19 package org.sleuthkit.datamodel;
21 import com.google.common.collect.ImmutableSet;
22 import com.google.common.eventbus.EventBus;
23 import com.mchange.v2.c3p0.ComboPooledDataSource;
24 import com.mchange.v2.c3p0.DataSources;
25 import com.mchange.v2.c3p0.PooledDataSource;
26 import com.zaxxer.sparsebits.SparseBitSet;
27 import java.beans.PropertyVetoException;
28 import java.io.BufferedInputStream;
29 import java.io.BufferedOutputStream;
31 import java.io.FileInputStream;
32 import java.io.FileOutputStream;
33 import java.io.IOException;
34 import java.io.InputStream;
35 import java.io.OutputStream;
36 import java.io.UnsupportedEncodingException;
37 import java.net.InetAddress;
38 import java.net.URLEncoder;
39 import java.nio.charset.StandardCharsets;
40 import java.nio.file.Paths;
41 import java.sql.Connection;
42 import java.sql.DriverManager;
43 import java.sql.PreparedStatement;
44 import java.sql.ResultSet;
45 import java.sql.SQLException;
46 import java.sql.Statement;
47 import java.text.SimpleDateFormat;
48 import java.util.ArrayList;
49 import java.util.Arrays;
50 import java.util.Collection;
51 import java.util.Collections;
52 import java.util.Date;
53 import java.util.EnumMap;
54 import java.util.HashMap;
55 import java.util.HashSet;
56 import java.util.LinkedHashMap;
57 import java.util.List;
59 import java.util.MissingResourceException;
60 import java.util.ResourceBundle;
62 import java.util.UUID;
63 import java.util.concurrent.ConcurrentHashMap;
64 import java.util.concurrent.locks.ReentrantReadWriteLock;
65 import java.util.logging.Level;
66 import java.util.logging.Logger;
67 import org.postgresql.util.PSQLState;
83 import org.sqlite.SQLiteConfig;
84 import org.sqlite.SQLiteDataSource;
85 import org.sqlite.SQLiteJDBCLoader;
93 private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
102 private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE;
103 private static final Logger logger = Logger.getLogger(
SleuthkitCase.class.getName());
104 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
105 private static final int IS_REACHABLE_TIMEOUT_MS = 1000;
106 private static final String SQL_ERROR_CONNECTION_GROUP =
"08";
107 private static final String SQL_ERROR_AUTHENTICATION_GROUP =
"28";
108 private static final String SQL_ERROR_PRIVILEGE_GROUP =
"42";
109 private static final String SQL_ERROR_RESOURCE_GROUP =
"53";
110 private static final String SQL_ERROR_LIMIT_GROUP =
"54";
111 private static final String SQL_ERROR_INTERNAL_GROUP =
"xx";
112 private static final int MIN_USER_DEFINED_TYPE_ID = 10000;
114 private static final Set<String> CORE_TABLE_NAMES = ImmutableSet.of(
116 "tsk_event_descriptions",
129 "tsk_files_derived_method",
132 "blackboard_artifact_tags",
133 "blackboard_artifacts",
134 "blackboard_attributes",
135 "blackboard_artifact_types",
136 "blackboard_attribute_types",
138 "file_encoding_types",
139 "ingest_module_types",
140 "ingest_job_status_types",
143 "ingest_job_modules",
146 "account_relationships",
150 private static final Set<String> CORE_INDEX_NAMES = ImmutableSet.of(
154 "artifact_artifact_objID",
159 "relationships_account1",
160 "relationships_account2",
161 "relationships_relationship_source_obj_id",
162 "relationships_date_time",
163 "relationships_relationship_type",
164 "relationships_data_source_obj_id",
167 "events_data_source_obj_id",
168 "events_file_obj_id",
169 "events_artifact_id");
171 private static final String TSK_VERSION_KEY =
"TSK_VER";
172 private static final String SCHEMA_MAJOR_VERSION_KEY =
"SCHEMA_MAJOR_VERSION";
173 private static final String SCHEMA_MINOR_VERSION_KEY =
"SCHEMA_MINOR_VERSION";
174 private static final String CREATION_SCHEMA_MAJOR_VERSION_KEY =
"CREATION_SCHEMA_MAJOR_VERSION";
175 private static final String CREATION_SCHEMA_MINOR_VERSION_KEY =
"CREATION_SCHEMA_MINOR_VERSION";
177 private final ConnectionPool connections;
178 private final Map<Long, VirtualDirectory> rootIdsToCarvedFileDirs =
new HashMap<>();
179 private final Map<Long, FileSystem> fileSystemIdMap =
new HashMap<>();
180 private final List<ErrorObserver> sleuthkitCaseErrorObservers =
new ArrayList<>();
181 private final String databaseName;
182 private final String dbPath;
183 private final DbType dbType;
184 private final String caseDirPath;
186 private String dbBackupPath;
197 private final Map<Long, SparseBitSet> hasChildrenBitSetMap =
new HashMap<>();
199 private long nextArtifactId;
204 private final ReentrantReadWriteLock rwLock =
new ReentrantReadWriteLock(
true);
211 private final Map<String, Set<Long>> deviceIdToDatasourceObjIdMap =
new HashMap<>();
213 private final EventBus eventBus =
new EventBus(
"SleuthkitCase-EventBus");
216 eventBus.register(listener);
220 eventBus.unregister(listener);
223 void fireTSKEvent(Object event) {
224 eventBus.post(event);
228 private final Map<Long, Content> frequentlyUsedContentMap =
new HashMap<>();
230 private Examiner cachedCurrentExaminer = null;
248 if (info.getHost() == null || info.getHost().isEmpty()) {
249 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
250 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
251 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
252 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
253 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
254 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
255 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
259 Class.forName(
"org.postgresql.Driver");
260 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
264 }
catch (SQLException ex) {
266 String sqlState = ex.getSQLState().toLowerCase();
267 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
269 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
271 result = bundle.getString(
"DatabaseConnectionCheck.Port");
273 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
275 }
catch (IOException | MissingResourceException any) {
277 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
279 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
280 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
281 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
282 result = bundle.getString(
"DatabaseConnectionCheck.Access");
283 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
284 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
285 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
286 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
287 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
288 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
290 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
293 }
catch (ClassNotFoundException ex) {
294 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
310 Class.forName(
"org.sqlite.JDBC");
311 this.dbPath = dbPath;
312 this.dbType = dbType;
314 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
315 this.databaseName = dbFile.
getName();
316 this.connections =
new SQLiteConnections(dbPath);
317 this.caseHandle = caseHandle;
319 logSQLiteJDBCDriverInfo();
339 private SleuthkitCase(String host,
int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType)
throws Exception {
341 this.databaseName = dbName;
342 this.dbType = dbType;
343 this.caseDirPath = caseDirPath;
344 this.connections =
new PostgreSQLConnections(host, port, dbName, userName, password);
345 this.caseHandle = caseHandle;
349 private void init() throws Exception {
350 typeIdToArtifactTypeMap =
new ConcurrentHashMap<>();
351 typeIdToAttributeTypeMap =
new ConcurrentHashMap<>();
352 typeNameToArtifactTypeMap =
new ConcurrentHashMap<>();
353 typeNameToAttributeTypeMap =
new ConcurrentHashMap<>();
359 initBlackboardArtifactTypes();
360 initBlackboardAttributeTypes();
361 initNextArtifactId();
362 updateDatabaseSchema(null);
364 try (CaseDbConnection connection = connections.getConnection()) {
365 initIngestModuleTypes(connection);
366 initIngestStatusTypes(connection);
367 initReviewStatuses(connection);
368 initEncodingTypes(connection);
369 populateHasChildrenMap(connection);
370 updateExaminers(connection);
371 initDBSchemaCreationVersion(connection);
374 blackboard =
new Blackboard(
this);
375 communicationsMgr =
new CommunicationsManager(
this);
376 timelineMgr =
new TimelineManager(
this);
377 dbAccessManager =
new CaseDbAccessManager(
this);
385 static Set<String> getCoreTableNames() {
386 return CORE_TABLE_NAMES;
394 static Set<String> getCoreIndexNames() {
395 return CORE_INDEX_NAMES;
406 boolean getHasChildren(Content content) {
407 long objId = content.getId();
408 long mapIndex = objId / Integer.MAX_VALUE;
409 int mapValue = (int) (objId % Integer.MAX_VALUE);
411 synchronized (hasChildrenBitSetMap) {
412 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
413 return hasChildrenBitSetMap.get(mapIndex).get(mapValue);
424 private void setHasChildren(Long objId) {
425 long mapIndex = objId / Integer.MAX_VALUE;
426 int mapValue = (int) (objId % Integer.MAX_VALUE);
428 synchronized (hasChildrenBitSetMap) {
429 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
430 hasChildrenBitSetMap.get(mapIndex).set(mapValue);
432 SparseBitSet bitSet =
new SparseBitSet();
433 bitSet.set(mapValue);
434 hasChildrenBitSetMap.put(mapIndex, bitSet);
447 return communicationsMgr;
478 return dbAccessManager;
487 private void initBlackboardArtifactTypes() throws SQLException,
TskCoreException {
488 CaseDbConnection connection = connections.getConnection();
489 Statement statement = null;
490 ResultSet resultSet = null;
493 statement = connection.createStatement();
496 statement.execute(
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES (" + type.getTypeID() +
" , '" + type.getLabel() +
"', '" + type.getDisplayName() +
"')");
497 }
catch (SQLException ex) {
498 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_artifact_types WHERE artifact_type_id = '" + type.getTypeID() +
"'");
500 if (resultSet.getLong(
"count") == 0) {
506 this.typeIdToArtifactTypeMap.put(type.getTypeID(),
new BlackboardArtifact.Type(type));
507 this.typeNameToArtifactTypeMap.put(type.getLabel(),
new BlackboardArtifact.Type(type));
510 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ARTIFACT_TYPE.values())).getTypeID() + 1;
511 statement.execute(
"ALTER SEQUENCE blackboard_artifact_types_artifact_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
514 closeResultSet(resultSet);
515 closeStatement(statement);
528 private void initBlackboardAttributeTypes() throws SQLException, TskCoreException {
529 CaseDbConnection connection = connections.getConnection();
530 Statement statement = null;
531 ResultSet resultSet = null;
534 statement = connection.createStatement();
535 for (ATTRIBUTE_TYPE type : ATTRIBUTE_TYPE.values()) {
537 statement.execute(
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES (" + type.getTypeID() +
", '" + type.getLabel() +
"', '" + type.getDisplayName() +
"', '" + type.getValueType().getType() +
"')");
538 }
catch (SQLException ex) {
539 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types WHERE attribute_type_id = '" + type.getTypeID() +
"'");
541 if (resultSet.getLong(
"count") == 0) {
547 this.typeIdToAttributeTypeMap.put(type.getTypeID(),
new BlackboardAttribute.Type(type));
548 this.typeNameToAttributeTypeMap.put(type.getLabel(),
new BlackboardAttribute.Type(type));
551 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ATTRIBUTE_TYPE.values())).getTypeID() + 1;
552 statement.execute(
"ALTER SEQUENCE blackboard_attribute_types_attribute_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
555 closeResultSet(resultSet);
556 closeStatement(statement);
571 private void initNextArtifactId() throws SQLException, TskCoreException {
572 CaseDbConnection connection = connections.getConnection();
573 Statement statement = null;
574 ResultSet resultSet = null;
577 statement = connection.createStatement();
578 resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
580 this.nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
581 if (this.nextArtifactId == 1) {
582 this.nextArtifactId = BASE_ARTIFACT_ID;
585 closeResultSet(resultSet);
586 closeStatement(statement);
599 private void initIngestModuleTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
600 Statement statement = null;
601 ResultSet resultSet = null;
604 statement = connection.createStatement();
605 for (IngestModuleType type : IngestModuleType.values()) {
607 statement.execute(
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
608 }
catch (SQLException ex) {
609 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
611 if (resultSet.getLong(
"count") == 0) {
619 closeResultSet(resultSet);
620 closeStatement(statement);
632 private void initIngestStatusTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
633 Statement statement = null;
634 ResultSet resultSet = null;
637 statement = connection.createStatement();
638 for (IngestJobStatusType type : IngestJobStatusType.values()) {
640 statement.execute(
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
641 }
catch (SQLException ex) {
642 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
644 if (resultSet.getLong(
"count") == 0) {
652 closeResultSet(resultSet);
653 closeStatement(statement);
664 private void initReviewStatuses(CaseDbConnection connection)
throws SQLException, TskCoreException {
665 Statement statement = null;
666 ResultSet resultSet = null;
669 statement = connection.createStatement();
670 for (BlackboardArtifact.ReviewStatus status : BlackboardArtifact.ReviewStatus.values()) {
672 statement.execute(
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
673 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')");
674 }
catch (SQLException ex) {
675 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
677 if (resultSet.getLong(
"count") == 0) {
685 closeResultSet(resultSet);
686 closeStatement(statement);
698 private void initEncodingTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
699 Statement statement = null;
700 ResultSet resultSet = null;
703 statement = connection.createStatement();
704 for (TskData.EncodingType type : TskData.EncodingType.values()) {
706 statement.execute(
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')");
707 }
catch (SQLException ex) {
708 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
710 if (resultSet.getLong(
"count") == 0) {
718 closeResultSet(resultSet);
719 closeStatement(statement);
732 private void updateExaminers(CaseDbConnection connection)
throws SQLException, TskCoreException {
734 String loginName = System.getProperty(
"user.name");
735 if (loginName.isEmpty()) {
736 logger.log(Level.SEVERE,
"Cannot determine logged in user name");
741 Statement statement = connection.createStatement();
743 String query =
"INTO tsk_examiners (login_name) VALUES ('" + loginName +
"')";
746 query =
"INSERT " + query +
" ON CONFLICT DO NOTHING";
749 query =
"INSERT OR IGNORE " + query;
752 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
755 statement.execute(query);
756 }
catch (SQLException ex) {
757 throw new TskCoreException(
"Error inserting row in tsk_examiners", ex);
759 closeStatement(statement);
771 private void populateHasChildrenMap(CaseDbConnection connection)
throws TskCoreException {
772 long timestamp = System.currentTimeMillis();
774 Statement statement = null;
775 ResultSet resultSet = null;
778 statement = connection.createStatement();
779 resultSet = statement.executeQuery(
"select distinct par_obj_id from tsk_objects");
781 synchronized (hasChildrenBitSetMap) {
782 while (resultSet.next()) {
783 setHasChildren(resultSet.getLong(
"par_obj_id"));
786 long delay = System.currentTimeMillis() - timestamp;
787 logger.log(Level.INFO,
"Time to initialize parent node cache: {0} ms", delay);
788 }
catch (SQLException ex) {
789 throw new TskCoreException(
"Error populating parent node cache", ex);
791 closeResultSet(resultSet);
792 closeStatement(statement);
803 void addDataSourceToHasChildrenMap() throws TskCoreException {
805 CaseDbConnection connection = connections.getConnection();
807 populateHasChildrenMap(connection);
809 if (connection != null) {
824 private void updateDatabaseSchema(String dbPath)
throws Exception {
825 CaseDbConnection connection = connections.getConnection();
826 ResultSet resultSet = null;
827 Statement statement = null;
830 connection.beginTransaction();
832 boolean hasMinorVersion =
false;
833 ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null,
"tsk_db_info",
"schema%");
834 while (columns.next()) {
835 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
836 hasMinorVersion =
true;
841 int dbSchemaMajorVersion;
842 int dbSchemaMinorVersion = 0;
844 statement = connection.createStatement();
845 resultSet = connection.executeQuery(statement,
"SELECT schema_ver"
846 + (hasMinorVersion ?
", schema_minor_ver" :
"")
847 +
" FROM tsk_db_info");
848 if (resultSet.next()) {
849 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver");
850 if (hasMinorVersion) {
852 dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver");
855 throw new TskCoreException();
857 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(dbSchemaMajorVersion, dbSchemaMinorVersion);
864 if (
false == CURRENT_DB_SCHEMA_VERSION.
isCompatible(dbSchemaVersion)) {
866 throw new TskUnsupportedSchemaVersionException(
867 "Unsupported DB schema version " + dbSchemaVersion +
", the highest supported schema version is " + CURRENT_DB_SCHEMA_VERSION.
getMajor() +
".X");
868 }
else if (dbSchemaVersion.compareTo(CURRENT_DB_SCHEMA_VERSION) < 0) {
871 if (null != dbPath) {
874 String backupFilePath = dbPath +
".schemaVer" + dbSchemaVersion.toString() +
".backup";
876 dbBackupPath = backupFilePath;
883 dbSchemaVersion = updateFromSchema2toSchema3(dbSchemaVersion, connection);
884 dbSchemaVersion = updateFromSchema3toSchema4(dbSchemaVersion, connection);
885 dbSchemaVersion = updateFromSchema4toSchema5(dbSchemaVersion, connection);
886 dbSchemaVersion = updateFromSchema5toSchema6(dbSchemaVersion, connection);
887 dbSchemaVersion = updateFromSchema6toSchema7(dbSchemaVersion, connection);
888 dbSchemaVersion = updateFromSchema7toSchema7dot1(dbSchemaVersion, connection);
889 dbSchemaVersion = updateFromSchema7dot1toSchema7dot2(dbSchemaVersion, connection);
890 dbSchemaVersion = updateFromSchema7dot2toSchema8dot0(dbSchemaVersion, connection);
891 dbSchemaVersion = updateFromSchema8dot0toSchema8dot1(dbSchemaVersion, connection);
892 dbSchemaVersion = updateFromSchema8dot1toSchema8dot2(dbSchemaVersion, connection);
893 dbSchemaVersion = updateFromSchema8dot2toSchema8dot3(dbSchemaVersion, connection);
894 dbSchemaVersion = updateFromSchema8dot3toSchema8dot4(dbSchemaVersion, connection);
895 statement = connection.createStatement();
896 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.getMajor() +
", schema_minor_ver = " + dbSchemaVersion.getMinor());
897 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMajor() +
" WHERE name = '" + SCHEMA_MAJOR_VERSION_KEY +
"'");
898 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMinor() +
" WHERE name = '" + SCHEMA_MINOR_VERSION_KEY +
"'");
903 connection.commitTransaction();
904 }
catch (Exception ex) {
905 connection.rollbackTransaction();
908 closeResultSet(resultSet);
909 closeStatement(statement);
922 private void initDBSchemaCreationVersion(CaseDbConnection connection)
throws SQLException {
924 Statement statement = null;
925 ResultSet resultSet = null;
926 String createdSchemaMajorVersion =
"0";
927 String createdSchemaMinorVersion =
"0";
930 statement = connection.createStatement();
931 resultSet = connection.executeQuery(statement,
"SELECT name, value FROM tsk_db_info_extended");
932 while (resultSet.next()) {
933 String name = resultSet.getString(
"name");
934 if (name.equals(CREATION_SCHEMA_MAJOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MAJOR_VERSION")) {
935 createdSchemaMajorVersion = resultSet.getString(
"value");
936 }
else if (name.equals(CREATION_SCHEMA_MINOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MINOR_VERSION")) {
937 createdSchemaMinorVersion = resultSet.getString(
"value");
942 closeResultSet(resultSet);
943 closeStatement(statement);
947 caseDBSchemaCreationVersion =
new CaseDbSchemaVersionNumber(Integer.parseInt(createdSchemaMajorVersion), Integer.parseInt(createdSchemaMinorVersion));
959 public void copyCaseDB(String newDBPath)
throws IOException {
960 if (dbPath.isEmpty()) {
961 throw new IOException(
"Copying case database files is not supported for this type of case database");
963 InputStream in = null;
964 OutputStream out = null;
967 InputStream inFile =
new FileInputStream(dbPath);
968 in =
new BufferedInputStream(inFile);
969 OutputStream outFile =
new FileOutputStream(newDBPath);
970 out =
new BufferedOutputStream(outFile);
971 int bytesRead = in.read();
972 while (bytesRead != -1) {
973 out.write(bytesRead);
974 bytesRead = in.read();
985 }
catch (IOException e) {
986 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
995 private void logSQLiteJDBCDriverInfo() {
997 SleuthkitCase.logger.info(String.format(
"sqlite-jdbc version %s loaded in %s mode",
998 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
999 ?
