arts.artifact_id = attrs.artifact_id "
3648 +
"AND attrs.attribute_type_id = " + attrType.getTypeID()
3649 +
" AND arts.artifact_type_id = " + artifactType.getTypeID()
3650 +
" AND attrs.value_text = '" + value +
"'"
3651 +
" AND types.artifact_type_id=arts.artifact_type_id"
3653 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3655 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3656 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3660 }
catch (SQLException ex) {
3661 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
3681 CaseDbConnection connection = connections.getConnection();
3683 ResultSet rs = null;
3686 s = connection.createStatement();
3687 rs = connection.executeQuery(s,
"SELECT arts.artifact_id AS artifact_id, "
3688 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3689 +
"types.type_name AS type_name, types.display_name AS display_name,"
3690 +
"arts.review_status_id AS review_status_id "
3691 +
"FROM blackboard_artifacts AS arts, blackboard_artifact_types AS types "
3692 +
"WHERE arts.artifact_id = " + artifactID
3693 +
" AND arts.artifact_type_id = types.artifact_type_id");
3695 return new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3696 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3704 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
3706 }
catch (SQLException ex) {
3707 throw new TskCoreException(
"Error getting a blackboard artifact. " + ex.getMessage(), ex);
3724 CaseDbConnection connection = connections.getConnection();
3727 addBlackBoardAttribute(attr, artifactTypeId, connection);
3728 }
catch (SQLException ex) {
3729 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
3746 CaseDbConnection connection = connections.getConnection();
3749 connection.beginTransaction();
3751 addBlackBoardAttribute(attr, artifactTypeId, connection);
3753 connection.commitTransaction();
3754 }
catch (SQLException ex) {
3755 connection.rollbackTransaction();
3756 throw new TskCoreException(
"Error adding blackboard attributes", ex);
3763 private void addBlackBoardAttribute(
BlackboardAttribute attr,
int artifactTypeId, CaseDbConnection connection)
throws SQLException, TskCoreException {
3764 PreparedStatement statement;
3765 switch (attr.getAttributeType().getValueType()) {
3768 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_STRING_ATTRIBUTE);
3769 statement.clearParameters();
3770 statement.setString(7, attr.getValueString());
3773 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_BYTE_ATTRIBUTE);
3774 statement.clearParameters();
3775 statement.setBytes(7, attr.getValueBytes());
3778 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INT_ATTRIBUTE);
3779 statement.clearParameters();
3780 statement.setInt(7, attr.getValueInt());
3783 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
3784 statement.clearParameters();
3785 statement.setLong(7, attr.getValueLong());
3788 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DOUBLE_ATTRIBUTE);
3789 statement.clearParameters();
3790 statement.setDouble(7, attr.getValueDouble());
3793 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
3794 statement.clearParameters();
3795 statement.setLong(7, attr.getValueLong());
3798 throw new TskCoreException(
"Unrecognized artifact attribute value type");
3800 statement.setLong(1, attr.getArtifactID());
3801 statement.setInt(2, artifactTypeId);
3802 statement.setString(3, attr.getSourcesCSV());
3803 statement.setString(4,
"");
3804 statement.setInt(5, attr.getAttributeType().getTypeID());
3805 statement.setLong(6, attr.getAttributeType().getValueType().getType());
3806 connection.executeUpdate(statement);
3819 String addSourceToArtifactAttribute(BlackboardAttribute attr, String source)
throws TskCoreException {
3827 if (null == source || source.isEmpty()) {
3828 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
3830 CaseDbConnection connection = connections.getConnection();
3832 Statement queryStmt = null;
3833 Statement updateStmt = null;
3834 ResultSet result = null;
3835 String newSources =
"";
3837 connection.beginTransaction();
3838 String valueClause =
"";
3839 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
3840 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
3841 switch (valueType) {
3847 valueClause =
" value_int32 = " + attr.getValueInt();
3851 valueClause =
" value_int64 = " + attr.getValueLong();
3854 valueClause =
" value_double = " + attr.getValueDouble();
3857 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
3859 String query =
"SELECT source FROM blackboard_attributes WHERE"
3860 +
" artifact_id = " + attr.getArtifactID()
3861 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
3862 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
3863 +
" AND " + valueClause +
";";
3864 queryStmt = connection.createStatement();
3865 updateStmt = connection.createStatement();
3866 result = connection.executeQuery(queryStmt, query);
3873 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
3874 statement.clearParameters();
3875 statement.setLong(1, attr.getArtifactID());
3876 statement.setLong(2, attr.getAttributeType().getTypeID());
3877 statement.setBytes(3, attr.getValueBytes());
3878 result = connection.executeQuery(statement);
3880 while (result.next()) {
3881 String oldSources = result.getString(
"source");
3882 if (null != oldSources && !oldSources.isEmpty()) {
3883 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
3884 if (!uniqueSources.contains(source)) {
3885 newSources = oldSources +
"," + source;
3887 newSources = oldSources;
3890 newSources = source;
3892 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
3893 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
3894 +
" artifact_id = " + attr.getArtifactID()
3895 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
3896 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
3897 +
" AND " + valueClause +
";";
3898 connection.executeUpdate(updateStmt, update);
3905 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
3906 statement.clearParameters();
3907 statement.setString(1, newSources);
3908 statement.setLong(2, attr.getArtifactID());
3909 statement.setLong(3, attr.getAttributeType().getTypeID());
3910 statement.setBytes(4, attr.getValueBytes());
3911 connection.executeUpdate(statement);
3914 connection.commitTransaction();
3916 }
catch (SQLException ex) {
3917 connection.rollbackTransaction();
3918 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
3920 closeResultSet(result);
3921 closeStatement(updateStmt);
3922 closeStatement(queryStmt);
3943 CaseDbConnection connection = connections.getConnection();
3946 ResultSet rs = null;
3948 connection.beginTransaction();
3949 s = connection.createStatement();
3950 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeString +
"'");
3953 rs = connection.executeQuery(s,
"SELECT MAX(attribute_type_id) AS highest_id FROM blackboard_attribute_types");
3956 maxID = rs.getInt(
"highest_id");
3957 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
3958 maxID = MIN_USER_DEFINED_TYPE_ID;
3963 connection.executeUpdate(s,
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES ('" + maxID +
"', '" + attrTypeString +
"', '" + displayName +
"', '" + valueType.getType() +
"')");
3965 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
3966 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
3967 connection.commitTransaction();
3970 throw new TskDataException(
"The attribute type that was added was already within the system.");
3973 }
catch (SQLException ex) {
3974 connection.rollbackTransaction();
3975 throw new TskCoreException(
"Error adding attribute type", ex);
3995 if (this.typeNameToAttributeTypeMap.containsKey(attrTypeName)) {
3996 return this.typeNameToAttributeTypeMap.get(attrTypeName);
3998 CaseDbConnection connection = connections.getConnection();
4001 ResultSet rs = null;
4003 s = connection.createStatement();
4004 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
4009 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
4010 this.typeNameToAttributeTypeMap.put(attrTypeName, type);
4013 }
catch (SQLException ex) {
4014 throw new TskCoreException(
"Error getting attribute type id", ex);
4034 if (this.typeIdToAttributeTypeMap.containsKey(typeID)) {
4035 return this.typeIdToAttributeTypeMap.get(typeID);
4037 CaseDbConnection connection = connections.getConnection();
4040 ResultSet rs = null;
4042 s = connection.createStatement();
4043 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE attribute_type_id = " + typeID +
"");
4044 BlackboardAttribute.Type type = null;
4046 type =
new BlackboardAttribute.Type(rs.getInt(
"attribute_type_id"), rs.getString(
"type_name"),
4047 rs.getString(
"display_name"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(rs.getLong(
"value_type")));
4048 this.typeIdToAttributeTypeMap.put(typeID, type);
4049 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
4052 }
catch (SQLException ex) {
4053 throw new TskCoreException(
"Error getting attribute type id", ex);
4073 if (this.typeNameToArtifactTypeMap.containsKey(artTypeName)) {
4074 return this.typeNameToArtifactTypeMap.get(artTypeName);
4076 CaseDbConnection connection = connections.getConnection();
4079 ResultSet rs = null;
4081 s = connection.createStatement();
4082 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE type_name = '" + artTypeName +
"'");
4086 rs.getString(
"type_name"), rs.getString(
"display_name"));
4087 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4088 this.typeNameToArtifactTypeMap.put(artTypeName, type);
4091 }
catch (SQLException ex) {
4092 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4112 if (this.typeIdToArtifactTypeMap.containsKey(artTypeId)) {
4113 return typeIdToArtifactTypeMap.get(artTypeId);
4115 CaseDbConnection connection = connections.getConnection();
4118 ResultSet rs = null;
4120 s = connection.createStatement();
4121 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE artifact_type_id = " + artTypeId +
"");
4122 BlackboardArtifact.Type type = null;
4124 type =
new BlackboardArtifact.Type(rs.getInt(
"artifact_type_id"),
4125 rs.getString(
"type_name"), rs.getString(
"display_name"));
4126 this.typeIdToArtifactTypeMap.put(artTypeId, type);
4127 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4130 }
catch (SQLException ex) {
4131 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4153 CaseDbConnection connection = connections.getConnection();
4156 ResultSet rs = null;
4158 connection.beginTransaction();
4159 s = connection.createStatement();
4160 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
4163 rs = connection.executeQuery(s,
"SELECT MAX(artifact_type_id) AS highest_id FROM blackboard_artifact_types");
4166 maxID = rs.getInt(
"highest_id");
4167 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
4168 maxID = MIN_USER_DEFINED_TYPE_ID;
4173 connection.executeUpdate(s,
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES ('" + maxID +
"', '" + artifactTypeName +
"', '" + displayName +
"')");
4175 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4176 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4177 connection.commitTransaction();
4180 throw new TskDataException(
"The attribute type that was added was already within the system.");
4182 }
catch (SQLException ex) {
4183 connection.rollbackTransaction();
4184 throw new TskCoreException(
"Error adding artifact type", ex);
4194 CaseDbConnection connection = connections.getConnection();
4196 ResultSet rs = null;
4198 Statement statement = connection.createStatement();
4199 rs = connection.executeQuery(statement,
"SELECT attrs.artifact_id AS artifact_id, "
4200 +
"attrs.source AS source, attrs.context AS context, attrs.attribute_type_id AS attribute_type_id, "
4201 +
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, "
4202 +
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, "
4203 +
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, "
4204 +
"types.type_name AS type_name, types.display_name AS display_name "
4205 +
"FROM blackboard_attributes AS attrs, blackboard_attribute_types AS types WHERE attrs.artifact_id = " + artifact.getArtifactID()
4206 +
" AND attrs.attribute_type_id = types.attribute_type_id");
4207 ArrayList<BlackboardAttribute> attributes =
new ArrayList<BlackboardAttribute>();
4209 int attributeTypeId = rs.getInt(
"attribute_type_id");
4210 String attributeTypeName = rs.getString(
"type_name");
4212 if (this.typeIdToAttributeTypeMap.containsKey(attributeTypeId)) {
4213 attributeType = this.typeIdToAttributeTypeMap.get(attributeTypeId);
4216 rs.getString(
"display_name"),
4218 this.typeIdToAttributeTypeMap.put(attributeTypeId, attributeType);
4219 this.typeNameToAttributeTypeMap.put(attributeTypeName, attributeType);
4223 rs.getLong(
"artifact_id"),
4225 rs.getString(
"source"),
4226 rs.getString(
"context"),
4227 rs.getInt(
"value_int32"),
4228 rs.getLong(
"value_int64"),
4229 rs.getDouble(
"value_double"),
4230 rs.getString(
"value_text"),
4231 rs.getBytes(
"value_byte"), this
4233 attributes.add(attr);
4236 }
catch (SQLException ex) {
4237 throw new TskCoreException(
"Error getting attributes for artifact, artifact id = " + artifact.getArtifactID(), ex);
4258 CaseDbConnection connection = connections.getConnection();
4261 ResultSet rs = null;
4263 s = connection.createStatement();
4264 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
4265 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
4266 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
4267 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
4268 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
4269 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
4270 +
"FROM blackboard_attributes " + whereClause);
4271 ArrayList<BlackboardAttribute> matches =
new ArrayList<BlackboardAttribute>();
4277 rs.getLong(
"artifact_id"),
4279 rs.getString(
"source"),
4280 rs.getString(
"context"),
4281 rs.getInt(
"value_int32"),
4282 rs.getLong(
"value_int64"),
4283 rs.getDouble(
"value_double"),
4284 rs.getString(
"value_text"),
4285 rs.getBytes(
"value_byte"), this
4290 }
catch (SQLException ex) {
4291 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4312 CaseDbConnection connection = connections.getConnection();
4314 ResultSet rs = null;
4317 s = connection.createStatement();
4318 rs = connection.executeQuery(s,
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
4319 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.data_source_obj_id AS data_source_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
4320 +
"blackboard_artifacts.review_status_id AS review_status_id "
4321 +
"FROM blackboard_artifacts " + whereClause);
4322 ArrayList<BlackboardArtifact> matches =
new ArrayList<BlackboardArtifact>();
4328 type.getTypeID(), type.getTypeName(), type.getDisplayName(),
4330 matches.add(artifact);
4333 }
catch (SQLException ex) {
4334 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4373 return newBlackboardArtifact(artifactType.getTypeID(), obj_id, artifactType.getLabel(), artifactType.getDisplayName());
4377 CaseDbConnection connection = connections.getConnection();
4379 ResultSet resultSet = null;
4382 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
4384 PreparedStatement statement = null;
4386 statement = connection.getPreparedStatement(PREPARED_STATEMENT.POSTGRESQL_INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
4387 statement.clearParameters();
4388 statement.setLong(1, obj_id);
4389 statement.setLong(2, artifact_obj_id);
4390 statement.setLong(3, data_source_obj_id);
4391 statement.setInt(4, artifact_type_id);
4394 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
4395 statement.clearParameters();
4396 this.nextArtifactId++;
4397 statement.setLong(1, this.nextArtifactId);
4398 statement.setLong(2, obj_id);
4399 statement.setLong(3, artifact_obj_id);
4400 statement.setLong(4, data_source_obj_id);
4401 statement.setInt(5, artifact_type_id);
4404 connection.executeUpdate(statement);
4405 resultSet = statement.getGeneratedKeys();
4407 return new BlackboardArtifact(
this, resultSet.getLong(1),
4408 obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, artifactTypeName, artifactDisplayName, BlackboardArtifact.ReviewStatus.UNDECIDED,
true);
4409 }
catch (SQLException ex) {
4410 throw new TskCoreException(
"Error creating a blackboard artifact", ex);
4412 closeResultSet(resultSet);
4430 boolean getContentHasChildren(Content content)
throws TskCoreException {
4431 CaseDbConnection connection = connections.getConnection();
4433 ResultSet rs = null;
4436 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
4437 statement.clearParameters();
4438 statement.setLong(1, content.getId());
4439 rs = connection.executeQuery(statement);
4440 boolean hasChildren =
false;
4442 hasChildren = rs.getInt(
"count") > 0;
4445 }
catch (SQLException e) {
4446 throw new TskCoreException(
"Error checking for children of parent " + content, e);
4466 int getContentChildrenCount(Content content)
throws TskCoreException {
4468 if (!this.getHasChildren(content)) {
4472 CaseDbConnection connection = connections.getConnection();
4474 ResultSet rs = null;
4477 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
4478 statement.clearParameters();
4479 statement.setLong(1, content.getId());
4480 rs = connection.executeQuery(statement);
4481 int countChildren = -1;
4483 countChildren = rs.getInt(
"count");
4485 return countChildren;
4486 }
catch (SQLException e) {
4487 throw new TskCoreException(
"Error checking for children of parent " + content, e);
4506 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
4507 CaseDbConnection connection = connections.getConnection();
4509 ResultSet rs = null;
4511 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
4512 statement.clearParameters();
4513 long parentId = parent.getId();
4514 statement.setLong(1, parentId);
4515 statement.setShort(2, type.getFileType());
4516 rs = connection.executeQuery(statement);
4517 return fileChildren(rs, connection, parentId);
4518 }
catch (SQLException ex) {
4519 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4536 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
