Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
HashsetHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.HashSet;
28 import java.util.LinkedHashMap;
29 import java.util.List;
30 import java.util.Map;
31 import java.util.Observable;
32 import java.util.Observer;
33 import java.util.Set;
34 import java.util.logging.Level;
35 import org.openide.nodes.ChildFactory;
36 import org.openide.nodes.Children;
37 import org.openide.nodes.Node;
38 import org.openide.nodes.Sheet;
39 import org.openide.util.NbBundle;
40 import org.openide.util.lookup.Lookups;
52 
56 public class HashsetHits implements AutopsyVisitableItem {
57 
58  private static final String HASHSET_HITS = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getLabel();
59  private static final String DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName();
60  private static final Logger logger = Logger.getLogger(HashsetHits.class.getName());
63 
64  public HashsetHits(SleuthkitCase skCase) {
65  this.skCase = skCase;
66  hashsetResults = new HashsetResults();
67  }
68 
69 
70  @Override
71  public <T> T accept(AutopsyItemVisitor<T> v) {
72  return v.visit(this);
73  }
74 
79  private class HashsetResults extends Observable {
80  // maps hashset name to list of artifacts for that set
81  private final Map<String, Set<Long>> hashSetHitsMap = new LinkedHashMap<>();
82 
83  HashsetResults() {
84  update();
85  }
86 
87  List<String> getSetNames() {
88  List<String> names = new ArrayList<>(hashSetHitsMap.keySet());
89  Collections.sort(names);
90  return names;
91  }
92 
93  Set<Long> getArtifactIds(String hashSetName) {
94  return hashSetHitsMap.get(hashSetName);
95  }
96  @SuppressWarnings("deprecation")
97  final void update() {
98  hashSetHitsMap.clear();
99 
100  if (skCase == null) {
101  return;
102  }
103 
104  int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
105  int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
106  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
107  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
108  + "attribute_type_id=" + setNameId //NON-NLS
109  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
110  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
111 
112  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
113  ResultSet resultSet = dbQuery.getResultSet();
114  while (resultSet.next()) {
115  String setName = resultSet.getString("value_text"); //NON-NLS
116  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
117  if (!hashSetHitsMap.containsKey(setName)) {
118  hashSetHitsMap.put(setName, new HashSet<Long>());
119  }
120  hashSetHitsMap.get(setName).add(artifactId);
121  }
122  } catch (TskCoreException | SQLException ex) {
123  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
124  }
125 
126  setChanged();
127  notifyObservers();
128  }
129  }
130 
134  public class RootNode extends DisplayableItemNode {
135 
136  public RootNode() {
137  super(Children.create(new HashsetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
138  super.setName(HASHSET_HITS);
139  super.setDisplayName(DISPLAY_NAME);
140  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
141  }
142 
143  @Override
144  public boolean isLeafTypeNode() {
145  return false;
146  }
147 
148  @Override
149  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
150  return v.visit(this);
151  }
152 
153  @Override
154  protected Sheet createSheet() {
155  Sheet s = super.createSheet();
156  Sheet.Set ss = s.get(Sheet.PROPERTIES);
157  if (ss == null) {
158  ss = Sheet.createPropertiesSet();
159  s.put(ss);
160  }
161 
162  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
163  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
164  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
165  getName()));
166 
167  return s;
168  }
169  }
170 
174  private class HashsetNameFactory extends ChildFactory.Detachable<String> implements Observer {
175 
176  /* This should probably be in the HashsetHits class, but the factory has nice methods
177  * for its startup and shutdown, so it seemed like a cleaner place to register the
178  * property change listener.
179  */
180  private final PropertyChangeListener pcl = new PropertyChangeListener() {
181  @Override
182  public void propertyChange(PropertyChangeEvent evt) {
183  String eventType = evt.getPropertyName();
184 
185  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
186  if (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == ARTIFACT_TYPE.TSK_HASHSET_HIT) {
187  hashsetResults.update();
188  }
189  }
190  else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
191  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
192  hashsetResults.update();
193  }
194  else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
195  // case was closed. Remove listeners so that we don't get called with a stale case handle
196  if (evt.getNewValue() == null) {
197  removeNotify();
198  skCase = null;
199  }
200  }
201  }
202  };
203 
204  @Override
205  protected void addNotify() {
209  hashsetResults.update();
210  hashsetResults.addObserver(this);
211  }
212 
213  @Override
214  protected void removeNotify() {
218  hashsetResults.deleteObserver(this);
219  }
220 
221  @Override
222  protected boolean createKeys(List<String> list) {
223  list.addAll(hashsetResults.getSetNames());
224  return true;
225  }
226 
227  @Override
228  protected Node createNodeForKey(String key) {
229  return new HashsetNameNode(key);
230  }
231 
232  @Override
233  public void update(Observable o, Object arg) {
234  refresh(true);
235  }
236  }
237 
241  public class HashsetNameNode extends DisplayableItemNode implements Observer {
242  private final String hashSetName;
243  public HashsetNameNode(String hashSetName) {
244  super(Children.create(new HitFactory(hashSetName), true), Lookups.singleton(hashSetName));
245  super.setName(hashSetName);
246  this.hashSetName = hashSetName;
248  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
249  hashsetResults.addObserver(this);
250  }
251 
255  private void updateDisplayName() {
256  super.setDisplayName(hashSetName + " (" + hashsetResults.getArtifactIds(hashSetName).size() + ")");
257  }
258 
259  @Override
260  public boolean isLeafTypeNode() {
261  return true;
262  }
263 
264  @Override
265  protected Sheet createSheet() {
266  Sheet s = super.createSheet();
267  Sheet.Set ss = s.get(Sheet.PROPERTIES);
268  if (ss == null) {
269  ss = Sheet.createPropertiesSet();
270  s.put(ss);
271  }
272 
273  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
274  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
275  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
276  getName()));
277 
278  return s;
279  }
280 
281  @Override
282  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
283  return v.visit(this);
284  }
285 
286  @Override
287  public void update(Observable o, Object arg) {
289  }
290  }
291 
295  private class HitFactory extends ChildFactory.Detachable<Long> implements Observer {
296  private String hashsetName;
297 
298  private HitFactory(String hashsetName) {
299  super();
300  this.hashsetName = hashsetName;
301  }
302 
303  @Override
304  protected void addNotify() {
305  hashsetResults.addObserver(this);
306  }
307 
308  @Override
309  protected void removeNotify() {
310  hashsetResults.deleteObserver(this);
311  }
312 
313  @Override
314  protected boolean createKeys(List<Long> list) {
315  list.addAll(hashsetResults.getArtifactIds(hashsetName));
316  return true;
317  }
318 
319  @Override
320  protected Node createNodeForKey(Long id) {
321  if (skCase == null) {
322  return null;
323  }
324 
325  try {
326  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
327  return new BlackboardArtifactNode(art);
328  } catch (TskException ex) {
329  logger.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
330  }
331  return null;
332  }
333 
334  @Override
335  public void update(Observable o, Object arg) {
336  refresh(true);
337  }
338  }
339 }
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
BlackboardArtifact getBlackboardArtifact(long artifactID)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static synchronized void removePropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:837
void addIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized void addPropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:833
static Logger getLogger(String name)
Definition: Logger.java:131
CaseDbQuery executeQuery(String query)

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.