"native" :
"pure-java"));
1000 }
catch (Exception ex) {
1001 SleuthkitCase.logger.log(Level.SEVERE,
"Error querying case database mode", ex);
1018 @SuppressWarnings(
"deprecation")
1019 private CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
1020 if (schemaVersion.getMajor() != 2) {
1021 return schemaVersion;
1023 Statement statement = null;
1024 Statement updateStatement = null;
1025 ResultSet resultSet = null;
1028 statement = connection.createStatement();
1031 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
1032 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
1033 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
1036 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
1039 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
1040 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
1041 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
1044 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
1047 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
1052 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
1053 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
1054 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
1055 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
1056 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
1057 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
1058 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
1059 +
"arts.artifact_type_id AS artifact_type_id "
1060 +
"FROM blackboard_attributes AS attrs "
1061 +
"INNER JOIN blackboard_artifacts AS arts "
1062 +
"WHERE attrs.artifact_id = arts.artifact_id;");
1063 updateStatement = connection.createStatement();
1064 while (resultSet.next()) {
1065 long artifactId = resultSet.getLong(
"artifact_id");
1066 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
1067 updateStatement.executeUpdate(
1068 "UPDATE blackboard_attributes "
1069 +
"SET artifact_type_id = " + artifactTypeId
1070 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
1079 HashMap<String, TagName> tagNames =
new HashMap<String, TagName>();
1083 String comment =
"";
1085 for (BlackboardAttribute attribute : attributes) {
1086 if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
1087 name = attribute.getValueString();
1088 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
1089 comment = attribute.getValueString();
1092 if (!name.isEmpty()) {
1094 if (tagNames.containsKey(name)) {
1095 tagName = tagNames.get(name);
1097 tagName =
addTagName(name,
"", TagName.HTML_COLOR.NONE);
1098 tagNames.put(name, tagName);
1100 addContentTag(content, tagName, comment, 0, content.getSize() - 1);
1104 long taggedArtifactId = -1;
1106 String comment =
"";
1108 for (BlackboardAttribute attribute : attributes) {
1109 if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
1110 name = attribute.getValueString();
1111 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
1112 comment = attribute.getValueString();
1113 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()) {
1114 taggedArtifactId = attribute.getValueLong();
1117 if (taggedArtifactId != -1 && !name.isEmpty()) {
1119 if (tagNames.containsKey(name)) {
1120 tagName = tagNames.get(name);
1122 tagName =
addTagName(name,
"", TagName.HTML_COLOR.NONE);
1123 tagNames.put(name, tagName);
1129 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
1130 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
1131 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1132 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
");");
1134 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
1135 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1136 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
";");
1138 return new CaseDbSchemaVersionNumber(3, 0);
1140 closeStatement(updateStatement);
1141 closeResultSet(resultSet);
1142 closeStatement(statement);
1161 private CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1162 if (schemaVersion.getMajor() != 3) {
1163 return schemaVersion;
1166 Statement statement = null;
1167 ResultSet resultSet = null;
1168 Statement queryStatement = null;
1169 ResultSet queryResultSet = null;
1170 Statement updateStatement = null;
1175 statement = connection.createStatement();
1176 updateStatement = connection.createStatement();
1177 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
1178 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
1179 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
1180 +
"WHERE files.obj_id = arts.obj_id AND "
1181 +
"arts.artifact_id = attrs.artifact_id AND "
1182 +
"arts.artifact_type_id = 1 AND "
1183 +
"attrs.attribute_type_id = 62");
1184 while (resultSet.next()) {
1185 updateStatement.executeUpdate(
1187 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
1188 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
1193 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
1194 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
1195 while (resultSet.next()) {
1196 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
1197 String attributeLabel = resultSet.getString(
"type_name");
1198 if (attributeTypeId < MIN_USER_DEFINED_TYPE_ID) {
1199 updateStatement.executeUpdate(
1200 "UPDATE blackboard_attribute_types "
1201 +
"SET value_type = " + ATTRIBUTE_TYPE.fromLabel(attributeLabel).getValueType().getType() +
" "
1202 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
1208 queryStatement = connection.createStatement();
1209 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
1210 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
1211 while (resultSet.next()) {
1212 long objectId = resultSet.getLong(
"obj_id");
1213 String timeZone =
"";
1214 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
1215 if (queryResultSet.next()) {
1216 timeZone = queryResultSet.getString(
"tzone");
1218 queryResultSet.close();
1219 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
1220 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
1234 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
1235 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
1236 while (resultSet.next()) {
1237 long fileId = resultSet.getLong(
"obj_id");
1238 long dataSourceId = getDataSourceObjectId(connection, fileId);
1239 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
1242 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1243 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1244 if (this.dbType.equals(DbType.SQLITE)) {
1245 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1246 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1248 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1249 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1252 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
1253 initIngestModuleTypes(connection);
1254 initIngestStatusTypes(connection);
1256 return new CaseDbSchemaVersionNumber(4, 0);
1259 closeResultSet(queryResultSet);
1260 closeStatement(queryStatement);
1261 closeStatement(updateStatement);
1262 closeResultSet(resultSet);
1263 closeStatement(statement);
1281 private CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1282 if (schemaVersion.getMajor() != 4) {
1283 return schemaVersion;
1286 Statement statement = null;
1290 statement = connection.createStatement();
1291 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1301 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1304 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
1305 initEncodingTypes(connection);
1312 initReviewStatuses(connection);
1317 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
1319 return new CaseDbSchemaVersionNumber(5, 0);
1322 closeStatement(statement);
1340 private CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1341 if (schemaVersion.getMajor() != 5) {
1342 return schemaVersion;
1349 Statement statement = null;
1350 ResultSet resultSet = null;
1356 statement = connection.createStatement();
1357 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1359 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
1361 if (resultSet.getLong(
"count") == 0) {
1370 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1373 return new CaseDbSchemaVersionNumber(6, 0);
1376 closeResultSet(resultSet);
1377 closeStatement(statement);
1395 private CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1396 if (schemaVersion.getMajor() != 6) {
1397 return schemaVersion;
1403 Statement statement = null;
1404 Statement updstatement = null;
1405 ResultSet resultSet = null;
1408 statement = connection.createStatement();
1409 updstatement = connection.createStatement();
1410 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
1412 resultSet = connection.executeQuery(statement,
"SELECT obj_id,name FROM tsk_files");
1413 while (resultSet.next()) {
1414 long objID = resultSet.getLong(
"obj_id");
1415 String name = resultSet.getString(
"name");
1416 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" +
escapeSingleQuotes(extractExtension(name)) +
"' "
1417 +
"WHERE obj_id = " + objID);
1420 statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
1423 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
1425 return new CaseDbSchemaVersionNumber(7, 0);
1428 closeResultSet(resultSet);
1429 closeStatement(statement);
1430 closeStatement(updstatement);
1448 private CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1449 if (schemaVersion.getMajor() != 7) {
1450 return schemaVersion;
1453 if (schemaVersion.getMinor() != 0) {
1454 return schemaVersion;
1460 Statement statement = null;
1461 ResultSet resultSet = null;
1464 statement = connection.createStatement();
1467 if (schemaVersion.getMinor() == 0) {
1469 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
1471 return new CaseDbSchemaVersionNumber(7, 1);
1474 closeResultSet(resultSet);
1475 closeStatement(statement);
1493 private CaseDbSchemaVersionNumber updateFromSchema7dot1toSchema7dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1494 if (schemaVersion.getMajor() != 7) {
1495 return schemaVersion;
1498 if (schemaVersion.getMinor() != 1) {
1499 return schemaVersion;
1502 Statement statement = null;
1503 Statement updstatement = null;
1504 ResultSet resultSet = null;
1508 statement = connection.createStatement();
1509 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1");
1512 updstatement = connection.createStatement();
1513 resultSet = connection.executeQuery(statement,
"SELECT artifact_id, obj_id FROM blackboard_artifacts");
1514 while (resultSet.next()) {
1515 long artifact_id = resultSet.getLong(
"artifact_id");
1516 long obj_id = resultSet.getLong(
"obj_id");
1517 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
1518 updstatement.executeUpdate(
"UPDATE blackboard_artifacts SET data_source_obj_id = " + data_source_obj_id +
" "
1519 +
"WHERE artifact_id = " + artifact_id);
1521 closeResultSet(resultSet);
1522 closeStatement(statement);
1523 closeStatement(updstatement);
1528 statement = connection.createStatement();
1529 statement.execute(
"ALTER TABLE tag_names ADD COLUMN knownStatus INTEGER NOT NULL DEFAULT " + TskData.FileKnown.UNKNOWN.getFileKnownValue());
1532 if (this.dbType.equals(DbType.SQLITE)) {
1533 statement.execute(
"CREATE TABLE account_types (account_type_id INTEGER PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1534 statement.execute(
"CREATE TABLE accounts (account_id INTEGER PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1535 statement.execute(
"CREATE TABLE account_relationships (relationship_id INTEGER PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time INTEGER, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1537 statement.execute(
"CREATE TABLE account_types (account_type_id BIGSERIAL PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1538 statement.execute(
"CREATE TABLE accounts (account_id BIGSERIAL PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1539 statement.execute(
"CREATE TABLE account_relationships (relationship_id BIGSERIAL PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time BIGINT, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1543 statement.execute(
"CREATE INDEX artifact_artifact_objID ON blackboard_artifacts(artifact_obj_id)");
1544 statement.execute(
"CREATE INDEX relationships_account1 ON account_relationships(account1_id)");
1545 statement.execute(
"CREATE INDEX relationships_account2 ON account_relationships(account2_id)");
1546 statement.execute(
"CREATE INDEX relationships_relationship_source_obj_id ON account_relationships(relationship_source_obj_id)");
1547 statement.execute(
"CREATE INDEX relationships_date_time ON account_relationships(date_time)");
1548 statement.execute(
"CREATE INDEX relationships_relationship_type ON account_relationships(relationship_type)");
1549 statement.execute(
"CREATE INDEX relationships_data_source_obj_id ON account_relationships(data_source_obj_id)");
1551 return new CaseDbSchemaVersionNumber(7, 2);
1553 closeResultSet(resultSet);
1554 closeStatement(statement);
1555 closeStatement(updstatement);
1573 private CaseDbSchemaVersionNumber updateFromSchema7dot2toSchema8dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1574 if (schemaVersion.getMajor() != 7) {
1575 return schemaVersion;
1578 if (schemaVersion.getMinor() != 2) {
1579 return schemaVersion;
1582 Statement updateSchemaStatement = connection.createStatement();
1583 Statement getExistingReportsStatement = connection.createStatement();
1584 ResultSet resultSet = null;
1585 ResultSet existingReports = null;
1593 updateSchemaStatement.execute(
"ALTER TABLE reports RENAME TO old_reports");
1596 updateSchemaStatement.execute(
"CREATE TABLE reports (obj_id BIGSERIAL PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id))");
1599 existingReports = getExistingReportsStatement.executeQuery(
"SELECT * FROM old_reports");
1600 while (existingReports.next()) {
1601 String path = existingReports.getString(2);
1602 long crtime = existingReports.getInt(3);
1603 String sourceModule = existingReports.getString(4);
1604 String reportName = existingReports.getString(5);
1606 PreparedStatement insertObjectStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
1607 insertObjectStatement.clearParameters();
1608 insertObjectStatement.setNull(1, java.sql.Types.BIGINT);
1609 insertObjectStatement.setLong(2, TskData.ObjectType.REPORT.getObjectType());
1610 connection.executeUpdate(insertObjectStatement);
1611 resultSet = insertObjectStatement.getGeneratedKeys();
1612 if (!resultSet.next()) {
1613 throw new TskCoreException(String.format(
"Failed to INSERT report %s (%s) in tsk_objects table", reportName, path));
1615 long objectId = resultSet.getLong(1);
1618 PreparedStatement insertReportStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
1619 insertReportStatement.clearParameters();
1620 insertReportStatement.setLong(1, objectId);
1621 insertReportStatement.setString(2, path);
1622 insertReportStatement.setLong(3, crtime);
1623 insertReportStatement.setString(4, sourceModule);
1624 insertReportStatement.setString(5, reportName);
1625 connection.executeUpdate(insertReportStatement);
1629 updateSchemaStatement.execute(
"DROP TABLE old_reports");
1631 return new CaseDbSchemaVersionNumber(8, 0);
1633 closeResultSet(resultSet);
1634 closeResultSet(existingReports);
1635 closeStatement(updateSchemaStatement);
1636 closeStatement(getExistingReportsStatement);
1654 private CaseDbSchemaVersionNumber updateFromSchema8dot0toSchema8dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1655 if (schemaVersion.getMajor() != 8) {
1656 return schemaVersion;
1659 if (schemaVersion.getMinor() != 0) {
1660 return schemaVersion;
1665 try (Statement statement = connection.createStatement();) {
1667 if (this.dbType.equals(DbType.SQLITE)) {
1668 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id INTEGER PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name) )");
1669 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1670 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1672 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id BIGSERIAL PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name))");
1673 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1674 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1677 return new CaseDbSchemaVersionNumber(8, 1);
1696 private CaseDbSchemaVersionNumber updateFromSchema8dot1toSchema8dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1697 if (schemaVersion.getMajor() != 8) {
1698 return schemaVersion;
1701 if (schemaVersion.getMinor() != 1) {
1702 return schemaVersion;
1707 try (Statement statement = connection.createStatement();) {
1708 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha1 TEXT DEFAULT NULL");
1709 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha256 TEXT DEFAULT NULL");
1711 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_details TEXT");
1719 statement.execute(
"CREATE TABLE tsk_db_info_extended (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
1720 ResultSet result = statement.executeQuery(
"SELECT tsk_ver FROM tsk_db_info");
1722 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + TSK_VERSION_KEY +
"', '" + result.getLong(
"tsk_ver") +
"')");
1723 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MAJOR_VERSION_KEY +
"', '8')");
1724 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MINOR_VERSION_KEY +
"', '2')");
1725 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MAJOR_VERSION_KEY +
"', '0')");
1726 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MINOR_VERSION_KEY +
"', '0')");
1728 String primaryKeyType;
1731 primaryKeyType =
"BIGSERIAL";
1734 primaryKeyType =
"INTEGER";
1737 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1741 statement.execute(
"CREATE TABLE tsk_event_types ("
1742 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1743 +
" display_name TEXT UNIQUE NOT NULL, "
1744 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1745 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1746 +
" values( 0, 'Event Types', null)");
1747 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1748 +
" values(1, 'File System', 0)");
1749 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1750 +
" values(2, 'Web Activity', 0)");
1751 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1752 +
" values(3, 'Misc Types', 0)");
1753 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1754 +
" values(4, 'Modified', 1)");
1755 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1756 +
" values(5, 'Accessed', 1)");
1757 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1758 +
" values(6, 'Created', 1)");
1759 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1760 +
" values(7, 'Changed', 1)");
1763 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1764 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1765 +
" full_description TEXT NOT NULL, "
1766 +
" med_description TEXT, "
1767 +
" short_description TEXT,"
1768 +
" data_source_obj_id BIGINT NOT NULL, "
1769 +
" file_obj_id BIGINT NOT NULL, "
1770 +
" artifact_id BIGINT, "
1771 +
" hash_hit INTEGER NOT NULL, "
1772 +
" tagged INTEGER NOT NULL, "
1773 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1774 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1775 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1778 statement.execute(
"CREATE TABLE tsk_events ( "
1779 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1780 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1781 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1782 +
" time INTEGER NOT NULL) "
1786 statement.execute(
"CREATE INDEX events_time ON tsk_events(time)");
1787 statement.execute(
"CREATE INDEX events_type ON tsk_events(event_type_id)");
1788 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1789 statement.execute(
"CREATE INDEX events_file_obj_id ON tsk_event_descriptions(file_obj_id) ");
1790 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1791 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1792 return new CaseDbSchemaVersionNumber(8, 2);
1812 private CaseDbSchemaVersionNumber updateFromSchema8dot2toSchema8dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1813 if (schemaVersion.getMajor() != 8) {
1814 return schemaVersion;
1817 if (schemaVersion.getMinor() != 2) {
1818 return schemaVersion;
1823 ResultSet resultSet = null;
1825 try (Statement statement = connection.createStatement();) {
1830 String primaryKeyType;
1833 primaryKeyType =
"BIGSERIAL";
1836 primaryKeyType =
"INTEGER";
1839 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1843 statement.execute(
"CREATE TABLE IF NOT EXISTS tsk_event_types ("
1844 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1845 +
" display_name TEXT UNIQUE NOT NULL, "
1846 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1848 resultSet = statement.executeQuery(
"SELECT * from tsk_event_types");
1852 if (!resultSet.next()) {
1854 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1855 +
" values( 0, 'Event Types', null)");
1856 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1857 +
" values(1, 'File System', 0)");
1858 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1859 +
" values(2, 'Web Activity', 0)");
1860 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1861 +
" values(3, 'Misc Types', 0)");
1862 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1863 +
" values(4, 'Modified', 1)");
1864 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1865 +
" values(5, 'Accessed', 1)");
1866 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1867 +
" values(6, 'Created', 1)");
1868 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1869 +
" values(7, 'Changed', 1)");
1874 statement.execute(
"DROP TABLE IF EXISTS tsk_events");
1878 statement.execute(
"DROP TABLE IF EXISTS tsk_event_descriptions");
1881 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1882 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1883 +
" full_description TEXT NOT NULL, "
1884 +
" med_description TEXT, "
1885 +
" short_description TEXT,"
1886 +
" data_source_obj_id BIGINT NOT NULL, "
1887 +
" file_obj_id BIGINT NOT NULL, "
1888 +
" artifact_id BIGINT, "
1889 +
" hash_hit INTEGER NOT NULL, "
1890 +
" tagged INTEGER NOT NULL, "
1891 +
" UNIQUE(full_description, file_obj_id, artifact_id), "
1892 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1893 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1894 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1898 statement.execute(
"CREATE TABLE tsk_events ( "
1899 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1900 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1901 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1902 +
" time INTEGER NOT NULL, "
1903 +
" UNIQUE (event_type_id, event_description_id, time))"
1907 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MAJOR_VERSION' WHERE name = 'CREATED_SCHEMA_MAJOR_VERSION'");
1908 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MINOR_VERSION' WHERE name = 'CREATED_SCHEMA_MINOR_VERSION'");
1912 return new CaseDbSchemaVersionNumber(8, 3);
1914 closeResultSet(resultSet);
1939 private CaseDbSchemaVersionNumber updateFromSchema8dot3toSchema8dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1940 if (schemaVersion.getMajor() != 8) {
1941 return schemaVersion;
1944 if (schemaVersion.getMinor() != 3) {
1945 return schemaVersion;
1948 Statement statement = connection.createStatement();
1949 ResultSet results = null;
1956 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1962 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
1963 +
"WHERE table_name='tsk_event_descriptions' and column_name='file_obj_id'");
1964 if (results.next()) {
1966 statement.execute(
"ALTER TABLE tsk_event_descriptions "
1967 +
"RENAME COLUMN file_obj_id TO content_obj_id");
1971 statement.execute(
"CREATE TABLE temp_tsk_events ( "
1972 +
" event_id BIGSERIAL PRIMARY KEY, "
1973 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1974 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id),"
1975 +
" time BIGINT NOT NULL, "
1976 +
" UNIQUE (event_type_id, event_description_id, time))"
1980 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
1981 +
"event_description_id, time) SELECT * FROM tsk_events");
1984 statement.execute(
"DROP TABLE tsk_events");
1987 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
1990 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1991 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
1992 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1993 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1994 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
1998 boolean hasMisnamedColumn =
false;
1999 results = statement.executeQuery(
"pragma table_info('tsk_event_descriptions')");
2000 while (results.next()) {
2001 if (results.getString(
"name") != null && results.getString(
"name").equals(
"file_obj_id")) {
2002 hasMisnamedColumn =
true;
2007 if (hasMisnamedColumn) {
2009 statement.execute(
"CREATE TABLE temp_tsk_event_descriptions ("
2010 +
" event_description_id INTEGER PRIMARY KEY, "
2011 +
" full_description TEXT NOT NULL, "
2012 +
" med_description TEXT, "
2013 +
" short_description TEXT,"
2014 +
" data_source_obj_id BIGINT NOT NULL, "
2015 +
" content_obj_id BIGINT NOT NULL, "
2016 +
" artifact_id BIGINT, "
2017 +
" hash_hit INTEGER NOT NULL, "
2018 +
" tagged INTEGER NOT NULL, "
2019 +
" UNIQUE(full_description, content_obj_id, artifact_id), "
2020 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2021 +
" FOREIGN KEY(content_obj_id) REFERENCES tsk_files(obj_id), "
2022 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2025 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2026 +
" event_id INTEGER PRIMARY KEY, "
2027 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2028 +
" event_description_id BIGINT NOT NULL REFERENCES temp_tsk_event_descriptions(event_description_id),"
2029 +
" time INTEGER NOT NULL, "
2030 +
" UNIQUE (event_type_id, event_description_id, time))"
2034 statement.execute(
"INSERT INTO temp_tsk_event_descriptions(event_description_id, full_description, "
2035 +
"med_description, short_description, data_source_obj_id, content_obj_id, artifact_id, "
2036 +
"hash_hit, tagged) SELECT * FROM tsk_event_descriptions");
2038 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2039 +
"event_description_id, time) SELECT * FROM tsk_events");
2042 statement.execute(
"DROP TABLE tsk_events");
2043 statement.execute(
"DROP TABLE tsk_event_descriptions");
2046 statement.execute(
"ALTER TABLE temp_tsk_event_descriptions RENAME TO tsk_event_descriptions");
2047 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2050 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2051 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2052 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2053 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2054 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2058 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2062 if (this.dbType.equals(DbType.SQLITE)) {
2063 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id INTEGER PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2065 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id BIGSERIAL PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2069 insertAccountTypeIfNotExists(statement,
"IMO",
"IMO");
2070 insertAccountTypeIfNotExists(statement,
"LINE",
"LINE");
2071 insertAccountTypeIfNotExists(statement,
"SKYPE",
"Skype");
2072 insertAccountTypeIfNotExists(statement,
"TANGO",
"Tango");
2073 insertAccountTypeIfNotExists(statement,
"TEXTNOW",
"TextNow");
2074 insertAccountTypeIfNotExists(statement,
"THREEMA",
"ThreeMa");
2075 insertAccountTypeIfNotExists(statement,
"VIBER",
"Viber");
2076 insertAccountTypeIfNotExists(statement,
"XENDER",
"Xender");
2077 insertAccountTypeIfNotExists(statement,
"ZAPYA",
"Zapya");
2078 insertAccountTypeIfNotExists(statement,
"SHAREIT",
"ShareIt");
2080 return new CaseDbSchemaVersionNumber(8, 4);
2082 closeResultSet(results);
2083 closeStatement(statement);
2099 private void insertAccountTypeIfNotExists(Statement statement, String type_name, String display_name)
throws TskCoreException, SQLException {
2101 String insertSQL = String.format(
"INTO account_types(type_name, display_name) VALUES ('%s', '%s')", type_name, display_name);
2104 insertSQL =
"INSERT " + insertSQL +
" ON CONFLICT DO NOTHING";
2107 insertSQL =
"INSERT OR IGNORE " + insertSQL;
2110 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
2112 statement.execute(insertSQL);
2121 static String extractExtension(
final String fileName) {
2123 int i = fileName.lastIndexOf(
".");
2125 if ((i > 0) && ((i + 1) < fileName.length())) {
2126 ext = fileName.substring(i + 1);
2137 return ext.toLowerCase();
2161 return CURRENT_DB_SCHEMA_VERSION;
2171 return caseDBSchemaCreationVersion;
2190 return dbBackupPath;
2213 return databaseName;
2233 rwLock.writeLock().lock();
2244 rwLock.writeLock().unlock();
2255 rwLock.readLock().lock();
2266 rwLock.readLock().unlock();
2286 }
catch (Exception ex) {
2287 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
2317 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType());
2318 }
catch (PropertyVetoException exp) {
2320 throw new TskCoreException(exp.getMessage(), exp);
2324 }
catch (Exception exp) {
2326 throw new TskCoreException(exp.getMessage(), exp);
2343 }
catch (Exception ex) {
2344 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
2364 String databaseName = createCaseDataBaseName(caseName);
2379 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
2380 databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType());
2381 }
catch (PropertyVetoException exp) {
2383 throw new TskCoreException(exp.getMessage(), exp);
2384 }
catch (Exception exp) {
2386 throw new TskCoreException(exp.getMessage(), exp);
2399 private static String createCaseDataBaseName(String candidateDbName) {
2401 if (!candidateDbName.isEmpty()) {
2405 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
2410 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
2415 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
2420 dbName = dbName.toLowerCase();
2426 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
2427 dbName =
"_" + dbName;
2434 if (dbName.length() > MAX_DB_NAME_LEN_BEFORE_TIMESTAMP) {
2435 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
2447 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
2448 Date date =
new Date();
2449 dbName = dbName +
"_" + dateFormat.format(date);
2464 if (cachedCurrentExaminer != null) {
2465 return cachedCurrentExaminer;
2467 String loginName = System.getProperty(
"user.name");
2468 if (loginName == null || loginName.isEmpty()) {
2469 throw new TskCoreException(
"Failed to determine logged in user name.");
2472 CaseDbConnection connection = connections.getConnection();
2474 ResultSet resultSet = null;
2476 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME);
2477 statement.clearParameters();
2478 statement.setString(1, loginName);
2479 resultSet = connection.executeQuery(statement);
2480 if (resultSet.next()) {
2481 cachedCurrentExaminer =
new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"display_name"));
2482 return cachedCurrentExaminer;
2484 throw new TskCoreException(
"Error getting examaminer for name = " + loginName);
2487 }
catch (SQLException ex) {
2488 throw new TskCoreException(
"Error getting examaminer for name = " + loginName, ex);
2490 closeResultSet(resultSet);
2506 Examiner getExaminerById(
long id)
throws TskCoreException {
2508 CaseDbConnection connection = connections.getConnection();
2510 ResultSet resultSet = null;
2512 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_ID);
2513 statement.clearParameters();
2514 statement.setLong(1,
id);
2515 resultSet = connection.executeQuery(statement);
2516 if (resultSet.next()) {
2517 return new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"full_name"));
2519 throw new TskCoreException(
"Error getting examaminer for id = " +
id);
2521 }
catch (SQLException ex) {
2522 throw new TskCoreException(
"Error getting examaminer for id = " +
id, ex);
2524 closeResultSet(resultSet);
2548 return this.caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath,
this);
2560 CaseDbConnection connection = connections.getConnection();
2563 ResultSet rs = null;
2565 s = connection.createStatement();
2566 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
2567 +
"WHERE par_obj_id IS NULL");
2568 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
2570 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
2573 List<Content> rootObjs =
new ArrayList<Content>();
2574 for (ObjectInfo i : infos) {
2575 if (null != i.type) {
2586 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
2592 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
2597 }
catch (SQLException ex) {
2598 throw new TskCoreException(
"Error getting root objects", ex);
2618 List<Long> getDataSourceObjIds(String deviceId)
throws TskCoreException {
2621 synchronized (deviceIdToDatasourceObjIdMap) {
2622 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
2623 return new ArrayList<Long>(deviceIdToDatasourceObjIdMap.get(deviceId));
2626 CaseDbConnection connection = connections.getConnection();
2629 ResultSet rs = null;
2631 s = connection.createStatement();
2632 rs = connection.executeQuery(s,
"SELECT obj_id FROM data_source_info WHERE device_id = '" + deviceId +
"'");
2633 List<Long> dataSourceObjIds =
new ArrayList<Long>();
2635 dataSourceObjIds.add(rs.getLong(
"obj_id"));
2638 long ds_obj_id = rs.getLong(
"obj_id");
2639 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
2640 deviceIdToDatasourceObjIdMap.get(deviceId).add(ds_obj_id);
2642 deviceIdToDatasourceObjIdMap.put(deviceId,
new HashSet<Long>(Arrays.asList(ds_obj_id)));
2645 return dataSourceObjIds;
2646 }
catch (SQLException ex) {
2647 throw new TskCoreException(
"Error getting data sources", ex);
2674 CaseDbConnection connection = connections.getConnection();
2676 Statement statement = null;
2677 ResultSet resultSet = null;
2678 Statement statement2 = null;
2679 ResultSet resultSet2 = null;
2681 statement = connection.createStatement();
2682 statement2 = connection.createStatement();
2683 resultSet = connection.executeQuery(statement,
2684 "SELECT ds.obj_id, ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
2685 +
"FROM data_source_info AS ds "
2686 +
"LEFT JOIN tsk_image_info AS img "
2687 +
"ON ds.obj_id = img.obj_id");
2689 List<DataSource> dataSourceList =
new ArrayList<DataSource>();
2692 while (resultSet.next()) {
2694 Long objectId = resultSet.getLong(
"obj_id");
2695 String deviceId = resultSet.getString(
"device_id");
2696 String timezone = resultSet.getString(
"time_zone");
2697 String type = resultSet.getString(
"type");
2705 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
2706 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
2714 String parentPath =
"/";
2715 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null,
FileKnown.
UNKNOWN, parentPath);
2720 Long ssize = resultSet.getLong(
"ssize");
2721 Long size = resultSet.getLong(
"size");
2722 String md5 = resultSet.getString(
"md5");
2723 String sha1 = resultSet.getString(
"sha1");
2724 String sha256 = resultSet.getString(
"sha256");
2725 String name = resultSet.getString(
"display_name");
2727 List<String> imagePaths = imagePathsMap.get(objectId);
2729 if (imagePaths.size() > 0) {
2730 String path = imagePaths.get(0);
2731 name = (
new java.io.File(path)).getName();
2737 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
2738 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
2741 dataSourceList.add(dataSource);
2744 return dataSourceList;
2746 }
catch (SQLException ex) {
2747 throw new TskCoreException(
"Error getting data sources", ex);
2749 closeResultSet(resultSet);
2750 closeStatement(statement);
2751 closeResultSet(resultSet2);
2752 closeStatement(statement2);
2779 CaseDbConnection connection = connections.getConnection();
2781 Statement statement = null;
2782 ResultSet resultSet = null;
2783 Statement statement2 = null;
2784 ResultSet resultSet2 = null;
2786 statement = connection.createStatement();
2787 statement2 = connection.createStatement();
2788 resultSet = connection.executeQuery(statement,
2789 "SELECT ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
2790 +
"FROM data_source_info AS ds "
2791 +
"LEFT JOIN tsk_image_info AS img "
2792 +
"ON ds.obj_id = img.obj_id "
2793 +
"WHERE ds.obj_id = " + objectId);
2794 if (resultSet.next()) {
2795 String deviceId = resultSet.getString(
"device_id");
2796 String timezone = resultSet.getString(
"time_zone");
2797 String type = resultSet.getString(
"type");
2805 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
2806 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
2813 String parentPath =
"/";
2814 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null,
FileKnown.