4537 CaseDbConnection connection = connections.getConnection();
4539 ResultSet rs = null;
4541 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
4542 statement.clearParameters();
4543 long parentId = parent.getId();
4544 statement.setLong(1, parentId);
4545 rs = connection.executeQuery(statement);
4546 return fileChildren(rs, connection, parentId);
4547 }
catch (SQLException ex) {
4548 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4567 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
4568 CaseDbConnection connection = connections.getConnection();
4570 ResultSet rs = null;
4572 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
4573 statement.clearParameters();
4574 statement.setLong(1, parent.getId());
4575 statement.setShort(2, type.getFileType());
4576 rs = connection.executeQuery(statement);
4577 List<Long> children =
new ArrayList<Long>();
4579 children.add(rs.getLong(
"obj_id"));
4582 }
catch (SQLException ex) {
4583 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4600 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
4601 CaseDbConnection connection = connections.getConnection();
4603 ResultSet rs = null;
4605 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
4606 statement.clearParameters();
4607 statement.setLong(1, parent.getId());
4608 rs = connection.executeQuery(statement);
4609 List<Long> children =
new ArrayList<Long>();
4611 children.add(rs.getLong(
"obj_id"));
4614 }
catch (SQLException ex) {
4615 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4633 List<Long> getBlackboardArtifactChildrenIds(Content parent)
throws TskCoreException {
4634 CaseDbConnection connection = connections.getConnection();
4636 ResultSet rs = null;
4638 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
4639 statement.clearParameters();
4640 statement.setLong(1, parent.getId());
4641 rs = connection.executeQuery(statement);
4642 List<Long> children =
new ArrayList<Long>();
4644 children.add(rs.getLong(
"obj_id"));
4647 }
catch (SQLException ex) {
4648 throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
4665 List<Content> getBlackboardArtifactChildren(Content parent)
throws TskCoreException {
4667 long parentId = parent.getId();
4668 ArrayList<BlackboardArtifact> artsArray = getArtifactsHelper(
"blackboard_artifacts.obj_id = " + parentId +
";");
4670 List<Content> lc =
new ArrayList<Content>();
4671 lc.addAll(artsArray);
4683 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
4684 CaseDbConnection connection = connections.getConnection();
4687 ResultSet rs = null;
4689 s = connection.createStatement();
4690 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
4691 +
"FROM tsk_objects LEFT JOIN tsk_files "
4692 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
4693 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
4694 +
" ORDER BY tsk_objects.obj_id");
4695 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
4697 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
4700 }
catch (SQLException ex) {
4701 throw new TskCoreException(
"Error getting Children Info for Content", ex);
4720 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
4721 return getParentInfo(c.getId());
4734 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
4735 CaseDbConnection connection = connections.getConnection();
4738 ResultSet rs = null;
4740 s = connection.createStatement();
4741 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
4742 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
4743 +
"ON child.par_obj_id = parent.obj_id "
4744 +
"WHERE child.obj_id = " + contentId);
4746 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
4750 }
catch (SQLException ex) {
4751 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
4770 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
4775 ObjectInfo parentInfo = getParentInfo(fsc);
4776 if (parentInfo == null) {
4779 Directory parent = null;
4780 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
4781 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
4783 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
4802 Content content = frequentlyUsedContentMap.get(
id);
4803 if (null != content) {
4807 CaseDbConnection connection = connections.getConnection();
4810 ResultSet rs = null;
4815 s = connection.createStatement();
4816 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
4820 parentId = rs.getLong(
"par_obj_id");
4822 }
catch (SQLException ex) {
4823 throw new TskCoreException(
"Error getting Content by ID.", ex);
4835 frequentlyUsedContentMap.put(
id, content);
4838 content = getVolumeSystemById(
id, parentId);
4841 content = getVolumeById(
id, parentId);
4842 frequentlyUsedContentMap.put(
id, content);
4845 content = getPoolById(
id, parentId);
4848 content = getFileSystemById(
id, parentId);
4849 frequentlyUsedContentMap.put(
id, content);
4860 frequentlyUsedContentMap.put(
id, content);
4870 throw new TskCoreException(
"Could not obtain Content object with ID: " +
id);
4883 String getFilePath(
long id) {
4884 CaseDbConnection connection;
4886 connection = connections.getConnection();
4887 }
catch (TskCoreException ex) {
4888 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
4891 String filePath = null;
4893 ResultSet rs = null;
4895 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
4896 statement.clearParameters();
4897 statement.setLong(1,
id);
4898 rs = connection.executeQuery(statement);
4900 filePath = rs.getString(
"path");
4902 }
catch (SQLException ex) {
4903 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
4919 TskData.EncodingType getEncodingType(
long id) {
4920 CaseDbConnection connection;
4922 connection = connections.getConnection();
4923 }
catch (TskCoreException ex) {
4924 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
4927 TskData.EncodingType type = TskData.EncodingType.NONE;
4929 ResultSet rs = null;
4931 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
4932 statement.clearParameters();
4933 statement.setLong(1,
id);
4934 rs = connection.executeQuery(statement);
4936 type = TskData.EncodingType.valueOf(rs.getInt(1));
4938 }
catch (SQLException ex) {
4939 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
4956 String getFileParentPath(
long objectId, CaseDbConnection connection) {
4957 String parentPath = null;
4959 ResultSet rs = null;
4961 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
4962 statement.clearParameters();
4963 statement.setLong(1, objectId);
4964 rs = connection.executeQuery(statement);
4966 parentPath = rs.getString(
"parent_path");
4968 }
catch (SQLException ex) {
4969 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
4985 String getFileName(
long objectId, CaseDbConnection connection) {
4986 String fileName = null;
4988 ResultSet rs = null;
4990 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
4991 statement.clearParameters();
4992 statement.setLong(1, objectId);
4993 rs = connection.executeQuery(statement);
4995 fileName = rs.getString(
"name");
4997 }
catch (SQLException ex) {
4998 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5016 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
5017 CaseDbConnection connection = connections.getConnection();
5018 DerivedFile.DerivedMethod method = null;
5020 ResultSet rs1 = null;
5021 ResultSet rs2 = null;
5023 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
5024 statement.clearParameters();
5025 statement.setLong(1,
id);
5026 rs1 = connection.executeQuery(statement);
5028 int method_id = rs1.getInt(
"derived_id");
5029 String rederive = rs1.getString(
"rederive");
5030 method =
new DerivedFile.DerivedMethod(method_id, rederive);
5031 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
5032 statement.clearParameters();
5033 statement.setInt(1, method_id);
5034 rs2 = connection.executeQuery(statement);
5036 method.setToolName(rs2.getString(
"tool_name"));
5037 method.setToolVersion(rs2.getString(
"tool_version"));
5038 method.setOther(rs2.getString(
"other"));
5041 }
catch (SQLException e) {
5042 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
5044 closeResultSet(rs2);
5045 closeResultSet(rs1);
5063 CaseDbConnection connection = connections.getConnection();
5085 ResultSet rs = null;
5087 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_BY_ID);
5088 statement.clearParameters();
5089 statement.setLong(1, objectId);
5090 rs = connection.executeQuery(statement);
5091 List<AbstractFile> files = resultSetToAbstractFiles(rs, connection);
5092 if (files.size() > 0) {
5093 return files.get(0);
5097 }
catch (SQLException ex) {
5098 throw new TskCoreException(
"Error getting file by id, id = " + objectId, ex);
5116 CaseDbConnection connection = connections.getConnection();
5118 ResultSet rs = null;
5120 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID);
5121 statement.clearParameters();
5122 statement.setLong(1,
id);
5123 rs = connection.executeQuery(statement);
5124 List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
5125 if (artifacts.size() > 0) {
5126 return artifacts.get(0);
5130 }
catch (SQLException ex) {
5131 throw new TskCoreException(
"Error getting artifacts by artifact_obj_id, artifact_obj_id = " +
id, ex);
5150 CaseDbConnection connection = connections.getConnection();
5152 ResultSet rs = null;
5154 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_ID);
5155 statement.clearParameters();
5156 statement.setLong(1,
id);
5157 rs = connection.executeQuery(statement);
5158 List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
5159 if (artifacts.size() > 0) {
5160 return artifacts.get(0);
5164 }
catch (SQLException ex) {
5165 throw new TskCoreException(
"Error getting artifacts by artifact id, artifact id = " +
id, ex);
5185 private long getFileSystemId(
long fileId, CaseDbConnection connection) {
5187 ResultSet rs = null;
5190 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_SYSTEM_BY_OBJECT);
5191 statement.clearParameters();
5192 statement.setLong(1, fileId);
5193 rs = connection.executeQuery(statement);
5195 ret = rs.getLong(
"fs_obj_id");
5200 }
catch (SQLException e) {
5201 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
5221 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
5222 CaseDbConnection connection = connections.getConnection();
5224 Statement statement = null;
5225 ResultSet resultSet = null;
5227 statement = connection.createStatement();
5228 resultSet = connection.executeQuery(statement, query);
5230 return (resultSet.getLong(
"count") > 0L);
5231 }
catch (SQLException ex) {
5232 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
5234 closeResultSet(resultSet);
5235 closeStatement(statement);
5252 public List<AbstractFile>
findFiles(
Content dataSource, String fileName)
throws TskCoreException {
5253 List<AbstractFile> files =
new ArrayList<AbstractFile>();
5254 CaseDbConnection connection = connections.getConnection();
5256 ResultSet resultSet = null;
5258 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME);
5259 statement.clearParameters();
5260 statement.setString(1, fileName.toLowerCase());
5261 statement.setLong(2, dataSource.getId());
5262 resultSet = connection.executeQuery(statement);
5263 files.addAll(resultSetToAbstractFiles(resultSet, connection));
5264 }
catch (SQLException e) {
5265 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
5267 closeResultSet(resultSet);
5287 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, String dirSubString)
throws TskCoreException {
5288 List<AbstractFile> files =
new ArrayList<AbstractFile>();
5289 CaseDbConnection connection = connections.getConnection();
5291 ResultSet resultSet = null;
5293 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
5294 statement.clearParameters();
5295 statement.setString(1, fileName.toLowerCase());
5296 statement.setString(2,
"%" + dirSubString.toLowerCase() +
"%");
5297 statement.setLong(3, dataSource.getId());
5298 resultSet = connection.executeQuery(statement);
5299 files.addAll(resultSetToAbstractFiles(resultSet, connection));
5300 }
catch (SQLException e) {
5301 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
5303 closeResultSet(resultSet);
5323 localTrans.acquireSingleUserCaseWriteLock();
5331 if (null != localTrans) {
5334 }
catch (TskCoreException ex2) {
5335 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
5353 private long addObject(
long parentId,
int objectType, CaseDbConnection connection)
throws SQLException {
5354 ResultSet resultSet = null;
5358 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
5359 statement.clearParameters();
5360 if (parentId != 0) {
5361 statement.setLong(1, parentId);
5363 statement.setNull(1, java.sql.Types.BIGINT);
5365 statement.setInt(2, objectType);
5366 connection.executeUpdate(statement);
5367 resultSet = statement.getGeneratedKeys();
5369 if (resultSet.next()) {
5370 if (parentId != 0) {
5371 setHasChildren(parentId);
5373 return resultSet.getLong(1);
5375 throw new SQLException(
"Error inserting object with parent " + parentId +
" into tsk_objects");
5378 closeResultSet(resultSet);
5401 if (transaction == null) {
5402 throw new TskCoreException(
"Passed null CaseDbTransaction");
5405 transaction.acquireSingleUserCaseWriteLock();
5406 ResultSet resultSet = null;
5409 CaseDbConnection connection = transaction.getConnection();
5414 if (isRootDirectory((AbstractFile) parent, transaction)) {
5417 parentPath = ((AbstractFile) parent).getParentPath() + parent.
getName() +
"/";
5431 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5432 statement.clearParameters();
5433 statement.setLong(1, newObjId);
5436 if (0 != parentId) {
5437 long parentFs = this.getFileSystemId(parentId, connection);
5438 if (parentFs != -1) {
5439 statement.setLong(2, parentFs);
5441 statement.setNull(2, java.sql.Types.BIGINT);
5444 statement.setNull(2, java.sql.Types.BIGINT);
5448 statement.setString(3, directoryName);
5452 statement.setShort(5, (
short) 1);
5456 statement.setShort(6, dirType.
getValue());
5458 statement.setShort(7, metaType.
getValue());
5462 statement.setShort(8, dirFlag.
getValue());
5465 statement.setShort(9, metaFlags);
5468 statement.setLong(10, 0);
5471 statement.setNull(11, java.sql.Types.BIGINT);
5472 statement.setNull(12, java.sql.Types.BIGINT);
5473 statement.setNull(13, java.sql.Types.BIGINT);
5474 statement.setNull(14, java.sql.Types.BIGINT);
5476 statement.setNull(15, java.sql.Types.VARCHAR);
5478 statement.setNull(17, java.sql.Types.VARCHAR);
5481 statement.setString(18, parentPath);
5484 long dataSourceObjectId;
5485 if (0 == parentId) {
5486 dataSourceObjectId = newObjId;
5488 dataSourceObjectId = getDataSourceObjectId(connection, parentId);
5490 statement.setLong(19, dataSourceObjectId);
5493 statement.setString(20, null);
5494 connection.executeUpdate(statement);
5496 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
5499 }
catch (SQLException e) {
5500 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
5502 closeResultSet(resultSet);
5526 }
catch (TskCoreException ex) {
5529 }
catch (TskCoreException ex2) {
5530 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
5556 if (transaction == null) {
5557 throw new TskCoreException(
"Passed null CaseDbTransaction");
5560 transaction.acquireSingleUserCaseWriteLock();
5561 ResultSet resultSet = null;
5564 CaseDbConnection connection = transaction.getConnection();
5567 if ((parent == null) || isRootDirectory(parent, transaction)) {
5580 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5581 statement.clearParameters();
5582 statement.setLong(1, newObjId);
5585 statement.setNull(2, java.sql.Types.BIGINT);
5588 statement.setString(3, directoryName);
5592 statement.setShort(5, (
short) 1);
5596 statement.setShort(6, dirType.
getValue());
5598 statement.setShort(7, metaType.
getValue());
5602 statement.setShort(8, dirFlag.
getValue());
5605 statement.setShort(9, metaFlags);
5608 statement.setLong(10, 0);
5611 statement.setNull(11, java.sql.Types.BIGINT);
5612 statement.setNull(12, java.sql.Types.BIGINT);
5613 statement.setNull(13, java.sql.Types.BIGINT);
5614 statement.setNull(14, java.sql.Types.BIGINT);
5616 statement.setNull(15, java.sql.Types.VARCHAR);
5618 statement.setNull(17, java.sql.Types.VARCHAR);
5621 statement.setString(18, parentPath);
5624 long dataSourceObjectId = getDataSourceObjectId(connection, parentId);
5625 statement.setLong(19, dataSourceObjectId);
5628 statement.setString(20, null);
5630 connection.executeUpdate(statement);
5632 return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
5635 }
catch (SQLException e) {
5636 throw new TskCoreException(
"Error creating local directory '" + directoryName +
"'", e);
5638 closeResultSet(resultSet);
5664 Statement statement = null;
5668 CaseDbConnection connection = transaction.getConnection();
5673 statement = connection.createStatement();
5674 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
5675 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"');");
5684 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5685 preparedStatement.clearParameters();
5686 preparedStatement.setLong(1, newObjId);
5687 preparedStatement.setNull(2, java.sql.Types.BIGINT);
5688 preparedStatement.setString(3, rootDirectoryName);
5690 preparedStatement.setShort(5, (
short) 1);
5694 preparedStatement.setShort(7, metaType.
getValue());
5696 preparedStatement.setShort(8, dirFlag.
getValue());
5699 preparedStatement.setShort(9, metaFlags);
5700 preparedStatement.setLong(10, 0);
5701 preparedStatement.setNull(11, java.sql.Types.BIGINT);
5702 preparedStatement.setNull(12, java.sql.Types.BIGINT);
5703 preparedStatement.setNull(13, java.sql.Types.BIGINT);
5704 preparedStatement.setNull(14, java.sql.Types.BIGINT);
5705 preparedStatement.setNull(15, java.sql.Types.VARCHAR);
5707 preparedStatement.setNull(17, java.sql.Types.VARCHAR);
5708 String parentPath =
"/";
5709 preparedStatement.setString(18, parentPath);
5710 preparedStatement.setLong(19, newObjId);
5711 preparedStatement.setString(20, null);
5712 connection.executeUpdate(preparedStatement);
5714 return new LocalFilesDataSource(
this, newObjId, newObjId, deviceId, rootDirectoryName, dirType, metaType, dirFlag, metaFlags, timeZone, null,
FileKnown.
