Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Protected Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart Class Reference

Inherits XYChart< DateTime, AggregateEvent >, and org.sleuthkit.autopsy.timeline.ui.TimeLineChart< X >.


class  DetailIntervalSelector
class  StartTimeComparator

Public Member Functions

void clearIntervalSelector ()
synchronized SimpleBooleanProperty getBandByType ()
synchronized void setController (TimeLineController controller)
void setModel (FilteredEventsModel filteredEvents)
IntervalSelector< DateTime > newIntervalSelector (double x, Axis< DateTime > axis)
DateTime getDateTimeForPosition (double x)
IntervalSelector<?extends DateTime > getIntervalSelector ()
void setIntervalSelector (IntervalSelector<?extends DateTime > newIntervalSelector)
synchronized SimpleBooleanProperty getOneEventPerRow ()
synchronized SimpleBooleanProperty getTruncateAll ()
TimeLineController getController ()
FilteredEventsModel getFilteredEvents ()
ContextMenu getChartContextMenu ()
void setIntervalSelector (IntervalSelector<?extends X > newIntervalSelector)
IntervalSelector< X > newIntervalSelector (double x, Axis< X > axis)
void setModel (final FilteredEventsModel filteredEvents)

Protected Member Functions

synchronized void dataItemAdded (Series< DateTime, AggregateEvent > series, int i, Data< DateTime, AggregateEvent > data)
synchronized void dataItemChanged (Data< DateTime, AggregateEvent > data)
synchronized void dataItemRemoved (Data< DateTime, AggregateEvent > data, Series< DateTime, AggregateEvent > series)
void layoutChildren ()
synchronized void layoutPlotChildren ()
synchronized void seriesAdded (Series< DateTime, AggregateEvent > series, int i)
synchronized void seriesRemoved (Series< DateTime, AggregateEvent > series)
void requestChartLayout ()

Private Member Functions

void checkNode (AggregateEventNode node, Predicate< AggregateEventNode > p, List< AggregateEventNode > nodes)
void clearGuideLine ()
synchronized double layoutNodes (final List< Node > nodes, final double minY, final double xOffset)
void layoutProjectionMap ()
double getParentXForValue (DateTime dt)

Private Attributes

final SimpleBooleanProperty bandByType = new SimpleBooleanProperty(false)
ContextMenu chartContextMenu
TimeLineController controller
FilteredEventsModel filteredEvents
final SimpleObjectProperty< DescriptionVisibility > descrVisibility = new SimpleObjectProperty<>(DescriptionVisibility.SHOWN)
Line guideLine
IntervalSelector<?extends DateTime > intervalSelector
final InvalidationListener layoutInvalidationListener
final ReadOnlyDoubleWrapper maxY = new ReadOnlyDoubleWrapper(0.0)
final Group nodeGroup = new Group()
final Map< AggregateEvent, AggregateEventNodenodeMap
final SimpleBooleanProperty oneEventPerRow = new SimpleBooleanProperty(false)
final ObservableMap< AggregateEventNode, Line > projectionMap = FXCollections.observableHashMap()
boolean requiresLayout = true
final ObservableList< Series< DateTime, AggregateEvent > > seriesList = FXCollections.<Series<DateTime, AggregateEvent>>observableArrayList()
final ObservableList< Series< DateTime, AggregateEvent > > sortedSeriesList
final SimpleBooleanProperty truncateAll = new SimpleBooleanProperty(false)
final SimpleDoubleProperty truncateWidth = new SimpleDoubleProperty(200.0)

Static Private Attributes

static final int PROJECTED_LINE_Y_OFFSET = 5
static final int PROJECTED_LINE_STROKE_WIDTH = 5
static final int DEFAULT_ROW_HEIGHT = 24

Detailed Description

Custom implementation of XYChart to graph events on a horizontal timeline.

The horizontal DateAxis controls the tick-marks and the horizontal layout of the nodes representing events. The vertical NumberAxis does nothing (although a custom implementation could help with the vertical layout?)

Series help organize events for the banding by event type, we could add a node to contain each band if we need a place for per band controls.