UNKNOWN, parentPath);
2819 Long ssize = resultSet.getLong(
"ssize");
2820 Long size = resultSet.getLong(
"size");
2821 String md5 = resultSet.getString(
"md5");
2822 String sha1 = resultSet.getString(
"sha1");
2823 String sha256 = resultSet.getString(
"sha256");
2824 String name = resultSet.getString(
"display_name");
2826 List<String> imagePaths = getImagePathsById(objectId);
2828 if (imagePaths.size() > 0) {
2829 String path = imagePaths.get(0);
2830 name = (
new java.io.File(path)).getName();
2836 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
2837 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
2840 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
2842 }
catch (SQLException ex) {
2843 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
2845 closeResultSet(resultSet);
2846 closeStatement(statement);
2847 closeResultSet(resultSet2);
2848 closeStatement(statement2);
2867 return getArtifactsHelper(
"blackboard_artifacts.artifact_type_id = " + artifactTypeID);
2881 CaseDbConnection connection = connections.getConnection();
2883 ResultSet rs = null;
2886 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE);
2887 statement.clearParameters();
2888 statement.setLong(1, objId);
2889 rs = connection.executeQuery(statement);
2892 count = rs.getLong(
"count");
2895 }
catch (SQLException ex) {
2896 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
2915 CaseDbConnection connection = connections.getConnection();
2917 ResultSet rs = null;
2920 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE);
2921 statement.clearParameters();
2922 statement.setInt(1, artifactTypeID);
2923 rs = connection.executeQuery(statement);
2926 count = rs.getLong(
"count");
2929 }
catch (SQLException ex) {
2930 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
2950 CaseDbConnection connection = connections.getConnection();
2952 ResultSet rs = null;
2955 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE);
2956 statement.clearParameters();
2957 statement.setInt(2, artifactTypeID);
2958 statement.setLong(1, dataSourceID);
2959 rs = connection.executeQuery(statement);
2962 count = rs.getLong(
"count");
2965 }
catch (SQLException ex) {
2966 throw new TskCoreException(String.format(
"Error getting number of blackboard artifacts by type (%d) and data source (%d)", artifactTypeID, dataSourceID), ex);
2989 CaseDbConnection connection = connections.getConnection();
2992 ResultSet rs = null;
2994 s = connection.createStatement();
2995 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
2996 +
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
2997 +
"types.type_name AS type_name, types.display_name AS display_name, "
2998 +
" arts.review_status_id AS review_status_id "
2999 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3000 +
"WHERE arts.artifact_id = attrs.artifact_id "
3001 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3002 +
" AND attrs.value_text = '" + value +
"'"
3003 +
" AND types.artifact_type_id=arts.artifact_type_id"
3005 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3007 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3008 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3012 }
catch (SQLException ex) {
3013 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3040 String valSubStr =
"%" + subString;
3041 if (startsWith ==
false) {
3044 CaseDbConnection connection = connections.getConnection();
3047 ResultSet rs = null;
3049 s = connection.createStatement();
3050 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3051 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3052 +
" types.type_name AS type_name, types.display_name AS display_name, "
3053 +
" arts.review_status_id AS review_status_id "
3054 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3055 +
" WHERE arts.artifact_id = attrs.artifact_id "
3056 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3057 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
3058 +
" AND types.artifact_type_id=arts.artifact_type_id "
3060 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3062 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3063 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3067 }
catch (SQLException ex) {
3068 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3092 CaseDbConnection connection = connections.getConnection();
3095 ResultSet rs = null;
3097 s = connection.createStatement();
3098 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3099 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3100 +
" types.type_name AS type_name, types.display_name AS display_name, "
3101 +
" arts.review_status_id AS review_status_id "
3102 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3103 +
"WHERE arts.artifact_id = attrs.artifact_id "
3104 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3105 +
" AND attrs.value_int32 = " + value
3106 +
" AND types.artifact_type_id=arts.artifact_type_id "
3108 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3110 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3111 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3115 }
catch (SQLException ex) {
3116 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3140 CaseDbConnection connection = connections.getConnection();
3143 ResultSet rs = null;
3145 s = connection.createStatement();
3146 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3147 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3148 +
" types.type_name AS type_name, types.display_name AS display_name, "
3149 +
" arts.review_status_id AS review_status_id "
3150 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3151 +
" WHERE arts.artifact_id = attrs.artifact_id "
3152 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3153 +
" AND attrs.value_int64 = " + value
3154 +
" AND types.artifact_type_id=arts.artifact_type_id "
3156 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3158 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3159 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3163 }
catch (SQLException ex) {
3164 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3188 CaseDbConnection connection = connections.getConnection();
3191 ResultSet rs = null;
3193 s = connection.createStatement();
3194 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3195 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3196 +
" types.type_name AS type_name, types.display_name AS display_name, "
3197 +
" arts.review_status_id AS review_status_id "
3198 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3199 +
" WHERE arts.artifact_id = attrs.artifact_id "
3200 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3201 +
" AND attrs.value_double = " + value
3202 +
" AND types.artifact_type_id=arts.artifact_type_id "
3204 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3206 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3207 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3211 }
catch (SQLException ex) {
3212 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3236 CaseDbConnection connection = connections.getConnection();
3239 ResultSet rs = null;
3241 s = connection.createStatement();
3242 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3243 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3244 +
" types.type_name AS type_name, types.display_name AS display_name, "
3245 +
" arts.review_status_id AS review_status_id "
3246 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3247 +
" WHERE arts.artifact_id = attrs.artifact_id "
3248 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3249 +
" AND attrs.value_byte = " + value
3250 +
" AND types.artifact_type_id=arts.artifact_type_id "
3252 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3254 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3255 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3259 }
catch (SQLException ex) {
3260 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3277 CaseDbConnection connection = connections.getConnection();
3280 ResultSet rs = null;
3282 s = connection.createStatement();
3283 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types");
3287 rs.getString(
"type_name"), rs.getString(
"display_name")));
3289 return artifactTypes;
3290 }
catch (SQLException ex) {
3291 throw new TskCoreException(
"Error getting artifact types", ex);
3309 String typeIdList =
"";
3316 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
3317 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
3318 CaseDbConnection connection = connections.getConnection();
3321 ResultSet rs = null;
3323 s = connection.createStatement();
3324 rs = connection.executeQuery(s, query);
3330 }
catch (SQLException ex) {
3331 throw new TskCoreException(
"Error getting artifact types in use", ex);
3351 CaseDbConnection connection = connections.getConnection();
3354 ResultSet rs = null;
3356 s = connection.createStatement();
3357 rs = connection.executeQuery(s,
3358 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
3359 +
"types.type_name AS type_name, types.display_name AS display_name "
3360 +
"FROM blackboard_artifact_types AS types "
3361 +
"INNER JOIN blackboard_artifacts AS arts "
3362 +
"ON arts.artifact_type_id = types.artifact_type_id");
3366 rs.getString(
"type_name"), rs.getString(
"display_name")));
3368 return uniqueArtifactTypes;
3369 }
catch (SQLException ex) {
3370 throw new TskCoreException(
"Error getting attribute types", ex);
3387 CaseDbConnection connection = connections.getConnection();
3390 ResultSet rs = null;
3392 s = connection.createStatement();
3393 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
3399 return attribute_types;
3400 }
catch (SQLException ex) {
3401 throw new TskCoreException(
"Error getting attribute types", ex);
3422 CaseDbConnection connection = connections.getConnection();
3425 ResultSet rs = null;
3427 s = connection.createStatement();
3428 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
3431 count = rs.getInt(
"count");
3434 }
catch (SQLException ex) {
3435 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
3456 ArrayList<BlackboardArtifact> getArtifactsHelper(String whereClause)
throws TskCoreException {
3457 CaseDbConnection connection = connections.getConnection();
3459 ResultSet rs = null;
3461 Statement statement = connection.createStatement();
3462 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
3463 +
"blackboard_artifacts.obj_id AS obj_id, "
3464 +
"blackboard_artifacts.artifact_obj_id AS artifact_obj_id, "
3465 +
"blackboard_artifacts.data_source_obj_id AS data_source_obj_id, "
3466 +
"blackboard_artifact_types.artifact_type_id AS artifact_type_id, "
3467 +
"blackboard_artifact_types.type_name AS type_name, "
3468 +
"blackboard_artifact_types.display_name AS display_name, "
3469 +
"blackboard_artifacts.review_status_id AS review_status_id "
3470 +
"FROM blackboard_artifacts, blackboard_artifact_types "
3471 +
"WHERE blackboard_artifacts.artifact_type_id = blackboard_artifact_types.artifact_type_id "
3473 +
" AND " + whereClause;
3474 rs = connection.executeQuery(statement, query);
3475 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3477 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3478 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3482 }
catch (SQLException ex) {
3483 throw new TskCoreException(
"Error getting or creating a blackboard artifact", ex);
3503 private long getArtifactsCountHelper(
int artifactTypeID,
long obj_id)
throws TskCoreException {
3504 CaseDbConnection connection = connections.getConnection();
3506 ResultSet rs = null;
3509 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE);
3510 statement.clearParameters();
3511 statement.setLong(1, obj_id);
3512 statement.setInt(2, artifactTypeID);
3513 rs = connection.executeQuery(statement);
3516 count = rs.getLong(
"count");
3519 }
catch (SQLException ex) {
3520 throw new TskCoreException(
"Error getting blackboard artifact count", ex);
3541 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
3557 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID +
";");
3589 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
3590 if (artifactTypeID == -1) {
3593 return getArtifactsCountHelper(artifactTypeID, obj_id);
3609 return getArtifactsCountHelper(artifactTypeID, obj_id);
3625 return getArtifactsCountHelper(artifactType.getTypeID(), obj_id);
3640 return getArtifactsHelper(
"blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
3655 return getArtifactsHelper(
"blackboard_artifact_types.artifact_type_id = " + artifactType.getTypeID() +
";");
3672 CaseDbConnection connection = connections.getConnection();
3675 ResultSet rs = null;
3677 s = connection.createStatement();
3678 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3679 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3680 +
"types.type_name AS type_name, types.display_name AS display_name,"
3681 +
"arts.review_status_id AS review_status_id "
3682 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3683 +
"WHERE arts.artifact_id = attrs.artifact_id "
3684 +
"AND attrs.attribute_type_id = " + attrType.getTypeID()
3685 +
" AND arts.artifact_type_id = " + artifactType.getTypeID()
3686 +
" AND attrs.value_text = '" + value +
"'"
3687 +
" AND types.artifact_type_id=arts.artifact_type_id"
3689 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3691 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3692 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3696 }
catch (SQLException ex) {
3697 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
3717 CaseDbConnection connection = connections.getConnection();
3719 ResultSet rs = null;
3722 s = connection.createStatement();
3723 rs = connection.executeQuery(s,
"SELECT arts.artifact_id AS artifact_id, "
3724 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3725 +
"types.type_name AS type_name, types.display_name AS display_name,"
3726 +
"arts.review_status_id AS review_status_id "
3727 +
"FROM blackboard_artifacts AS arts, blackboard_artifact_types AS types "
3728 +
"WHERE arts.artifact_id = " + artifactID
3729 +
" AND arts.artifact_type_id = types.artifact_type_id");
3731 return new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3732 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3740 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
3742 }
catch (SQLException ex) {
3743 throw new TskCoreException(
"Error getting a blackboard artifact. " + ex.getMessage(), ex);
3760 CaseDbConnection connection = connections.getConnection();
3763 addBlackBoardAttribute(attr, artifactTypeId, connection);
3764 }
catch (SQLException ex) {
3765 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
3782 CaseDbConnection connection = connections.getConnection();
3785 connection.beginTransaction();
3787 addBlackBoardAttribute(attr, artifactTypeId, connection);
3789 connection.commitTransaction();
3790 }
catch (SQLException ex) {
3791 connection.rollbackTransaction();
3792 throw new TskCoreException(
"Error adding blackboard attributes", ex);
3799 private void addBlackBoardAttribute(
BlackboardAttribute attr,
int artifactTypeId, CaseDbConnection connection)
throws SQLException, TskCoreException {
3800 PreparedStatement statement;
3801 switch (attr.getAttributeType().getValueType()) {
3804 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_STRING_ATTRIBUTE);
3805 statement.clearParameters();
3806 statement.setString(7, attr.getValueString());
3809 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_BYTE_ATTRIBUTE);
3810 statement.clearParameters();
3811 statement.setBytes(7, attr.getValueBytes());
3814 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INT_ATTRIBUTE);
3815 statement.clearParameters();
3816 statement.setInt(7, attr.getValueInt());
3819 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
3820 statement.clearParameters();
3821 statement.setLong(7, attr.getValueLong());
3824 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DOUBLE_ATTRIBUTE);
3825 statement.clearParameters();
3826 statement.setDouble(7, attr.getValueDouble());
3829 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
3830 statement.clearParameters();
3831 statement.setLong(7, attr.getValueLong());
3834 throw new TskCoreException(
"Unrecognized artifact attribute value type");
3836 statement.setLong(1, attr.getArtifactID());
3837 statement.setInt(2, artifactTypeId);
3838 statement.setString(3, attr.getSourcesCSV());
3839 statement.setString(4,
"");
3840 statement.setInt(5, attr.getAttributeType().getTypeID());
3841 statement.setLong(6, attr.getAttributeType().getValueType().getType());
3842 connection.executeUpdate(statement);
3855 String addSourceToArtifactAttribute(BlackboardAttribute attr, String source)
throws TskCoreException {
3863 if (null == source || source.isEmpty()) {
3864 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
3866 CaseDbConnection connection = connections.getConnection();
3868 Statement queryStmt = null;
3869 Statement updateStmt = null;
3870 ResultSet result = null;
3871 String newSources =
"";
3873 connection.beginTransaction();
3874 String valueClause =
"";
3875 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
3876 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
3877 switch (valueType) {
3883 valueClause =
" value_int32 = " + attr.getValueInt();
3887 valueClause =
" value_int64 = " + attr.getValueLong();
3890 valueClause =
" value_double = " + attr.getValueDouble();
3893 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
3895 String query =
"SELECT source FROM blackboard_attributes WHERE"
3896 +
" artifact_id = " + attr.getArtifactID()
3897 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
3898 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
3899 +
" AND " + valueClause +
";";
3900 queryStmt = connection.createStatement();
3901 updateStmt = connection.createStatement();
3902 result = connection.executeQuery(queryStmt, query);
3909 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
3910 statement.clearParameters();
3911 statement.setLong(1, attr.getArtifactID());
3912 statement.setLong(2, attr.getAttributeType().getTypeID());
3913 statement.setBytes(3, attr.getValueBytes());
3914 result = connection.executeQuery(statement);
3916 while (result.next()) {
3917 String oldSources = result.getString(
"source");
3918 if (null != oldSources && !oldSources.isEmpty()) {
3919 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
3920 if (!uniqueSources.contains(source)) {
3921 newSources = oldSources +
"," + source;
3923 newSources = oldSources;
3926 newSources = source;
3928 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
3929 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
3930 +
" artifact_id = " + attr.getArtifactID()
3931 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
3932 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
3933 +
" AND " + valueClause +
";";
3934 connection.executeUpdate(updateStmt, update);
3941 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
3942 statement.clearParameters();
3943 statement.setString(1, newSources);
3944 statement.setLong(2, attr.getArtifactID());
3945 statement.setLong(3, attr.getAttributeType().getTypeID());
3946 statement.setBytes(4, attr.getValueBytes());
3947 connection.executeUpdate(statement);
3950 connection.commitTransaction();
3952 }
catch (SQLException ex) {
3953 connection.rollbackTransaction();
3954 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
3956 closeResultSet(result);
3957 closeStatement(updateStmt);
3958 closeStatement(queryStmt);
3979 CaseDbConnection connection = connections.getConnection();
3982 ResultSet rs = null;
3984 connection.beginTransaction();
3985 s = connection.createStatement();
3986 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeString +
"'");
3989 rs = connection.executeQuery(s,
"SELECT MAX(attribute_type_id) AS highest_id FROM blackboard_attribute_types");
3992 maxID = rs.getInt(
"highest_id");
3993 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
3994 maxID = MIN_USER_DEFINED_TYPE_ID;
3999 connection.executeUpdate(s,
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES ('" + maxID +
"', '" + attrTypeString +
"', '" + displayName +
"', '" + valueType.getType() +
"')");
4001 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
4002 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
4003 connection.commitTransaction();
4006 throw new TskDataException(
"The attribute type that was added was already within the system.");
4009 }
catch (SQLException ex) {
4010 connection.rollbackTransaction();
4011 throw new TskCoreException(
"Error adding attribute type", ex);
4031 if (this.typeNameToAttributeTypeMap.containsKey(attrTypeName)) {
4032 return this.typeNameToAttributeTypeMap.get(attrTypeName);
4034 CaseDbConnection connection = connections.getConnection();
4037 ResultSet rs = null;
4039 s = connection.createStatement();
4040 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
4045 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
4046 this.typeNameToAttributeTypeMap.put(attrTypeName, type);
4049 }
catch (SQLException ex) {
4050 throw new TskCoreException(
"Error getting attribute type id", ex);
4070 if (this.typeIdToAttributeTypeMap.containsKey(typeID)) {
4071 return this.typeIdToAttributeTypeMap.get(typeID);
4073 CaseDbConnection connection = connections.getConnection();
4076 ResultSet rs = null;
4078 s = connection.createStatement();
4079 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE attribute_type_id = " + typeID +
"");
4080 BlackboardAttribute.Type type = null;
4082 type =
new BlackboardAttribute.Type(rs.getInt(
"attribute_type_id"), rs.getString(
"type_name"),
4083 rs.getString(
"display_name"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(rs.getLong(
"value_type")));
4084 this.typeIdToAttributeTypeMap.put(typeID, type);
4085 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
4088 }
catch (SQLException ex) {
4089 throw new TskCoreException(
"Error getting attribute type id", ex);
4109 if (this.typeNameToArtifactTypeMap.containsKey(artTypeName)) {
4110 return this.typeNameToArtifactTypeMap.get(artTypeName);
4112 CaseDbConnection connection = connections.getConnection();
4115 ResultSet rs = null;
4117 s = connection.createStatement();
4118 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE type_name = '" + artTypeName +
"'");
4122 rs.getString(
"type_name"), rs.getString(
"display_name"));
4123 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4124 this.typeNameToArtifactTypeMap.put(artTypeName, type);
4127 }
catch (SQLException ex) {
4128 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4148 if (this.typeIdToArtifactTypeMap.containsKey(artTypeId)) {
4149 return typeIdToArtifactTypeMap.get(artTypeId);
4151 CaseDbConnection connection = connections.getConnection();
4154 ResultSet rs = null;
4156 s = connection.createStatement();
4157 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE artifact_type_id = " + artTypeId +
"");
4158 BlackboardArtifact.Type type = null;
4160 type =
new BlackboardArtifact.Type(rs.getInt(
"artifact_type_id"),
4161 rs.getString(
"type_name"), rs.getString(
"display_name"));
4162 this.typeIdToArtifactTypeMap.put(artTypeId, type);
4163 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4166 }
catch (SQLException ex) {
4167 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4189 CaseDbConnection connection = connections.getConnection();
4192 ResultSet rs = null;
4194 connection.beginTransaction();
4195 s = connection.createStatement();
4196 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
4199 rs = connection.executeQuery(s,
"SELECT MAX(artifact_type_id) AS highest_id FROM blackboard_artifact_types");
4202 maxID = rs.getInt(
"highest_id");
4203 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
4204 maxID = MIN_USER_DEFINED_TYPE_ID;
4209 connection.executeUpdate(s,
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES ('" + maxID +
"', '" + artifactTypeName +
"', '" + displayName +
"')");
4211 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4212 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4213 connection.commitTransaction();
4216 throw new TskDataException(
"The attribute type that was added was already within the system.");
4218 }
catch (SQLException ex) {
4219 connection.rollbackTransaction();
4220 throw new TskCoreException(
"Error adding artifact type", ex);
4230 CaseDbConnection connection = connections.getConnection();
4232 ResultSet rs = null;
4234 Statement statement = connection.createStatement();
4235 rs = connection.executeQuery(statement,
"SELECT attrs.artifact_id AS artifact_id, "
4236 +
"attrs.source AS source, attrs.context AS context, attrs.attribute_type_id AS attribute_type_id, "
4237 +
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, "
4238 +
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, "
4239 +
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, "
4240 +
"types.type_name AS type_name, types.display_name AS display_name "
4241 +
"FROM blackboard_attributes AS attrs, blackboard_attribute_types AS types WHERE attrs.artifact_id = " + artifact.getArtifactID()
4242 +
" AND attrs.attribute_type_id = types.attribute_type_id");
4243 ArrayList<BlackboardAttribute> attributes =
new ArrayList<BlackboardAttribute>();
4245 int attributeTypeId = rs.getInt(
"attribute_type_id");
4246 String attributeTypeName = rs.getString(
"type_name");
4248 if (this.typeIdToAttributeTypeMap.containsKey(attributeTypeId)) {
4249 attributeType = this.typeIdToAttributeTypeMap.get(attributeTypeId);
4252 rs.getString(
"display_name"),
4254 this.typeIdToAttributeTypeMap.put(attributeTypeId, attributeType);
4255 this.typeNameToAttributeTypeMap.put(attributeTypeName, attributeType);
4259 rs.getLong(
"artifact_id"),
4261 rs.getString(
"source"),
4262 rs.getString(
"context"),
4263 rs.getInt(
"value_int32"),
4264 rs.getLong(
"value_int64"),
4265 rs.getDouble(
"value_double"),
4266 rs.getString(
"value_text"),
4267 rs.getBytes(
"value_byte"), this
4269 attributes.add(attr);
4272 }
catch (SQLException ex) {
4273 throw new TskCoreException(
"Error getting attributes for artifact, artifact id = " + artifact.getArtifactID(), ex);
4294 CaseDbConnection connection = connections.getConnection();
4297 ResultSet rs = null;
4299 s = connection.createStatement();
4300 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
4301 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
4302 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
4303 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
4304 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
4305 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
4306 +
"FROM blackboard_attributes " + whereClause);
4307 ArrayList<BlackboardAttribute> matches =
new ArrayList<BlackboardAttribute>();
4313 rs.getLong(
"artifact_id"),
4315 rs.getString(
"source"),
4316 rs.getString(
"context"),
4317 rs.getInt(
"value_int32"),
4318 rs.getLong(
"value_int64"),
4319 rs.getDouble(
"value_double"),
4320 rs.getString(
"value_text"),
4321 rs.getBytes(
"value_byte"), this
4326 }
catch (SQLException ex) {
4327 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4348 CaseDbConnection connection = connections.getConnection();
4350 ResultSet rs = null;
4353 s = connection.createStatement();
4354 rs = connection.executeQuery(s,
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
4355 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.data_source_obj_id AS data_source_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
4356 +
"blackboard_artifacts.review_status_id AS review_status_id "
4357 +
"FROM blackboard_artifacts " + whereClause);
4358 ArrayList<BlackboardArtifact> matches =
new ArrayList<BlackboardArtifact>();
4364 type.getTypeID(), type.getTypeName(), type.getDisplayName(),
4366 matches.add(artifact);
4369 }
catch (SQLException ex) {
4370 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4409 return newBlackboardArtifact(artifactType.getTypeID(), obj_id, artifactType.getLabel(), artifactType.getDisplayName());