UNKNOWN, parentPath);
5716 }
catch (SQLException ex) {
5717 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
5719 closeStatement(statement);
5744 String timezone, String md5, String sha1, String sha256,
5748 Statement statement = null;
5751 CaseDbConnection connection = transaction.getConnection();
5756 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
5757 preparedStatement.clearParameters();
5758 preparedStatement.setLong(1, newObjId);
5759 preparedStatement.setShort(2, (
short) type.getValue());
5760 preparedStatement.setLong(3, sectorSize);
5761 preparedStatement.setString(4, timezone);
5763 long savedSize = size < 0 ? 0 : size;
5764 preparedStatement.setLong(5, savedSize);
5765 preparedStatement.setString(6, md5);
5766 preparedStatement.setString(7, sha1);
5767 preparedStatement.setString(8, sha256);
5768 preparedStatement.setString(9, displayName);
5769 connection.executeUpdate(preparedStatement);
5772 for (
int i = 0; i < imagePaths.size(); i++) {
5773 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
5774 preparedStatement.clearParameters();
5775 preparedStatement.setLong(1, newObjId);
5776 preparedStatement.setString(2, imagePaths.get(i));
5777 preparedStatement.setLong(3, i);
5778 connection.executeUpdate(preparedStatement);
5782 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO);
5783 statement = connection.createStatement();
5784 preparedStatement.setLong(1, newObjId);
5785 preparedStatement.setString(2, deviceId);
5786 preparedStatement.setString(3, timezone);
5787 connection.executeUpdate(preparedStatement);
5790 return new Image(
this, newObjId, type.getValue(), deviceId, sectorSize, displayName,
5791 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, savedSize);
5792 }
catch (SQLException ex) {
5793 if (!imagePaths.isEmpty()) {
5794 throw new TskCoreException(String.format(
"Error adding image with path %s to database", imagePaths.get(0)), ex);
5796 throw new TskCoreException(String.format(
"Error adding image with display name %s to database", displayName), ex);
5799 closeStatement(statement);
5822 CaseDbConnection connection = transaction.getConnection();
5823 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
VS.getObjectType(), connection);
5827 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_INFO);
5828 preparedStatement.clearParameters();
5829 preparedStatement.setLong(1, newObjId);
5830 preparedStatement.setShort(2, (
short) type.getVsType());
5831 preparedStatement.setLong(3, imgOffset);
5832 preparedStatement.setLong(4, blockSize);
5833 connection.executeUpdate(preparedStatement);
5836 return new VolumeSystem(
this, newObjId,
"", type.getVsType(), imgOffset, blockSize);
5837 }
catch (SQLException ex) {
5838 throw new TskCoreException(String.format(
"Error creating volume system with parent ID %d and image offset %d",
5839 parentObjId, imgOffset), ex);
5860 public Volume addVolume(
long parentObjId,
long addr,
long start,
long length, String desc,
5863 Statement statement = null;
5866 CaseDbConnection connection = transaction.getConnection();
5871 PreparedStatement preparedStatement;
5873 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL);
5875 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_SQLITE);
5877 preparedStatement.clearParameters();
5878 preparedStatement.setLong(1, newObjId);
5879 preparedStatement.setLong(2, addr);
5880 preparedStatement.setLong(3, start);
5881 preparedStatement.setLong(4, length);
5882 preparedStatement.setString(5, desc);
5883 preparedStatement.setShort(6, (
short) flags);
5884 connection.executeUpdate(preparedStatement);
5887 return new Volume(
this, newObjId, addr, start, length, flags, desc);
5888 }
catch (SQLException ex) {
5889 throw new TskCoreException(String.format(
"Error creating volume with address %d and parent ID %d", addr, parentObjId), ex);
5891 closeStatement(statement);
5909 Statement statement = null;
5912 CaseDbConnection connection = transaction.getConnection();
5917 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_POOL_INFO);
5918 preparedStatement.clearParameters();
5919 preparedStatement.setLong(1, newObjId);
5920 preparedStatement.setShort(2, type.getValue());
5921 connection.executeUpdate(preparedStatement);
5924 return new Pool(
this, newObjId, type.getName(), type.getValue());
5925 }
catch (SQLException ex) {
5926 throw new TskCoreException(String.format(
"Error creating pool with type %d and parent ID %d", type.getValue(), parentObjId), ex);
5928 closeStatement(statement);
5952 long rootInum,
long firstInum,
long lastInum, String displayName,
5955 Statement statement = null;
5958 CaseDbConnection connection = transaction.getConnection();
5959 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
FS.getObjectType(), connection);
5963 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FS_INFO);
5964 preparedStatement.clearParameters();
5965 preparedStatement.setLong(1, newObjId);
5966 preparedStatement.setLong(2, imgOffset);
5967 preparedStatement.setShort(3, (
short) type.getValue());
5968 preparedStatement.setLong(4, blockSize);
5969 preparedStatement.setLong(5, blockCount);
5970 preparedStatement.setLong(6, rootInum);
5971 preparedStatement.setLong(7, firstInum);
5972 preparedStatement.setLong(8, lastInum);
5973 preparedStatement.setString(9, displayName);
5974 connection.executeUpdate(preparedStatement);
5977 return new FileSystem(
this, newObjId, displayName, imgOffset, type, blockSize, blockCount, rootInum,
5978 firstInum, lastInum);
5979 }
catch (SQLException ex) {
5980 throw new TskCoreException(String.format(
"Error creating file system with image offset %d and parent ID %d",
5981 imgOffset, parentObjId), ex);
5983 closeStatement(statement);
6015 long metaAddr,
int metaSeq,
6018 long ctime,
long crtime,
long atime,
long mtime,
6019 boolean isFile,
Content parent)
throws TskCoreException {
6022 Statement queryStatement = null;
6024 CaseDbConnection connection = transaction.getConnection();
6025 transaction.acquireSingleUserCaseWriteLock();
6034 AbstractFile parentFile = (AbstractFile) parent;
6035 if (isRootDirectory(parentFile, transaction)) {
6038 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
6044 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE);
6045 statement.clearParameters();
6046 statement.setLong(1, objectId);
6047 statement.setLong(2, fsObjId);
6048 statement.setLong(3, dataSourceObjId);
6049 statement.setShort(4, (
short) attrType.getValue());
6050 statement.setInt(5, attrId);
6051 statement.setString(6, fileName);
6052 statement.setLong(7, metaAddr);
6053 statement.setInt(8, metaSeq);
6055 statement.setShort(10, (
short) 1);
6057 statement.setShort(11, dirType.
getValue());
6059 statement.setShort(12, metaType.
getValue());
6060 statement.setShort(13, dirFlag.getValue());
6061 statement.setShort(14, metaFlags);
6062 statement.setLong(15, size < 0 ? 0 : size);
6063 statement.setLong(16, ctime);
6064 statement.setLong(17, crtime);
6065 statement.setLong(18, atime);
6066 statement.setLong(19, mtime);
6067 statement.setString(20, parentPath);
6068 final String extension = extractExtension(fileName);
6069 statement.setString(21, extension);
6071 connection.executeUpdate(statement);
6077 attrType, attrId, fileName, metaAddr, metaSeq,
6078 dirType, metaType, dirFlag, metaFlags,
6079 size, ctime, crtime, atime, mtime,
6080 (
short) 0, 0, 0, null, null, parentPath, null,
6083 }
catch (SQLException ex) {
6084 logger.log(Level.WARNING,
"Failed to add file system file", ex);
6086 closeStatement(queryStatement);
6087 if (null != transaction) {
6090 }
catch (TskCoreException ex2) {
6091 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6107 CaseDbConnection connection = connections.getConnection();
6110 ResultSet rs = null;
6112 s = connection.createStatement();
6113 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
6115 +
" AND obj_id = data_source_obj_id"
6116 +
" ORDER BY dir_type, LOWER(name)");
6117 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
6119 virtDirRootIds.add(virtualDirectory(rs, connection));
6121 return virtDirRootIds;
6122 }
catch (SQLException ex) {
6123 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
6145 assert (null != fileRanges);
6146 if (null == fileRanges) {
6147 throw new TskCoreException(
"TskFileRange object is null");
6150 assert (null != parent);
6151 if (null == parent) {
6152 throw new TskCoreException(
"Conent is null");
6156 Statement statement = null;
6157 ResultSet resultSet = null;
6161 transaction.acquireSingleUserCaseWriteLock();
6162 CaseDbConnection connection = transaction.getConnection();
6164 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<LayoutFile>();
6172 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
6181 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6182 prepStmt.clearParameters();
6183 prepStmt.setLong(1, fileRangeId);
6184 prepStmt.setNull(2, java.sql.Types.BIGINT);
6185 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
6187 prepStmt.setNull(5, java.sql.Types.BIGINT);
6192 prepStmt.setLong(10, fileRange.getByteLen());
6193 prepStmt.setNull(11, java.sql.Types.BIGINT);
6194 prepStmt.setNull(12, java.sql.Types.BIGINT);
6195 prepStmt.setNull(13, java.sql.Types.BIGINT);
6196 prepStmt.setNull(14, java.sql.Types.BIGINT);
6197 prepStmt.setNull(15, java.sql.Types.VARCHAR);
6199 prepStmt.setNull(17, java.sql.Types.VARCHAR);
6200 prepStmt.setNull(18, java.sql.Types.VARCHAR);
6201 prepStmt.setLong(19, parent.getId());
6204 prepStmt.setString(20, null);
6205 connection.executeUpdate(prepStmt);
6212 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
6213 prepStmt.clearParameters();
6214 prepStmt.setLong(1, fileRangeId);
6215 prepStmt.setLong(2, fileRange.getByteStart());
6216 prepStmt.setLong(3, fileRange.getByteLen());
6217 prepStmt.setLong(4, fileRange.getSequence());
6218 connection.executeUpdate(prepStmt);
6223 fileRangeLayoutFiles.add(
new LayoutFile(
this,
6226 Long.toString(fileRange.getSequence()),
6232 fileRange.getByteLen(),
6236 parent.getUniquePath(),
6242 return fileRangeLayoutFiles;
6244 }
catch (SQLException ex) {
6245 throw new TskCoreException(
"Failed to add layout files to case database", ex);
6247 closeResultSet(resultSet);
6248 closeStatement(statement);
6251 if (null != transaction) {
6254 }
catch (TskCoreException ex2) {
6255 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6273 assert (null != carvingResult);
6274 if (null == carvingResult) {
6275 throw new TskCoreException(
"Carving is null");
6277 assert (null != carvingResult.getParent());
6278 if (null == carvingResult.getParent()) {
6279 throw new TskCoreException(
"Carving result has null parent");
6281 assert (null != carvingResult.getCarvedFiles());
6282 if (null == carvingResult.getCarvedFiles()) {
6283 throw new TskCoreException(
"Carving result has null carved files");
6286 Statement statement = null;
6287 ResultSet resultSet = null;
6288 long newCacheKey = 0;
6291 transaction.acquireSingleUserCaseWriteLock();
6292 CaseDbConnection connection = transaction.getConnection();
6301 while (null != root) {
6316 if (null == carvedFilesDir) {
6317 List<Content> rootChildren;
6319 rootChildren = ((FileSystem) root).getRootDirectory().
getChildren();
6323 for (
Content child : rootChildren) {
6329 if (null == carvedFilesDir) {
6330 long parId = root.
getId();
6332 if (root instanceof FileSystem) {
6333 Content rootDir = ((FileSystem) root).getRootDirectory();
6334 parId = rootDir.
getId();
6338 newCacheKey = root.
getId();
6339 rootIdsToCarvedFileDirs.put(newCacheKey, carvedFilesDir);
6346 String parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
6347 List<LayoutFile> carvedFiles =
new ArrayList<LayoutFile>();
6363 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6364 prepStmt.clearParameters();
6365 prepStmt.setLong(1, carvedFileId);
6367 prepStmt.setLong(2, root.
getId());
6369 prepStmt.setNull(2, java.sql.Types.BIGINT);
6371 prepStmt.setString(3, carvedFile.getName());
6373 prepStmt.setShort(5, (
short) 1);
6378 prepStmt.setLong(10, carvedFile.getSizeInBytes());
6379 prepStmt.setNull(11, java.sql.Types.BIGINT);
6380 prepStmt.setNull(12, java.sql.Types.BIGINT);
6381 prepStmt.setNull(13, java.sql.Types.BIGINT);
6382 prepStmt.setNull(14, java.sql.Types.BIGINT);
6383 prepStmt.setNull(15, java.sql.Types.VARCHAR);
6385 prepStmt.setNull(17, java.sql.Types.VARCHAR);
6386 prepStmt.setString(18, parentPath);
6388 prepStmt.setString(20, extractExtension(carvedFile.getName()));
6389 connection.executeUpdate(prepStmt);
6396 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
6397 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
6398 prepStmt.clearParameters();
6399 prepStmt.setLong(1, carvedFileId);
6400 prepStmt.setLong(2, tskFileRange.getByteStart());
6401 prepStmt.setLong(3, tskFileRange.getByteLen());
6402 prepStmt.setLong(4, tskFileRange.getSequence());
6403 connection.executeUpdate(prepStmt);
6412 carvedFile.getName(),
6418 carvedFile.getSizeInBytes(),
6430 }
catch (SQLException ex) {
6431 throw new TskCoreException(
"Failed to add carved files to case database", ex);
6433 closeResultSet(resultSet);
6434 closeStatement(statement);
6437 if (null != transaction) {
6440 }
catch (TskCoreException ex2) {
6441 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6443 if (0 != newCacheKey) {
6444 rootIdsToCarvedFileDirs.remove(newCacheKey);
6481 long size,
long ctime,
long crtime,
long atime,
long mtime,
6482 boolean isFile,
Content parentObj,
6483 String rederiveDetails, String toolName, String toolVersion,
6486 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
6492 CaseDbConnection connection = transaction.getConnection();
6494 final long parentId = parentObj.
getId();
6495 String parentPath =
"";
6499 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() +
'/';
6511 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6512 statement.clearParameters();
6513 statement.setLong(1, newObjId);
6516 long fsObjId = this.getFileSystemId(parentId, connection);
6517 if (fsObjId != -1) {
6518 statement.setLong(2, fsObjId);
6520 statement.setNull(2, java.sql.Types.BIGINT);
6522 statement.setString(3, fileName);
6526 statement.setShort(5, (
short) 1);
6530 statement.setShort(6, dirType.
getValue());
6532 statement.setShort(7, metaType.
getValue());
6536 statement.setShort(8, dirFlag.
getValue());
6539 statement.setShort(9, metaFlags);
6543 long savedSize = size < 0 ? 0 : size;
6544 statement.setLong(10, savedSize);
6548 statement.setLong(11, ctime);
6549 statement.setLong(12, crtime);
6550 statement.setLong(13, atime);
6551 statement.setLong(14, mtime);
6553 statement.setNull(15, java.sql.Types.VARCHAR);
6555 statement.setNull(17, java.sql.Types.VARCHAR);
6558 statement.setString(18, parentPath);
6561 long dataSourceObjId = getDataSourceObjectId(connection, parentId);
6562 statement.setLong(19, dataSourceObjId);
6563 final String extension = extractExtension(fileName);
6565 statement.setString(20, extension);
6567 connection.executeUpdate(statement);
6570 addFilePath(connection, newObjId, localPath, encodingType);
6572 DerivedFile derivedFile =
new DerivedFile(
this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
6573 savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
6575 timelineManager.addEventsForNewFile(derivedFile, connection);
6579 }
catch (SQLException ex) {
6580 connection.rollbackTransaction();
6581 throw new TskCoreException(
"Failed to add derived file to case database", ex);
6619 long size,
long ctime,
long crtime,
long atime,
long mtime,
6620 boolean isFile, String mimeType,
6621 String rederiveDetails, String toolName, String toolVersion,
6625 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
6627 CaseDbConnection connection = connections.getConnection();
6629 ResultSet rs = null;
6632 connection.beginTransaction();
6633 final long parentId = parentObj.
getId();
6634 String parentPath =
"";
6638 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() +
'/';
6642 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_DERIVED_FILE);
6643 statement.clearParameters();
6650 statement.setShort(2, dirType.
getValue());
6652 statement.setShort(3, metaType.
getValue());
6656 statement.setShort(4, dirFlag.
getValue());
6659 statement.setShort(5, metaFlags);
6663 long savedSize = size < 0 ? 0 : size;
6664 statement.setLong(6, savedSize);
6668 statement.setLong(7, ctime);
6669 statement.setLong(8, crtime);
6670 statement.setLong(9, atime);
6671 statement.setLong(10, mtime);
6672 statement.setString(11, mimeType);
6673 statement.setString(12, String.valueOf(derivedFile.
getId()));
6674 connection.executeUpdate(statement);
6677 updateFilePath(connection, derivedFile.
getId(), localPath, encodingType);
6679 connection.commitTransaction();
6681 long dataSourceObjId = getDataSourceObjectId(connection, parentId);
6682 final String extension = extractExtension(derivedFile.
getName());
6683 return new DerivedFile(
this, derivedFile.
getId(), dataSourceObjId, derivedFile.
getName(), dirType, metaType, dirFlag, metaFlags,
6684 savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
6685 }
catch (SQLException ex) {
6686 connection.rollbackTransaction();
6687 throw new TskCoreException(
"Failed to add derived file to case database", ex);
6715 long size,
long ctime,
long crtime,
long atime,
long mtime,
6721 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
6726 if (null != localTrans) {
6729 }
catch (TskCoreException ex2) {
6730 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6761 long size,
long ctime,
long crtime,
long atime,
long mtime,
6766 size, ctime, crtime, atime, mtime,
6768 isFile, encodingType,
6769 parent, transaction);
6800 long size,
long ctime,
long crtime,
long atime,
long mtime,
6801 String md5,
FileKnown known, String mimeType,
6804 CaseDbConnection connection = transaction.getConnection();
6805 transaction.acquireSingleUserCaseWriteLock();
6806 Statement queryStatement = null;
6818 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6819 statement.clearParameters();
6820 statement.setLong(1, objectId);
6821 statement.setNull(2, java.sql.Types.BIGINT);
6822 statement.setString(3, fileName);
6824 statement.setShort(5, (
short) 1);
6826 statement.setShort(6, dirType.
getValue());
6828 statement.setShort(7, metaType.
getValue());
6830 statement.setShort(8, dirFlag.
getValue());
6832 statement.setShort(9, metaFlags);
6834 long savedSize = size < 0 ? 0 : size;
6835 statement.setLong(10, savedSize);
6836 statement.setLong(11, ctime);
6837 statement.setLong(12, crtime);
6838 statement.setLong(13, atime);
6839 statement.setLong(14, mtime);
6840 statement.setString(15, md5);
6841 if (known != null) {
6842 statement.setByte(16, known.getFileKnownValue());
6846 statement.setString(17, mimeType);
6848 long dataSourceObjId;
6851 AbstractFile parentFile = (AbstractFile) parent;
6852 if (isRootDirectory(parentFile, transaction)) {
6855 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
6860 dataSourceObjId = getDataSourceObjectId(connection, parent.getId());
6862 statement.setString(18, parentPath);
6863 statement.setLong(19, dataSourceObjId);
6864 final String extension = extractExtension(fileName);
6865 statement.setString(20, extension);
6867 connection.executeUpdate(statement);
6868 addFilePath(connection, objectId, localPath, encodingType);
6878 ctime, crtime, atime, mtime,
6879 mimeType, md5, known,
6880 parent.getId(), parentPath,
6883 encodingType, extension);
6887 }
catch (SQLException ex) {
6888 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
6890 closeStatement(queryStatement);
6908 CaseDbConnection connection = transaction.getConnection();
6909 transaction.acquireSingleUserCaseWriteLock();
6910 Statement statement = null;
6911 ResultSet resultSet = null;
6914 String query = String.format(
"SELECT ParentRow.type AS parent_type, ParentRow.obj_id AS parent_object_id "
6915 +
"FROM tsk_objects ParentRow JOIN tsk_objects ChildRow ON ChildRow.par_obj_id = ParentRow.obj_id "
6916 +
"WHERE ChildRow.obj_id = %s;", file.
getId());
6918 statement = connection.createStatement();
6919 resultSet = statement.executeQuery(query);
6920 if (resultSet.next()) {
6921 long parentId = resultSet.getLong(
"parent_object_id");
6922 if (parentId == 0) {
6925 int type = resultSet.getInt(
"parent_type");
6926 return (type == TskData.ObjectType.IMG.getObjectType()
6927 || type == TskData.ObjectType.VS.getObjectType()
6928 || type == TskData.ObjectType.VOL.getObjectType()
6929 || type == TskData.ObjectType.FS.getObjectType());
6934 }
catch (SQLException ex) {
6935 throw new TskCoreException(String.format(
"Failed to lookup parent of file (%s) with id %d", file.
getName(), file.