//TODO: refactor the projected lines to a separate class. -jm

Definition at line 92 of file

Member Function Documentation

void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.checkNode ( AggregateEventNode  node,
Predicate< AggregateEventNode p,
List< AggregateEventNode nodes 
void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.clearGuideLine ( )

Definition at line 517 of file

void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.clearIntervalSelector ( )

clear any references to previous interval selectors , including removing the interval selector from the ui / scene-graph

Implements org.sleuthkit.autopsy.timeline.ui.TimeLineChart< X >.

Definition at line 304 of file

synchronized void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.dataItemAdded ( Series< DateTime, AggregateEvent series,
int  i,
Data< DateTime, AggregateEvent data 
synchronized void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.dataItemChanged ( Data< DateTime, AggregateEvent data)

Definition at line 397 of file

synchronized void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.dataItemRemoved ( Data< DateTime, AggregateEvent data,
Series< DateTime, AggregateEvent series 

Definition at line 403 of file

synchronized SimpleBooleanProperty org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getBandByType ( )

Definition at line 309 of file

ContextMenu org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getChartContextMenu ( )
the chartContextMenu

Definition at line 646 of file

TimeLineController org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getController ( )
DateTime org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getDateTimeForPosition ( double  x)

get the DateTime along the x-axis that corresponds to the given x-coordinate in the coordinate system of this EventDetailChart

xa x-coordinate in the space of this EventDetailChart
the DateTime along the x-axis corresponding to the given x value (in the space of this EventDetailChart

Definition at line 349 of file

FilteredEventsModel org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getFilteredEvents ( )
the filteredEvents

Definition at line 639 of file

Referenced by org.sleuthkit.autopsy.timeline.ui.detailview.AggregateEventNode.loadSubClusters().

IntervalSelector<? extends DateTime> org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getIntervalSelector ( )
synchronized SimpleBooleanProperty org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getOneEventPerRow ( )

Definition at line 364 of file

double org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getParentXForValue ( DateTime  dt)

Definition at line 625 of file

synchronized SimpleBooleanProperty org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.getTruncateAll ( )

Definition at line 368 of file

void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.layoutChildren ( )

Definition at line 410 of file

synchronized double org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.layoutNodes ( final List< Node >  nodes,
final double  minY,
final double  xOffset 
synchronized void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.layoutPlotChildren ( )

Layout the nodes representing events via the following algorithm.

we start with a list of nodes (each representing an event) - sort the list of nodes by span start time of the underlying event - initialize empty map (maxXatY) from y-position to max used x-value - for each node: – autosize the node (based on text label) – get the event's start and end positions from the dateaxis – size the capsule representing event duration – starting from the top of the chart: — (1)check if maxXatY is to the left of the start position: ----—if maxXatY less than start position , good, put the current node here, mark end position as maxXatY, go to next node ----—if maxXatY greater than start position, increment y position, do ----------—check(1) again until maxXatY less than start position

Definition at line 431 of file

void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.layoutProjectionMap ( )
IntervalSelector<X> org.sleuthkit.autopsy.timeline.ui.TimeLineChart< X >.newIntervalSelector ( double  x,
Axis< X >  axis 

derived classes should implement this so as to supply an appropriate subclass of IntervalSelector

xthe initial x position of the new interval selector
axisthe axis the new interval selector will be over
a new interval selector
IntervalSelector<DateTime> org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.newIntervalSelector ( double  x,
Axis< DateTime >  axis 

Definition at line 333 of file

void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.requestChartLayout ( )
synchronized void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.seriesAdded ( Series< DateTime, AggregateEvent series,
int  i 

Definition at line 461 of file

synchronized void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.seriesRemoved ( Series< DateTime, AggregateEvent series)

Definition at line 470 of file

synchronized void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.setController ( TimeLineController  controller)
void org.sleuthkit.autopsy.timeline.ui.TimeLineChart< X >.setIntervalSelector ( IntervalSelector<?extends X >  newIntervalSelector)
void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.setIntervalSelector ( IntervalSelector<?extends DateTime >  newIntervalSelector)