4413 CaseDbConnection connection = connections.getConnection();
4415 ResultSet resultSet = null;
4418 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
4420 PreparedStatement statement = null;
4422 statement = connection.getPreparedStatement(PREPARED_STATEMENT.POSTGRESQL_INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
4423 statement.clearParameters();
4424 statement.setLong(1, obj_id);
4425 statement.setLong(2, artifact_obj_id);
4426 statement.setLong(3, data_source_obj_id);
4427 statement.setInt(4, artifact_type_id);
4430 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
4431 statement.clearParameters();
4432 this.nextArtifactId++;
4433 statement.setLong(1, this.nextArtifactId);
4434 statement.setLong(2, obj_id);
4435 statement.setLong(3, artifact_obj_id);
4436 statement.setLong(4, data_source_obj_id);
4437 statement.setInt(5, artifact_type_id);
4440 connection.executeUpdate(statement);
4441 resultSet = statement.getGeneratedKeys();
4443 return new BlackboardArtifact(
this, resultSet.getLong(1),
4444 obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, artifactTypeName, artifactDisplayName, BlackboardArtifact.ReviewStatus.UNDECIDED,
true);
4445 }
catch (SQLException ex) {
4446 throw new TskCoreException(
"Error creating a blackboard artifact", ex);
4448 closeResultSet(resultSet);
4466 boolean getContentHasChildren(Content content)
throws TskCoreException {
4467 CaseDbConnection connection = connections.getConnection();
4469 ResultSet rs = null;
4472 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
4473 statement.clearParameters();
4474 statement.setLong(1, content.getId());
4475 rs = connection.executeQuery(statement);
4476 boolean hasChildren =
false;
4478 hasChildren = rs.getInt(
"count") > 0;
4481 }
catch (SQLException e) {
4482 throw new TskCoreException(
"Error checking for children of parent " + content, e);
4502 int getContentChildrenCount(Content content)
throws TskCoreException {
4504 if (!this.getHasChildren(content)) {
4508 CaseDbConnection connection = connections.getConnection();
4510 ResultSet rs = null;
4513 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
4514 statement.clearParameters();
4515 statement.setLong(1, content.getId());
4516 rs = connection.executeQuery(statement);
4517 int countChildren = -1;
4519 countChildren = rs.getInt(
"count");
4521 return countChildren;
4522 }
catch (SQLException e) {
4523 throw new TskCoreException(
"Error checking for children of parent " + content, e);
4542 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
4543 CaseDbConnection connection = connections.getConnection();
4545 ResultSet rs = null;
4547 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
4548 statement.clearParameters();
4549 long parentId = parent.getId();
4550 statement.setLong(1, parentId);
4551 statement.setShort(2, type.getFileType());
4552 rs = connection.executeQuery(statement);
4553 return fileChildren(rs, connection, parentId);
4554 }
catch (SQLException ex) {
4555 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4572 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
4573 CaseDbConnection connection = connections.getConnection();
4575 ResultSet rs = null;
4577 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
4578 statement.clearParameters();
4579 long parentId = parent.getId();
4580 statement.setLong(1, parentId);
4581 rs = connection.executeQuery(statement);
4582 return fileChildren(rs, connection, parentId);
4583 }
catch (SQLException ex) {
4584 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4603 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
4604 CaseDbConnection connection = connections.getConnection();
4606 ResultSet rs = null;
4608 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
4609 statement.clearParameters();
4610 statement.setLong(1, parent.getId());
4611 statement.setShort(2, type.getFileType());
4612 rs = connection.executeQuery(statement);
4613 List<Long> children =
new ArrayList<Long>();
4615 children.add(rs.getLong(
"obj_id"));
4618 }
catch (SQLException ex) {
4619 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4636 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
4637 CaseDbConnection connection = connections.getConnection();
4639 ResultSet rs = null;
4641 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
4642 statement.clearParameters();
4643 statement.setLong(1, parent.getId());
4644 rs = connection.executeQuery(statement);
4645 List<Long> children =
new ArrayList<Long>();
4647 children.add(rs.getLong(
"obj_id"));
4650 }
catch (SQLException ex) {
4651 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4669 List<Long> getBlackboardArtifactChildrenIds(Content parent)
throws TskCoreException {
4670 CaseDbConnection connection = connections.getConnection();
4672 ResultSet rs = null;
4674 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
4675 statement.clearParameters();
4676 statement.setLong(1, parent.getId());
4677 rs = connection.executeQuery(statement);
4678 List<Long> children =
new ArrayList<Long>();
4680 children.add(rs.getLong(
"obj_id"));
4683 }
catch (SQLException ex) {
4684 throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
4701 List<Content> getBlackboardArtifactChildren(Content parent)
throws TskCoreException {
4703 long parentId = parent.getId();
4704 ArrayList<BlackboardArtifact> artsArray = getArtifactsHelper(
"blackboard_artifacts.obj_id = " + parentId +
";");
4706 List<Content> lc =
new ArrayList<Content>();
4707 lc.addAll(artsArray);
4719 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
4720 CaseDbConnection connection = connections.getConnection();
4723 ResultSet rs = null;
4725 s = connection.createStatement();
4726 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
4727 +
"FROM tsk_objects LEFT JOIN tsk_files "
4728 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
4729 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
4730 +
" ORDER BY tsk_objects.obj_id");
4731 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
4733 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
4736 }
catch (SQLException ex) {
4737 throw new TskCoreException(
"Error getting Children Info for Content", ex);
4756 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
4757 return getParentInfo(c.getId());
4770 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
4771 CaseDbConnection connection = connections.getConnection();
4774 ResultSet rs = null;
4776 s = connection.createStatement();
4777 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
4778 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
4779 +
"ON child.par_obj_id = parent.obj_id "
4780 +
"WHERE child.obj_id = " + contentId);
4782 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
4786 }
catch (SQLException ex) {
4787 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
4806 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
4811 ObjectInfo parentInfo = getParentInfo(fsc);
4812 if (parentInfo == null) {
4815 Directory parent = null;
4816 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
4817 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
4819 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
4838 Content content = frequentlyUsedContentMap.get(
id);
4839 if (null != content) {
4843 CaseDbConnection connection = connections.getConnection();
4846 ResultSet rs = null;
4851 s = connection.createStatement();
4852 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
4856 parentId = rs.getLong(
"par_obj_id");
4858 }
catch (SQLException ex) {
4859 throw new TskCoreException(
"Error getting Content by ID.", ex);
4871 frequentlyUsedContentMap.put(
id, content);
4874 content = getVolumeSystemById(
id, parentId);
4877 content = getVolumeById(
id, parentId);
4878 frequentlyUsedContentMap.put(
id, content);
4881 content = getPoolById(
id, parentId);
4884 content = getFileSystemById(
id, parentId);
4885 frequentlyUsedContentMap.put(
id, content);
4896 frequentlyUsedContentMap.put(
id, content);
4906 throw new TskCoreException(
"Could not obtain Content object with ID: " +
id);
4919 String getFilePath(
long id) {
4920 CaseDbConnection connection;
4922 connection = connections.getConnection();
4923 }
catch (TskCoreException ex) {
4924 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
4927 String filePath = null;
4929 ResultSet rs = null;
4931 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
4932 statement.clearParameters();
4933 statement.setLong(1,
id);
4934 rs = connection.executeQuery(statement);
4936 filePath = rs.getString(
"path");
4938 }
catch (SQLException ex) {
4939 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
4955 TskData.EncodingType getEncodingType(
long id) {
4956 CaseDbConnection connection;
4958 connection = connections.getConnection();
4959 }
catch (TskCoreException ex) {
4960 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
4963 TskData.EncodingType type = TskData.EncodingType.NONE;
4965 ResultSet rs = null;
4967 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
4968 statement.clearParameters();
4969 statement.setLong(1,
id);
4970 rs = connection.executeQuery(statement);
4972 type = TskData.EncodingType.valueOf(rs.getInt(1));
4974 }
catch (SQLException ex) {
4975 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
4992 String getFileParentPath(
long objectId, CaseDbConnection connection) {
4993 String parentPath = null;
4995 ResultSet rs = null;
4997 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
4998 statement.clearParameters();
4999 statement.setLong(1, objectId);
5000 rs = connection.executeQuery(statement);
5002 parentPath = rs.getString(
"parent_path");
5004 }
catch (SQLException ex) {
5005 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5021 String getFileName(
long objectId, CaseDbConnection connection) {
5022 String fileName = null;
5024 ResultSet rs = null;
5026 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
5027 statement.clearParameters();
5028 statement.setLong(1, objectId);
5029 rs = connection.executeQuery(statement);
5031 fileName = rs.getString(
"name");
5033 }
catch (SQLException ex) {
5034 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5052 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
5053 CaseDbConnection connection = connections.getConnection();
5054 DerivedFile.DerivedMethod method = null;
5056 ResultSet rs1 = null;
5057 ResultSet rs2 = null;
5059 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
5060 statement.clearParameters();
5061 statement.setLong(1,
id);
5062 rs1 = connection.executeQuery(statement);
5064 int method_id = rs1.getInt(
"derived_id");
5065 String rederive = rs1.getString(
"rederive");
5066 method =
new DerivedFile.DerivedMethod(method_id, rederive);
5067 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
5068 statement.clearParameters();
5069 statement.setInt(1, method_id);
5070 rs2 = connection.executeQuery(statement);
5072 method.setToolName(rs2.getString(
"tool_name"));
5073 method.setToolVersion(rs2.getString(
"tool_version"));
5074 method.setOther(rs2.getString(
"other"));
5077 }
catch (SQLException e) {
5078 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
5080 closeResultSet(rs2);
5081 closeResultSet(rs1);
5099 CaseDbConnection connection = connections.getConnection();
5121 ResultSet rs = null;
5123 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_BY_ID);
5124 statement.clearParameters();
5125 statement.setLong(1, objectId);
5126 rs = connection.executeQuery(statement);
5127 List<AbstractFile> files = resultSetToAbstractFiles(rs, connection);
5128 if (files.size() > 0) {
5129 return files.get(0);
5133 }
catch (SQLException ex) {
5134 throw new TskCoreException(
"Error getting file by id, id = " + objectId, ex);
5152 CaseDbConnection connection = connections.getConnection();
5154 ResultSet rs = null;
5156 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID);
5157 statement.clearParameters();
5158 statement.setLong(1,
id);
5159 rs = connection.executeQuery(statement);
5160 List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
5161 if (artifacts.size() > 0) {
5162 return artifacts.get(0);
5166 }
catch (SQLException ex) {
5167 throw new TskCoreException(
"Error getting artifacts by artifact_obj_id, artifact_obj_id = " +
id, ex);
5186 CaseDbConnection connection = connections.getConnection();
5188 ResultSet rs = null;
5190 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_ID);
5191 statement.clearParameters();
5192 statement.setLong(1,
id);
5193 rs = connection.executeQuery(statement);
5194 List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
5195 if (artifacts.size() > 0) {
5196 return artifacts.get(0);
5200 }
catch (SQLException ex) {
5201 throw new TskCoreException(
"Error getting artifacts by artifact id, artifact id = " +
id, ex);
5221 private long getFileSystemId(
long fileId, CaseDbConnection connection) {
5223 ResultSet rs = null;
5226 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_SYSTEM_BY_OBJECT);
5227 statement.clearParameters();
5228 statement.setLong(1, fileId);
5229 rs = connection.executeQuery(statement);
5231 ret = rs.getLong(
"fs_obj_id");
5236 }
catch (SQLException e) {
5237 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
5257 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
5258 CaseDbConnection connection = connections.getConnection();
5260 Statement statement = null;
5261 ResultSet resultSet = null;
5263 statement = connection.createStatement();
5264 resultSet = connection.executeQuery(statement, query);
5266 return (resultSet.getLong(
"count") > 0L);
5267 }
catch (SQLException ex) {
5268 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
5270 closeResultSet(resultSet);
5271 closeStatement(statement);
5288 public List<AbstractFile>
findFiles(
Content dataSource, String fileName)
throws TskCoreException {
5289 List<AbstractFile> files =
new ArrayList<AbstractFile>();
5290 CaseDbConnection connection = connections.getConnection();
5292 ResultSet resultSet = null;
5294 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME);
5295 statement.clearParameters();
5296 statement.setString(1, fileName.toLowerCase());
5297 statement.setLong(2, dataSource.getId());
5298 resultSet = connection.executeQuery(statement);
5299 files.addAll(resultSetToAbstractFiles(resultSet, connection));
5300 }
catch (SQLException e) {
5301 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
5303 closeResultSet(resultSet);
5323 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, String dirSubString)
throws TskCoreException {
5324 List<AbstractFile> files =
new ArrayList<AbstractFile>();
5325 CaseDbConnection connection = connections.getConnection();
5327 ResultSet resultSet = null;
5329 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
5330 statement.clearParameters();
5331 statement.setString(1, fileName.toLowerCase());
5332 statement.setString(2,
"%" + dirSubString.toLowerCase() +
"%");
5333 statement.setLong(3, dataSource.getId());
5334 resultSet = connection.executeQuery(statement);
5335 files.addAll(resultSetToAbstractFiles(resultSet, connection));
5336 }
catch (SQLException e) {
5337 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
5339 closeResultSet(resultSet);
5359 localTrans.acquireSingleUserCaseWriteLock();
5367 if (null != localTrans) {
5370 }
catch (TskCoreException ex2) {
5371 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
5389 private long addObject(
long parentId,
int objectType, CaseDbConnection connection)
throws SQLException {
5390 ResultSet resultSet = null;
5394 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
5395 statement.clearParameters();
5396 if (parentId != 0) {
5397 statement.setLong(1, parentId);
5399 statement.setNull(1, java.sql.Types.BIGINT);
5401 statement.setInt(2, objectType);
5402 connection.executeUpdate(statement);
5403 resultSet = statement.getGeneratedKeys();
5405 if (resultSet.next()) {
5406 if (parentId != 0) {
5407 setHasChildren(parentId);
5409 return resultSet.getLong(1);
5411 throw new SQLException(
"Error inserting object with parent " + parentId +
" into tsk_objects");
5414 closeResultSet(resultSet);
5437 if (transaction == null) {
5438 throw new TskCoreException(
"Passed null CaseDbTransaction");
5441 transaction.acquireSingleUserCaseWriteLock();
5442 ResultSet resultSet = null;
5445 CaseDbConnection connection = transaction.getConnection();
5450 if (isRootDirectory((AbstractFile) parent, transaction)) {
5453 parentPath = ((AbstractFile) parent).getParentPath() + parent.
getName() +
"/";
5467 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5468 statement.clearParameters();
5469 statement.setLong(1, newObjId);
5472 if (0 != parentId) {
5473 long parentFs = this.getFileSystemId(parentId, connection);
5474 if (parentFs != -1) {
5475 statement.setLong(2, parentFs);
5477 statement.setNull(2, java.sql.Types.BIGINT);
5480 statement.setNull(2, java.sql.Types.BIGINT);
5484 statement.setString(3, directoryName);
5488 statement.setShort(5, (
short) 1);
5492 statement.setShort(6, dirType.
getValue());
5494 statement.setShort(7, metaType.
getValue());
5498 statement.setShort(8, dirFlag.
getValue());
5501 statement.setShort(9, metaFlags);
5504 statement.setLong(10, 0);
5507 statement.setNull(11, java.sql.Types.BIGINT);
5508 statement.setNull(12, java.sql.Types.BIGINT);
5509 statement.setNull(13, java.sql.Types.BIGINT);
5510 statement.setNull(14, java.sql.Types.BIGINT);
5512 statement.setNull(15, java.sql.Types.VARCHAR);
5514 statement.setNull(17, java.sql.Types.VARCHAR);
5517 statement.setString(18, parentPath);
5520 long dataSourceObjectId;
5521 if (0 == parentId) {
5522 dataSourceObjectId = newObjId;
5524 dataSourceObjectId = getDataSourceObjectId(connection, parentId);
5526 statement.setLong(19, dataSourceObjectId);
5529 statement.setString(20, null);
5530 connection.executeUpdate(statement);
5532 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
5535 }
catch (SQLException e) {
5536 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
5538 closeResultSet(resultSet);
5562 }
catch (TskCoreException ex) {
5565 }
catch (TskCoreException ex2) {
5566 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
5592 if (transaction == null) {
5593 throw new TskCoreException(
"Passed null CaseDbTransaction");
5596 transaction.acquireSingleUserCaseWriteLock();
5597 ResultSet resultSet = null;
5600 CaseDbConnection connection = transaction.getConnection();
5603 if ((parent == null) || isRootDirectory(parent, transaction)) {
5616 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5617 statement.clearParameters();
5618 statement.setLong(1, newObjId);
5621 statement.setNull(2, java.sql.Types.BIGINT);
5624 statement.setString(3, directoryName);
5628 statement.setShort(5, (
short) 1);
5632 statement.setShort(6, dirType.
getValue());
5634 statement.setShort(7, metaType.
getValue());
5638 statement.setShort(8, dirFlag.
getValue());
5641 statement.setShort(9, metaFlags);
5644 statement.setLong(10, 0);
5647 statement.setNull(11, java.sql.Types.BIGINT);
5648 statement.setNull(12, java.sql.Types.BIGINT);
5649 statement.setNull(13, java.sql.Types.BIGINT);
5650 statement.setNull(14, java.sql.Types.BIGINT);
5652 statement.setNull(15, java.sql.Types.VARCHAR);
5654 statement.setNull(17, java.sql.Types.VARCHAR);
5657 statement.setString(18, parentPath);
5660 long dataSourceObjectId = getDataSourceObjectId(connection, parentId);
5661 statement.setLong(19, dataSourceObjectId);
5664 statement.setString(20, null);
5666 connection.executeUpdate(statement);
5668 return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
5671 }
catch (SQLException e) {
5672 throw new TskCoreException(
"Error creating local directory '" + directoryName +
"'", e);
5674 closeResultSet(resultSet);
5700 Statement statement = null;
5704 CaseDbConnection connection = transaction.getConnection();
5709 statement = connection.createStatement();
5710 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
5711 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"');");
5720 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5721 preparedStatement.clearParameters();
5722 preparedStatement.setLong(1, newObjId);
5723 preparedStatement.setNull(2, java.sql.Types.BIGINT);
5724 preparedStatement.setString(3, rootDirectoryName);
5726 preparedStatement.setShort(5, (
short) 1);
5730 preparedStatement.setShort(7, metaType.
getValue());
5732 preparedStatement.setShort(8, dirFlag.
getValue());
5735 preparedStatement.setShort(9, metaFlags);
5736 preparedStatement.setLong(10, 0);
5737 preparedStatement.setNull(11, java.sql.Types.BIGINT);
5738 preparedStatement.setNull(12, java.sql.Types.BIGINT);
5739 preparedStatement.setNull(13, java.sql.Types.BIGINT);
5740 preparedStatement.setNull(14, java.sql.Types.BIGINT);
5741 preparedStatement.setNull(15, java.sql.Types.VARCHAR);
5743 preparedStatement.setNull(17, java.sql.Types.VARCHAR);
5744 String parentPath =
"/";
5745 preparedStatement.setString(18, parentPath);
5746 preparedStatement.setLong(19, newObjId);
5747 preparedStatement.setString(20, null);
5748 connection.executeUpdate(preparedStatement);
5750 return new LocalFilesDataSource(
this, newObjId, newObjId, deviceId, rootDirectoryName, dirType, metaType, dirFlag, metaFlags, timeZone, null,
FileKnown.
UNKNOWN, parentPath);
5752 }
catch (SQLException ex) {
5753 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
5755 closeStatement(statement);
5780 String timezone, String md5, String sha1, String sha256,
5784 Statement statement = null;
5787 CaseDbConnection connection = transaction.getConnection();
5792 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
5793 preparedStatement.clearParameters();
5794 preparedStatement.setLong(1, newObjId);
5795 preparedStatement.setShort(2, (
short) type.getValue());
5796 preparedStatement.setLong(3, sectorSize);
5797 preparedStatement.setString(4, timezone);
5799 long savedSize = size < 0 ? 0 : size;
5800 preparedStatement.setLong(5, savedSize);
5801 preparedStatement.setString(6, md5);
5802 preparedStatement.setString(7, sha1);
5803 preparedStatement.setString(8, sha256);
5804 preparedStatement.setString(9, displayName);
5805 connection.executeUpdate(preparedStatement);
5808 for (
int i = 0; i < imagePaths.size(); i++) {
5809 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
5810 preparedStatement.clearParameters();
5811 preparedStatement.setLong(1, newObjId);
5812 preparedStatement.setString(2, imagePaths.get(i));
5813 preparedStatement.setLong(3, i);
5814 connection.executeUpdate(preparedStatement);
5818 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO);
5819 statement = connection.createStatement();
5820 preparedStatement.setLong(1, newObjId);
5821 preparedStatement.setString(2, deviceId);
5822 preparedStatement.setString(3, timezone);
5823 connection.executeUpdate(preparedStatement);
5826 return new Image(
this, newObjId, type.getValue(), deviceId, sectorSize, displayName,
5827 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, savedSize);
5828 }
catch (SQLException ex) {
5829 if (!imagePaths.isEmpty()) {
5830 throw new TskCoreException(String.format(
"Error adding image with path %s to database", imagePaths.get(0)), ex);
5832 throw new TskCoreException(String.format(
"Error adding image with display name %s to database", displayName), ex);
5835 closeStatement(statement);
5858 CaseDbConnection connection = transaction.getConnection();
5859 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
VS.getObjectType(), connection);
5863 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_INFO);
5864 preparedStatement.clearParameters();
5865 preparedStatement.setLong(1, newObjId);
5866 preparedStatement.setShort(2, (
short) type.getVsType());
5867 preparedStatement.setLong(3, imgOffset);
5868 preparedStatement.setLong(4, blockSize);
5869 connection.executeUpdate(preparedStatement);
5872 return new VolumeSystem(
this, newObjId,
"", type.getVsType(), imgOffset, blockSize);
5873 }
catch (SQLException ex) {
5874 throw new TskCoreException(String.format(
"Error creating volume system with parent ID %d and image offset %d",
5875 parentObjId, imgOffset), ex);
5896 public Volume addVolume(
long parentObjId,
long addr,
long start,
long length, String desc,
5899 Statement statement = null;
5902 CaseDbConnection connection = transaction.getConnection();
5907 PreparedStatement preparedStatement;
5909 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL);
5911 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_SQLITE);
5913 preparedStatement.clearParameters();
5914 preparedStatement.setLong(1, newObjId);
5915 preparedStatement.setLong(2, addr);
5916 preparedStatement.setLong(3, start);
5917 preparedStatement.setLong(4, length);
5918 preparedStatement.setString(5, desc);
5919 preparedStatement.setShort(6, (
short) flags);
5920 connection.executeUpdate(preparedStatement);
5923 return new Volume(
this, newObjId, addr, start, length, flags, desc);
5924 }
catch (SQLException ex) {
5925 throw new TskCoreException(String.format(
"Error creating volume with address %d and parent ID %d", addr, parentObjId), ex);
5927 closeStatement(statement);
5945 Statement statement = null;
5948 CaseDbConnection connection = transaction.getConnection();
5953 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_POOL_INFO);
5954 preparedStatement.clearParameters();
5955 preparedStatement.setLong(1, newObjId);
5956 preparedStatement.setShort(2, type.getValue());
5957 connection.executeUpdate(preparedStatement);
5960 return new Pool(
this, newObjId, type.getName(), type.getValue());
5961 }
catch (SQLException ex) {
5962 throw new TskCoreException(String.format(
"Error creating pool with type %d and parent ID %d", type.getValue(), parentObjId), ex);
5964 closeStatement(statement);
5988 long rootInum,
long firstInum,
long lastInum, String displayName,
5991 Statement statement = null;
5994 CaseDbConnection connection = transaction.getConnection();
5995 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
FS.getObjectType(), connection);
5999 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FS_INFO);
6000 preparedStatement.clearParameters();
6001 preparedStatement.setLong(1, newObjId);
6002 preparedStatement.setLong(2, imgOffset);
6003 preparedStatement.setShort(3, (
short) type.getValue());
6004 preparedStatement.setLong(4, blockSize);
6005 preparedStatement.setLong(5, blockCount);
6006 preparedStatement.setLong(6, rootInum);
6007 preparedStatement.setLong(7, firstInum);
6008 preparedStatement.setLong(8, lastInum);
6009 preparedStatement.setString(9, displayName);
6010 connection.executeUpdate(preparedStatement);
6013 return new FileSystem(
this, newObjId, displayName, imgOffset, type, blockSize, blockCount, rootInum,
6014 firstInum, lastInum);
6015 }
catch (SQLException ex) {
6016 throw new TskCoreException(String.format(
"Error creating file system with image offset %d and parent ID %d",
6017 imgOffset, parentObjId), ex);
6019 closeStatement(statement);
6051 long metaAddr,
int metaSeq,
6054 long ctime,
long crtime,
long atime,
long mtime,
6055 boolean isFile,
Content parent)
throws TskCoreException {
6060 Statement queryStatement = null;
6062 CaseDbConnection connection = transaction.getConnection();
6063 transaction.acquireSingleUserCaseWriteLock();
6072 AbstractFile parentFile = (AbstractFile) parent;
6073 if (isRootDirectory(parentFile, transaction)) {
6076 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
6082 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE);
6083 statement.clearParameters();
6084 statement.setLong(1, objectId);
6085 statement.setLong(2, fsObjId);
6086 statement.setLong(3, dataSourceObjId);
6087 statement.setShort(4, (
short) attrType.getValue());
6088 statement.setInt(5, attrId);
6089 statement.setString(6, fileName);
6090 statement.setLong(7, metaAddr);
6091 statement.setInt(8, metaSeq);
6093 statement.setShort(10, (
short) 1);
6095 statement.setShort(11, dirType.
getValue());
6097 statement.setShort(12, metaType.