getId()), ex);
6937 closeResultSet(resultSet);
6938 closeStatement(statement);
6965 long ctime,
long crtime,
long atime,
long mtime,
6966 List<TskFileRange> fileRanges,
6967 Content parent)
throws TskCoreException {
6969 if (null == parent) {
6970 throw new TskCoreException(
"Parent can not be null");
6975 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
6981 Statement statement = null;
6982 ResultSet resultSet = null;
6985 transaction.acquireSingleUserCaseWriteLock();
6986 CaseDbConnection connection = transaction.getConnection();
7002 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7003 prepStmt.clearParameters();
7004 prepStmt.setLong(1, newFileId);
7007 if (0 != parent.getId()) {
7008 long parentFs = this.getFileSystemId(parent.getId(), connection);
7009 if (parentFs != -1) {
7010 prepStmt.setLong(2, parentFs);
7012 prepStmt.setNull(2, java.sql.Types.BIGINT);
7015 prepStmt.setNull(2, java.sql.Types.BIGINT);
7017 prepStmt.setString(3, fileName);
7019 prepStmt.setShort(5, (
short) 0);
7022 prepStmt.setShort(8, dirFlag.getValue());
7023 prepStmt.setShort(9, metaFlag.getValue());
7025 long savedSize = size < 0 ? 0 : size;
7026 prepStmt.setLong(10, savedSize);
7027 prepStmt.setLong(11, ctime);
7028 prepStmt.setLong(12, crtime);
7029 prepStmt.setLong(13, atime);
7030 prepStmt.setLong(14, mtime);
7031 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7033 prepStmt.setNull(17, java.sql.Types.VARCHAR);
7034 prepStmt.setString(18, parentPath);
7035 prepStmt.setLong(19, parent.getDataSource().getId());
7037 prepStmt.setString(20, extractExtension(fileName));
7038 connection.executeUpdate(prepStmt);
7045 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7047 prepStmt.clearParameters();
7048 prepStmt.setLong(1, newFileId);
7049 prepStmt.setLong(2, tskFileRange.getByteStart());
7050 prepStmt.setLong(3, tskFileRange.getByteLen());
7051 prepStmt.setLong(4, tskFileRange.getSequence());
7052 connection.executeUpdate(prepStmt);
7060 parent.getDataSource().getId(),
7066 metaFlag.getValue(),
7068 ctime, crtime, atime, mtime,
7078 }
catch (SQLException ex) {
7079 throw new TskCoreException(
"Failed to add layout file " + fileName +
" to case database", ex);
7081 closeResultSet(resultSet);
7082 closeStatement(statement);
7085 if (null != transaction) {
7088 }
catch (TskCoreException ex2) {
7089 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7107 private long getDataSourceObjectId(CaseDbConnection connection,
long objectId)
throws TskCoreException {
7109 Statement statement = null;
7110 ResultSet resultSet = null;
7112 statement = connection.createStatement();
7113 long dataSourceObjId;
7114 long ancestorId = objectId;
7116 dataSourceObjId = ancestorId;
7117 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
7118 resultSet = statement.executeQuery(query);
7119 if (resultSet.next()) {
7120 ancestorId = resultSet.getLong(
"par_obj_id");
7122 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
7126 }
while (0 != ancestorId);
7127 return dataSourceObjId;
7128 }
catch (SQLException ex) {
7129 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
7131 closeResultSet(resultSet);
7132 closeStatement(statement);
7148 private void addFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
7149 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LOCAL_PATH);
7150 statement.clearParameters();
7151 statement.setLong(1, objId);
7152 statement.setString(2, path);
7153 statement.setInt(3, type.getType());
7154 connection.executeUpdate(statement);
7168 private void updateFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
7169 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_LOCAL_PATH);
7170 statement.clearParameters();
7171 statement.setString(1, path);
7172 statement.setInt(2, type.getType());
7173 statement.setLong(3, objId);
7174 connection.executeUpdate(statement);
7193 return findFiles(dataSource, fileName, parentFile.getName());
7208 CaseDbConnection connection = connections.getConnection();
7211 ResultSet rs = null;
7213 s = connection.createStatement();
7214 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
7216 return rs.getLong(
"count");
7217 }
catch (SQLException e) {
7218 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
7245 CaseDbConnection connection = connections.getConnection();
7248 ResultSet rs = null;
7250 s = connection.createStatement();
7251 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
7252 return resultSetToAbstractFiles(rs, connection);
7253 }
catch (SQLException e) {
7254 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
7276 CaseDbConnection connection = connections.getConnection();
7279 ResultSet rs = null;
7281 s = connection.createStatement();
7282 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
7283 List<Long> ret =
new ArrayList<Long>();
7285 ret.add(rs.getLong(
"obj_id"));
7288 }
catch (SQLException e) {
7289 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
7309 public List<AbstractFile>
openFiles(
Content dataSource, String filePath)
throws TskCoreException {
7316 int lastSlash = path.lastIndexOf(
'/');
7319 if (lastSlash == path.length()) {
7320 path = path.substring(0, lastSlash - 1);
7321 lastSlash = path.lastIndexOf(
'/');
7324 String parentPath = path.substring(0, lastSlash);
7325 String fileName = path.substring(lastSlash);
7327 return findFiles(dataSource, fileName, parentPath);
7341 CaseDbConnection connection = connections.getConnection();
7344 ResultSet rs = null;
7346 s = connection.createStatement();
7347 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
7348 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
7351 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
7355 }
catch (SQLException ex) {
7356 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
7376 CaseDbConnection connection = connections.getConnection();
7378 Statement s1 = null;
7379 ResultSet rs1 = null;
7380 Statement s2 = null;
7381 ResultSet rs2 = null;
7383 s1 = connection.createStatement();
7384 rs1 = connection.executeQuery(s1,
"SELECT tsk_image_info.type, tsk_image_info.ssize, tsk_image_info.tzone, tsk_image_info.size, tsk_image_info.md5, tsk_image_info.sha1, tsk_image_info.sha256, tsk_image_info.display_name, data_source_info.device_id "
7385 +
"FROM tsk_image_info "
7386 +
"INNER JOIN data_source_info ON tsk_image_info.obj_id = data_source_info.obj_id "
7387 +
"WHERE tsk_image_info.obj_id = " +
id);
7389 s2 = connection.createStatement();
7390 rs2 = connection.executeQuery(s2,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " +
id);
7391 List<String> imagePaths =
new ArrayList<String>();
7392 while (rs2.next()) {
7393 imagePaths.add(rs2.getString(
"name"));
7395 long type = rs1.getLong(
"type");
7396 long ssize = rs1.getLong(
"ssize");
7397 String tzone = rs1.getString(
"tzone");
7398 long size = rs1.getLong(
"size");
7399 String md5 = rs1.getString(
"md5");
7400 String sha1 = rs1.getString(
"sha1");
7401 String sha256 = rs1.getString(
"sha256");
7402 String name = rs1.getString(
"display_name");
7404 if (imagePaths.size() > 0) {
7405 String path = imagePaths.get(0);
7406 name = (
new java.io.File(path)).getName();
7411 String device_id = rs1.getString(
"device_id");
7413 return new Image(
this,
id, type, device_id, ssize, name,
7414 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, sha1, sha256, size);
7416 throw new TskCoreException(
"No image found for id: " +
id);
7418 }
catch (SQLException ex) {
7419 throw new TskCoreException(
"Error getting Image by id, id = " +
id, ex);
7421 closeResultSet(rs2);
7423 closeResultSet(rs1);
7442 CaseDbConnection connection = connections.getConnection();
7445 ResultSet rs = null;
7447 s = connection.createStatement();
7448 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
7449 +
"where obj_id = " +
id);
7451 long type = rs.getLong(
"vs_type");
7452 long imgOffset = rs.getLong(
"img_offset");
7453 long blockSize = rs.getLong(
"block_size");
7455 vs.setParent(parent);
7458 throw new TskCoreException(
"No volume system found for id:" +
id);
7460 }
catch (SQLException ex) {
7461 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
7478 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
7479 VolumeSystem vs = getVolumeSystemById(
id, null);
7480 vs.setParentId(parentId);
7495 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
7496 return getFileSystemByIdHelper(
id, parent);
7507 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
7509 FileSystem fs = getFileSystemById(
id, vol);
7510 fs.setParentId(parentId);
7525 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
7526 return getFileSystemByIdHelper(
id, parent);
7540 Pool getPoolById(
long id, Content parent)
throws TskCoreException {
7541 return getPoolByIdHelper(
id, parent);
7552 Pool getPoolById(
long id,
long parentId)
throws TskCoreException {
7553 Pool pool = getPoolById(
id, null);
7554 pool.setParentId(parentId);
7569 private Pool getPoolByIdHelper(
long id, Content parent)
throws TskCoreException {
7572 try (CaseDbConnection connection = connections.getConnection();
7573 Statement s = connection.createStatement();
7574 ResultSet rs = connection.executeQuery(s,
"SELECT * FROM tsk_pool_info "
7575 +
"where obj_id = " +
id);) {
7577 Pool pool =
new Pool(
this, rs.getLong(
"obj_id"), TskData.TSK_POOL_TYPE_ENUM.valueOf(rs.getLong(
"pool_type")).getName(), rs.getLong(
"pool_type"));
7578 pool.setParent(parent);
7582 throw new TskCoreException(
"No pool found for ID:" +
id);
7584 }
catch (SQLException ex) {
7585 throw new TskCoreException(
"Error getting Pool by ID", ex);
7602 private FileSystem getFileSystemByIdHelper(
long id, Content parent)
throws TskCoreException {
7606 synchronized (fileSystemIdMap) {
7607 if (fileSystemIdMap.containsKey(
id)) {
7608 return fileSystemIdMap.get(
id);
7611 CaseDbConnection connection = connections.getConnection();
7614 ResultSet rs = null;
7616 s = connection.createStatement();
7617 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
7618 +
"where obj_id = " +
id);
7620 TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt(
"fs_type"));
7621 FileSystem fs =
new FileSystem(
this, rs.getLong(
"obj_id"),
"", rs.getLong(
"img_offset"),
7622 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
7623 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
7624 fs.setParent(parent);
7626 synchronized (fileSystemIdMap) {
7627 fileSystemIdMap.put(
id, fs);
7631 throw new TskCoreException(
"No file system found for id:" +
id);
7633 }
catch (SQLException ex) {
7634 throw new TskCoreException(
"Error getting File System by ID", ex);
7654 Volume getVolumeById(
long id, VolumeSystem parent)
throws TskCoreException {
7655 CaseDbConnection connection = connections.getConnection();
7658 ResultSet rs = null;
7660 s = connection.createStatement();
7661 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
7662 +
"where obj_id = " +
id);
7673 description = rs.getString(
"desc");
7674 }
catch (Exception ex) {
7675 description = rs.getString(
"descr");
7677 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
7678 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
7680 vol.setParent(parent);
7683 throw new TskCoreException(
"No volume found for id:" +
id);
7685 }
catch (SQLException ex) {
7686 throw new TskCoreException(
"Error getting Volume by ID", ex);
7703 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
7704 Volume vol = getVolumeById(
id, null);
7705 vol.setParentId(parentId);
7720 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
7721 CaseDbConnection connection = connections.getConnection();
7724 ResultSet rs = null;
7726 s = connection.createStatement();
7727 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
7728 +
"WHERE obj_id = " +
id);
7729 Directory temp = null;
7731 final short type = rs.getShort(
"type");
7732 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
7733 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
7734 || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
7735 temp = directory(rs, parentFs);
7737 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
7738 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
7741 throw new TskCoreException(
"No Directory found for id:" +
id);
7744 }
catch (SQLException ex) {
7745 throw new TskCoreException(
"Error getting Directory by ID", ex);
7762 List<FileSystem> fileSystems =
new ArrayList<FileSystem>();
7763 CaseDbConnection connection;
7765 connection = connections.getConnection();
7766 }
catch (TskCoreException ex) {
7767 logger.log(Level.SEVERE,
"Error getting file systems for image " + image.
getId(), ex);
7772 ResultSet rs = null;
7774 s = connection.createStatement();
7777 List<FileSystem> allFileSystems =
new ArrayList<FileSystem>();
7779 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info");
7783 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
7784 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
7786 allFileSystems.add(fs);
7788 }
catch (SQLException ex) {
7789 logger.log(Level.SEVERE,
"There was a problem while trying to obtain all file systems", ex);
7799 Long imageID = null;
7800 Long currentObjID = fs.getId();
7801 while (imageID == null) {
7803 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE tsk_objects.obj_id = " + currentObjID);
7805 currentObjID = rs.getLong(
"par_obj_id");
7807 imageID = rs.getLong(
"obj_id");
7809 }
catch (SQLException ex) {
7810 logger.log(Level.SEVERE,
"There was a problem while trying to obtain this image's file systems", ex);
7818 if (imageID == image.
