DomainSearch.java

Go to the documentation of this file.

/*
 * Autopsy
 *
 * Copyright 2020 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.discovery.search;

import java.awt.Image;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.TimeZone;
import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository;
import org.sleuthkit.autopsy.datamodel.ContentUtils;
import org.sleuthkit.autopsy.discovery.search.DiscoveryKeyUtils.GroupKey;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TimeUtilities;
import org.sleuthkit.datamodel.TskCoreException;

public class DomainSearch {

    private final DomainSearchCache searchCache;
    private final DomainSearchThumbnailCache thumbnailCache;
    private final DomainSearchArtifactsCache artifactsCache;

    public DomainSearch() {
        this(new DomainSearchCache(), new DomainSearchThumbnailCache(),
                new DomainSearchArtifactsCache());
    }

    DomainSearch(DomainSearchCache cache, DomainSearchThumbnailCache thumbnailCache,
            DomainSearchArtifactsCache artifactsCache) {
        this.searchCache = cache;
        this.thumbnailCache = thumbnailCache;
        this.artifactsCache = artifactsCache;
    }

    public Map<GroupKey, Integer> getGroupSizes(String userName,
            List<AbstractFilter> filters,
            DiscoveryAttributes.AttributeType groupAttributeType,
            Group.GroupSortingAlgorithm groupSortingType,
            ResultsSorter.SortingMethod domainSortingMethod,
            SleuthkitCase caseDb, CentralRepository centralRepoDb) throws DiscoveryException {

        final Map<GroupKey, List<Result>> searchResults = searchCache.get(
                userName, filters, groupAttributeType, groupSortingType,
                domainSortingMethod, caseDb, centralRepoDb);

        // Transform the cached results into a map of group key to group size.
        final LinkedHashMap<GroupKey, Integer> groupSizes = new LinkedHashMap<>();
        for (GroupKey groupKey : searchResults.keySet()) {
            groupSizes.put(groupKey, searchResults.get(groupKey).size());
        }

        return groupSizes;
    }

    public List<Result> getDomainsInGroup(String userName,
            List<AbstractFilter> filters,
            DiscoveryAttributes.AttributeType groupAttributeType,
            Group.GroupSortingAlgorithm groupSortingType,
            ResultsSorter.SortingMethod domainSortingMethod,
            GroupKey groupKey, int startingEntry, int numberOfEntries,
            SleuthkitCase caseDb, CentralRepository centralRepoDb) throws DiscoveryException {

        final Map<GroupKey, List<Result>> searchResults = searchCache.get(
                userName, filters, groupAttributeType, groupSortingType,
                domainSortingMethod, caseDb, centralRepoDb);
        final List<Result> domainsInGroup = searchResults.get(groupKey);

        final List<Result> page = new ArrayList<>();
        for (int i = startingEntry; (i < startingEntry + numberOfEntries)
                && (i < domainsInGroup.size()); i++) {
            page.add(domainsInGroup.get(i));
        }

        return page;
    }

    public Image getThumbnail(DomainSearchThumbnailRequest thumbnailRequest) throws DiscoveryException {
        return thumbnailCache.get(thumbnailRequest);
    }

    public List<BlackboardArtifact> getArtifacts(DomainSearchArtifactsRequest artifactsRequest) throws DiscoveryException {
        return artifactsCache.get(artifactsRequest);
    }

    public List<MiniTimelineResult> getAllArtifactsForDomain(SleuthkitCase sleuthkitCase, String domain) throws DiscoveryException {
        List<BlackboardArtifact> artifacts = new ArrayList<>();
        Map<String, List<BlackboardArtifact>> dateMap = new HashMap<>();
        if (!StringUtils.isBlank(domain)) {
            for (BlackboardArtifact.ARTIFACT_TYPE type : SearchData.Type.DOMAIN.getArtifactTypes()) {

                artifacts.addAll(getArtifacts(new DomainSearchArtifactsRequest(sleuthkitCase, domain, type)));
            }

            for (BlackboardArtifact artifact : artifacts) {
                String date;
                try {
                    date = getDate(artifact);
                } catch (TskCoreException ex) {
                    throw new DiscoveryException("Unable to get date for artifact with ID: " + artifact.getArtifactID(), ex);
                }
                if (!StringUtils.isBlank(date)) {
                    List<BlackboardArtifact> artifactList = dateMap.get(date);
                    if (artifactList == null) {
                        artifactList = new ArrayList<>();
                    }
                    artifactList.add(artifact);
                    dateMap.put(date, artifactList);
                }
            }
        }
        List<MiniTimelineResult> dateArtifactList = new ArrayList<>();

        for (String date : dateMap.keySet()) {
            dateArtifactList.add(new MiniTimelineResult(date, dateMap.get(date)));
        }
        return dateArtifactList;
    }

    private String getDate(BlackboardArtifact artifact) throws TskCoreException {
        for (BlackboardAttribute attribute : artifact.getAttributes()) {
            if (attribute.getAttributeType().getTypeName().startsWith("TSK_DATETIME")) {
                TimeZone timeZone = ContentUtils.getTimeZone(artifact);
                String dateString = TimeUtilities.epochToTime(attribute.getValueLong(), timeZone);
                if (dateString.length() >= 10) {
                    return dateString.substring(0, 10);
                }
            }
        }
        return "";
    }

}