getValue());
6098 statement.setShort(13, dirFlag.getValue());
6099 statement.setShort(14, metaFlags);
6100 statement.setLong(15, size < 0 ? 0 : size);
6101 statement.setLong(16, ctime);
6102 statement.setLong(17, crtime);
6103 statement.setLong(18, atime);
6104 statement.setLong(19, mtime);
6105 statement.setString(20, parentPath);
6106 final String extension = extractExtension(fileName);
6107 statement.setString(21, extension);
6109 connection.executeUpdate(statement);
6111 DerivedFile derivedFile =
new DerivedFile(
this, objectId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
6112 size, ctime, crtime, atime, mtime, null, null, parentPath, null, parent.getId(), null, null, extension);
6114 timelineManager.addEventsForNewFile(derivedFile, connection);
6120 attrType, attrId, fileName, metaAddr, metaSeq,
6121 dirType, metaType, dirFlag, metaFlags,
6122 size, ctime, crtime, atime, mtime,
6123 (
short) 0, 0, 0, null, null, parentPath, null,
6126 }
catch (SQLException ex) {
6127 logger.log(Level.WARNING,
"Failed to add file system file", ex);
6129 closeStatement(queryStatement);
6130 if (null != transaction) {
6133 }
catch (TskCoreException ex2) {
6134 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6150 CaseDbConnection connection = connections.getConnection();
6153 ResultSet rs = null;
6155 s = connection.createStatement();
6156 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
6158 +
" AND obj_id = data_source_obj_id"
6159 +
" ORDER BY dir_type, LOWER(name)");
6160 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
6162 virtDirRootIds.add(virtualDirectory(rs, connection));
6164 return virtDirRootIds;
6165 }
catch (SQLException ex) {
6166 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
6188 assert (null != fileRanges);
6189 if (null == fileRanges) {
6190 throw new TskCoreException(
"TskFileRange object is null");
6193 assert (null != parent);
6194 if (null == parent) {
6195 throw new TskCoreException(
"Conent is null");
6199 Statement statement = null;
6200 ResultSet resultSet = null;
6204 transaction.acquireSingleUserCaseWriteLock();
6205 CaseDbConnection connection = transaction.getConnection();
6207 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<LayoutFile>();
6215 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
6224 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6225 prepStmt.clearParameters();
6226 prepStmt.setLong(1, fileRangeId);
6227 prepStmt.setNull(2, java.sql.Types.BIGINT);
6228 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
6230 prepStmt.setNull(5, java.sql.Types.BIGINT);
6235 prepStmt.setLong(10, fileRange.getByteLen());
6236 prepStmt.setNull(11, java.sql.Types.BIGINT);
6237 prepStmt.setNull(12, java.sql.Types.BIGINT);
6238 prepStmt.setNull(13, java.sql.Types.BIGINT);
6239 prepStmt.setNull(14, java.sql.Types.BIGINT);
6240 prepStmt.setNull(15, java.sql.Types.VARCHAR);
6242 prepStmt.setNull(17, java.sql.Types.VARCHAR);
6243 prepStmt.setNull(18, java.sql.Types.VARCHAR);
6244 prepStmt.setLong(19, parent.getId());
6247 prepStmt.setString(20, null);
6248 connection.executeUpdate(prepStmt);
6255 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
6256 prepStmt.clearParameters();
6257 prepStmt.setLong(1, fileRangeId);
6258 prepStmt.setLong(2, fileRange.getByteStart());
6259 prepStmt.setLong(3, fileRange.getByteLen());
6260 prepStmt.setLong(4, fileRange.getSequence());
6261 connection.executeUpdate(prepStmt);
6266 fileRangeLayoutFiles.add(
new LayoutFile(
this,
6269 Long.toString(fileRange.getSequence()),
6275 fileRange.getByteLen(),
6279 parent.getUniquePath(),
6285 return fileRangeLayoutFiles;
6287 }
catch (SQLException ex) {
6288 throw new TskCoreException(
"Failed to add layout files to case database", ex);
6290 closeResultSet(resultSet);
6291 closeStatement(statement);
6294 if (null != transaction) {
6297 }
catch (TskCoreException ex2) {
6298 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6316 assert (null != carvingResult);
6317 if (null == carvingResult) {
6318 throw new TskCoreException(
"Carving is null");
6320 assert (null != carvingResult.getParent());
6321 if (null == carvingResult.getParent()) {
6322 throw new TskCoreException(
"Carving result has null parent");
6324 assert (null != carvingResult.getCarvedFiles());
6325 if (null == carvingResult.getCarvedFiles()) {
6326 throw new TskCoreException(
"Carving result has null carved files");
6329 Statement statement = null;
6330 ResultSet resultSet = null;
6331 long newCacheKey = 0;
6334 transaction.acquireSingleUserCaseWriteLock();
6335 CaseDbConnection connection = transaction.getConnection();
6344 while (null != root) {
6359 if (null == carvedFilesDir) {
6360 List<Content> rootChildren;
6362 rootChildren = ((FileSystem) root).getRootDirectory().
getChildren();
6366 for (
Content child : rootChildren) {
6372 if (null == carvedFilesDir) {
6373 long parId = root.
getId();
6375 if (root instanceof FileSystem) {
6376 Content rootDir = ((FileSystem) root).getRootDirectory();
6377 parId = rootDir.
getId();
6381 newCacheKey = root.
getId();
6382 rootIdsToCarvedFileDirs.put(newCacheKey, carvedFilesDir);
6389 String parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
6390 List<LayoutFile> carvedFiles =
new ArrayList<LayoutFile>();
6406 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6407 prepStmt.clearParameters();
6408 prepStmt.setLong(1, carvedFileId);
6410 prepStmt.setLong(2, root.
getId());
6412 prepStmt.setNull(2, java.sql.Types.BIGINT);
6414 prepStmt.setString(3, carvedFile.getName());
6416 prepStmt.setShort(5, (
short) 1);
6421 prepStmt.setLong(10, carvedFile.getSizeInBytes());
6422 prepStmt.setNull(11, java.sql.Types.BIGINT);
6423 prepStmt.setNull(12, java.sql.Types.BIGINT);
6424 prepStmt.setNull(13, java.sql.Types.BIGINT);
6425 prepStmt.setNull(14, java.sql.Types.BIGINT);
6426 prepStmt.setNull(15, java.sql.Types.VARCHAR);
6428 prepStmt.setNull(17, java.sql.Types.VARCHAR);
6429 prepStmt.setString(18, parentPath);
6431 prepStmt.setString(20, extractExtension(carvedFile.getName()));
6432 connection.executeUpdate(prepStmt);
6439 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
6440 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
6441 prepStmt.clearParameters();
6442 prepStmt.setLong(1, carvedFileId);
6443 prepStmt.setLong(2, tskFileRange.getByteStart());
6444 prepStmt.setLong(3, tskFileRange.getByteLen());
6445 prepStmt.setLong(4, tskFileRange.getSequence());
6446 connection.executeUpdate(prepStmt);
6455 carvedFile.getName(),
6461 carvedFile.getSizeInBytes(),
6473 }
catch (SQLException ex) {
6474 throw new TskCoreException(
"Failed to add carved files to case database", ex);
6476 closeResultSet(resultSet);
6477 closeStatement(statement);
6480 if (null != transaction) {
6483 }
catch (TskCoreException ex2) {
6484 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6486 if (0 != newCacheKey) {
6487 rootIdsToCarvedFileDirs.remove(newCacheKey);
6524 long size,
long ctime,
long crtime,
long atime,
long mtime,
6525 boolean isFile,
Content parentObj,
6526 String rederiveDetails, String toolName, String toolVersion,
6529 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
6535 CaseDbConnection connection = transaction.getConnection();
6537 final long parentId = parentObj.
getId();
6538 String parentPath =
"";
6542 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() +
'/';
6554 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6555 statement.clearParameters();
6556 statement.setLong(1, newObjId);
6559 long fsObjId = this.getFileSystemId(parentId, connection);
6560 if (fsObjId != -1) {
6561 statement.setLong(2, fsObjId);
6563 statement.setNull(2, java.sql.Types.BIGINT);
6565 statement.setString(3, fileName);
6569 statement.setShort(5, (
short) 1);
6573 statement.setShort(6, dirType.
getValue());
6575 statement.setShort(7, metaType.
getValue());
6579 statement.setShort(8, dirFlag.
getValue());
6582 statement.setShort(9, metaFlags);
6586 long savedSize = size < 0 ? 0 : size;
6587 statement.setLong(10, savedSize);
6591 statement.setLong(11, ctime);
6592 statement.setLong(12, crtime);
6593 statement.setLong(13, atime);
6594 statement.setLong(14, mtime);
6596 statement.setNull(15, java.sql.Types.VARCHAR);
6598 statement.setNull(17, java.sql.Types.VARCHAR);
6601 statement.setString(18, parentPath);
6604 long dataSourceObjId = getDataSourceObjectId(connection, parentId);
6605 statement.setLong(19, dataSourceObjId);
6606 final String extension = extractExtension(fileName);
6608 statement.setString(20, extension);
6610 connection.executeUpdate(statement);
6613 addFilePath(connection, newObjId, localPath, encodingType);
6615 DerivedFile derivedFile =
new DerivedFile(
this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
6616 savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
6618 timelineManager.addEventsForNewFile(derivedFile, connection);
6622 }
catch (SQLException ex) {
6623 connection.rollbackTransaction();
6624 throw new TskCoreException(
"Failed to add derived file to case database", ex);
6662 long size,
long ctime,
long crtime,
long atime,
long mtime,
6663 boolean isFile, String mimeType,
6664 String rederiveDetails, String toolName, String toolVersion,
6668 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
6670 CaseDbConnection connection = connections.getConnection();
6672 ResultSet rs = null;
6675 connection.beginTransaction();
6676 final long parentId = parentObj.
getId();
6677 String parentPath =
"";
6681 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() +
'/';
6685 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_DERIVED_FILE);
6686 statement.clearParameters();
6693 statement.setShort(2, dirType.
getValue());
6695 statement.setShort(3, metaType.
getValue());
6699 statement.setShort(4, dirFlag.
getValue());
6702 statement.setShort(5, metaFlags);
6706 long savedSize = size < 0 ? 0 : size;
6707 statement.setLong(6, savedSize);
6711 statement.setLong(7, ctime);
6712 statement.setLong(8, crtime);
6713 statement.setLong(9, atime);
6714 statement.setLong(10, mtime);
6715 statement.setString(11, mimeType);
6716 statement.setString(12, String.valueOf(derivedFile.
getId()));
6717 connection.executeUpdate(statement);
6720 updateFilePath(connection, derivedFile.
getId(), localPath, encodingType);
6722 connection.commitTransaction();
6724 long dataSourceObjId = getDataSourceObjectId(connection, parentId);
6725 final String extension = extractExtension(derivedFile.
getName());
6726 return new DerivedFile(
this, derivedFile.
getId(), dataSourceObjId, derivedFile.
getName(), dirType, metaType, dirFlag, metaFlags,
6727 savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
6728 }
catch (SQLException ex) {
6729 connection.rollbackTransaction();
6730 throw new TskCoreException(
"Failed to add derived file to case database", ex);
6758 long size,
long ctime,
long crtime,
long atime,
long mtime,
6764 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
6769 if (null != localTrans) {
6772 }
catch (TskCoreException ex2) {
6773 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6804 long size,
long ctime,
long crtime,
long atime,
long mtime,
6809 size, ctime, crtime, atime, mtime,
6811 isFile, encodingType,
6812 parent, transaction);
6843 long size,
long ctime,
long crtime,
long atime,
long mtime,
6844 String md5,
FileKnown known, String mimeType,
6847 CaseDbConnection connection = transaction.getConnection();
6848 transaction.acquireSingleUserCaseWriteLock();
6849 Statement queryStatement = null;
6861 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6862 statement.clearParameters();
6863 statement.setLong(1, objectId);
6864 statement.setNull(2, java.sql.Types.BIGINT);
6865 statement.setString(3, fileName);
6867 statement.setShort(5, (
short) 1);
6869 statement.setShort(6, dirType.
getValue());
6871 statement.setShort(7, metaType.
getValue());
6873 statement.setShort(8, dirFlag.
getValue());
6875 statement.setShort(9, metaFlags);
6877 long savedSize = size < 0 ? 0 : size;
6878 statement.setLong(10, savedSize);
6879 statement.setLong(11, ctime);
6880 statement.setLong(12, crtime);
6881 statement.setLong(13, atime);
6882 statement.setLong(14, mtime);
6883 statement.setString(15, md5);
6884 if (known != null) {
6885 statement.setByte(16, known.getFileKnownValue());
6889 statement.setString(17, mimeType);
6891 long dataSourceObjId;
6894 AbstractFile parentFile = (AbstractFile) parent;
6895 if (isRootDirectory(parentFile, transaction)) {
6898 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
6903 dataSourceObjId = getDataSourceObjectId(connection, parent.getId());
6905 statement.setString(18, parentPath);
6906 statement.setLong(19, dataSourceObjId);
6907 final String extension = extractExtension(fileName);
6908 statement.setString(20, extension);
6910 connection.executeUpdate(statement);
6911 addFilePath(connection, objectId, localPath, encodingType);
6921 ctime, crtime, atime, mtime,
6922 mimeType, md5, known,
6923 parent.getId(), parentPath,
6926 encodingType, extension);
6930 }
catch (SQLException ex) {
6931 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
6933 closeStatement(queryStatement);
6951 CaseDbConnection connection = transaction.getConnection();
6952 transaction.acquireSingleUserCaseWriteLock();
6953 Statement statement = null;
6954 ResultSet resultSet = null;
6957 String query = String.format(
"SELECT ParentRow.type AS parent_type, ParentRow.obj_id AS parent_object_id "
6958 +
"FROM tsk_objects ParentRow JOIN tsk_objects ChildRow ON ChildRow.par_obj_id = ParentRow.obj_id "
6959 +
"WHERE ChildRow.obj_id = %s;", file.
getId());
6961 statement = connection.createStatement();
6962 resultSet = statement.executeQuery(query);
6963 if (resultSet.next()) {
6964 long parentId = resultSet.getLong(
"parent_object_id");
6965 if (parentId == 0) {
6968 int type = resultSet.getInt(
"parent_type");
6969 return (type == TskData.ObjectType.IMG.getObjectType()
6970 || type == TskData.ObjectType.VS.getObjectType()
6971 || type == TskData.ObjectType.VOL.getObjectType()
6972 || type == TskData.ObjectType.FS.getObjectType());
6977 }
catch (SQLException ex) {
6978 throw new TskCoreException(String.format(
"Failed to lookup parent of file (%s) with id %d", file.
getName(), file.
getId()), ex);
6980 closeResultSet(resultSet);
6981 closeStatement(statement);
7008 long ctime,
long crtime,
long atime,
long mtime,
7009 List<TskFileRange> fileRanges,
7010 Content parent)
throws TskCoreException {
7012 if (null == parent) {
7013 throw new TskCoreException(
"Parent can not be null");
7018 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
7024 Statement statement = null;
7025 ResultSet resultSet = null;
7028 transaction.acquireSingleUserCaseWriteLock();
7029 CaseDbConnection connection = transaction.getConnection();
7045 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7046 prepStmt.clearParameters();
7047 prepStmt.setLong(1, newFileId);
7050 if (0 != parent.getId()) {
7051 long parentFs = this.getFileSystemId(parent.getId(), connection);
7052 if (parentFs != -1) {
7053 prepStmt.setLong(2, parentFs);
7055 prepStmt.setNull(2, java.sql.Types.BIGINT);
7058 prepStmt.setNull(2, java.sql.Types.BIGINT);
7060 prepStmt.setString(3, fileName);
7062 prepStmt.setShort(5, (
short) 0);
7065 prepStmt.setShort(8, dirFlag.getValue());
7066 prepStmt.setShort(9, metaFlag.getValue());
7068 long savedSize = size < 0 ? 0 : size;
7069 prepStmt.setLong(10, savedSize);
7070 prepStmt.setLong(11, ctime);
7071 prepStmt.setLong(12, crtime);
7072 prepStmt.setLong(13, atime);
7073 prepStmt.setLong(14, mtime);
7074 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7076 prepStmt.setNull(17, java.sql.Types.VARCHAR);
7077 prepStmt.setString(18, parentPath);
7078 prepStmt.setLong(19, parent.getDataSource().getId());
7080 prepStmt.setString(20, extractExtension(fileName));
7081 connection.executeUpdate(prepStmt);
7088 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7090 prepStmt.clearParameters();
7091 prepStmt.setLong(1, newFileId);
7092 prepStmt.setLong(2, tskFileRange.getByteStart());
7093 prepStmt.setLong(3, tskFileRange.getByteLen());
7094 prepStmt.setLong(4, tskFileRange.getSequence());
7095 connection.executeUpdate(prepStmt);
7103 parent.getDataSource().getId(),
7109 metaFlag.getValue(),
7111 ctime, crtime, atime, mtime,
7121 }
catch (SQLException ex) {
7122 throw new TskCoreException(
"Failed to add layout file " + fileName +
" to case database", ex);
7124 closeResultSet(resultSet);
7125 closeStatement(statement);
7128 if (null != transaction) {
7131 }
catch (TskCoreException ex2) {
7132 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7150 private long getDataSourceObjectId(CaseDbConnection connection,
long objectId)
throws TskCoreException {
7152 Statement statement = null;
7153 ResultSet resultSet = null;
7155 statement = connection.createStatement();
7156 long dataSourceObjId;
7157 long ancestorId = objectId;
7159 dataSourceObjId = ancestorId;
7160 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
7161 resultSet = statement.executeQuery(query);
7162 if (resultSet.next()) {
7163 ancestorId = resultSet.getLong(
"par_obj_id");
7165 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
7169 }
while (0 != ancestorId);
7170 return dataSourceObjId;
7171 }
catch (SQLException ex) {
7172 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
7174 closeResultSet(resultSet);
7175 closeStatement(statement);
7191 private void addFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
7192 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LOCAL_PATH);
7193 statement.clearParameters();
7194 statement.setLong(1, objId);
7195 statement.setString(2, path);
7196 statement.setInt(3, type.getType());
7197 connection.executeUpdate(statement);
7211 private void updateFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
7212 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_LOCAL_PATH);
7213 statement.clearParameters();
7214 statement.setString(1, path);
7215 statement.setInt(2, type.getType());
7216 statement.setLong(3, objId);
7217 connection.executeUpdate(statement);
7236 return findFiles(dataSource, fileName, parentFile.getName());
7251 CaseDbConnection connection = connections.getConnection();
7254 ResultSet rs = null;
7256 s = connection.createStatement();
7257 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
7259 return rs.getLong(
"count");
7260 }
catch (SQLException e) {
7261 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
7288 CaseDbConnection connection = connections.getConnection();
7291 ResultSet rs = null;
7293 s = connection.createStatement();
7294 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
7295 return resultSetToAbstractFiles(rs, connection);
7296 }
catch (SQLException e) {
7297 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
7319 CaseDbConnection connection = connections.getConnection();
7322 ResultSet rs = null;
7324 s = connection.createStatement();
7325 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
7326 List<Long> ret =
new ArrayList<Long>();
7328 ret.add(rs.getLong(
"obj_id"));
7331 }
catch (SQLException e) {
7332 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
7352 public List<AbstractFile>
openFiles(
Content dataSource, String filePath)
throws TskCoreException {
7359 int lastSlash = path.lastIndexOf(
'/');
7362 if (lastSlash == path.length()) {
7363 path = path.substring(0, lastSlash - 1);
7364 lastSlash = path.lastIndexOf(
'/');
7367 String parentPath = path.substring(0, lastSlash);
7368 String fileName = path.substring(lastSlash);
7370 return findFiles(dataSource, fileName, parentPath);
7384 CaseDbConnection connection = connections.getConnection();
7387 ResultSet rs = null;
7389 s = connection.createStatement();
7390 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
7391 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
7394 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
7398 }
catch (SQLException ex) {
7399 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
7419 CaseDbConnection connection = connections.getConnection();
7421 Statement s1 = null;
7422 ResultSet rs1 = null;
7423 Statement s2 = null;
7424 ResultSet rs2 = null;
7426 s1 = connection.createStatement();
7427 rs1 = connection.executeQuery(s1,
"SELECT tsk_image_info.type, tsk_image_info.ssize, tsk_image_info.tzone, tsk_image_info.size, tsk_image_info.md5, tsk_image_info.sha1, tsk_image_info.sha256, tsk_image_info.display_name, data_source_info.device_id "
7428 +
"FROM tsk_image_info "
7429 +
"INNER JOIN data_source_info ON tsk_image_info.obj_id = data_source_info.obj_id "
7430 +
"WHERE tsk_image_info.obj_id = " +
id);
7432 s2 = connection.createStatement();
7433 rs2 = connection.executeQuery(s2,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " +
id);
7434 List<String> imagePaths =
new ArrayList<String>();
7435 while (rs2.next()) {
7436 imagePaths.add(rs2.getString(
"name"));
7438 long type = rs1.getLong(
"type");
7439 long ssize = rs1.getLong(
"ssize");
7440 String tzone = rs1.getString(
"tzone");
7441 long size = rs1.getLong(
"size");
7442 String md5 = rs1.getString(
"md5");
7443 String sha1 = rs1.getString(
"sha1");
7444 String sha256 = rs1.getString(
"sha256");
7445 String name = rs1.getString(
"display_name");
7447 if (imagePaths.size() > 0) {
7448 String path = imagePaths.get(0);
7449 name = (
new java.io.File(path)).getName();
7454 String device_id = rs1.getString(
"device_id");
7456 return new Image(
this,
id, type, device_id, ssize, name,
7457 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, sha1, sha256, size);
7459 throw new TskCoreException(
"No image found for id: " +
id);
7461 }
catch (SQLException ex) {
7462 throw new TskCoreException(
"Error getting Image by id, id = " +
id, ex);
7464 closeResultSet(rs2);
7466 closeResultSet(rs1);
7485 CaseDbConnection connection = connections.getConnection();
7488 ResultSet rs = null;
7490 s = connection.createStatement();
7491 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
7492 +
"where obj_id = " +
id);
7494 long type = rs.getLong(
"vs_type");
7495 long imgOffset = rs.getLong(
"img_offset");
7496 long blockSize = rs.getLong(
"block_size");
7498 vs.setParent(parent);
7501 throw new TskCoreException(
"No volume system found for id:" +
id);
7503 }
catch (SQLException ex) {
7504 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
7521 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
7522 VolumeSystem vs = getVolumeSystemById(
id, null);
7523 vs.setParentId(parentId);
7538 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
7539 return getFileSystemByIdHelper(
id, parent);
7550 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
7552 FileSystem fs = getFileSystemById(
id, vol);
7553 fs.setParentId(parentId);
7568 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
7569 return getFileSystemByIdHelper(
id, parent);
7583 Pool getPoolById(
long id, Content parent)
throws TskCoreException {
7584 return getPoolByIdHelper(
id, parent);
7595 Pool getPoolById(
long id,
long parentId)
throws TskCoreException {
7596 Pool pool = getPoolById(
id, null);
7597 pool.setParentId(parentId);
7612 private Pool getPoolByIdHelper(
long id, Content parent)
throws TskCoreException {
7615 try (CaseDbConnection connection = connections.getConnection();
7616 Statement s = connection.createStatement();
7617 ResultSet rs = connection.executeQuery(s,
"SELECT * FROM tsk_pool_info "
7618 +
"where obj_id = " +
id);) {
7620 Pool pool =
new Pool(
this, rs.getLong(
"obj_id"), TskData.TSK_POOL_TYPE_ENUM.valueOf(rs.getLong(
"pool_type")).getName(), rs.getLong(
"pool_type"));
7621 pool.setParent(parent);
7625 throw new TskCoreException(
"No pool found for ID:" +
id);
7627 }
catch (SQLException ex) {
7628 throw new TskCoreException(
"Error getting Pool by ID", ex);
7645 private FileSystem getFileSystemByIdHelper(
long id, Content parent)
throws TskCoreException {
7649 synchronized (fileSystemIdMap) {
7650 if (fileSystemIdMap.containsKey(
id)) {
7651 return fileSystemIdMap.get(
id);
7654 CaseDbConnection connection = connections.getConnection();
7657 ResultSet rs = null;
7659 s = connection.createStatement();
7660 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
7661 +
"where obj_id = " +
id);
7663 TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt(
"fs_type"));
7664 FileSystem fs =
new FileSystem(
this, rs.getLong(
"obj_id"),
"", rs.getLong(
"img_offset"),
7665 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
7666 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
7667 fs.setParent(parent);
7669 synchronized (fileSystemIdMap) {
7670 fileSystemIdMap.put(
id, fs);
7674 throw new TskCoreException(
"No file system found for id:" +
id);
7676 }
catch (SQLException ex) {
7677 throw new TskCoreException(
"Error getting File System by ID", ex);
7697 Volume getVolumeById(
long id, VolumeSystem parent)
throws TskCoreException {
7698 CaseDbConnection connection = connections.getConnection();
7701 ResultSet rs = null;
7703 s = connection.createStatement();
7704 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
7705 +
"where obj_id = " +
id);
7716 description = rs.getString(
"desc");
7717 }
catch (Exception ex) {
7718 description = rs.getString(
"descr");
7720 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
7721 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
7723 vol.setParent(parent);
7726 throw new TskCoreException(
"No volume found for id:" +
id);
7728 }
catch (SQLException ex) {
7729 throw new TskCoreException(
"Error getting Volume by ID", ex);
7746 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
7747 Volume vol = getVolumeById(
id, null);
7748 vol.setParentId(parentId);
7763 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
7764 CaseDbConnection connection = connections.getConnection();
7767 ResultSet rs = null;
7769 s = connection.createStatement();
7770 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
7771 +
"WHERE obj_id = " +
id);
7772 Directory temp = null;
7774 final short type = rs.getShort(
"type");
7775 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
7776 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
7777 || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
7778 temp = directory(rs, parentFs);
7780 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
7781 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
7784 throw new TskCoreException(
"No Directory found for id:" +
id);
7787 }
catch (SQLException ex) {
7788 throw new TskCoreException(
"Error getting Directory by ID", ex);
7805 List<FileSystem> fileSystems =
new ArrayList<FileSystem>();
7806 CaseDbConnection connection;
7808 connection = connections.getConnection();
7809 }
catch (TskCoreException ex) {
7810 logger.log(Level.SEVERE,
"Error getting file systems for image " + image.
getId(), ex);
7815 ResultSet rs = null;
7817 s = connection.createStatement();
7820 List<FileSystem> allFileSystems =
new ArrayList<FileSystem>();
7822 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info");
7826 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
7827 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
7829 allFileSystems.add(fs);
7831 }
catch (SQLException ex) {
7832 logger.log(Level.SEVERE,
"There was a problem while trying to obtain all file systems", ex);
7842 Long imageID = null;
7843 Long currentObjID = fs.getId();
7844 while (imageID == null) {
7846 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE tsk_objects.obj_id = " + currentObjID);
7848 currentObjID = rs.getLong(
"par_obj_id");
7850 imageID = rs.getLong(
"obj_id");
7852 }
catch (SQLException ex) {
7853 logger.log(Level.SEVERE,
"There was a problem while trying to obtain this image's file systems", ex);
7861 if (imageID == image.