getId()) {
7819 fileSystems.add(fs);
7822 }
catch (SQLException ex) {
7823 logger.log(Level.SEVERE,
"Error getting case database connection", ex);
7843 List<Content> getImageChildren(
Image img)
throws TskCoreException {
7844 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
7845 List<Content> children =
new ArrayList<Content>();
7846 for (ObjectInfo info : childInfos) {
7847 if (null != info.type) {
7848 switch (info.type) {
7850 children.add(getVolumeSystemById(info.id, img));
7853 children.add(getPoolById(info.id, img));
7856 children.add(getFileSystemById(info.id, img));
7874 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
7891 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
7892 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
7893 List<Long> children =
new ArrayList<Long>();
7894 for (ObjectInfo info : childInfos) {
7895 if (info.type == ObjectType.VS
7896 || info.type == ObjectType.POOL
7897 || info.type == ObjectType.FS
7898 || info.type == ObjectType.ABSTRACTFILE
7899 || info.type == ObjectType.ARTIFACT) {
7900 children.add(info.id);
7901 }
else if (info.type == ObjectType.REPORT) {
7904 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
7920 List<Content> getPoolChildren(Pool pool)
throws TskCoreException {
7921 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
7922 List<Content> children =
new ArrayList<Content>();
7923 for (ObjectInfo info : childInfos) {
7924 if (null != info.type) {
7925 switch (info.type) {
7927 children.add(getVolumeSystemById(info.id, pool));
7942 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
7959 List<Long> getPoolChildrenIds(Pool pool)
throws TskCoreException {
7960 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
7961 List<Long> children =
new ArrayList<Long>();
7962 for (ObjectInfo info : childInfos) {
7963 if (info.type == ObjectType.VS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
7964 children.add(info.id);
7966 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
7982 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
7983 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
7984 List<Content> children =
new ArrayList<Content>();
7985 for (ObjectInfo info : childInfos) {
7986 if (null != info.type) {
7987 switch (info.type) {
7989 children.add(getVolumeById(info.id, vs));
8004 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
8021 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
8022 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
8023 List<Long> children =
new ArrayList<Long>();
8024 for (ObjectInfo info : childInfos) {
8025 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8026 children.add(info.id);
8028 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
8044 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
8045 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
8046 List<Content> children =
new ArrayList<Content>();
8047 for (ObjectInfo info : childInfos) {
8048 if (null != info.type) {
8049 switch (info.type) {
8051 children.add(getPoolById(info.id, vol));
8054 children.add(getFileSystemById(info.id, vol));
8069 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
8086 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
8087 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
8088 final List<Long> children =
new ArrayList<Long>();
8089 for (ObjectInfo info : childInfos) {
8090 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8091 children.add(info.id);
8093 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
8112 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone)
throws TskCoreException {
8113 long imageId = this.caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone,
this);
8127 CaseDbConnection connection = connections.getConnection();
8129 Statement s1 = null;
8130 Statement s2 = null;
8131 ResultSet rs1 = null;
8132 ResultSet rs2 = null;
8134 s1 = connection.createStatement();
8135 rs1 = connection.executeQuery(s1,
"SELECT obj_id FROM tsk_image_info");
8136 s2 = connection.createStatement();
8137 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
8138 while (rs1.next()) {
8139 long obj_id = rs1.getLong(
"obj_id");
8140 rs2 = connection.executeQuery(s2,
"SELECT * FROM tsk_image_names WHERE obj_id = " + obj_id);
8141 List<String> paths =
new ArrayList<String>();
8142 while (rs2.next()) {
8143 paths.add(rs2.getString(
"name"));
8147 imgPaths.put(obj_id, paths);
8150 }
catch (SQLException ex) {
8151 throw new TskCoreException(
"Error getting image paths.", ex);
8153 closeResultSet(rs2);
8155 closeResultSet(rs1);
8172 private List<String> getImagePathsById(
long objectId)
throws TskCoreException {
8173 List<String> imagePaths =
new ArrayList<String>();
8174 CaseDbConnection connection = connections.getConnection();
8176 Statement statement = null;
8177 ResultSet resultSet = null;
8179 statement = connection.createStatement();
8180 resultSet = connection.executeQuery(statement,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + objectId);
8181 while (resultSet.next()) {
8182 imagePaths.add(resultSet.getString(
"name"));
8184 }
catch (SQLException ex) {
8185 throw new TskCoreException(String.format(
"Error getting image names with obj_id = %d", objectId), ex);
8187 closeResultSet(resultSet);
8188 closeStatement(statement);
8203 CaseDbConnection connection = connections.getConnection();
8206 ResultSet rs = null;
8208 s = connection.createStatement();
8209 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
8210 Collection<Long> imageIDs =
new ArrayList<Long>();
8212 imageIDs.add(rs.getLong(
"obj_id"));
8214 List<Image> images =
new ArrayList<Image>();
8215 for (
long id : imageIDs) {
8219 }
catch (SQLException ex) {
8220 throw new TskCoreException(
"Error retrieving images.", ex);
8239 public void setImagePaths(
long obj_id, List<String> paths)
throws TskCoreException {
8240 CaseDbConnection connection = connections.getConnection();
8242 PreparedStatement statement = null;
8244 connection.beginTransaction();
8245 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_IMAGE_NAME);
8246 statement.clearParameters();
8247 statement.setLong(1, obj_id);
8248 connection.executeUpdate(statement);
8249 for (
int i = 0; i < paths.size(); i++) {
8250 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
8251 statement.clearParameters();
8252 statement.setLong(1, obj_id);
8253 statement.setString(2, paths.get(i));
8254 statement.setLong(3, i);
8255 connection.executeUpdate(statement);
8257 connection.commitTransaction();
8258 }
catch (SQLException ex) {
8259 connection.rollbackTransaction();
8260 throw new TskCoreException(
"Error updating image paths.", ex);
8278 void deleteDataSource(
long dataSourceObjectId)
throws TskCoreException {
8279 CaseDbConnection connection = connections.getConnection();
8280 Statement statement = null;
8283 statement = connection.createStatement();
8284 connection.beginTransaction();
8287 statement.execute(
"DELETE FROM tsk_objects WHERE obj_id = " + dataSourceObjectId);
8290 String accountSql =
"DELETE FROM accounts WHERE account_id in (SELECT account_id FROM accounts "
8291 +
"WHERE account_id NOT IN (SELECT account1_id FROM account_relationships) "
8292 +
"AND account_id NOT IN (SELECT account2_id FROM account_relationships))";
8293 statement.execute(accountSql);
8294 connection.commitTransaction();
8295 }
catch (SQLException ex) {
8296 connection.rollbackTransaction();
8297 throw new TskCoreException(
"Error deleting data source.", ex);
8329 private List<AbstractFile> resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
throws SQLException {
8330 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
8333 final short type = rs.getShort(
"type");
8334 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()
8335 && (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
8337 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
8338 result = directory(rs, null);
8340 result = file(rs, null);
8342 results.add(result);
8343 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()
8344 || (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
8345 final VirtualDirectory virtDir = virtualDirectory(rs, connection);
8346 results.add(virtDir);
8347 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR.getFileType()) {
8348 final LocalDirectory localDir = localDirectory(rs);
8349 results.add(localDir);
8350 }
else if (type == TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType()
8351 || type == TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.getFileType()
8352 || type == TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType()
8353 || type == TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType()) {
8354 TSK_DB_FILES_TYPE_ENUM atype = TSK_DB_FILES_TYPE_ENUM.valueOf(type);
8355 String parentPath = rs.getString(
"parent_path");
8356 if (parentPath == null) {
8359 LayoutFile lf =
new LayoutFile(
this,
8360 rs.getLong(
"obj_id"),
8361 rs.getLong(
"data_source_obj_id"),
8362 rs.getString(
"name"),
8364 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8365 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8367 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8368 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
8370 }
else if (type == TSK_DB_FILES_TYPE_ENUM.DERIVED.getFileType()) {
8371 final DerivedFile df;
8372 df = derivedFile(rs, connection, AbstractContent.UNKNOWN_ID);
8374 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL.getFileType()) {
8376 lf = localFile(rs, connection, AbstractContent.UNKNOWN_ID);
8378 }
else if (type == TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType()) {
8379 final SlackFile sf = slackFile(rs, null);
8383 }
catch (SQLException e) {
8384 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
8404 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8405 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8406 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8407 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8408 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8409 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8410 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8411 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8412 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8413 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8414 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
8415 f.setFileSystem(fs);
8430 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
8431 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8432 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8433 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8434 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8435 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8436 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8437 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8438 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8439 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8440 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8441 rs.getString(
"parent_path"));
8442 dir.setFileSystem(fs);
8456 VirtualDirectory virtualDirectory(ResultSet rs, CaseDbConnection connection)
throws SQLException {
8457 String parentPath = rs.getString(
"parent_path");
8458 if (parentPath == null) {
8462 long objId = rs.getLong(
"obj_id");
8463 long dsObjId = rs.getLong(
"data_source_obj_id");
8464 if (objId == dsObjId) {
8466 String deviceId =
"";
8467 String timeZone =
"";
8469 ResultSet rsDataSourceInfo = null;
8473 s = connection.createStatement();
8474 rsDataSourceInfo = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objId);
8475 if (rsDataSourceInfo.next()) {
8476 deviceId = rsDataSourceInfo.getString(
"device_id");
8477 timeZone = rsDataSourceInfo.getString(
"time_zone");
8479 }
catch (SQLException ex) {
8480 logger.log(Level.SEVERE,
"Error data source info for datasource id " + objId, ex);
8482 closeResultSet(rsDataSourceInfo);
8487 return new LocalFilesDataSource(
this,
8490 rs.getString(
"name"),
8491 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8492 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8493 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8494 rs.getShort(
"meta_flags"),
8496 rs.getString(
"md5"),
8497 FileKnown.valueOf(rs.getByte(
"known")),
8500 final VirtualDirectory vd =
new VirtualDirectory(
this,
8502 rs.getString(
"name"),
8503 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8504 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8505 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8506 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
8507 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
8521 LocalDirectory localDirectory(ResultSet rs)
throws SQLException {
8522 String parentPath = rs.getString(
"parent_path");
8523 if (parentPath == null) {
8526 final LocalDirectory ld =
new LocalDirectory(
this, rs.getLong(
"obj_id"),
8527 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
8528 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8529 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8530 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8531 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
8532 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
8549 private DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8550 boolean hasLocalPath = rs.getBoolean(
"has_path");
8551 long objId = rs.getLong(
"obj_id");
8552 String localPath = null;
8553 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
8555 ResultSet rsFilePath = null;
8558 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
8559 statement.clearParameters();
8560 statement.setLong(1, objId);
8561 rsFilePath = connection.executeQuery(statement);
8562 if (rsFilePath.next()) {
8563 localPath = rsFilePath.getString(
"path");
8564 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
8566 }
catch (SQLException ex) {
8567 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
8569 closeResultSet(rsFilePath);
8573 String parentPath = rs.getString(
"parent_path");
8574 if (parentPath == null) {
8577 final DerivedFile df =
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
8578 rs.getString(
"name"),
8579 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8580 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8581 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8583 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8584 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8585 parentPath, localPath, parentId, rs.getString(
"mime_type"),
8586 encodingType, rs.getString(
"extension"));
8603 private LocalFile localFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8604 long objId = rs.getLong(
"obj_id");
8605 String localPath = null;
8606 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
8607 if (rs.getBoolean(
"has_path")) {
8608 ResultSet rsFilePath = null;
8611 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
8612 statement.clearParameters();
8613 statement.setLong(1, objId);
8614 rsFilePath = connection.executeQuery(statement);
8615 if (rsFilePath.next()) {
8616 localPath = rsFilePath.getString(
"path");
8617 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
8619 }
catch (SQLException ex) {
8620 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
8622 closeResultSet(rsFilePath);
8626 String parentPath = rs.getString(
"parent_path");
8627 if (null == parentPath) {
8630 LocalFile file =
new LocalFile(
this, objId, rs.getString(
"name"),
8631 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")),
8632 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8633 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8634 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8636 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8637 rs.getString(
"mime_type"), rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8638 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
8639 localPath, encodingType, rs.getString(
"extension"));
8656 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8657 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8658 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8659 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8660 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8661 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8662 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8663 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8664 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8665 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8666 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
8667 f.setFileSystem(fs);
8682 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8683 List<Content> children =
new ArrayList<Content>();
8686 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
8691 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
8693 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
8694 result = directory(rs, null);
8696 result = file(rs, null);
8698 children.add(result);
8700 VirtualDirectory virtDir = virtualDirectory(rs, connection);
8701 children.add(virtDir);
8705 VirtualDirectory virtDir = virtualDirectory(rs, connection);
8706 children.add(virtDir);
8709 LocalDirectory localDir = localDirectory(rs);
8710 children.add(localDir);
8712 case UNALLOC_BLOCKS:
8716 String parentPath = rs.getString(
"parent_path");
8717 if (parentPath == null) {
8720 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
8721 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), type,
8722 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8723 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8724 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8726 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8727 rs.getString(
"md5"),
8728 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
8733 final DerivedFile df = derivedFile(rs, connection, parentId);
8737 final LocalFile lf = localFile(rs, connection, parentId);
8742 final SlackFile sf = slackFile(rs, null);
8769 private List<BlackboardArtifact> resultSetToArtifacts(ResultSet rs)
throws SQLException, TskCoreException {
8770 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
8773 BlackboardArtifact.Type artifactType =
getArtifactType(rs.getInt(
"artifact_type_id"));
8774 if (artifactType != null) {
8775 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
8776 rs.getInt(
"artifact_type_id"), artifactType.getTypeName(), artifactType.getDisplayName(),
8777 BlackboardArtifact.ReviewStatus.withID(rs.getInt(
"review_status_id"))));
8779 throw new TskCoreException(
"Error looking up artifact type ID " + rs.getInt(
"artifact_type_id") +
" from artifact " + rs.getLong(
"artifact_id"));
8782 }
catch (SQLException e) {
8783 logger.log(Level.SEVERE,
"Error getting artifacts from result set", e);
8846 CaseDbConnection getConnection() throws TskCoreException {
8847 return connections.getConnection();
8850 synchronized long getCaseDbPointer() throws TskCoreException {
8851 if (caseHandle != null) {
8852 return caseHandle.getCaseDbPointer();
8854 throw new TskCoreException(
"Case has been closed");
8873 connections.close();
8874 }
catch (TskCoreException ex) {
8875 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
8878 fileSystemIdMap.clear();
8881 if (this.caseHandle != null) {
8882 this.caseHandle.free();
8883 this.caseHandle = null;
8885 }
catch (TskCoreException ex) {
8886 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
8905 long id = file.getId();
8906 FileKnown currentKnown = file.getKnown();
8907 if (currentKnown.compareTo(fileKnown) > 0) {
8910 CaseDbConnection connection = connections.getConnection();
8912 Statement statement = null;
8914 statement = connection.createStatement();
8915 connection.executeUpdate(statement,
"UPDATE tsk_files "
8916 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
8917 +
"WHERE obj_id=" + id);
8919 file.setKnown(fileKnown);
8920 }
catch (SQLException ex) {
8921 throw new TskCoreException(
"Error setting Known status.", ex);
8923 closeStatement(statement);
8938 void setFileName(String name,
long objId)
throws TskCoreException {
8940 CaseDbConnection connection = connections.getConnection();
8944 preparedStatement.clearParameters();
8945 preparedStatement.setString(1, name);
8946 preparedStatement.setLong(2, objId);
8947 connection.executeUpdate(preparedStatement);
8948 }
catch (SQLException ex) {
8949 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
8964 void setImageName(String name,
long objId)
throws TskCoreException {
8966 CaseDbConnection connection = connections.getConnection();
8969 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_NAME);
8970 preparedStatement.clearParameters();
8971 preparedStatement.setString(1, name);
8972 preparedStatement.setLong(2, objId);
8973 connection.executeUpdate(preparedStatement);
8974 }
catch (SQLException ex) {
8975 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
8992 CaseDbConnection connection = connections.getConnection();
8993 Statement statement = null;
8994 ResultSet rs = null;
8997 statement = connection.createStatement();
8998 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
8999 file.setMIMEType(mimeType);
9000 }
catch (SQLException ex) {
9001 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
9004 closeStatement(statement);
9019 void setMd5Hash(
AbstractFile file, String md5Hash)
throws TskCoreException {
9020 if (md5Hash == null) {
9023 long id = file.getId();
9024 CaseDbConnection connection = connections.getConnection();
9027 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
9028 statement.clearParameters();
9029 statement.setString(1, md5Hash.toLowerCase());
9030 statement.setLong(2,
id);
9031 connection.executeUpdate(statement);
9032 file.setMd5Hash(md5Hash.toLowerCase());
9033 }
catch (SQLException ex) {
9034 throw new TskCoreException(
"Error setting MD5 hash", ex);
9050 void setMd5ImageHash(Image img, String md5Hash)
throws TskCoreException {
9051 if (md5Hash == null) {
9054 long id = img.getId();
9055 CaseDbConnection connection = connections.getConnection();
9058 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_MD5);
9059 statement.clearParameters();
9060 statement.setString(1, md5Hash.toLowerCase());
9061 statement.setLong(2,
id);
9062 connection.executeUpdate(statement);
9063 }
catch (SQLException ex) {
9064 throw new TskCoreException(
"Error setting MD5 hash", ex);
9081 String getMd5ImageHash(Image img)
throws TskCoreException {
9082 long id = img.getId();
9083 CaseDbConnection connection = connections.getConnection();
9085 ResultSet rs = null;
9088 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_MD5);
9089 statement.clearParameters();
9090 statement.setLong(1,
id);
9091 rs = connection.executeQuery(statement);
9093 hash = rs.getString(
"md5");
9096 }
catch (SQLException ex) {
9097 throw new TskCoreException(
"Error getting MD5 hash", ex);
9114 void setSha1ImageHash(Image img, String sha1Hash)
throws TskCoreException {
9115 if (sha1Hash == null) {
9118 long id = img.getId();
9119 CaseDbConnection connection = connections.getConnection();
9122 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA1);
9123 statement.clearParameters();
9124 statement.setString(1, sha1Hash.toLowerCase());
9125 statement.setLong(2,
id);
9126 connection.executeUpdate(statement);
9127 }
catch (SQLException ex) {
9128 throw new TskCoreException(
"Error setting SHA1 hash", ex);
9145 String getSha1ImageHash(Image img)
throws TskCoreException {
9146 long id = img.getId();
9147 CaseDbConnection connection = connections.getConnection();
9149 ResultSet rs = null;
9152 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA1);
9153 statement.clearParameters();
9154 statement.setLong(1,
id);
9155 rs = connection.executeQuery(statement);
9157 hash = rs.getString(
"sha1");
9160 }
catch (SQLException ex) {
9161 throw new TskCoreException(
"Error getting SHA1 hash", ex);
9178 void setSha256ImageHash(Image img, String sha256Hash)
throws TskCoreException {
9179 if (sha256Hash == null) {
9182 long id = img.getId();
9183 CaseDbConnection connection = connections.getConnection();
9186 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA256);
9187 statement.clearParameters();
9188 statement.setString(1, sha256Hash.toLowerCase());
9189 statement.setLong(2,
id);
9190 connection.executeUpdate(statement);
9191 }
catch (SQLException ex) {
9192 throw new TskCoreException(
"Error setting SHA256 hash", ex);
9209 String getSha256ImageHash(Image img)
throws TskCoreException {
9210 long id = img.getId();
9211 CaseDbConnection connection = connections.getConnection();
9213 ResultSet rs = null;
9216 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA256);
9217 statement.clearParameters();
9218 statement.setLong(1,
id);
9219 rs = connection.executeQuery(statement);
9221 hash = rs.getString(
"sha256");
9224 }
catch (SQLException ex) {
9225 throw new TskCoreException(
"Error setting SHA256 hash", ex);
9241 void setAcquisitionDetails(DataSource datasource, String details)
throws TskCoreException {
9243 long id = datasource.getId();
9244 CaseDbConnection connection = connections.getConnection();
9247 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
9248 statement.clearParameters();
9249 statement.setString(1, details);
9250 statement.setLong(2,
id);
9251 connection.executeUpdate(statement);
9252 }
catch (SQLException ex) {
9253 throw new TskCoreException(
"Error setting acquisition details", ex);
9269 String getAcquisitionDetails(DataSource datasource)
throws TskCoreException {
9270 long id = datasource.getId();
9271 CaseDbConnection connection = connections.getConnection();
9273 ResultSet rs = null;
9276 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_DETAILS);
9277 statement.clearParameters();
9278 statement.setLong(1,
id);
9279 rs = connection.executeQuery(statement);
9281 hash = rs.getString(
"acquisition_details");
9284 }
catch (SQLException ex) {
9285 throw new TskCoreException(
"Error setting acquisition details", ex);
9304 if (newStatus == null) {
9307 CaseDbConnection connection = connections.getConnection();
9309 Statement statement = null;
9311 statement = connection.createStatement();
9312 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
9313 +
" SET review_status_id=" + newStatus.getID()
9314 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
9315 }
catch (SQLException ex) {
9316 throw new TskCoreException(
"Error setting review status", ex);
9318 closeStatement(statement);
9335 CaseDbConnection connection = connections.getConnection();
9338 ResultSet rs = null;
9340 s = connection.createStatement();
9341 Short contentShort = contentType.getValue();
9342 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
9345 count = rs.getInt(
"count");
9348 }
catch (SQLException ex) {
9349 throw new TskCoreException(
"Error getting number of objects.", ex);
9367 String escapedText = null;
9369 escapedText = text.replaceAll(
"'",
"''");
9382 if (md5Hash == null) {
9385 CaseDbConnection connection;
9387 connection = connections.getConnection();
9388 }
catch (TskCoreException ex) {
9389 logger.log(Level.SEVERE,
"Error finding files by md5 hash " + md5Hash, ex);
9394 ResultSet rs = null;
9396 s = connection.createStatement();
9397 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
9398 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
9400 return resultSetToAbstractFiles(rs, connection);
9401 }
catch (SQLException ex) {
9402 logger.log(Level.WARNING,
"Error querying database.", ex);
9419 CaseDbConnection connection;
9421 connection = connections.getConnection();
9422 }
catch (TskCoreException ex) {
9423 logger.log(Level.SEVERE,
"Error checking md5 hashing status", ex);
9426 boolean allFilesAreHashed =
false;
9429 ResultSet rs = null;
9431 s = connection.createStatement();
9432 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
9434 +
"AND md5 IS NULL "
9435 +
"AND size > '0'");
9436 if (rs.next() && rs.getInt(
"count") == 0) {
9437 allFilesAreHashed =
true;
9439 }
catch (SQLException ex) {
9440 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
9447 return allFilesAreHashed;
9456 CaseDbConnection connection;
9458 connection = connections.getConnection();
9459 }
catch (TskCoreException ex) {
9460 logger.log(Level.SEVERE,
"Error getting database connection for hashed files count", ex);
9466 ResultSet rs = null;
9468 s = connection.createStatement();
9469 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
9470 +
"WHERE md5 IS NOT NULL "
9471 +
"AND size > '0'");
9473 count = rs.getInt(
"count");
9475 }
catch (SQLException ex) {
9476 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
9496 CaseDbConnection connection = connections.getConnection();
9498 ResultSet resultSet = null;
9501 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES);
9502 resultSet = connection.executeQuery(statement);
9503 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
9504 while (resultSet.next()) {
9505 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9510 }
catch (SQLException ex) {
9511 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
9513 closeResultSet(resultSet);
9530 CaseDbConnection connection = connections.getConnection();
9532 ResultSet resultSet = null;
9535 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE);
9536 resultSet = connection.executeQuery(statement);
9537 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
9538 while (resultSet.next()) {
9539 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9544 }
catch (SQLException ex) {
9545 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
9547 closeResultSet(resultSet);
9567 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
9573 CaseDbConnection connection = connections.getConnection();
9575 ResultSet resultSet = null;
9578 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE);
9579 statement.setLong(1, dsObjId);
9580 statement.setLong(2, dsObjId);
9581 resultSet = connection.executeQuery(statement);
9582 while (resultSet.next()) {
9583 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9588 }
catch (SQLException ex) {
9589 throw new TskCoreException(
"Failed to get tag names in use for data source objID : " + dsObjId, ex);
9591 closeResultSet(resultSet);
9630 CaseDbConnection connection = connections.getConnection();
9632 ResultSet resultSet = null;
9634 PreparedStatement statement;
9636 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OR_UPDATE_TAG_NAME, Statement.RETURN_GENERATED_KEYS);
9637 statement.clearParameters();
9638 statement.setString(5, description);
9639 statement.setString(6, color.getName());
9640 statement.setByte(7, knownStatus.getFileKnownValue());
9641 statement.setString(1, displayName);
9642 statement.setString(2, description);
9643 statement.setString(3, color.getName());
9644 statement.setByte(4, knownStatus.getFileKnownValue());
9645 connection.executeUpdate(statement);
9646 resultSet = statement.getGeneratedKeys();
9648 return new TagName(resultSet.getLong(1),
9649 displayName, description, color, knownStatus);
9650 }
catch (SQLException ex) {
9651 throw new TskCoreException(
"Error adding row for " + displayName +
" tag name to tag_names table", ex);
9653 closeResultSet(resultSet);
9673 CaseDbConnection connection = connections.getConnection();
9675 ResultSet resultSet = null;
9679 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_CONTENT_TAG, Statement.RETURN_GENERATED_KEYS);
9680 statement.clearParameters();
9681 statement.setLong(1, content.getId());
9682 statement.setLong(2, tagName.getId());
9683 statement.setString(3, comment);
9684 statement.setLong(4, beginByteOffset);
9685 statement.setLong(5, endByteOffset);
9686 statement.setLong(6, currentExaminer.