Definition at line 359 of file

void org.sleuthkit.autopsy.timeline.TimeLineView.setModel ( final FilteredEventsModel  filteredEvents)
void org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.setModel ( FilteredEventsModel  filteredEvents)

Member Data Documentation

final SimpleBooleanProperty org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.bandByType = new SimpleBooleanProperty(false)

true == layout each event type in its own band, false == mix all the events together during layout

Definition at line 100 of file

ContextMenu org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.chartContextMenu

Definition at line 103 of file

TimeLineController org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.controller

Definition at line 105 of file

final int org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.DEFAULT_ROW_HEIGHT = 24

Definition at line 611 of file

final SimpleObjectProperty<DescriptionVisibility> org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.descrVisibility = new SimpleObjectProperty<>(DescriptionVisibility.SHOWN)

how much detail of the description to show in the ui

Definition at line 110 of file

FilteredEventsModel org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.filteredEvents

Definition at line 107 of file

Line org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.guideLine

a user position-able vertical line to help the compare events

Definition at line 113 of file

IntervalSelector<? extends DateTime> org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.intervalSelector
  • the user can drag out a time range to zoom into and this IntervalSelector is the visual representation of it while the user is dragging

Definition at line 118 of file

final InvalidationListener org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.layoutInvalidationListener
Initial value:
= (
Observable o) -> {
synchronized (EventDetailChart.this) {

listener that triggers layout pass

Definition at line 121 of file

final ReadOnlyDoubleWrapper org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.maxY = new ReadOnlyDoubleWrapper(0.0)

the maximum y value used so far during the most recent layout pass

Definition at line 130 of file

final Group org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.nodeGroup = new Group()

the group that all event nodes are added to. This facilitates scrolling by allowing a single translation of this group.

Definition at line 136 of file

final Map<AggregateEvent, AggregateEventNode> org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.nodeMap
Initial value:
= new TreeMap<>((
AggregateEvent o1,
AggregateEvent o2) -> {
int comp =, o2.getSpan().getStartMillis());
if (comp != 0) {
return comp;
} else {
return Comparator.comparing(AggregateEvent::hashCode).compare(o1, o2);

map from event to node

Definition at line 139 of file

final SimpleBooleanProperty org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.oneEventPerRow = new SimpleBooleanProperty(false)

true == enforce that no two events can share the same 'row', leading to sparser but possibly clearer layout. false == put unrelated events in the same 'row', creating a denser more compact layout

Definition at line 153 of file

final int org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.PROJECTED_LINE_STROKE_WIDTH = 5

Definition at line 96 of file

final int org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.PROJECTED_LINE_Y_OFFSET = 5

Definition at line 94 of file

final ObservableMap<AggregateEventNode, Line> org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.projectionMap = FXCollections.observableHashMap()

Definition at line 155 of file

boolean org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.requiresLayout = true

flag indicating whether this chart actually needs a layout pass

Definition at line 159 of file

final ObservableList<Series<DateTime, AggregateEvent> > org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.seriesList = FXCollections.<Series<DateTime, AggregateEvent>>observableArrayList()

list of series of data added to this chart TODO: replace this with a map from name to series? -jm

Definition at line 168 of file

final ObservableList<Series<DateTime, AggregateEvent> > org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.sortedSeriesList
Initial value:
.sorted((s1, s2) -> {
final List<String> collect =;
return, collect.indexOf(s2.getName()));

Definition at line 170 of file

final SimpleBooleanProperty org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.truncateAll = new SimpleBooleanProperty(false)

true == truncate all the labels to the greater of the size of their timespan indicator or the value of truncateWidth. false == don't truncate the labels, alow them to extend past the timespan indicator and off the edge of the screen

Definition at line 180 of file

final SimpleDoubleProperty org.sleuthkit.autopsy.timeline.ui.detailview.EventDetailChart.truncateWidth = new SimpleDoubleProperty(200.0)

the width to truncate all labels to if truncateAll is true. adjustable via slider if truncateAll is true

Definition at line 184 of file

The documentation for this class was generated from the following file:

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.