getId()) {
7862 fileSystems.add(fs);
7865 }
catch (SQLException ex) {
7866 logger.log(Level.SEVERE,
"Error getting case database connection", ex);
7886 List<Content> getImageChildren(
Image img)
throws TskCoreException {
7887 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
7888 List<Content> children =
new ArrayList<Content>();
7889 for (ObjectInfo info : childInfos) {
7890 if (null != info.type) {
7891 switch (info.type) {
7893 children.add(getVolumeSystemById(info.id, img));
7896 children.add(getPoolById(info.id, img));
7899 children.add(getFileSystemById(info.id, img));
7917 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
7934 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
7935 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
7936 List<Long> children =
new ArrayList<Long>();
7937 for (ObjectInfo info : childInfos) {
7938 if (info.type == ObjectType.VS
7939 || info.type == ObjectType.POOL
7940 || info.type == ObjectType.FS
7941 || info.type == ObjectType.ABSTRACTFILE
7942 || info.type == ObjectType.ARTIFACT) {
7943 children.add(info.id);
7944 }
else if (info.type == ObjectType.REPORT) {
7947 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
7963 List<Content> getPoolChildren(Pool pool)
throws TskCoreException {
7964 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
7965 List<Content> children =
new ArrayList<Content>();
7966 for (ObjectInfo info : childInfos) {
7967 if (null != info.type) {
7968 switch (info.type) {
7970 children.add(getVolumeSystemById(info.id, pool));
7985 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
8002 List<Long> getPoolChildrenIds(Pool pool)
throws TskCoreException {
8003 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
8004 List<Long> children =
new ArrayList<Long>();
8005 for (ObjectInfo info : childInfos) {
8006 if (info.type == ObjectType.VS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8007 children.add(info.id);
8009 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
8025 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
8026 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
8027 List<Content> children =
new ArrayList<Content>();
8028 for (ObjectInfo info : childInfos) {
8029 if (null != info.type) {
8030 switch (info.type) {
8032 children.add(getVolumeById(info.id, vs));
8047 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
8064 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
8065 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
8066 List<Long> children =
new ArrayList<Long>();
8067 for (ObjectInfo info : childInfos) {
8068 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8069 children.add(info.id);
8071 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
8087 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
8088 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
8089 List<Content> children =
new ArrayList<Content>();
8090 for (ObjectInfo info : childInfos) {
8091 if (null != info.type) {
8092 switch (info.type) {
8094 children.add(getPoolById(info.id, vol));
8097 children.add(getFileSystemById(info.id, vol));
8112 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
8129 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
8130 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
8131 final List<Long> children =
new ArrayList<Long>();
8132 for (ObjectInfo info : childInfos) {
8133 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8134 children.add(info.id);
8136 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
8155 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone)
throws TskCoreException {
8156 long imageId = this.caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone,
this);
8170 CaseDbConnection connection = connections.getConnection();
8172 Statement s1 = null;
8173 Statement s2 = null;
8174 ResultSet rs1 = null;
8175 ResultSet rs2 = null;
8177 s1 = connection.createStatement();
8178 rs1 = connection.executeQuery(s1,
"SELECT obj_id FROM tsk_image_info");
8179 s2 = connection.createStatement();
8180 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
8181 while (rs1.next()) {
8182 long obj_id = rs1.getLong(
"obj_id");
8183 rs2 = connection.executeQuery(s2,
"SELECT * FROM tsk_image_names WHERE obj_id = " + obj_id);
8184 List<String> paths =
new ArrayList<String>();
8185 while (rs2.next()) {
8186 paths.add(rs2.getString(
"name"));
8190 imgPaths.put(obj_id, paths);
8193 }
catch (SQLException ex) {
8194 throw new TskCoreException(
"Error getting image paths.", ex);
8196 closeResultSet(rs2);
8198 closeResultSet(rs1);
8215 private List<String> getImagePathsById(
long objectId)
throws TskCoreException {
8216 List<String> imagePaths =
new ArrayList<String>();
8217 CaseDbConnection connection = connections.getConnection();
8219 Statement statement = null;
8220 ResultSet resultSet = null;
8222 statement = connection.createStatement();
8223 resultSet = connection.executeQuery(statement,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + objectId);
8224 while (resultSet.next()) {
8225 imagePaths.add(resultSet.getString(
"name"));
8227 }
catch (SQLException ex) {
8228 throw new TskCoreException(String.format(
"Error getting image names with obj_id = %d", objectId), ex);
8230 closeResultSet(resultSet);
8231 closeStatement(statement);
8246 CaseDbConnection connection = connections.getConnection();
8249 ResultSet rs = null;
8251 s = connection.createStatement();
8252 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
8253 Collection<Long> imageIDs =
new ArrayList<Long>();
8255 imageIDs.add(rs.getLong(
"obj_id"));
8257 List<Image> images =
new ArrayList<Image>();
8258 for (
long id : imageIDs) {
8262 }
catch (SQLException ex) {
8263 throw new TskCoreException(
"Error retrieving images.", ex);
8282 public void setImagePaths(
long obj_id, List<String> paths)
throws TskCoreException {
8283 CaseDbConnection connection = connections.getConnection();
8285 PreparedStatement statement = null;
8287 connection.beginTransaction();
8288 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_IMAGE_NAME);
8289 statement.clearParameters();
8290 statement.setLong(1, obj_id);
8291 connection.executeUpdate(statement);
8292 for (
int i = 0; i < paths.size(); i++) {
8293 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
8294 statement.clearParameters();
8295 statement.setLong(1, obj_id);
8296 statement.setString(2, paths.get(i));
8297 statement.setLong(3, i);
8298 connection.executeUpdate(statement);
8300 connection.commitTransaction();
8301 }
catch (SQLException ex) {
8302 connection.rollbackTransaction();
8303 throw new TskCoreException(
"Error updating image paths.", ex);
8321 void deleteDataSource(
long dataSourceObjectId)
throws TskCoreException {
8322 CaseDbConnection connection = connections.getConnection();
8323 Statement statement = null;
8326 statement = connection.createStatement();
8327 connection.beginTransaction();
8330 statement.execute(
"DELETE FROM tsk_objects WHERE obj_id = " + dataSourceObjectId);
8333 String accountSql =
"DELETE FROM accounts WHERE account_id in (SELECT account_id FROM accounts "
8334 +
"WHERE account_id NOT IN (SELECT account1_id FROM account_relationships) "
8335 +
"AND account_id NOT IN (SELECT account2_id FROM account_relationships))";
8336 statement.execute(accountSql);
8337 connection.commitTransaction();
8338 }
catch (SQLException ex) {
8339 connection.rollbackTransaction();
8340 throw new TskCoreException(
"Error deleting data source.", ex);
8372 private List<AbstractFile> resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
throws SQLException {
8373 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
8376 final short type = rs.getShort(
"type");
8377 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()
8378 && (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
8380 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
8381 result = directory(rs, null);
8383 result = file(rs, null);
8385 results.add(result);
8386 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()
8387 || (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
8388 final VirtualDirectory virtDir = virtualDirectory(rs, connection);
8389 results.add(virtDir);
8390 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR.getFileType()) {
8391 final LocalDirectory localDir = localDirectory(rs);
8392 results.add(localDir);
8393 }
else if (type == TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType()
8394 || type == TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.getFileType()
8395 || type == TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType()
8396 || type == TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType()) {
8397 TSK_DB_FILES_TYPE_ENUM atype = TSK_DB_FILES_TYPE_ENUM.valueOf(type);
8398 String parentPath = rs.getString(
"parent_path");
8399 if (parentPath == null) {
8402 LayoutFile lf =
new LayoutFile(
this,
8403 rs.getLong(
"obj_id"),
8404 rs.getLong(
"data_source_obj_id"),
8405 rs.getString(
"name"),
8407 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8408 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8410 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8411 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
8413 }
else if (type == TSK_DB_FILES_TYPE_ENUM.DERIVED.getFileType()) {
8414 final DerivedFile df;
8415 df = derivedFile(rs, connection, AbstractContent.UNKNOWN_ID);
8417 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL.getFileType()) {
8419 lf = localFile(rs, connection, AbstractContent.UNKNOWN_ID);
8421 }
else if (type == TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType()) {
8422 final SlackFile sf = slackFile(rs, null);
8426 }
catch (SQLException e) {
8427 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
8447 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8448 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8449 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8450 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8451 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8452 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8453 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8454 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8455 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8456 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8457 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
8458 f.setFileSystem(fs);
8473 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
8474 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8475 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8476 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8477 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8478 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8479 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8480 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8481 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8482 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8483 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8484 rs.getString(
"parent_path"));
8485 dir.setFileSystem(fs);
8499 VirtualDirectory virtualDirectory(ResultSet rs, CaseDbConnection connection)
throws SQLException {
8500 String parentPath = rs.getString(
"parent_path");
8501 if (parentPath == null) {
8505 long objId = rs.getLong(
"obj_id");
8506 long dsObjId = rs.getLong(
"data_source_obj_id");
8507 if (objId == dsObjId) {
8509 String deviceId =
"";
8510 String timeZone =
"";
8512 ResultSet rsDataSourceInfo = null;
8516 s = connection.createStatement();
8517 rsDataSourceInfo = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objId);
8518 if (rsDataSourceInfo.next()) {
8519 deviceId = rsDataSourceInfo.getString(
"device_id");
8520 timeZone = rsDataSourceInfo.getString(
"time_zone");
8522 }
catch (SQLException ex) {
8523 logger.log(Level.SEVERE,
"Error data source info for datasource id " + objId, ex);
8525 closeResultSet(rsDataSourceInfo);
8530 return new LocalFilesDataSource(
this,
8533 rs.getString(
"name"),
8534 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8535 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8536 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8537 rs.getShort(
"meta_flags"),
8539 rs.getString(
"md5"),
8540 FileKnown.valueOf(rs.getByte(
"known")),
8543 final VirtualDirectory vd =
new VirtualDirectory(
this,
8545 rs.getString(
"name"),
8546 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8547 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8548 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8549 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
8550 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
8564 LocalDirectory localDirectory(ResultSet rs)
throws SQLException {
8565 String parentPath = rs.getString(
"parent_path");
8566 if (parentPath == null) {
8569 final LocalDirectory ld =
new LocalDirectory(
this, rs.getLong(
"obj_id"),
8570 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
8571 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8572 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8573 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8574 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
8575 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
8592 private DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8593 boolean hasLocalPath = rs.getBoolean(
"has_path");
8594 long objId = rs.getLong(
"obj_id");
8595 String localPath = null;
8596 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
8598 ResultSet rsFilePath = null;
8601 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
8602 statement.clearParameters();
8603 statement.setLong(1, objId);
8604 rsFilePath = connection.executeQuery(statement);
8605 if (rsFilePath.next()) {
8606 localPath = rsFilePath.getString(
"path");
8607 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
8609 }
catch (SQLException ex) {
8610 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
8612 closeResultSet(rsFilePath);
8616 String parentPath = rs.getString(
"parent_path");
8617 if (parentPath == null) {
8620 final DerivedFile df =
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
8621 rs.getString(
"name"),
8622 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8623 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8624 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8626 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8627 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8628 parentPath, localPath, parentId, rs.getString(
"mime_type"),
8629 encodingType, rs.getString(
"extension"));
8646 private LocalFile localFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8647 long objId = rs.getLong(
"obj_id");
8648 String localPath = null;
8649 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
8650 if (rs.getBoolean(
"has_path")) {
8651 ResultSet rsFilePath = null;
8654 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
8655 statement.clearParameters();
8656 statement.setLong(1, objId);
8657 rsFilePath = connection.executeQuery(statement);
8658 if (rsFilePath.next()) {
8659 localPath = rsFilePath.getString(
"path");
8660 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
8662 }
catch (SQLException ex) {
8663 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
8665 closeResultSet(rsFilePath);
8669 String parentPath = rs.getString(
"parent_path");
8670 if (null == parentPath) {
8673 LocalFile file =
new LocalFile(
this, objId, rs.getString(
"name"),
8674 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")),
8675 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8676 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8677 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8679 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8680 rs.getString(
"mime_type"), rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8681 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
8682 localPath, encodingType, rs.getString(
"extension"));
8699 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8700 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8701 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8702 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8703 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8704 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8705 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8706 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8707 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8708 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8709 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
8710 f.setFileSystem(fs);
8725 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8726 List<Content> children =
new ArrayList<Content>();
8729 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
8734 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
8736 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
8737 result = directory(rs, null);
8739 result = file(rs, null);
8741 children.add(result);
8743 VirtualDirectory virtDir = virtualDirectory(rs, connection);
8744 children.add(virtDir);
8748 VirtualDirectory virtDir = virtualDirectory(rs, connection);
8749 children.add(virtDir);
8752 LocalDirectory localDir = localDirectory(rs);
8753 children.add(localDir);
8755 case UNALLOC_BLOCKS:
8759 String parentPath = rs.getString(
"parent_path");
8760 if (parentPath == null) {
8763 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
8764 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), type,
8765 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8766 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8767 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8769 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8770 rs.getString(
"md5"),
8771 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
8776 final DerivedFile df = derivedFile(rs, connection, parentId);
8780 final LocalFile lf = localFile(rs, connection, parentId);
8785 final SlackFile sf = slackFile(rs, null);
8812 private List<BlackboardArtifact> resultSetToArtifacts(ResultSet rs)
throws SQLException, TskCoreException {
8813 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
8816 BlackboardArtifact.Type artifactType =
getArtifactType(rs.getInt(
"artifact_type_id"));
8817 if (artifactType != null) {
8818 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
8819 rs.getInt(
"artifact_type_id"), artifactType.getTypeName(), artifactType.getDisplayName(),
8820 BlackboardArtifact.ReviewStatus.withID(rs.getInt(
"review_status_id"))));
8822 throw new TskCoreException(
"Error looking up artifact type ID " + rs.getInt(
"artifact_type_id") +
" from artifact " + rs.getLong(
"artifact_id"));
8825 }
catch (SQLException e) {
8826 logger.log(Level.SEVERE,
"Error getting artifacts from result set", e);
8889 CaseDbConnection getConnection() throws TskCoreException {
8890 return connections.getConnection();
8893 synchronized long getCaseDbPointer() throws TskCoreException {
8894 if (caseHandle != null) {
8895 return caseHandle.getCaseDbPointer();
8897 throw new TskCoreException(
"Case has been closed");
8916 connections.close();
8917 }
catch (TskCoreException ex) {
8918 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
8921 fileSystemIdMap.clear();
8924 if (this.caseHandle != null) {
8925 this.caseHandle.free();
8926 this.caseHandle = null;
8928 }
catch (TskCoreException ex) {
8929 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
8948 long id = file.getId();
8949 FileKnown currentKnown = file.getKnown();
8950 if (currentKnown.compareTo(fileKnown) > 0) {
8953 CaseDbConnection connection = connections.getConnection();
8955 Statement statement = null;
8957 statement = connection.createStatement();
8958 connection.executeUpdate(statement,
"UPDATE tsk_files "
8959 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
8960 +
"WHERE obj_id=" + id);
8962 file.setKnown(fileKnown);
8963 }
catch (SQLException ex) {
8964 throw new TskCoreException(
"Error setting Known status.", ex);
8966 closeStatement(statement);
8981 void setFileName(String name,
long objId)
throws TskCoreException {
8983 CaseDbConnection connection = connections.getConnection();
8987 preparedStatement.clearParameters();
8988 preparedStatement.setString(1, name);
8989 preparedStatement.setLong(2, objId);
8990 connection.executeUpdate(preparedStatement);
8991 }
catch (SQLException ex) {
8992 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
9007 void setImageName(String name,
long objId)
throws TskCoreException {
9009 CaseDbConnection connection = connections.getConnection();
9012 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_NAME);
9013 preparedStatement.clearParameters();
9014 preparedStatement.setString(1, name);
9015 preparedStatement.setLong(2, objId);
9016 connection.executeUpdate(preparedStatement);
9017 }
catch (SQLException ex) {
9018 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
9035 CaseDbConnection connection = connections.getConnection();
9036 Statement statement = null;
9037 ResultSet rs = null;
9040 statement = connection.createStatement();
9041 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
9042 file.setMIMEType(mimeType);
9043 }
catch (SQLException ex) {
9044 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
9047 closeStatement(statement);
9062 void setMd5Hash(
AbstractFile file, String md5Hash)
throws TskCoreException {
9063 if (md5Hash == null) {
9066 long id = file.getId();
9067 CaseDbConnection connection = connections.getConnection();
9070 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
9071 statement.clearParameters();
9072 statement.setString(1, md5Hash.toLowerCase());
9073 statement.setLong(2,
id);
9074 connection.executeUpdate(statement);
9075 file.setMd5Hash(md5Hash.toLowerCase());
9076 }
catch (SQLException ex) {
9077 throw new TskCoreException(
"Error setting MD5 hash", ex);
9093 void setMd5ImageHash(Image img, String md5Hash)
throws TskCoreException {
9094 if (md5Hash == null) {
9097 long id = img.getId();
9098 CaseDbConnection connection = connections.getConnection();
9101 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_MD5);
9102 statement.clearParameters();
9103 statement.setString(1, md5Hash.toLowerCase());
9104 statement.setLong(2,
id);
9105 connection.executeUpdate(statement);
9106 }
catch (SQLException ex) {
9107 throw new TskCoreException(
"Error setting MD5 hash", ex);
9124 String getMd5ImageHash(Image img)
throws TskCoreException {
9125 long id = img.getId();
9126 CaseDbConnection connection = connections.getConnection();
9128 ResultSet rs = null;
9131 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_MD5);
9132 statement.clearParameters();
9133 statement.setLong(1,
id);
9134 rs = connection.executeQuery(statement);
9136 hash = rs.getString(
"md5");
9139 }
catch (SQLException ex) {
9140 throw new TskCoreException(
"Error getting MD5 hash", ex);
9157 void setSha1ImageHash(Image img, String sha1Hash)
throws TskCoreException {
9158 if (sha1Hash == null) {
9161 long id = img.getId();
9162 CaseDbConnection connection = connections.getConnection();
9165 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA1);
9166 statement.clearParameters();
9167 statement.setString(1, sha1Hash.toLowerCase());
9168 statement.setLong(2,
id);
9169 connection.executeUpdate(statement);
9170 }
catch (SQLException ex) {
9171 throw new TskCoreException(
"Error setting SHA1 hash", ex);
9188 String getSha1ImageHash(Image img)
throws TskCoreException {
9189 long id = img.getId();
9190 CaseDbConnection connection = connections.getConnection();
9192 ResultSet rs = null;
9195 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA1);
9196 statement.clearParameters();
9197 statement.setLong(1,
id);
9198 rs = connection.executeQuery(statement);
9200 hash = rs.getString(
"sha1");
9203 }
catch (SQLException ex) {
9204 throw new TskCoreException(
"Error getting SHA1 hash", ex);
9221 void setSha256ImageHash(Image img, String sha256Hash)
throws TskCoreException {
9222 if (sha256Hash == null) {
9225 long id = img.getId();
9226 CaseDbConnection connection = connections.getConnection();
9229 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA256);
9230 statement.clearParameters();
9231 statement.setString(1, sha256Hash.toLowerCase());
9232 statement.setLong(2,
id);
9233 connection.executeUpdate(statement);
9234 }
catch (SQLException ex) {
9235 throw new TskCoreException(
"Error setting SHA256 hash", ex);
9252 String getSha256ImageHash(Image img)
throws TskCoreException {
9253 long id = img.getId();
9254 CaseDbConnection connection = connections.getConnection();
9256 ResultSet rs = null;
9259 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA256);
9260 statement.clearParameters();
9261 statement.setLong(1,
id);
9262 rs = connection.executeQuery(statement);
9264 hash = rs.getString(
"sha256");
9267 }
catch (SQLException ex) {
9268 throw new TskCoreException(
"Error setting SHA256 hash", ex);
9284 void setAcquisitionDetails(DataSource datasource, String details)
throws TskCoreException {
9286 long id = datasource.getId();
9287 CaseDbConnection connection = connections.getConnection();
9290 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
9291 statement.clearParameters();
9292 statement.setString(1, details);
9293 statement.setLong(2,
id);
9294 connection.executeUpdate(statement);
9295 }
catch (SQLException ex) {
9296 throw new TskCoreException(
"Error setting acquisition details", ex);
9312 String getAcquisitionDetails(DataSource datasource)
throws TskCoreException {
9313 long id = datasource.getId();
9314 CaseDbConnection connection = connections.getConnection();
9316 ResultSet rs = null;
9319 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_DETAILS);
9320 statement.clearParameters();
9321 statement.setLong(1,
id);
9322 rs = connection.executeQuery(statement);
9324 hash = rs.getString(
"acquisition_details");
9327 }
catch (SQLException ex) {
9328 throw new TskCoreException(
"Error setting acquisition details", ex);
9347 if (newStatus == null) {
9350 CaseDbConnection connection = connections.getConnection();
9352 Statement statement = null;
9354 statement = connection.createStatement();
9355 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
9356 +
" SET review_status_id=" + newStatus.getID()
9357 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
9358 }
catch (SQLException ex) {
9359 throw new TskCoreException(
"Error setting review status", ex);
9361 closeStatement(statement);
9378 CaseDbConnection connection = connections.getConnection();
9381 ResultSet rs = null;
9383 s = connection.createStatement();
9384 Short contentShort = contentType.getValue();
9385 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
9388 count = rs.getInt(
"count");
9391 }
catch (SQLException ex) {
9392 throw new TskCoreException(
"Error getting number of objects.", ex);
9410 String escapedText = null;
9412 escapedText = text.replaceAll(
"'",
"''");
9425 if (md5Hash == null) {
9428 CaseDbConnection connection;
9430 connection = connections.getConnection();
9431 }
catch (TskCoreException ex) {
9432 logger.log(Level.SEVERE,
"Error finding files by md5 hash " + md5Hash, ex);
9437 ResultSet rs = null;
9439 s = connection.createStatement();
9440 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
9441 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
9443 return resultSetToAbstractFiles(rs, connection);
9444 }
catch (SQLException ex) {
9445 logger.log(Level.WARNING,
"Error querying database.", ex);
9462 CaseDbConnection connection;
9464 connection = connections.getConnection();
9465 }
catch (TskCoreException ex) {
9466 logger.log(Level.SEVERE,
"Error checking md5 hashing status", ex);
9469 boolean allFilesAreHashed =
false;
9472 ResultSet rs = null;
9474 s = connection.createStatement();
9475 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
9477 +
"AND md5 IS NULL "
9478 +
"AND size > '0'");
9479 if (rs.next() && rs.getInt(
"count") == 0) {
9480 allFilesAreHashed =
true;
9482 }
catch (SQLException ex) {
9483 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
9490 return allFilesAreHashed;
9499 CaseDbConnection connection;
9501 connection = connections.getConnection();
9502 }
catch (TskCoreException ex) {
9503 logger.log(Level.SEVERE,
"Error getting database connection for hashed files count", ex);
9509 ResultSet rs = null;
9511 s = connection.createStatement();
9512 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
9513 +
"WHERE md5 IS NOT NULL "
9514 +
"AND size > '0'");
9516 count = rs.getInt(
"count");
9518 }
catch (SQLException ex) {
9519 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
9539 CaseDbConnection connection = connections.getConnection();
9541 ResultSet resultSet = null;
9544 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES);
9545 resultSet = connection.executeQuery(statement);
9546 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
9547 while (resultSet.next()) {
9548 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9553 }
catch (SQLException ex) {
9554 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
9556 closeResultSet(resultSet);
9573 CaseDbConnection connection = connections.getConnection();
9575 ResultSet resultSet = null;
9578 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE);
9579 resultSet = connection.executeQuery(statement);
9580 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
9581 while (resultSet.next()) {
9582 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9587 }
catch (SQLException ex) {
9588 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
9590 closeResultSet(resultSet);
9610 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
9616 CaseDbConnection connection = connections.getConnection();
9618 ResultSet resultSet = null;
9621 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE);
9622 statement.setLong(1, dsObjId);
9623 statement.setLong(2, dsObjId);
9624 resultSet = connection.executeQuery(statement);
9625 while (resultSet.next()) {
9626 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9631 }
catch (SQLException ex) {
9632 throw new TskCoreException(
"Failed to get tag names in use for data source objID : " + dsObjId, ex);
9634 closeResultSet(resultSet);
9673 CaseDbConnection connection = connections.getConnection();
9675 ResultSet resultSet = null;
9677 PreparedStatement statement;
9679 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OR_UPDATE_TAG_NAME, Statement.RETURN_GENERATED_KEYS);
9680 statement.clearParameters();
9681 statement.setString(5, description);
9682 statement.setString(6, color.getName());
9683 statement.setByte(7, knownStatus.getFileKnownValue());
9684 statement.setString(1, displayName);
9685 statement.setString(2, description);
9686 statement.setString(3, color.getName());
9687 statement.setByte(4, knownStatus.getFileKnownValue());
9688 connection.executeUpdate(statement);
9689 resultSet = statement.getGeneratedKeys();
9691 return new TagName(resultSet.getLong(1),
9692 displayName, description, color, knownStatus);
9693 }
catch (SQLException ex) {
9694 throw new TskCoreException(
"Error adding row for " + displayName +
" tag name to tag_names table", ex);
9696 closeResultSet(resultSet);
9716 CaseDbConnection connection = connections.getConnection();
9718 ResultSet resultSet = null;
9722 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_CONTENT_TAG, Statement.RETURN_GENERATED_KEYS);
9723 statement.clearParameters();
9724 statement.setLong(1, content.getId());
9725 statement.setLong(2, tagName.getId());
9726 statement.setString(3, comment);
9727 statement.setLong(4, beginByteOffset);
9728 statement.setLong(5, endByteOffset);
9729 statement.setLong(6, currentExaminer.