getId());
9687 connection.executeUpdate(statement);
9688 resultSet = statement.getGeneratedKeys();
9691 content, tagName, comment, beginByteOffset, endByteOffset, currentExaminer.
getLoginName());
9692 }
catch (SQLException ex) {
9693 throw new TskCoreException(
"Error adding row to content_tags table (obj_id = " + content.getId() +
", tag_name_id = " + tagName.getId() +
")", ex);
9695 closeResultSet(resultSet);
9707 CaseDbConnection connection = connections.getConnection();
9711 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_CONTENT_TAG);
9712 statement.clearParameters();
9713 statement.setLong(1, tag.getId());
9714 connection.executeUpdate(statement);
9715 }
catch (SQLException ex) {
9716 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
9732 CaseDbConnection connection = connections.getConnection();
9734 ResultSet resultSet = null;
9740 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS);
9741 resultSet = connection.executeQuery(statement);
9742 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
9743 while (resultSet.next()) {
9744 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9748 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
9749 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name")));
9752 }
catch (SQLException ex) {
9753 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
9755 closeResultSet(resultSet);
9772 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9773 throw new TskCoreException(
"TagName object is invalid, id not set");
9775 CaseDbConnection connection = connections.getConnection();
9777 ResultSet resultSet = null;
9780 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME);
9781 statement.clearParameters();
9782 statement.setLong(1, tagName.getId());
9783 resultSet = connection.executeQuery(statement);
9784 if (resultSet.next()) {
9785 return resultSet.getLong(
"count");
9787 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
9789 }
catch (SQLException ex) {
9790 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
9792 closeResultSet(resultSet);
9815 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9816 throw new TskCoreException(
"TagName object is invalid, id not set");
9819 CaseDbConnection connection = connections.getConnection();
9821 ResultSet resultSet = null;
9826 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
9827 statement.clearParameters();
9828 statement.setLong(1, tagName.getId());
9829 statement.setLong(2, dsObjId);
9831 resultSet = connection.executeQuery(statement);
9832 if (resultSet.next()) {
9833 return resultSet.getLong(
"count");
9835 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
9837 }
catch (SQLException ex) {
9838 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
9840 closeResultSet(resultSet);
9858 CaseDbConnection connection = connections.getConnection();
9860 ResultSet resultSet = null;
9868 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID);
9869 statement.clearParameters();
9870 statement.setLong(1, contentTagID);
9871 resultSet = connection.executeQuery(statement);
9873 while (resultSet.next()) {
9874 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9878 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
9882 }
catch (SQLException ex) {
9883 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
9885 closeResultSet(resultSet);
9904 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9905 throw new TskCoreException(
"TagName object is invalid, id not set");
9907 CaseDbConnection connection = connections.getConnection();
9909 ResultSet resultSet = null;
9915 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME);
9916 statement.clearParameters();
9917 statement.setLong(1, tagName.getId());
9918 resultSet = connection.executeQuery(statement);
9919 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
9920 while (resultSet.next()) {
9922 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
9927 }
catch (SQLException ex) {
9928 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
9930 closeResultSet(resultSet);
9950 CaseDbConnection connection = connections.getConnection();
9952 ResultSet resultSet = null;
9961 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
9962 statement.clearParameters();
9963 statement.setLong(1, tagName.getId());
9964 statement.setLong(2, dsObjId);
9965 resultSet = connection.executeQuery(statement);
9966 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
9967 while (resultSet.next()) {
9969 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
9974 }
catch (SQLException ex) {
9975 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
" data source objID : " + dsObjId, ex);
9977 closeResultSet(resultSet);
9995 CaseDbConnection connection = connections.getConnection();
9997 ResultSet resultSet = null;
10004 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT);
10005 statement.clearParameters();
10006 statement.setLong(1, content.getId());
10007 resultSet = connection.executeQuery(statement);
10008 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
10009 while (resultSet.next()) {
10010 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10014 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
10018 }
catch (SQLException ex) {
10019 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
10021 closeResultSet(resultSet);
10022 connection.close();
10041 CaseDbConnection connection = connections.getConnection();
10043 ResultSet resultSet = null;
10047 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT_TAG, Statement.RETURN_GENERATED_KEYS);
10048 statement.clearParameters();
10049 statement.setLong(1, artifact.getArtifactID());
10050 statement.setLong(2, tagName.getId());
10051 statement.setString(3, comment);
10052 statement.setLong(4, currentExaminer.
getId());
10053 connection.executeUpdate(statement);
10054 resultSet = statement.getGeneratedKeys();
10058 }
catch (SQLException ex) {
10059 throw new TskCoreException(
"Error adding row to blackboard_artifact_tags table (obj_id = " + artifact.getArtifactID() +
", tag_name_id = " + tagName.getId() +
")", ex);
10061 closeResultSet(resultSet);
10062 connection.close();
10073 CaseDbConnection connection = connections.getConnection();
10077 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_ARTIFACT_TAG);
10078 statement.clearParameters();
10079 statement.setLong(1, tag.getId());
10080 connection.executeUpdate(statement);
10081 }
catch (SQLException ex) {
10082 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
10084 connection.close();
10099 CaseDbConnection connection = connections.getConnection();
10101 ResultSet resultSet = null;
10107 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS);
10108 resultSet = connection.executeQuery(statement);
10109 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10110 while (resultSet.next()) {
10111 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10117 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10121 }
catch (SQLException ex) {
10122 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
10124 closeResultSet(resultSet);
10125 connection.close();
10141 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10142 throw new TskCoreException(
"TagName object is invalid, id not set");
10144 CaseDbConnection connection = connections.getConnection();
10146 ResultSet resultSet = null;
10149 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME);
10150 statement.clearParameters();
10151 statement.setLong(1, tagName.getId());
10152 resultSet = connection.executeQuery(statement);
10153 if (resultSet.next()) {
10154 return resultSet.getLong(
"count");
10156 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
10158 }
catch (SQLException ex) {
10159 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
10161 closeResultSet(resultSet);
10162 connection.close();
10183 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10184 throw new TskCoreException(
"TagName object is invalid, id not set");
10187 CaseDbConnection connection = connections.getConnection();
10189 ResultSet resultSet = null;
10194 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE);
10195 statement.clearParameters();
10196 statement.setLong(1, tagName.getId());
10197 statement.setLong(2, dsObjId);
10198 resultSet = connection.executeQuery(statement);
10199 if (resultSet.next()) {
10200 return resultSet.getLong(
"count");
10202 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
10204 }
catch (SQLException ex) {
10205 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
10207 closeResultSet(resultSet);
10208 connection.close();
10225 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10226 throw new TskCoreException(
"TagName object is invalid, id not set");
10228 CaseDbConnection connection = connections.getConnection();
10230 ResultSet resultSet = null;
10236 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME);
10237 statement.clearParameters();
10238 statement.setLong(1, tagName.getId());
10239 resultSet = connection.executeQuery(statement);
10240 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10241 while (resultSet.next()) {
10245 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10249 }
catch (SQLException ex) {
10250 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
10252 closeResultSet(resultSet);
10253 connection.close();
10274 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10275 throw new TskCoreException(
"TagName object is invalid, id not set");
10278 CaseDbConnection connection = connections.getConnection();
10280 ResultSet resultSet = null;
10288 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
10289 statement.clearParameters();
10290 statement.setLong(1, tagName.getId());
10291 statement.setLong(2, dsObjId);
10292 resultSet = connection.executeQuery(statement);
10293 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10294 while (resultSet.next()) {
10298 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10302 }
catch (SQLException ex) {
10303 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
10305 closeResultSet(resultSet);
10306 connection.close();
10325 CaseDbConnection connection = connections.getConnection();
10327 ResultSet resultSet = null;
10335 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID);
10336 statement.clearParameters();
10337 statement.setLong(1, artifactTagID);
10338 resultSet = connection.executeQuery(statement);
10340 while (resultSet.next()) {
10341 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10347 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10351 }
catch (SQLException ex) {
10352 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
10354 closeResultSet(resultSet);
10355 connection.close();
10374 CaseDbConnection connection = connections.getConnection();
10376 ResultSet resultSet = null;
10383 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT);
10384 statement.clearParameters();
10385 statement.setLong(1, artifact.getArtifactID());
10386 resultSet = connection.executeQuery(statement);
10387 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10388 while (resultSet.next()) {
10389 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10394 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10398 }
catch (SQLException ex) {
10399 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
10401 closeResultSet(resultSet);
10402 connection.close();
10416 CaseDbConnection connection = connections.getConnection();
10420 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_PATH);
10421 statement.clearParameters();
10422 statement.setString(1, newPath);
10423 statement.setLong(2, objectId);
10424 connection.executeUpdate(statement);
10425 }
catch (SQLException ex) {
10426 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
10428 connection.close();
10446 public Report addReport(String localPath, String sourceModuleName, String reportName)
throws TskCoreException {
10447 return addReport(localPath, sourceModuleName, reportName, null);
10468 String relativePath =
"";
10469 long createTime = 0;
10470 String localPathLower = localPath.toLowerCase();
10472 if (localPathLower.startsWith(
"http")) {
10473 relativePath = localPathLower;
10474 createTime = System.currentTimeMillis() / 1000;
10485 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
10486 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
10487 }
catch (IllegalArgumentException ex) {
10488 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
10489 throw new TskCoreException(errorMessage, ex);
10493 java.io.File tempFile =
new java.io.File(localPath);
10495 createTime = tempFile.lastModified() / 1000;
10496 }
catch (Exception ex) {
10497 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
10502 CaseDbConnection connection = connections.getConnection();
10504 ResultSet resultSet = null;
10508 long parentObjId = 0;
10509 if (parent != null) {
10510 parentObjId = parent.getId();
10515 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
10516 statement.clearParameters();
10517 statement.setLong(1, objectId);
10518 statement.setString(2, relativePath);
10519 statement.setLong(3, createTime);
10520 statement.setString(4, sourceModuleName);
10521 statement.setString(5, reportName);
10522 connection.executeUpdate(statement);
10523 return new Report(
this, objectId, localPath, createTime, sourceModuleName, reportName, parent);
10524 }
catch (SQLException ex) {
10525 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
10527 closeResultSet(resultSet);
10528 connection.close();
10542 CaseDbConnection connection = connections.getConnection();
10544 ResultSet resultSet = null;
10545 ResultSet parentResultSet = null;
10546 PreparedStatement statement = null;
10547 Statement parentStatement = null;
10550 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORTS);
10551 parentStatement = connection.createStatement();
10552 resultSet = connection.executeQuery(statement);
10553 ArrayList<Report> reports =
new ArrayList<Report>();
10554 while (resultSet.next()) {
10555 String localpath = resultSet.getString(
"path");
10556 if (localpath.toLowerCase().startsWith(
"http") ==
false) {
10558 localpath = Paths.get(
getDbDirPath(), localpath).normalize().toString();
10563 long reportId = resultSet.getLong(
"obj_id");
10564 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", reportId);
10565 parentResultSet = parentStatement.executeQuery(parentQuery);
10566 if (parentResultSet.next()) {
10567 long parentId = parentResultSet.getLong(
"par_obj_id");
10570 parentResultSet.close();
10572 reports.add(
new Report(
this,
10575 resultSet.getLong(
"crtime"),
10576 resultSet.getString(
"src_module_name"),
10577 resultSet.getString(
"report_name"),
10581 }
catch (SQLException ex) {
10582 throw new TskCoreException(
"Error querying reports table", ex);
10584 closeResultSet(resultSet);
10585 closeResultSet(parentResultSet);
10586 closeStatement(statement);
10587 closeStatement(parentStatement);
10589 connection.close();
10604 CaseDbConnection connection = connections.getConnection();
10606 PreparedStatement statement = null;
10607 Statement parentStatement = null;
10608 ResultSet resultSet = null;
10609 ResultSet parentResultSet = null;
10613 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORT_BY_ID);
10614 parentStatement = connection.createStatement();
10615 statement.clearParameters();
10616 statement.setLong(1,
id);
10617 resultSet = connection.executeQuery(statement);
10619 if (resultSet.next()) {
10622 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;",
id);
10623 parentResultSet = parentStatement.executeQuery(parentQuery);
10624 if (parentResultSet.next()) {
10625 long parentId = parentResultSet.getLong(
"par_obj_id");
10629 report =
new Report(
this, resultSet.getLong(
"obj_id"),
10630 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
10631 resultSet.getLong(
"crtime"),
10632 resultSet.getString(
"src_module_name"),
10633 resultSet.getString(
"report_name"),
10636 throw new TskCoreException(
"No report found for id: " +
id);
10638 }
catch (SQLException ex) {
10639 throw new TskCoreException(
"Error querying reports table for id: " +
id, ex);
10641 closeResultSet(resultSet);
10642 closeResultSet(parentResultSet);
10643 closeStatement(statement);
10644 closeStatement(parentStatement);
10645 connection.close();
10660 CaseDbConnection connection = connections.getConnection();
10664 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT);
10665 statement.setLong(1, report.getId());
10666 connection.executeUpdate(statement);
10667 }
catch (SQLException ex) {
10668 throw new TskCoreException(
"Error querying reports table", ex);
10674 static void closeResultSet(ResultSet resultSet) {
10675 if (resultSet != null) {
10678 }
catch (SQLException ex) {
10679 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
10684 static void closeStatement(Statement statement) {
10685 if (statement != null) {
10688 }
catch (SQLException ex) {
10689 logger.log(Level.SEVERE,
"Error closing Statement", ex);
10703 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
10704 CaseDbConnection connection = connections.getConnection();
10707 Statement statement = connection.createStatement();
10708 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
10709 }
catch (SQLException ex) {
10710 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
10712 connection.close();
10717 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
10718 CaseDbConnection connection = connections.getConnection();
10721 Statement statement = connection.createStatement();
10722 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
10723 }
catch (SQLException ex) {
10724 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
10726 connection.close();
10748 CaseDbConnection connection = connections.getConnection();
10750 ResultSet resultSet = null;
10751 Statement statement;
10753 connection.beginTransaction();
10754 statement = connection.createStatement();
10755 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_JOB, Statement.RETURN_GENERATED_KEYS);
10756 insertStatement.setLong(1, dataSource.getId());
10757 insertStatement.setString(2, hostName);
10758 insertStatement.setLong(3, jobStart.getTime());
10759 insertStatement.setLong(4, jobEnd.getTime());
10760 insertStatement.setInt(5, status.ordinal());
10761 insertStatement.setString(6, settingsDir);
10762 connection.executeUpdate(insertStatement);
10763 resultSet = insertStatement.getGeneratedKeys();
10765 long id = resultSet.getLong(1);
10766 for (
int i = 0; i < ingestModules.size(); i++) {
10768 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
10769 +
"VALUES (" +
id +
", " + ingestModule.
getIngestModuleId() +
", " + i +
");");
10773 connection.commitTransaction();
10774 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
10775 }
catch (SQLException ex) {
10776 connection.rollbackTransaction();
10777 throw new TskCoreException(
"Error adding the ingest job.", ex);
10779 closeResultSet(resultSet);
10780 connection.close();
10799 CaseDbConnection connection = connections.getConnection();
10800 ResultSet resultSet = null;
10801 Statement statement = null;
10802 String uniqueName = factoryClassName +
"-" + displayName +
"-" + type.toString() +
"-" + version;
10805 statement = connection.createStatement();
10806 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
10807 if (!resultSet.next()) {
10810 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_MODULE, Statement.RETURN_GENERATED_KEYS);
10811 insertStatement.setString(1, displayName);
10812 insertStatement.setString(2, uniqueName);
10813 insertStatement.setInt(3, type.ordinal());
10814 insertStatement.setString(4, version);
10815 connection.executeUpdate(insertStatement);
10816 resultSet = statement.getGeneratedKeys();
10818 long id = resultSet.getLong(1);
10823 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10824 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
10826 }
catch (SQLException ex) {
10828 closeStatement(statement);
10829 statement = connection.createStatement();
10830 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
10831 if (resultSet.next()) {
10832 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10835 throw new TskCoreException(
"Couldn't add new module to database.", ex);
10837 }
catch (SQLException ex1) {
10838 throw new TskCoreException(
"Couldn't add new module to database.", ex1);
10841 closeResultSet(resultSet);
10842 closeStatement(statement);
10843 connection.close();
10856 CaseDbConnection connection = connections.getConnection();
10857 ResultSet resultSet = null;
10858 Statement statement = null;
10859 List<IngestJobInfo> ingestJobs =
new ArrayList<IngestJobInfo>();
10862 statement = connection.createStatement();
10863 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
10864 while (resultSet.next()) {
10865 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
10866 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
10868 resultSet.getString(
"settings_dir"), this.getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
10871 }
catch (SQLException ex) {
10872 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
10874 closeResultSet(resultSet);
10875 closeStatement(statement);
10876 connection.close();
10891 private List<IngestModuleInfo> getIngestModules(
int ingestJobId, CaseDbConnection connection)
throws SQLException {
10892 ResultSet resultSet = null;
10893 Statement statement = null;
10894 List<IngestModuleInfo> ingestModules =
new ArrayList<IngestModuleInfo>();
10897 statement = connection.createStatement();
10898 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
10899 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
10900 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
10901 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
10902 +
"FROM ingest_job_modules, ingest_modules "
10903 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
10904 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
10905 +
"ORDER BY (ingest_job_modules.pipeline_position);");
10906 while (resultSet.next()) {
10907 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10908 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
10910 return ingestModules;
10912 closeResultSet(resultSet);
10913 closeStatement(statement);
10922 static class ObjectInfo {
10925 private TskData.ObjectType type;
10927 ObjectInfo(
long id, ObjectType type) {
10936 TskData.ObjectType getType() {
10941 private interface DbCommand {
10943 void execute() throws SQLException;
10946 private enum PREPARED_STATEMENT {
10948 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
10949 +
"WHERE artifact_type_id = ?"),
10950 COUNT_ARTIFACTS_OF_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
10951 COUNT_ARTIFACTS_FROM_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
10952 COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
10953 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
10954 +
"FROM tsk_objects INNER JOIN tsk_files "
10955 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
10956 +
"WHERE (tsk_objects.par_obj_id = ? ) "
10957 +
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"),
10958 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
10959 +
"FROM tsk_objects INNER JOIN tsk_files "
10960 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
10961 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
10962 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
10963 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
10964 +
"FROM tsk_objects INNER JOIN tsk_files "
10965 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
10966 +
"WHERE (tsk_objects.par_obj_id = ?)"),
10967 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
10968 +
"FROM tsk_objects INNER JOIN tsk_files "
10969 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
10970 +
"WHERE (tsk_objects.par_obj_id = ? "
10971 +
"AND tsk_files.type = ? )"),
10972 SELECT_FILE_BY_ID(
"SELECT * FROM tsk_files WHERE obj_id = ? LIMIT 1"),
10973 SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
10974 SELECT_ARTIFACT_BY_ARTIFACT_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_id = ? LIMIT 1"),
10975 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
10976 +
"VALUES (?, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
10977 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
10978 +
"VALUES (DEFAULT, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
10979 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
10980 +
"VALUES (?,?,?,?,?,?,?)"),
10981 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
10982 +
"VALUES (?,?,?,?,?,?,?)"),
10983 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
10984 +
"VALUES (?,?,?,?,?,?,?)"),
10985 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
10986 +
"VALUES (?,?,?,?,?,?,?)"),
10987 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
10988 +
"VALUES (?,?,?,?,?,?,?)"),
10989 SELECT_FILES_BY_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
10990 SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
10991 UPDATE_FILE_MD5(
"UPDATE tsk_files SET md5 = ? WHERE obj_id = ?"),
10992 UPDATE_IMAGE_MD5(
"UPDATE tsk_image_info SET md5 = ? WHERE obj_id = ?"),
10993 UPDATE_IMAGE_SHA1(
"UPDATE tsk_image_info SET sha1 = ? WHERE obj_id = ?"),
10994 UPDATE_IMAGE_SHA256(
"UPDATE tsk_image_info SET sha256 = ? WHERE obj_id = ?"),
10995 SELECT_IMAGE_MD5(
"SELECT md5 FROM tsk_image_info WHERE obj_id = ?"),
10996 SELECT_IMAGE_SHA1(
"SELECT sha1 FROM tsk_image_info WHERE obj_id = ?"),
10997 SELECT_IMAGE_SHA256(
"SELECT sha256 FROM tsk_image_info WHERE obj_id = ?"),
10998 UPDATE_ACQUISITION_DETAILS(
"UPDATE data_source_info SET acquisition_details = ? WHERE obj_id = ?"),
10999 SELECT_ACQUISITION_DETAILS(
"SELECT acquisition_details FROM data_source_info WHERE obj_id = ?"),
11000 SELECT_LOCAL_PATH_FOR_FILE(
"SELECT path FROM tsk_files_path WHERE obj_id = ?"),
11001 SELECT_ENCODING_FOR_FILE(
"SELECT encoding_type FROM tsk_files_path WHERE obj_id = ?"),
11002 SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE(
"SELECT path, encoding_type FROM tsk_files_path WHERE obj_id = ?"),
11003 SELECT_PATH_FOR_FILE(
"SELECT parent_path FROM tsk_files WHERE obj_id = ?"),
11004 SELECT_FILE_NAME(
"SELECT name FROM tsk_files WHERE obj_id = ?"),
11005 SELECT_DERIVED_FILE(
"SELECT derived_id, rederive FROM tsk_files_derived WHERE obj_id = ?"),
11006 SELECT_FILE_DERIVATION_METHOD(
"SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"),
11007 SELECT_MAX_OBJECT_ID(
"SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"),
11008 INSERT_OBJECT(
"INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"),
11009 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, known, mime_type, parent_path, data_source_obj_id,extension) "
11010 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11011 INSERT_FILE_SYSTEM_FILE(
"INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, parent_path, extension)"
11012 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11013 UPDATE_DERIVED_FILE(
"UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?, meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ? "
11014 +
"WHERE obj_id = ?"),
11015 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
11016 +
"VALUES (?, ?, ?, ?)"),
11017 INSERT_LOCAL_PATH(
"INSERT INTO tsk_files_path (obj_id, path, encoding_type) VALUES (?, ?, ?)"),
11018 UPDATE_LOCAL_PATH(
"UPDATE tsk_files_path SET path = ?, encoding_type = ? WHERE obj_id = ?"),
11019 COUNT_CHILD_OBJECTS_BY_PARENT(
"SELECT COUNT(obj_id) AS count FROM tsk_objects WHERE par_obj_id = ?"),
11020 SELECT_FILE_SYSTEM_BY_OBJECT(
"SELECT fs_obj_id from tsk_files WHERE obj_id=?"),
11021 SELECT_TAG_NAMES(
"SELECT * FROM tag_names"),
11022 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
11023 +
"WHERE tag_name_id IN "
11024 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
11025 SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE(
"SELECT * FROM tag_names "
11026 +
"WHERE tag_name_id IN "
11027 +
"( SELECT content_tags.tag_name_id as tag_name_id "
11028 +
"FROM content_tags as content_tags, tsk_files as tsk_files"
11029 +
" WHERE content_tags.obj_id = tsk_files.obj_id"
11030 +
" AND tsk_files.data_source_obj_id = ?"
11032 +
"SELECT artifact_tags.tag_name_id as tag_name_id "
11033 +
" FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts "
11034 +
" WHERE artifact_tags.artifact_id = arts.artifact_id"
11035 +
" AND arts.data_source_obj_id = ?"
11037 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?)"),
11038 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset, examiner_id) VALUES (?, ?, ?, ?, ?, ?)"),
11039 DELETE_CONTENT_TAG(
"DELETE FROM content_tags WHERE tag_id = ?"),
11040 COUNT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM content_tags WHERE tag_name_id = ?"),
11041 COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
11042 "SELECT COUNT(*) AS count FROM content_tags as content_tags, tsk_files as tsk_files WHERE content_tags.obj_id = tsk_files.obj_id"
11043 +
" AND content_tags.tag_name_id = ? "
11044 +
" AND tsk_files.data_source_obj_id = ? "
11046 SELECT_CONTENT_TAGS(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11047 +
"FROM content_tags "
11048 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11049 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id"),
11050 SELECT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tsk_examiners.login_name "
11051 +
"FROM content_tags "
11052 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11053 +
"WHERE tag_name_id = ?"),
11054 SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11055 +
"FROM content_tags as content_tags, tsk_files as tsk_files, tag_names as tag_names, tsk_examiners as tsk_examiners "
11056 +
"WHERE content_tags.examiner_id = tsk_examiners.examiner_id"
11057 +
" AND content_tags.obj_id = tsk_files.obj_id"
11058 +
" AND content_tags.tag_name_id = tag_names.tag_name_id"
11059 +
" AND content_tags.tag_name_id = ?"
11060 +
" AND tsk_files.data_source_obj_id = ? "),
11061 SELECT_CONTENT_TAG_BY_ID(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11062 +
"FROM content_tags "
11063 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11064 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11065 +
"WHERE tag_id = ?"),
11066 SELECT_CONTENT_TAGS_BY_CONTENT(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11067 +
"FROM content_tags "
11068 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11069 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11070 +
"WHERE content_tags.obj_id = ?"),
11071 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment, examiner_id) "
11072 +
"VALUES (?, ?, ?, ?)"),
11073 DELETE_ARTIFACT_TAG(
"DELETE FROM blackboard_artifact_tags WHERE tag_id = ?"),
11074 SELECT_ARTIFACT_TAGS(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11075 +
"FROM blackboard_artifact_tags "
11076 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11077 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id"),
11078 COUNT_ARTIFACTS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags WHERE tag_name_id = ?"),
11079 COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts WHERE artifact_tags.artifact_id = arts.artifact_id"
11080 +
" AND artifact_tags.tag_name_id = ?"
11081 +
" AND arts.data_source_obj_id = ? "),
11082 SELECT_ARTIFACT_TAGS_BY_TAG_NAME(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tsk_examiners.login_name "
11083 +
"FROM blackboard_artifact_tags "
11084 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11085 +
"WHERE tag_name_id = ?"),
11086 SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT artifact_tags.tag_id, artifact_tags.artifact_id, artifact_tags.tag_name_id, artifact_tags.comment, arts.obj_id, arts.artifact_obj_id, arts.data_source_obj_id, arts.artifact_type_id, arts.review_status_id, tsk_examiners.login_name "
11087 +
"FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts, tsk_examiners AS tsk_examiners "
11088 +
"WHERE artifact_tags.examiner_id = tsk_examiners.examiner_id"
11089 +
" AND artifact_tags.artifact_id = arts.artifact_id"
11090 +
" AND artifact_tags.tag_name_id = ? "
11091 +
" AND arts.data_source_obj_id = ? "),
11092 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11093 +
"FROM blackboard_artifact_tags "
11094 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11095 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11096 +
"WHERE blackboard_artifact_tags.tag_id = ?"),
11097 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11098 +
"FROM blackboard_artifact_tags "
11099 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11100 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11101 +
"WHERE blackboard_artifact_tags.artifact_id = ?"),
11102 SELECT_REPORTS(
"SELECT * FROM reports"),
11103 SELECT_REPORT_BY_ID(
"SELECT * FROM reports WHERE obj_id = ?"),
11104 INSERT_REPORT(
"INSERT INTO reports (obj_id, path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?, ?)"),
11105 DELETE_REPORT(
"DELETE FROM reports WHERE reports.obj_id = ?"),
11106 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
11107 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
11108 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
11109 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
11110 UPDATE_IMAGE_PATH(
"UPDATE tsk_image_names SET name = ? WHERE obj_id = ?"),
11111 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "
11112 +
"FROM tsk_objects INNER JOIN blackboard_artifacts "
11113 +
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "
11114 +
"WHERE (tsk_objects.par_obj_id = ?)"),
11115 INSERT_OR_UPDATE_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?) ON CONFLICT (display_name) DO UPDATE SET description = ?, color = ?, knownStatus = ?"),
11116 SELECT_EXAMINER_BY_ID(
"SELECT * FROM tsk_examiners WHERE examiner_id = ?"),
11117 SELECT_EXAMINER_BY_LOGIN_NAME(
"SELECT * FROM tsk_examiners WHERE login_name = ?"),
11118 UPDATE_FILE_NAME(
"UPDATE tsk_files SET name = ? WHERE obj_id = ?"),
11119 UPDATE_IMAGE_NAME(
"UPDATE tsk_image_info SET display_name = ? WHERE obj_id = ?"),
11120 DELETE_IMAGE_NAME(
"DELETE FROM tsk_image_names WHERE obj_id = ?"),
11121 INSERT_IMAGE_NAME(
"INSERT INTO tsk_image_names (obj_id, name, sequence) VALUES (?, ?, ?)"),
11122 INSERT_IMAGE_INFO(
"INSERT INTO tsk_image_info (obj_id, type, ssize, tzone, size, md5, sha1, sha256, display_name)"
11123 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11124 INSERT_DATA_SOURCE_INFO(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) VALUES (?, ?, ?)"),
11125 INSERT_VS_INFO(
"INSERT INTO tsk_vs_info (obj_id, vs_type, img_offset, block_size) VALUES (?, ?, ?, ?)"),
11126 INSERT_VS_PART_SQLITE(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, desc, flags) VALUES (?, ?, ?, ?, ?, ?)"),
11127 INSERT_VS_PART_POSTGRESQL(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, descr, flags) VALUES (?, ?, ?, ?, ?, ?)"),
11128 INSERT_POOL_INFO(
"INSERT INTO tsk_pool_info (obj_id, pool_type) VALUES (?, ?)"),
11129 INSERT_FS_INFO(
"INSERT INTO tsk_fs_info (obj_id, img_offset, fs_type, block_size, block_count, root_inum, first_inum, last_inum, display_name)"
11130 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
11132 private final String sql;
11134 private PREPARED_STATEMENT(String sql) {
11148 abstract private class ConnectionPool {
11150 private PooledDataSource pooledDataSource;
11152 public ConnectionPool() {
11153 pooledDataSource = null;
11156 CaseDbConnection getConnection() throws TskCoreException {
11157 if (pooledDataSource == null) {
11158 throw new TskCoreException(
"Error getting case database connection - case is closed");
11161 return getPooledConnection();
11162 }
catch (SQLException exp) {
11163 throw new TskCoreException(exp.getMessage());
11167 void close() throws TskCoreException {
11168 if (pooledDataSource != null) {
11170 pooledDataSource.close();
11171 }
catch (SQLException exp) {
11172 throw new TskCoreException(exp.getMessage());
11174 pooledDataSource = null;
11179 abstract CaseDbConnection getPooledConnection() throws SQLException;
11181 public PooledDataSource getPooledDataSource() {
11182 return pooledDataSource;
11185 public void setPooledDataSource(PooledDataSource pooledDataSource) {
11186 this.pooledDataSource = pooledDataSource;
11194 private final class SQLiteConnections
extends ConnectionPool {
11196 private final Map<String, String> configurationOverrides =
new HashMap<String, String>();
11198 SQLiteConnections(String dbPath)
throws SQLException {
11199 configurationOverrides.put(
"acquireIncrement",
"2");
11200 configurationOverrides.put(
"initialPoolSize",
"5");
11201 configurationOverrides.put(
"minPoolSize",
"5");
11206 configurationOverrides.put(
"maxPoolSize",
"20");
11207 configurationOverrides.put(
"maxStatements",
"200");
11208 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
11210 SQLiteConfig config =
new SQLiteConfig();
11211 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
11212 config.setReadUncommited(
true);
11213 config.enforceForeignKeys(
true);
11214 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
11215 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
11216 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
11220 public CaseDbConnection getPooledConnection() throws SQLException {
11221 return new SQLiteConnection(getPooledDataSource().getConnection());
11229 private final class PostgreSQLConnections
extends ConnectionPool {
11231 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
11232 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
11233 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
11234 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
11235 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
11236 comboPooledDataSource.setUser(userName);
11237 comboPooledDataSource.setPassword(password);
11238 comboPooledDataSource.setAcquireIncrement(2);
11239 comboPooledDataSource.setInitialPoolSize(5);
11240 comboPooledDataSource.setMinPoolSize(5);
11245 comboPooledDataSource.setMaxPoolSize(20);
11246 comboPooledDataSource.setMaxStatements(200);
11247 comboPooledDataSource.setMaxStatementsPerConnection(20);
11248 setPooledDataSource(comboPooledDataSource);
11252 public CaseDbConnection getPooledConnection() throws SQLException {
11253 return new PostgreSQLConnection(getPooledDataSource().getConnection());
11260 abstract class CaseDbConnection
implements AutoCloseable {
11262 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
11263 static final int MAX_RETRIES = 20;
11265 private class CreateStatement
implements DbCommand {
11267 private final Connection connection;
11268 private Statement statement = null;
11270 CreateStatement(Connection connection) {
11271 this.connection = connection;
11274 Statement getStatement() {
11279 public void execute() throws SQLException {
11280 statement = connection.createStatement();
11284 private class SetAutoCommit
implements DbCommand {
11286 private final Connection connection;
11287 private final boolean mode;
11289 SetAutoCommit(Connection connection,
boolean mode) {
11290 this.connection = connection;
11295 public void execute() throws SQLException {
11296 connection.setAutoCommit(mode);
11300 private class Commit
implements DbCommand {
11302 private final Connection connection;
11304 Commit(Connection connection) {
11305 this.connection = connection;
11309 public void execute() throws SQLException {
11310 connection.commit();
11314 private class ExecuteQuery
implements DbCommand {
11316 private final Statement statement;
11317 private final String query;
11318 private ResultSet resultSet;
11320 ExecuteQuery(Statement statement, String query) {
11321 this.statement = statement;
11322 this.query = query;
11325 ResultSet getResultSet() {
11330 public void execute() throws SQLException {
11331 resultSet = statement.executeQuery(query);
11335 private class ExecutePreparedStatementQuery
implements DbCommand {
11337 private final PreparedStatement preparedStatement;
11338 private ResultSet resultSet;
11340 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