getId());
9730 connection.executeUpdate(statement);
9731 resultSet = statement.getGeneratedKeys();
9734 content, tagName, comment, beginByteOffset, endByteOffset, currentExaminer.
getLoginName());
9735 }
catch (SQLException ex) {
9736 throw new TskCoreException(
"Error adding row to content_tags table (obj_id = " + content.getId() +
", tag_name_id = " + tagName.getId() +
")", ex);
9738 closeResultSet(resultSet);
9750 CaseDbConnection connection = connections.getConnection();
9754 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_CONTENT_TAG);
9755 statement.clearParameters();
9756 statement.setLong(1, tag.getId());
9757 connection.executeUpdate(statement);
9758 }
catch (SQLException ex) {
9759 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
9775 CaseDbConnection connection = connections.getConnection();
9777 ResultSet resultSet = null;
9783 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS);
9784 resultSet = connection.executeQuery(statement);
9785 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
9786 while (resultSet.next()) {
9787 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9791 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
9792 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name")));
9795 }
catch (SQLException ex) {
9796 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
9798 closeResultSet(resultSet);
9815 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9816 throw new TskCoreException(
"TagName object is invalid, id not set");
9818 CaseDbConnection connection = connections.getConnection();
9820 ResultSet resultSet = null;
9823 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME);
9824 statement.clearParameters();
9825 statement.setLong(1, tagName.getId());
9826 resultSet = connection.executeQuery(statement);
9827 if (resultSet.next()) {
9828 return resultSet.getLong(
"count");
9830 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
9832 }
catch (SQLException ex) {
9833 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
9835 closeResultSet(resultSet);
9858 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9859 throw new TskCoreException(
"TagName object is invalid, id not set");
9862 CaseDbConnection connection = connections.getConnection();
9864 ResultSet resultSet = null;
9869 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
9870 statement.clearParameters();
9871 statement.setLong(1, tagName.getId());
9872 statement.setLong(2, dsObjId);
9874 resultSet = connection.executeQuery(statement);
9875 if (resultSet.next()) {
9876 return resultSet.getLong(
"count");
9878 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
9880 }
catch (SQLException ex) {
9881 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
9883 closeResultSet(resultSet);
9901 CaseDbConnection connection = connections.getConnection();
9903 ResultSet resultSet = null;
9911 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID);
9912 statement.clearParameters();
9913 statement.setLong(1, contentTagID);
9914 resultSet = connection.executeQuery(statement);
9916 while (resultSet.next()) {
9917 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9921 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
9925 }
catch (SQLException ex) {
9926 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
9928 closeResultSet(resultSet);
9947 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9948 throw new TskCoreException(
"TagName object is invalid, id not set");
9950 CaseDbConnection connection = connections.getConnection();
9952 ResultSet resultSet = null;
9958 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME);
9959 statement.clearParameters();
9960 statement.setLong(1, tagName.getId());
9961 resultSet = connection.executeQuery(statement);
9962 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
9963 while (resultSet.next()) {
9965 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
9970 }
catch (SQLException ex) {
9971 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
9973 closeResultSet(resultSet);
9993 CaseDbConnection connection = connections.getConnection();
9995 ResultSet resultSet = null;
10004 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
10005 statement.clearParameters();
10006 statement.setLong(1, tagName.getId());
10007 statement.setLong(2, dsObjId);
10008 resultSet = connection.executeQuery(statement);
10009 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
10010 while (resultSet.next()) {
10012 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
10017 }
catch (SQLException ex) {
10018 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
" data source objID : " + dsObjId, ex);
10020 closeResultSet(resultSet);
10021 connection.close();
10038 CaseDbConnection connection = connections.getConnection();
10040 ResultSet resultSet = null;
10047 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT);
10048 statement.clearParameters();
10049 statement.setLong(1, content.getId());
10050 resultSet = connection.executeQuery(statement);
10051 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
10052 while (resultSet.next()) {
10053 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10057 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
10061 }
catch (SQLException ex) {
10062 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
10064 closeResultSet(resultSet);
10065 connection.close();
10084 CaseDbConnection connection = connections.getConnection();
10086 ResultSet resultSet = null;
10090 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT_TAG, Statement.RETURN_GENERATED_KEYS);
10091 statement.clearParameters();
10092 statement.setLong(1, artifact.getArtifactID());
10093 statement.setLong(2, tagName.getId());
10094 statement.setString(3, comment);
10095 statement.setLong(4, currentExaminer.
getId());
10096 connection.executeUpdate(statement);
10097 resultSet = statement.getGeneratedKeys();
10101 }
catch (SQLException ex) {
10102 throw new TskCoreException(
"Error adding row to blackboard_artifact_tags table (obj_id = " + artifact.getArtifactID() +
", tag_name_id = " + tagName.getId() +
")", ex);
10104 closeResultSet(resultSet);
10105 connection.close();
10116 CaseDbConnection connection = connections.getConnection();
10120 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_ARTIFACT_TAG);
10121 statement.clearParameters();
10122 statement.setLong(1, tag.getId());
10123 connection.executeUpdate(statement);
10124 }
catch (SQLException ex) {
10125 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
10127 connection.close();
10142 CaseDbConnection connection = connections.getConnection();
10144 ResultSet resultSet = null;
10150 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS);
10151 resultSet = connection.executeQuery(statement);
10152 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10153 while (resultSet.next()) {
10154 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10160 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10164 }
catch (SQLException ex) {
10165 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
10167 closeResultSet(resultSet);
10168 connection.close();
10184 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10185 throw new TskCoreException(
"TagName object is invalid, id not set");
10187 CaseDbConnection connection = connections.getConnection();
10189 ResultSet resultSet = null;
10192 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME);
10193 statement.clearParameters();
10194 statement.setLong(1, tagName.getId());
10195 resultSet = connection.executeQuery(statement);
10196 if (resultSet.next()) {
10197 return resultSet.getLong(
"count");
10199 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
10201 }
catch (SQLException ex) {
10202 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
10204 closeResultSet(resultSet);
10205 connection.close();
10226 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10227 throw new TskCoreException(
"TagName object is invalid, id not set");
10230 CaseDbConnection connection = connections.getConnection();
10232 ResultSet resultSet = null;
10237 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE);
10238 statement.clearParameters();
10239 statement.setLong(1, tagName.getId());
10240 statement.setLong(2, dsObjId);
10241 resultSet = connection.executeQuery(statement);
10242 if (resultSet.next()) {
10243 return resultSet.getLong(
"count");
10245 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
10247 }
catch (SQLException ex) {
10248 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
10250 closeResultSet(resultSet);
10251 connection.close();
10268 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10269 throw new TskCoreException(
"TagName object is invalid, id not set");
10271 CaseDbConnection connection = connections.getConnection();
10273 ResultSet resultSet = null;
10279 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME);
10280 statement.clearParameters();
10281 statement.setLong(1, tagName.getId());
10282 resultSet = connection.executeQuery(statement);
10283 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10284 while (resultSet.next()) {
10288 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10292 }
catch (SQLException ex) {
10293 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
10295 closeResultSet(resultSet);
10296 connection.close();
10317 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10318 throw new TskCoreException(
"TagName object is invalid, id not set");
10321 CaseDbConnection connection = connections.getConnection();
10323 ResultSet resultSet = null;
10331 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
10332 statement.clearParameters();
10333 statement.setLong(1, tagName.getId());
10334 statement.setLong(2, dsObjId);
10335 resultSet = connection.executeQuery(statement);
10336 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10337 while (resultSet.next()) {
10341 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10345 }
catch (SQLException ex) {
10346 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
10348 closeResultSet(resultSet);
10349 connection.close();
10368 CaseDbConnection connection = connections.getConnection();
10370 ResultSet resultSet = null;
10378 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID);
10379 statement.clearParameters();
10380 statement.setLong(1, artifactTagID);
10381 resultSet = connection.executeQuery(statement);
10383 while (resultSet.next()) {
10384 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10390 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10394 }
catch (SQLException ex) {
10395 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
10397 closeResultSet(resultSet);
10398 connection.close();
10417 CaseDbConnection connection = connections.getConnection();
10419 ResultSet resultSet = null;
10426 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT);
10427 statement.clearParameters();
10428 statement.setLong(1, artifact.getArtifactID());
10429 resultSet = connection.executeQuery(statement);
10430 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10431 while (resultSet.next()) {
10432 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10437 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10441 }
catch (SQLException ex) {
10442 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
10444 closeResultSet(resultSet);
10445 connection.close();
10459 CaseDbConnection connection = connections.getConnection();
10463 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_PATH);
10464 statement.clearParameters();
10465 statement.setString(1, newPath);
10466 statement.setLong(2, objectId);
10467 connection.executeUpdate(statement);
10468 }
catch (SQLException ex) {
10469 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
10471 connection.close();
10489 public Report addReport(String localPath, String sourceModuleName, String reportName)
throws TskCoreException {
10490 return addReport(localPath, sourceModuleName, reportName, null);
10511 String relativePath =
"";
10512 long createTime = 0;
10513 String localPathLower = localPath.toLowerCase();
10515 if (localPathLower.startsWith(
"http")) {
10516 relativePath = localPathLower;
10517 createTime = System.currentTimeMillis() / 1000;
10528 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
10529 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
10530 }
catch (IllegalArgumentException ex) {
10531 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
10532 throw new TskCoreException(errorMessage, ex);
10536 java.io.File tempFile =
new java.io.File(localPath);
10538 createTime = tempFile.lastModified() / 1000;
10539 }
catch (Exception ex) {
10540 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
10545 CaseDbConnection connection = connections.getConnection();
10547 ResultSet resultSet = null;
10551 long parentObjId = 0;
10552 if (parent != null) {
10553 parentObjId = parent.getId();
10558 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
10559 statement.clearParameters();
10560 statement.setLong(1, objectId);
10561 statement.setString(2, relativePath);
10562 statement.setLong(3, createTime);
10563 statement.setString(4, sourceModuleName);
10564 statement.setString(5, reportName);
10565 connection.executeUpdate(statement);
10566 return new Report(
this, objectId, localPath, createTime, sourceModuleName, reportName, parent);
10567 }
catch (SQLException ex) {
10568 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
10570 closeResultSet(resultSet);
10571 connection.close();
10585 CaseDbConnection connection = connections.getConnection();
10587 ResultSet resultSet = null;
10588 ResultSet parentResultSet = null;
10589 PreparedStatement statement = null;
10590 Statement parentStatement = null;
10593 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORTS);
10594 parentStatement = connection.createStatement();
10595 resultSet = connection.executeQuery(statement);
10596 ArrayList<Report> reports =
new ArrayList<Report>();
10597 while (resultSet.next()) {
10598 String localpath = resultSet.getString(
"path");
10599 if (localpath.toLowerCase().startsWith(
"http") ==
false) {
10601 localpath = Paths.get(
getDbDirPath(), localpath).normalize().toString();
10606 long reportId = resultSet.getLong(
"obj_id");
10607 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", reportId);
10608 parentResultSet = parentStatement.executeQuery(parentQuery);
10609 if (parentResultSet.next()) {
10610 long parentId = parentResultSet.getLong(
"par_obj_id");
10613 parentResultSet.close();
10615 reports.add(
new Report(
this,
10618 resultSet.getLong(
"crtime"),
10619 resultSet.getString(
"src_module_name"),
10620 resultSet.getString(
"report_name"),
10624 }
catch (SQLException ex) {
10625 throw new TskCoreException(
"Error querying reports table", ex);
10627 closeResultSet(resultSet);
10628 closeResultSet(parentResultSet);
10629 closeStatement(statement);
10630 closeStatement(parentStatement);
10632 connection.close();
10647 CaseDbConnection connection = connections.getConnection();
10649 PreparedStatement statement = null;
10650 Statement parentStatement = null;
10651 ResultSet resultSet = null;
10652 ResultSet parentResultSet = null;
10656 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORT_BY_ID);
10657 parentStatement = connection.createStatement();
10658 statement.clearParameters();
10659 statement.setLong(1,
id);
10660 resultSet = connection.executeQuery(statement);
10662 if (resultSet.next()) {
10665 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;",
id);
10666 parentResultSet = parentStatement.executeQuery(parentQuery);
10667 if (parentResultSet.next()) {
10668 long parentId = parentResultSet.getLong(
"par_obj_id");
10672 report =
new Report(
this, resultSet.getLong(
"obj_id"),
10673 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
10674 resultSet.getLong(
"crtime"),
10675 resultSet.getString(
"src_module_name"),
10676 resultSet.getString(
"report_name"),
10679 throw new TskCoreException(
"No report found for id: " +
id);
10681 }
catch (SQLException ex) {
10682 throw new TskCoreException(
"Error querying reports table for id: " +
id, ex);
10684 closeResultSet(resultSet);
10685 closeResultSet(parentResultSet);
10686 closeStatement(statement);
10687 closeStatement(parentStatement);
10688 connection.close();
10703 CaseDbConnection connection = connections.getConnection();
10707 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT);
10708 statement.setLong(1, report.getId());
10709 connection.executeUpdate(statement);
10710 }
catch (SQLException ex) {
10711 throw new TskCoreException(
"Error querying reports table", ex);
10713 connection.close();
10718 static void closeResultSet(ResultSet resultSet) {
10719 if (resultSet != null) {
10722 }
catch (SQLException ex) {
10723 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
10728 static void closeStatement(Statement statement) {
10729 if (statement != null) {
10732 }
catch (SQLException ex) {
10733 logger.log(Level.SEVERE,
"Error closing Statement", ex);
10747 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
10748 CaseDbConnection connection = connections.getConnection();
10751 Statement statement = connection.createStatement();
10752 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
10753 }
catch (SQLException ex) {
10754 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
10756 connection.close();
10761 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
10762 CaseDbConnection connection = connections.getConnection();
10765 Statement statement = connection.createStatement();
10766 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
10767 }
catch (SQLException ex) {
10768 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
10770 connection.close();
10792 CaseDbConnection connection = connections.getConnection();
10794 ResultSet resultSet = null;
10795 Statement statement;
10797 connection.beginTransaction();
10798 statement = connection.createStatement();
10799 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_JOB, Statement.RETURN_GENERATED_KEYS);
10800 insertStatement.setLong(1, dataSource.getId());
10801 insertStatement.setString(2, hostName);
10802 insertStatement.setLong(3, jobStart.getTime());
10803 insertStatement.setLong(4, jobEnd.getTime());
10804 insertStatement.setInt(5, status.ordinal());
10805 insertStatement.setString(6, settingsDir);
10806 connection.executeUpdate(insertStatement);
10807 resultSet = insertStatement.getGeneratedKeys();
10809 long id = resultSet.getLong(1);
10810 for (
int i = 0; i < ingestModules.size(); i++) {
10812 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
10813 +
"VALUES (" +
id +
", " + ingestModule.
getIngestModuleId() +
", " + i +
");");
10817 connection.commitTransaction();
10818 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
10819 }
catch (SQLException ex) {
10820 connection.rollbackTransaction();
10821 throw new TskCoreException(
"Error adding the ingest job.", ex);
10823 closeResultSet(resultSet);
10824 connection.close();
10843 CaseDbConnection connection = connections.getConnection();
10844 ResultSet resultSet = null;
10845 Statement statement = null;
10846 String uniqueName = factoryClassName +
"-" + displayName +
"-" + type.toString() +
"-" + version;
10849 statement = connection.createStatement();
10850 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
10851 if (!resultSet.next()) {
10854 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_MODULE, Statement.RETURN_GENERATED_KEYS);
10855 insertStatement.setString(1, displayName);
10856 insertStatement.setString(2, uniqueName);
10857 insertStatement.setInt(3, type.ordinal());
10858 insertStatement.setString(4, version);
10859 connection.executeUpdate(insertStatement);
10860 resultSet = statement.getGeneratedKeys();
10862 long id = resultSet.getLong(1);
10867 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10868 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
10870 }
catch (SQLException ex) {
10872 closeStatement(statement);
10873 statement = connection.createStatement();
10874 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
10875 if (resultSet.next()) {
10876 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10879 throw new TskCoreException(
"Couldn't add new module to database.", ex);
10881 }
catch (SQLException ex1) {
10882 throw new TskCoreException(
"Couldn't add new module to database.", ex1);
10885 closeResultSet(resultSet);
10886 closeStatement(statement);
10887 connection.close();
10900 CaseDbConnection connection = connections.getConnection();
10901 ResultSet resultSet = null;
10902 Statement statement = null;
10903 List<IngestJobInfo> ingestJobs =
new ArrayList<IngestJobInfo>();
10906 statement = connection.createStatement();
10907 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
10908 while (resultSet.next()) {
10909 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
10910 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
10912 resultSet.getString(
"settings_dir"), this.getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
10915 }
catch (SQLException ex) {
10916 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
10918 closeResultSet(resultSet);
10919 closeStatement(statement);
10920 connection.close();
10935 private List<IngestModuleInfo> getIngestModules(
int ingestJobId, CaseDbConnection connection)
throws SQLException {
10936 ResultSet resultSet = null;
10937 Statement statement = null;
10938 List<IngestModuleInfo> ingestModules =
new ArrayList<IngestModuleInfo>();
10941 statement = connection.createStatement();
10942 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
10943 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
10944 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
10945 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
10946 +
"FROM ingest_job_modules, ingest_modules "
10947 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
10948 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
10949 +
"ORDER BY (ingest_job_modules.pipeline_position);");
10950 while (resultSet.next()) {
10951 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10952 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
10954 return ingestModules;
10956 closeResultSet(resultSet);
10957 closeStatement(statement);
10966 static class ObjectInfo {
10969 private TskData.ObjectType type;
10971 ObjectInfo(
long id, ObjectType type) {
10980 TskData.ObjectType getType() {
10985 private interface DbCommand {
10987 void execute() throws SQLException;
10990 private enum PREPARED_STATEMENT {
10992 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
10993 +
"WHERE artifact_type_id = ?"),
10994 COUNT_ARTIFACTS_OF_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
10995 COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE data_source_obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
10996 COUNT_ARTIFACTS_FROM_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
10997 COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
10998 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
10999 +
"FROM tsk_objects INNER JOIN tsk_files "
11000 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11001 +
"WHERE (tsk_objects.par_obj_id = ? ) "
11002 +
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"),
11003 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
11004 +
"FROM tsk_objects INNER JOIN tsk_files "
11005 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11006 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
11007 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
11008 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
11009 +
"FROM tsk_objects INNER JOIN tsk_files "
11010 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11011 +
"WHERE (tsk_objects.par_obj_id = ?)"),
11012 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
11013 +
"FROM tsk_objects INNER JOIN tsk_files "
11014 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11015 +
"WHERE (tsk_objects.par_obj_id = ? "
11016 +
"AND tsk_files.type = ? )"),
11017 SELECT_FILE_BY_ID(
"SELECT * FROM tsk_files WHERE obj_id = ? LIMIT 1"),
11018 SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
11019 SELECT_ARTIFACT_BY_ARTIFACT_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_id = ? LIMIT 1"),
11020 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
11021 +
"VALUES (?, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
11022 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
11023 +
"VALUES (DEFAULT, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
11024 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
11025 +
"VALUES (?,?,?,?,?,?,?)"),
11026 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
11027 +
"VALUES (?,?,?,?,?,?,?)"),
11028 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
11029 +
"VALUES (?,?,?,?,?,?,?)"),
11030 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
11031 +
"VALUES (?,?,?,?,?,?,?)"),
11032 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
11033 +
"VALUES (?,?,?,?,?,?,?)"),
11034 SELECT_FILES_BY_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
11035 SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
11036 UPDATE_FILE_MD5(
"UPDATE tsk_files SET md5 = ? WHERE obj_id = ?"),
11037 UPDATE_IMAGE_MD5(
"UPDATE tsk_image_info SET md5 = ? WHERE obj_id = ?"),
11038 UPDATE_IMAGE_SHA1(
"UPDATE tsk_image_info SET sha1 = ? WHERE obj_id = ?"),
11039 UPDATE_IMAGE_SHA256(
"UPDATE tsk_image_info SET sha256 = ? WHERE obj_id = ?"),
11040 SELECT_IMAGE_MD5(
"SELECT md5 FROM tsk_image_info WHERE obj_id = ?"),
11041 SELECT_IMAGE_SHA1(
"SELECT sha1 FROM tsk_image_info WHERE obj_id = ?"),
11042 SELECT_IMAGE_SHA256(
"SELECT sha256 FROM tsk_image_info WHERE obj_id = ?"),
11043 UPDATE_ACQUISITION_DETAILS(
"UPDATE data_source_info SET acquisition_details = ? WHERE obj_id = ?"),
11044 SELECT_ACQUISITION_DETAILS(
"SELECT acquisition_details FROM data_source_info WHERE obj_id = ?"),
11045 SELECT_LOCAL_PATH_FOR_FILE(
"SELECT path FROM tsk_files_path WHERE obj_id = ?"),
11046 SELECT_ENCODING_FOR_FILE(
"SELECT encoding_type FROM tsk_files_path WHERE obj_id = ?"),
11047 SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE(
"SELECT path, encoding_type FROM tsk_files_path WHERE obj_id = ?"),
11048 SELECT_PATH_FOR_FILE(
"SELECT parent_path FROM tsk_files WHERE obj_id = ?"),
11049 SELECT_FILE_NAME(
"SELECT name FROM tsk_files WHERE obj_id = ?"),
11050 SELECT_DERIVED_FILE(
"SELECT derived_id, rederive FROM tsk_files_derived WHERE obj_id = ?"),
11051 SELECT_FILE_DERIVATION_METHOD(
"SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"),
11052 SELECT_MAX_OBJECT_ID(
"SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"),
11053 INSERT_OBJECT(
"INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"),
11054 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, known, mime_type, parent_path, data_source_obj_id,extension) "
11055 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11056 INSERT_FILE_SYSTEM_FILE(
"INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, parent_path, extension)"
11057 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11058 UPDATE_DERIVED_FILE(
"UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?, meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ? "
11059 +
"WHERE obj_id = ?"),
11060 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
11061 +
"VALUES (?, ?, ?, ?)"),
11062 INSERT_LOCAL_PATH(
"INSERT INTO tsk_files_path (obj_id, path, encoding_type) VALUES (?, ?, ?)"),
11063 UPDATE_LOCAL_PATH(
"UPDATE tsk_files_path SET path = ?, encoding_type = ? WHERE obj_id = ?"),
11064 COUNT_CHILD_OBJECTS_BY_PARENT(
"SELECT COUNT(obj_id) AS count FROM tsk_objects WHERE par_obj_id = ?"),
11065 SELECT_FILE_SYSTEM_BY_OBJECT(
"SELECT fs_obj_id from tsk_files WHERE obj_id=?"),
11066 SELECT_TAG_NAMES(
"SELECT * FROM tag_names"),
11067 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
11068 +
"WHERE tag_name_id IN "
11069 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
11070 SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE(
"SELECT * FROM tag_names "
11071 +
"WHERE tag_name_id IN "
11072 +
"( SELECT content_tags.tag_name_id as tag_name_id "
11073 +
"FROM content_tags as content_tags, tsk_files as tsk_files"
11074 +
" WHERE content_tags.obj_id = tsk_files.obj_id"
11075 +
" AND tsk_files.data_source_obj_id = ?"
11077 +
"SELECT artifact_tags.tag_name_id as tag_name_id "
11078 +
" FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts "
11079 +
" WHERE artifact_tags.artifact_id = arts.artifact_id"
11080 +
" AND arts.data_source_obj_id = ?"
11082 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?)"),
11083 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset, examiner_id) VALUES (?, ?, ?, ?, ?, ?)"),
11084 DELETE_CONTENT_TAG(
"DELETE FROM content_tags WHERE tag_id = ?"),
11085 COUNT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM content_tags WHERE tag_name_id = ?"),
11086 COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
11087 "SELECT COUNT(*) AS count FROM content_tags as content_tags, tsk_files as tsk_files WHERE content_tags.obj_id = tsk_files.obj_id"
11088 +
" AND content_tags.tag_name_id = ? "
11089 +
" AND tsk_files.data_source_obj_id = ? "
11091 SELECT_CONTENT_TAGS(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11092 +
"FROM content_tags "
11093 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11094 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id"),
11095 SELECT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tsk_examiners.login_name "
11096 +
"FROM content_tags "
11097 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11098 +
"WHERE tag_name_id = ?"),
11099 SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11100 +
"FROM content_tags as content_tags, tsk_files as tsk_files, tag_names as tag_names, tsk_examiners as tsk_examiners "
11101 +
"WHERE content_tags.examiner_id = tsk_examiners.examiner_id"
11102 +
" AND content_tags.obj_id = tsk_files.obj_id"
11103 +
" AND content_tags.tag_name_id = tag_names.tag_name_id"
11104 +
" AND content_tags.tag_name_id = ?"
11105 +
" AND tsk_files.data_source_obj_id = ? "),
11106 SELECT_CONTENT_TAG_BY_ID(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11107 +
"FROM content_tags "
11108 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11109 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11110 +
"WHERE tag_id = ?"),
11111 SELECT_CONTENT_TAGS_BY_CONTENT(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11112 +
"FROM content_tags "
11113 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11114 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11115 +
"WHERE content_tags.obj_id = ?"),
11116 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment, examiner_id) "
11117 +
"VALUES (?, ?, ?, ?)"),
11118 DELETE_ARTIFACT_TAG(
"DELETE FROM blackboard_artifact_tags WHERE tag_id = ?"),
11119 SELECT_ARTIFACT_TAGS(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11120 +
"FROM blackboard_artifact_tags "
11121 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11122 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id"),
11123 COUNT_ARTIFACTS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags WHERE tag_name_id = ?"),
11124 COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts WHERE artifact_tags.artifact_id = arts.artifact_id"
11125 +
" AND artifact_tags.tag_name_id = ?"