11341 this.preparedStatement = preparedStatement;
11344 ResultSet getResultSet() {
11349 public void execute() throws SQLException {
11350 resultSet = preparedStatement.executeQuery();
11354 private class ExecutePreparedStatementUpdate
implements DbCommand {
11356 private final PreparedStatement preparedStatement;
11358 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
11359 this.preparedStatement = preparedStatement;
11363 public void execute() throws SQLException {
11364 preparedStatement.executeUpdate();
11368 private class ExecuteStatementUpdate
implements DbCommand {
11370 private final Statement statement;
11371 private final String updateCommand;
11373 ExecuteStatementUpdate(Statement statement, String updateCommand) {
11374 this.statement = statement;
11375 this.updateCommand = updateCommand;
11379 public void execute() throws SQLException {
11380 statement.executeUpdate(updateCommand);
11384 private class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
11386 private final Statement statement;
11387 private final int generateKeys;
11388 private final String updateCommand;
11390 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
11391 this.statement = statement;
11392 this.generateKeys = generateKeys;
11393 this.updateCommand = updateCommand;
11397 public void execute() throws SQLException {
11398 statement.executeUpdate(updateCommand, generateKeys);
11402 private class PrepareStatement
implements DbCommand {
11404 private final Connection connection;
11405 private final String input;
11406 private PreparedStatement preparedStatement = null;
11408 PrepareStatement(Connection connection, String input) {
11409 this.connection = connection;
11410 this.input = input;
11413 PreparedStatement getPreparedStatement() {
11414 return preparedStatement;
11418 public void execute() throws SQLException {
11419 preparedStatement = connection.prepareStatement(input);
11423 private class PrepareStatementGenerateKeys
implements DbCommand {
11425 private final Connection connection;
11426 private final String input;
11427 private final int generateKeys;
11428 private PreparedStatement preparedStatement = null;
11430 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
11431 this.connection = connection;
11432 this.input = input;
11433 this.generateKeys = generateKeysInput;
11436 PreparedStatement getPreparedStatement() {
11437 return preparedStatement;
11441 public void execute() throws SQLException {
11442 preparedStatement = connection.prepareStatement(input, generateKeys);
11446 abstract void executeCommand(DbCommand command)
throws SQLException;
11448 private final Connection connection;
11449 private final Map<PREPARED_STATEMENT, PreparedStatement> preparedStatements;
11451 CaseDbConnection(Connection connection) {
11452 this.connection = connection;
11453 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(PREPARED_STATEMENT.class);
11457 return this.connection != null;
11460 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
11461 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
11464 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
11466 PreparedStatement statement;
11467 if (this.preparedStatements.containsKey(statementKey)) {
11468 statement = this.preparedStatements.get(statementKey);
11470 statement = prepareStatement(statementKey.getSQL(), generateKeys);
11471 this.preparedStatements.put(statementKey, statement);
11476 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
11477 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
11478 executeCommand(prepareStatement);
11479 return prepareStatement.getPreparedStatement();
11482 Statement createStatement() throws SQLException {
11483 CreateStatement createStatement =
new CreateStatement(this.connection);
11484 executeCommand(createStatement);
11485 return createStatement.getStatement();
11489 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
11490 executeCommand(setAutoCommit);
11493 void commitTransaction() throws SQLException {
11494 Commit commit =
new Commit(connection);
11495 executeCommand(commit);
11497 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
11498 executeCommand(setAutoCommit);
11506 void rollbackTransaction() {
11508 connection.rollback();
11509 }
catch (SQLException e) {
11510 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
11513 connection.setAutoCommit(
true);
11514 }
catch (SQLException e) {
11515 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
11526 void rollbackTransactionWithThrow() throws SQLException {
11528 connection.rollback();
11530 connection.setAutoCommit(
true);
11534 ResultSet
executeQuery(Statement statement, String query)
throws SQLException {
11535 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
11536 executeCommand(queryCommand);
11537 return queryCommand.getResultSet();
11549 ResultSet
executeQuery(PreparedStatement statement)
throws SQLException {
11550 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
11551 executeCommand(executePreparedStatementQuery);
11552 return executePreparedStatementQuery.getResultSet();
11555 void executeUpdate(Statement statement, String update)
throws SQLException {
11556 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
11559 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
11560 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
11561 executeCommand(executeStatementUpdate);
11564 void executeUpdate(PreparedStatement statement)
throws SQLException {
11565 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
11566 executeCommand(executePreparedStatementUpdate);
11573 public void close() {
11575 connection.close();
11576 }
catch (SQLException ex) {
11577 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
11581 Connection getConnection() {
11582 return this.connection;
11589 private final class SQLiteConnection
extends CaseDbConnection {
11591 private static final int DATABASE_LOCKED_ERROR = 0;
11592 private static final int SQLITE_BUSY_ERROR = 5;
11594 SQLiteConnection(Connection conn) {
11599 void executeCommand(DbCommand command)
throws SQLException {
11600 int retryCounter = 0;
11605 }
catch (SQLException ex) {
11606 if ((ex.getErrorCode() == SQLITE_BUSY_ERROR || ex.getErrorCode() == DATABASE_LOCKED_ERROR) && retryCounter < MAX_RETRIES) {
11613 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
11614 }
catch (InterruptedException exp) {
11615 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
11628 private final class PostgreSQLConnection
extends CaseDbConnection {
11630 private final String COMMUNICATION_ERROR = PSQLState.COMMUNICATION_ERROR.getState();
11631 private final String SYSTEM_ERROR = PSQLState.SYSTEM_ERROR.getState();
11632 private final String UNKNOWN_STATE = PSQLState.UNKNOWN_STATE.getState();
11633 private static final int MAX_RETRIES = 3;
11635 PostgreSQLConnection(Connection conn) {
11640 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
11641 CaseDbConnection.ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new CaseDbConnection.ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
11642 executeCommand(executeStatementUpdateGenerateKeys);
11646 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
11647 CaseDbConnection.PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new CaseDbConnection.PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
11648 executeCommand(prepareStatementGenerateKeys);
11649 return prepareStatementGenerateKeys.getPreparedStatement();
11653 void executeCommand(DbCommand command)
throws SQLException {
11654 SQLException lastException = null;
11655 for (
int retries = 0; retries < MAX_RETRIES; retries++) {
11658 lastException = null;
11660 }
catch (SQLException ex) {
11661 lastException = ex;
11662 String sqlState = ex.getSQLState();
11663 if (sqlState == null || sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
11665 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
11666 }
catch (InterruptedException exp) {
11667 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
11676 if (lastException != null) {
11677 throw lastException;
11692 private final CaseDbConnection connection;
11693 private boolean hasWriteLock =
false;
11697 this.connection = connection;
11698 this.sleuthkitCase = sleuthkitCase;
11700 this.connection.beginTransaction();
11701 }
catch (SQLException ex) {
11702 throw new TskCoreException(
"Failed to create transaction on case database", ex);
11713 CaseDbConnection getConnection() {
11714 return this.connection;
11728 if (!hasWriteLock) {
11729 hasWriteLock =
true;
11742 this.connection.commitTransaction();
11743 }
catch (SQLException ex) {
11744 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
11758 this.connection.rollbackTransactionWithThrow();
11759 }
catch (SQLException ex) {
11760 throw new TskCoreException(
"Case database transaction rollback failed", ex);
11771 this.connection.close();
11772 if (hasWriteLock) {
11774 hasWriteLock =
false;
11790 private ResultSet resultSet;
11791 private CaseDbConnection connection;
11793 private CaseDbQuery(String query)
throws TskCoreException {
11794 this(query,
false);
11797 private CaseDbQuery(String query,
boolean allowWriteQuery)
throws TskCoreException {
11798 if (!allowWriteQuery) {
11799 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
11800 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
11804 connection = connections.getConnection();
11805 }
catch (TskCoreException ex) {
11806 throw new TskCoreException(
"Error getting connection for query: ", ex);
11811 resultSet = connection.executeQuery(connection.createStatement(), query);
11812 }
catch (SQLException ex) {
11814 throw new TskCoreException(
"Error executing query: ", ex);
11828 public void close() throws TskCoreException {
11830 if (resultSet != null) {
11831 final Statement statement = resultSet.getStatement();
11832 if (statement != null) {
11837 connection.close();
11838 }
catch (SQLException ex) {
11839 throw new TskCoreException(
"Error closing query: ", ex);
11855 sleuthkitCaseErrorObservers.add(observer);
11867 int i = sleuthkitCaseErrorObservers.indexOf(observer);
11869 sleuthkitCaseErrorObservers.remove(i);
11883 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
11884 if (observer != null) {
11886 observer.receiveError(context, errorMessage);
11887 }
catch (Exception ex) {
11888 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
11920 private final String contextString;
11922 private Context(String context) {
11923 this.contextString = context;
11927 return contextString;
11931 void receiveError(String context, String errorMessage);
11945 long getDataSourceObjectId(
long objectId) {
11947 CaseDbConnection connection = connections.getConnection();
11949 return getDataSourceObjectId(connection, objectId);
11951 connection.close();
11953 }
catch (TskCoreException ex) {
11954 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
11970 CaseDbConnection connection = connections.getConnection();
11972 ResultSet rs = null;
11975 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID);
11976 rs = connection.executeQuery(statement);
11979 id = rs.getLong(
"max_obj_id");
11982 }
catch (SQLException e) {
11983 throw new TskCoreException(
"Error getting last object id", e);
11985 closeResultSet(rs);
11986 connection.close();
12006 CaseDbConnection connection = connections.getConnection();
12008 Statement s = null;
12009 ResultSet rs = null;
12011 s = connection.createStatement();
12012 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
12013 List<FsContent> results =
new ArrayList<FsContent>();
12014 List<AbstractFile> temp = resultSetToAbstractFiles(rs, connection);
12022 }
catch (SQLException e) {
12023 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
12025 closeResultSet(rs);
12027 connection.close();
12045 CaseDbConnection connection = connections.getConnection();
12047 Statement s = null;
12048 ResultSet rs = null;
12050 s = connection.createStatement();
12051 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
12054 typeId = rs.getInt(
"artifact_type_id");
12057 }
catch (SQLException ex) {
12058 throw new TskCoreException(
"Error getting artifact type id", ex);
12060 closeResultSet(rs);
12062 connection.close();
12095 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
12098 }
catch (TskDataException ex) {
12099 throw new TskCoreException(
"Failed to add artifact type.", ex);
12117 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
12120 }
catch (TskDataException ex) {
12121 throw new TskCoreException(
"Couldn't add new attribute type");
12137 CaseDbConnection connection = connections.getConnection();
12139 Statement s = null;
12140 ResultSet rs = null;
12142 s = connection.createStatement();
12143 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
12146 typeId = rs.getInt(
"attribute_type_id");
12149 }
catch (SQLException ex) {
12150 throw new TskCoreException(
"Error getting attribute type id", ex);
12152 closeResultSet(rs);
12154 connection.close();
12173 CaseDbConnection connection = connections.getConnection();
12175 Statement s = null;
12176 ResultSet rs = null;
12178 s = connection.createStatement();
12179 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
12181 return rs.getString(
"type_name");
12183 throw new TskCoreException(
"No type with that id");
12185 }
catch (SQLException ex) {
12186 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
12188 closeResultSet(rs);
12190 connection.close();
12209 CaseDbConnection connection = connections.getConnection();
12211 Statement s = null;
12212 ResultSet rs = null;
12214 s = connection.createStatement();
12215 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
12217 return rs.getString(
"display_name");
12219 throw new TskCoreException(
"No type with that id");
12221 }
catch (SQLException ex) {
12222 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
12224 closeResultSet(rs);
12226 connection.close();
12261 public ResultSet
runQuery(String query)
throws SQLException {
12262 CaseDbConnection connection;
12264 connection = connections.getConnection();
12265 }
catch (TskCoreException ex) {
12266 throw new SQLException(
"Error getting connection for ad hoc query", ex);
12270 return connection.executeQuery(connection.createStatement(), query);
12274 connection.close();
12290 final Statement statement = resultSet.getStatement();
12292 if (statement != null) {
12314 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
12317 files.add(carvedFile);
12321 || parent instanceof
Volume
12322 || parent instanceof
Image) {
12325 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
12344 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
12348 carvedFiles.add(carvedFile);
12353 || parent instanceof
Volume
12354 || parent instanceof
Image) {
12357 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
12393 long size,
long ctime,
long crtime,
long atime,
long mtime,
12395 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
12396 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
12397 isFile, parentFile, rederiveDetails, toolName, toolVersion,
12427 long size,
long ctime,
long crtime,
long atime,
long mtime,
12430 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
12455 long size,
long ctime,
long crtime,
long atime,
long mtime,
12458 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
12480 return this.caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"",
this);
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
static ARTIFACT_TYPE fromID(int id)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
BlackboardArtifact getArtifactByArtifactId(long id)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
BlackboardArtifact getArtifactById(long id)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
synchronized Content getParent()
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
CommunicationsManager getCommunicationsManager()
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
List< Content > getChildren()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbSchemaVersionNumber getDBSchemaCreationVersion()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
void addErrorObserver(ErrorObserver observer)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
Blackboard getBlackboard()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
synchronized void close()
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
void setFileMIMEType(AbstractFile file, String mimeType)
UNALLOC
Metadata structure is currently in an unallocated state.
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
synchronized CaseDbAccessManager getCaseDbAccessManager()
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
List< AbstractFile > openFiles(Content dataSource, String filePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
VersionNumber getDBSchemaVersion()
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
static final String NAME_CARVED
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
long getDataSourceObjectId()
List< VirtualDirectory > getVirtualDirectoryRoots()
LayoutFile addLayoutFile(String fileName, long size, TSK_FS_NAME_FLAG_ENUM dirFlag, TSK_FS_META_FLAG_ENUM metaFlag, long ctime, long crtime, long atime, long mtime, List< TskFileRange > fileRanges, Content parent)
long getBlackboardArtifactTagsCountByTagName(TagName tagName, long dsObjId)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
BlackboardArtifact getBlackboardArtifact(long artifactID)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
long countFilesWhere(String sqlWhereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
FS
File System - see tsk_fs_info for more details.
Pool addPool(long parentObjId, TskData.TSK_POOL_TYPE_ENUM type, CaseDbTransaction transaction)
boolean isFileFromSource(Content dataSource, long fileId)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Image > getImages()
int getAttrTypeID(String attrTypeName)
Image getImageById(long id)
Report addReport(String localPath, String sourceModuleName, String reportName, Content parent)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
void unregisterForEvents(Object listener)
LOCAL_DIR
Local directory that was added (not from a disk image)
TimelineManager getTimelineManager()
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void releaseSingleUserCaseReadLock()
VOL
Volume - see tsk_vs_parts for more details.
void closeRunQuery(ResultSet resultSet)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
long getContentTagsCountByTagName(TagName tagName, long dsObjId)
List< ContentTag > getContentTagsByTagName(TagName tagName)
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static String escapeSingleQuotes(String text)
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< TagName > getAllTagNames()
Report getReportById(long id)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
static HTML_COLOR getColorByName(String colorName)
void acquireSingleUserCaseWriteLock()
REPORT
Artifact - see blackboard_artifacts for more details.
List< AbstractFile > findFilesByMd5(String md5Hash)
BlackboardArtifact.Type getArtifactType(String artTypeName)
BlackboardArtifact newBlackboardArtifact(ARTIFACT_TYPE artifactType, long obj_id)
void releaseSingleUserCaseWriteLock()
DERIVED
File derived from a parent file (i.e. from ZIP)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, CaseDbTransaction transaction)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
List< Content > getRootObjects()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirSubString)
FileSystem addFileSystem(long parentObjId, long imgOffset, TskData.TSK_FS_TYPE_ENUM type, long blockSize, long blockCount, long rootInum, long firstInum, long lastInum, String displayName, CaseDbTransaction transaction)
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
List< ContentTag > getContentTagsByTagName(TagName tagName, long dsObjId)
void deleteContentTag(ContentTag tag)
static ObjectType valueOf(short objectType)
long getContentTagsCountByTagName(TagName tagName)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parent)
void updateImagePath(String newPath, long objectId)
VolumeSystem addVolumeSystem(long parentObjId, TskData.TSK_VS_TYPE_ENUM type, long imgOffset, long blockSize, CaseDbTransaction transaction)
Examiner getCurrentExaminer()
UNKNOWN
File marked as unknown by hash db.
List< TagName > getTagNamesInUse(long dsObjId)
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
static void tryConnect(CaseDbConnectionInfo info)
static SleuthkitCase openCase(String dbPath)
CaseDbQuery executeInsertOrUpdate(String query)
static String createNonUniquePath(String uniquePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName, long dsObjId)
Volume addVolume(long parentObjId, long addr, long start, long length, String desc, long flags, CaseDbTransaction transaction)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
void acquireSingleUserCaseReadLock()
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
List< FsContent > findFilesWhere(String sqlWhereClause)
static ReviewStatus withID(int id)
void copyCaseDB(String newDBPath)
ResultSet runQuery(String query)
List< TskFileRange > getFileRanges(long id)
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
void registerForEvents(Object listener)
CaseDbQuery executeQuery(String query)
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
LocalDirectory addLocalDirectory(long parentId, String directoryName)