11126 +
" AND arts.data_source_obj_id = ? "),
11127 SELECT_ARTIFACT_TAGS_BY_TAG_NAME(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tsk_examiners.login_name "
11128 +
"FROM blackboard_artifact_tags "
11129 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11130 +
"WHERE tag_name_id = ?"),
11131 SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT artifact_tags.tag_id, artifact_tags.artifact_id, artifact_tags.tag_name_id, artifact_tags.comment, arts.obj_id, arts.artifact_obj_id, arts.data_source_obj_id, arts.artifact_type_id, arts.review_status_id, tsk_examiners.login_name "
11132 +
"FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts, tsk_examiners AS tsk_examiners "
11133 +
"WHERE artifact_tags.examiner_id = tsk_examiners.examiner_id"
11134 +
" AND artifact_tags.artifact_id = arts.artifact_id"
11135 +
" AND artifact_tags.tag_name_id = ? "
11136 +
" AND arts.data_source_obj_id = ? "),
11137 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11138 +
"FROM blackboard_artifact_tags "
11139 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11140 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11141 +
"WHERE blackboard_artifact_tags.tag_id = ?"),
11142 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name "
11143 +
"FROM blackboard_artifact_tags "
11144 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11145 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11146 +
"WHERE blackboard_artifact_tags.artifact_id = ?"),
11147 SELECT_REPORTS(
"SELECT * FROM reports"),
11148 SELECT_REPORT_BY_ID(
"SELECT * FROM reports WHERE obj_id = ?"),
11149 INSERT_REPORT(
"INSERT INTO reports (obj_id, path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?, ?)"),
11150 DELETE_REPORT(
"DELETE FROM reports WHERE reports.obj_id = ?"),
11151 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
11152 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
11153 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
11154 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
11155 UPDATE_IMAGE_PATH(
"UPDATE tsk_image_names SET name = ? WHERE obj_id = ?"),
11156 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "
11157 +
"FROM tsk_objects INNER JOIN blackboard_artifacts "
11158 +
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "
11159 +
"WHERE (tsk_objects.par_obj_id = ?)"),
11160 INSERT_OR_UPDATE_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?) ON CONFLICT (display_name) DO UPDATE SET description = ?, color = ?, knownStatus = ?"),
11161 SELECT_EXAMINER_BY_ID(
"SELECT * FROM tsk_examiners WHERE examiner_id = ?"),
11162 SELECT_EXAMINER_BY_LOGIN_NAME(
"SELECT * FROM tsk_examiners WHERE login_name = ?"),
11163 UPDATE_FILE_NAME(
"UPDATE tsk_files SET name = ? WHERE obj_id = ?"),
11164 UPDATE_IMAGE_NAME(
"UPDATE tsk_image_info SET display_name = ? WHERE obj_id = ?"),
11165 DELETE_IMAGE_NAME(
"DELETE FROM tsk_image_names WHERE obj_id = ?"),
11166 INSERT_IMAGE_NAME(
"INSERT INTO tsk_image_names (obj_id, name, sequence) VALUES (?, ?, ?)"),
11167 INSERT_IMAGE_INFO(
"INSERT INTO tsk_image_info (obj_id, type, ssize, tzone, size, md5, sha1, sha256, display_name)"
11168 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11169 INSERT_DATA_SOURCE_INFO(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) VALUES (?, ?, ?)"),
11170 INSERT_VS_INFO(
"INSERT INTO tsk_vs_info (obj_id, vs_type, img_offset, block_size) VALUES (?, ?, ?, ?)"),
11171 INSERT_VS_PART_SQLITE(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, desc, flags) VALUES (?, ?, ?, ?, ?, ?)"),
11172 INSERT_VS_PART_POSTGRESQL(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, descr, flags) VALUES (?, ?, ?, ?, ?, ?)"),
11173 INSERT_POOL_INFO(
"INSERT INTO tsk_pool_info (obj_id, pool_type) VALUES (?, ?)"),
11174 INSERT_FS_INFO(
"INSERT INTO tsk_fs_info (obj_id, img_offset, fs_type, block_size, block_count, root_inum, first_inum, last_inum, display_name)"
11175 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
11177 private final String sql;
11179 private PREPARED_STATEMENT(String sql) {
11193 abstract private class ConnectionPool {
11195 private PooledDataSource pooledDataSource;
11197 public ConnectionPool() {
11198 pooledDataSource = null;
11201 CaseDbConnection getConnection() throws TskCoreException {
11202 if (pooledDataSource == null) {
11203 throw new TskCoreException(
"Error getting case database connection - case is closed");
11206 return getPooledConnection();
11207 }
catch (SQLException exp) {
11208 throw new TskCoreException(exp.getMessage());
11212 void close() throws TskCoreException {
11213 if (pooledDataSource != null) {
11215 pooledDataSource.close();
11216 }
catch (SQLException exp) {
11217 throw new TskCoreException(exp.getMessage());
11219 pooledDataSource = null;
11224 abstract CaseDbConnection getPooledConnection() throws SQLException;
11226 public PooledDataSource getPooledDataSource() {
11227 return pooledDataSource;
11230 public void setPooledDataSource(PooledDataSource pooledDataSource) {
11231 this.pooledDataSource = pooledDataSource;
11239 private final class SQLiteConnections
extends ConnectionPool {
11241 private final Map<String, String> configurationOverrides =
new HashMap<String, String>();
11243 SQLiteConnections(String dbPath)
throws SQLException {
11244 configurationOverrides.put(
"acquireIncrement",
"2");
11245 configurationOverrides.put(
"initialPoolSize",
"5");
11246 configurationOverrides.put(
"minPoolSize",
"5");
11251 configurationOverrides.put(
"maxPoolSize",
"20");
11252 configurationOverrides.put(
"maxStatements",
"200");
11253 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
11255 SQLiteConfig config =
new SQLiteConfig();
11256 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
11257 config.setReadUncommited(
true);
11258 config.enforceForeignKeys(
true);
11259 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
11260 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
11261 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
11265 public CaseDbConnection getPooledConnection() throws SQLException {
11266 return new SQLiteConnection(getPooledDataSource().getConnection());
11274 private final class PostgreSQLConnections
extends ConnectionPool {
11276 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
11277 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
11278 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
11279 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
11280 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
11281 comboPooledDataSource.setUser(userName);
11282 comboPooledDataSource.setPassword(password);
11283 comboPooledDataSource.setAcquireIncrement(2);
11284 comboPooledDataSource.setInitialPoolSize(5);
11285 comboPooledDataSource.setMinPoolSize(5);
11290 comboPooledDataSource.setMaxPoolSize(20);
11291 comboPooledDataSource.setMaxStatements(200);
11292 comboPooledDataSource.setMaxStatementsPerConnection(20);
11293 setPooledDataSource(comboPooledDataSource);
11297 public CaseDbConnection getPooledConnection() throws SQLException {
11298 return new PostgreSQLConnection(getPooledDataSource().getConnection());
11305 abstract class CaseDbConnection
implements AutoCloseable {
11307 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
11308 static final int MAX_RETRIES = 20;
11310 private class CreateStatement
implements DbCommand {
11312 private final Connection connection;
11313 private Statement statement = null;
11315 CreateStatement(Connection connection) {
11316 this.connection = connection;
11319 Statement getStatement() {
11324 public void execute() throws SQLException {
11325 statement = connection.createStatement();
11329 private class SetAutoCommit
implements DbCommand {
11331 private final Connection connection;
11332 private final boolean mode;
11334 SetAutoCommit(Connection connection,
boolean mode) {
11335 this.connection = connection;
11340 public void execute() throws SQLException {
11341 connection.setAutoCommit(mode);
11345 private class Commit
implements DbCommand {
11347 private final Connection connection;
11349 Commit(Connection connection) {
11350 this.connection = connection;
11354 public void execute() throws SQLException {
11355 connection.commit();
11359 private class ExecuteQuery
implements DbCommand {
11361 private final Statement statement;
11362 private final String query;
11363 private ResultSet resultSet;
11365 ExecuteQuery(Statement statement, String query) {
11366 this.statement = statement;
11367 this.query = query;
11370 ResultSet getResultSet() {
11375 public void execute() throws SQLException {
11376 resultSet = statement.executeQuery(query);
11380 private class ExecutePreparedStatementQuery
implements DbCommand {
11382 private final PreparedStatement preparedStatement;
11383 private ResultSet resultSet;
11385 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
11386 this.preparedStatement = preparedStatement;
11389 ResultSet getResultSet() {
11394 public void execute() throws SQLException {
11395 resultSet = preparedStatement.executeQuery();
11399 private class ExecutePreparedStatementUpdate
implements DbCommand {
11401 private final PreparedStatement preparedStatement;
11403 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
11404 this.preparedStatement = preparedStatement;
11408 public void execute() throws SQLException {
11409 preparedStatement.executeUpdate();
11413 private class ExecuteStatementUpdate
implements DbCommand {
11415 private final Statement statement;
11416 private final String updateCommand;
11418 ExecuteStatementUpdate(Statement statement, String updateCommand) {
11419 this.statement = statement;
11420 this.updateCommand = updateCommand;
11424 public void execute() throws SQLException {
11425 statement.executeUpdate(updateCommand);
11429 private class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
11431 private final Statement statement;
11432 private final int generateKeys;
11433 private final String updateCommand;
11435 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
11436 this.statement = statement;
11437 this.generateKeys = generateKeys;
11438 this.updateCommand = updateCommand;
11442 public void execute() throws SQLException {
11443 statement.executeUpdate(updateCommand, generateKeys);
11447 private class PrepareStatement
implements DbCommand {
11449 private final Connection connection;
11450 private final String input;
11451 private PreparedStatement preparedStatement = null;
11453 PrepareStatement(Connection connection, String input) {
11454 this.connection = connection;
11455 this.input = input;
11458 PreparedStatement getPreparedStatement() {
11459 return preparedStatement;
11463 public void execute() throws SQLException {
11464 preparedStatement = connection.prepareStatement(input);
11468 private class PrepareStatementGenerateKeys
implements DbCommand {
11470 private final Connection connection;
11471 private final String input;
11472 private final int generateKeys;
11473 private PreparedStatement preparedStatement = null;
11475 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
11476 this.connection = connection;
11477 this.input = input;
11478 this.generateKeys = generateKeysInput;
11481 PreparedStatement getPreparedStatement() {
11482 return preparedStatement;
11486 public void execute() throws SQLException {
11487 preparedStatement = connection.prepareStatement(input, generateKeys);
11491 abstract void executeCommand(DbCommand command)
throws SQLException;
11493 private final Connection connection;
11494 private final Map<PREPARED_STATEMENT, PreparedStatement> preparedStatements;
11496 CaseDbConnection(Connection connection) {
11497 this.connection = connection;
11498 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(PREPARED_STATEMENT.class);
11502 return this.connection != null;
11505 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
11506 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
11509 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
11511 PreparedStatement statement;
11512 if (this.preparedStatements.containsKey(statementKey)) {
11513 statement = this.preparedStatements.get(statementKey);
11515 statement = prepareStatement(statementKey.getSQL(), generateKeys);
11516 this.preparedStatements.put(statementKey, statement);
11521 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
11522 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
11523 executeCommand(prepareStatement);
11524 return prepareStatement.getPreparedStatement();
11527 Statement createStatement() throws SQLException {
11528 CreateStatement createStatement =
new CreateStatement(this.connection);
11529 executeCommand(createStatement);
11530 return createStatement.getStatement();
11534 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
11535 executeCommand(setAutoCommit);
11538 void commitTransaction() throws SQLException {
11539 Commit commit =
new Commit(connection);
11540 executeCommand(commit);
11542 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
11543 executeCommand(setAutoCommit);
11551 void rollbackTransaction() {
11553 connection.rollback();
11554 }
catch (SQLException e) {
11555 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
11558 connection.setAutoCommit(
true);
11559 }
catch (SQLException e) {
11560 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
11571 void rollbackTransactionWithThrow() throws SQLException {
11573 connection.rollback();
11575 connection.setAutoCommit(
true);
11579 ResultSet
executeQuery(Statement statement, String query)
throws SQLException {
11580 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
11581 executeCommand(queryCommand);
11582 return queryCommand.getResultSet();
11594 ResultSet
executeQuery(PreparedStatement statement)
throws SQLException {
11595 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
11596 executeCommand(executePreparedStatementQuery);
11597 return executePreparedStatementQuery.getResultSet();
11600 void executeUpdate(Statement statement, String update)
throws SQLException {
11601 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
11604 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
11605 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
11606 executeCommand(executeStatementUpdate);
11609 void executeUpdate(PreparedStatement statement)
throws SQLException {
11610 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
11611 executeCommand(executePreparedStatementUpdate);
11618 public void close() {
11620 connection.close();
11621 }
catch (SQLException ex) {
11622 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
11626 Connection getConnection() {
11627 return this.connection;
11634 private final class SQLiteConnection
extends CaseDbConnection {
11636 private static final int DATABASE_LOCKED_ERROR = 0;
11637 private static final int SQLITE_BUSY_ERROR = 5;
11639 SQLiteConnection(Connection conn) {
11644 void executeCommand(DbCommand command)
throws SQLException {
11645 int retryCounter = 0;
11650 }
catch (SQLException ex) {
11651 if ((ex.getErrorCode() == SQLITE_BUSY_ERROR || ex.getErrorCode() == DATABASE_LOCKED_ERROR) && retryCounter < MAX_RETRIES) {
11658 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
11659 }
catch (InterruptedException exp) {
11660 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
11673 private final class PostgreSQLConnection
extends CaseDbConnection {
11675 private final String COMMUNICATION_ERROR = PSQLState.COMMUNICATION_ERROR.getState();
11676 private final String SYSTEM_ERROR = PSQLState.SYSTEM_ERROR.getState();
11677 private final String UNKNOWN_STATE = PSQLState.UNKNOWN_STATE.getState();
11678 private static final int MAX_RETRIES = 3;
11680 PostgreSQLConnection(Connection conn) {
11685 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
11686 CaseDbConnection.ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new CaseDbConnection.ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
11687 executeCommand(executeStatementUpdateGenerateKeys);
11691 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
11692 CaseDbConnection.PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new CaseDbConnection.PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
11693 executeCommand(prepareStatementGenerateKeys);
11694 return prepareStatementGenerateKeys.getPreparedStatement();
11698 void executeCommand(DbCommand command)
throws SQLException {
11699 SQLException lastException = null;
11700 for (
int retries = 0; retries < MAX_RETRIES; retries++) {
11703 lastException = null;
11705 }
catch (SQLException ex) {
11706 lastException = ex;
11707 String sqlState = ex.getSQLState();
11708 if (sqlState == null || sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
11710 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
11711 }
catch (InterruptedException exp) {
11712 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
11721 if (lastException != null) {
11722 throw lastException;
11737 private final CaseDbConnection connection;
11738 private boolean hasWriteLock =
false;
11742 this.connection = connection;
11743 this.sleuthkitCase = sleuthkitCase;
11745 this.connection.beginTransaction();
11746 }
catch (SQLException ex) {
11747 throw new TskCoreException(
"Failed to create transaction on case database", ex);
11758 CaseDbConnection getConnection() {
11759 return this.connection;
11773 if (!hasWriteLock) {
11774 hasWriteLock =
true;
11787 this.connection.commitTransaction();
11788 }
catch (SQLException ex) {
11789 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
11803 this.connection.rollbackTransactionWithThrow();
11804 }
catch (SQLException ex) {
11805 throw new TskCoreException(
"Case database transaction rollback failed", ex);
11816 this.connection.close();
11817 if (hasWriteLock) {
11819 hasWriteLock =
false;
11835 private ResultSet resultSet;
11836 private CaseDbConnection connection;
11838 private CaseDbQuery(String query)
throws TskCoreException {
11839 this(query,
false);
11842 private CaseDbQuery(String query,
boolean allowWriteQuery)
throws TskCoreException {
11843 if (!allowWriteQuery) {
11844 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
11845 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
11849 connection = connections.getConnection();
11850 }
catch (TskCoreException ex) {
11851 throw new TskCoreException(
"Error getting connection for query: ", ex);
11856 resultSet = connection.executeQuery(connection.createStatement(), query);
11857 }
catch (SQLException ex) {
11859 throw new TskCoreException(
"Error executing query: ", ex);
11873 public void close() throws TskCoreException {
11875 if (resultSet != null) {
11876 final Statement statement = resultSet.getStatement();
11877 if (statement != null) {
11882 connection.close();
11883 }
catch (SQLException ex) {
11884 throw new TskCoreException(
"Error closing query: ", ex);
11900 sleuthkitCaseErrorObservers.add(observer);
11912 int i = sleuthkitCaseErrorObservers.indexOf(observer);
11914 sleuthkitCaseErrorObservers.remove(i);
11928 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
11929 if (observer != null) {
11931 observer.receiveError(context, errorMessage);
11932 }
catch (Exception ex) {
11933 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
11965 private final String contextString;
11967 private Context(String context) {
11968 this.contextString = context;
11972 return contextString;
11976 void receiveError(String context, String errorMessage);
11990 long getDataSourceObjectId(
long objectId) {
11992 CaseDbConnection connection = connections.getConnection();
11994 return getDataSourceObjectId(connection, objectId);
11996 connection.close();
11998 }
catch (TskCoreException ex) {
11999 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
12015 CaseDbConnection connection = connections.getConnection();
12017 ResultSet rs = null;
12020 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID);
12021 rs = connection.executeQuery(statement);
12024 id = rs.getLong(
"max_obj_id");
12027 }
catch (SQLException e) {
12028 throw new TskCoreException(
"Error getting last object id", e);
12030 closeResultSet(rs);
12031 connection.close();
12051 CaseDbConnection connection = connections.getConnection();
12053 Statement s = null;
12054 ResultSet rs = null;
12056 s = connection.createStatement();
12057 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
12058 List<FsContent> results =
new ArrayList<FsContent>();
12059 List<AbstractFile> temp = resultSetToAbstractFiles(rs, connection);
12067 }
catch (SQLException e) {
12068 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
12070 closeResultSet(rs);
12072 connection.close();
12090 CaseDbConnection connection = connections.getConnection();
12092 Statement s = null;
12093 ResultSet rs = null;
12095 s = connection.createStatement();
12096 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
12099 typeId = rs.getInt(
"artifact_type_id");
12102 }
catch (SQLException ex) {
12103 throw new TskCoreException(
"Error getting artifact type id", ex);
12105 closeResultSet(rs);
12107 connection.close();
12140 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
12143 }
catch (TskDataException ex) {
12144 throw new TskCoreException(
"Failed to add artifact type.", ex);
12162 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
12165 }
catch (TskDataException ex) {
12166 throw new TskCoreException(
"Couldn't add new attribute type");
12182 CaseDbConnection connection = connections.getConnection();
12184 Statement s = null;
12185 ResultSet rs = null;
12187 s = connection.createStatement();
12188 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
12191 typeId = rs.getInt(
"attribute_type_id");
12194 }
catch (SQLException ex) {
12195 throw new TskCoreException(
"Error getting attribute type id", ex);
12197 closeResultSet(rs);
12199 connection.close();
12218 CaseDbConnection connection = connections.getConnection();
12220 Statement s = null;
12221 ResultSet rs = null;
12223 s = connection.createStatement();
12224 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
12226 return rs.getString(
"type_name");
12228 throw new TskCoreException(
"No type with that id");
12230 }
catch (SQLException ex) {
12231 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
12233 closeResultSet(rs);
12235 connection.close();
12254 CaseDbConnection connection = connections.getConnection();
12256 Statement s = null;
12257 ResultSet rs = null;
12259 s = connection.createStatement();
12260 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
12262 return rs.getString(
"display_name");
12264 throw new TskCoreException(
"No type with that id");
12266 }
catch (SQLException ex) {
12267 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
12269 closeResultSet(rs);
12271 connection.close();
12306 public ResultSet
runQuery(String query)
throws SQLException {
12307 CaseDbConnection connection;
12309 connection = connections.getConnection();
12310 }
catch (TskCoreException ex) {
12311 throw new SQLException(
"Error getting connection for ad hoc query", ex);
12315 return connection.executeQuery(connection.createStatement(), query);
12319 connection.close();
12335 final Statement statement = resultSet.getStatement();
12337 if (statement != null) {
12359 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
12362 files.add(carvedFile);
12366 || parent instanceof
Volume
12367 || parent instanceof
Image) {
12370 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
12389 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
12393 carvedFiles.add(carvedFile);
12398 || parent instanceof
Volume
12399 || parent instanceof
Image) {
12402 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
12438 long size,
long ctime,
long crtime,
long atime,
long mtime,
12440 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
12441 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
12442 isFile, parentFile, rederiveDetails, toolName, toolVersion,
12472 long size,
long ctime,
long crtime,
long atime,
long mtime,
12475 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
12500 long size,
long ctime,
long crtime,
long atime,
long mtime,
12503 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
12525 return this.caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"",
this);
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
static ARTIFACT_TYPE fromID(int id)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
BlackboardArtifact getArtifactByArtifactId(long id)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
BlackboardArtifact getArtifactById(long id)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
synchronized Content getParent()
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
CommunicationsManager getCommunicationsManager()
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
List< Content > getChildren()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbSchemaVersionNumber getDBSchemaCreationVersion()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
void addErrorObserver(ErrorObserver observer)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
Blackboard getBlackboard()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
synchronized void close()
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
void setFileMIMEType(AbstractFile file, String mimeType)
UNALLOC
Metadata structure is currently in an unallocated state.
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
synchronized CaseDbAccessManager getCaseDbAccessManager()
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
List< AbstractFile > openFiles(Content dataSource, String filePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
VersionNumber getDBSchemaVersion()
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
static final String NAME_CARVED
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
long getDataSourceObjectId()
List< VirtualDirectory > getVirtualDirectoryRoots()
LayoutFile addLayoutFile(String fileName, long size, TSK_FS_NAME_FLAG_ENUM dirFlag, TSK_FS_META_FLAG_ENUM metaFlag, long ctime, long crtime, long atime, long mtime, List< TskFileRange > fileRanges, Content parent)
long getBlackboardArtifactTagsCountByTagName(TagName tagName, long dsObjId)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
BlackboardArtifact getBlackboardArtifact(long artifactID)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
long countFilesWhere(String sqlWhereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
FS
File System - see tsk_fs_info for more details.
Pool addPool(long parentObjId, TskData.TSK_POOL_TYPE_ENUM type, CaseDbTransaction transaction)
boolean isFileFromSource(Content dataSource, long fileId)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Image > getImages()
int getAttrTypeID(String attrTypeName)
Image getImageById(long id)
Report addReport(String localPath, String sourceModuleName, String reportName, Content parent)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
void unregisterForEvents(Object listener)
LOCAL_DIR
Local directory that was added (not from a disk image)
TimelineManager getTimelineManager()
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void releaseSingleUserCaseReadLock()
VOL
Volume - see tsk_vs_parts for more details.
void closeRunQuery(ResultSet resultSet)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
long getContentTagsCountByTagName(TagName tagName, long dsObjId)
List< ContentTag > getContentTagsByTagName(TagName tagName)
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static String escapeSingleQuotes(String text)
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< TagName > getAllTagNames()
Report getReportById(long id)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
static HTML_COLOR getColorByName(String colorName)
void acquireSingleUserCaseWriteLock()
REPORT
Artifact - see blackboard_artifacts for more details.
List< AbstractFile > findFilesByMd5(String md5Hash)
long getBlackboardArtifactsTypeCount(int artifactTypeID, long dataSourceID)
BlackboardArtifact.Type getArtifactType(String artTypeName)
BlackboardArtifact newBlackboardArtifact(ARTIFACT_TYPE artifactType, long obj_id)
void releaseSingleUserCaseWriteLock()
DERIVED
File derived from a parent file (i.e. from ZIP)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, CaseDbTransaction transaction)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
List< Content > getRootObjects()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirSubString)
FileSystem addFileSystem(long parentObjId, long imgOffset, TskData.TSK_FS_TYPE_ENUM type, long blockSize, long blockCount, long rootInum, long firstInum, long lastInum, String displayName, CaseDbTransaction transaction)
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
List< ContentTag > getContentTagsByTagName(TagName tagName, long dsObjId)
void deleteContentTag(ContentTag tag)
static ObjectType valueOf(short objectType)
long getContentTagsCountByTagName(TagName tagName)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parent)
void updateImagePath(String newPath, long objectId)
VolumeSystem addVolumeSystem(long parentObjId, TskData.TSK_VS_TYPE_ENUM type, long imgOffset, long blockSize, CaseDbTransaction transaction)
Examiner getCurrentExaminer()
UNKNOWN
File marked as unknown by hash db.
List< TagName > getTagNamesInUse(long dsObjId)
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
static void tryConnect(CaseDbConnectionInfo info)
static SleuthkitCase openCase(String dbPath)
CaseDbQuery executeInsertOrUpdate(String query)
static String createNonUniquePath(String uniquePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName, long dsObjId)
Volume addVolume(long parentObjId, long addr, long start, long length, String desc, long flags, CaseDbTransaction transaction)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
void acquireSingleUserCaseReadLock()
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
List< FsContent > findFilesWhere(String sqlWhereClause)
static ReviewStatus withID(int id)
void copyCaseDB(String newDBPath)
ResultSet runQuery(String query)
List< TskFileRange > getFileRanges(long id)
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
void registerForEvents(Object listener)
CaseDbQuery executeQuery(String query)
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
LocalDirectory addLocalDirectory(long parentId, String directoryName)