Autopsy  4.18.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Static Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.datamodel.FileTypesByMimeType Class Reference

Inherits Observable, and org.sleuthkit.autopsy.datamodel.AutopsyVisitableItem.


class  ByMimeTypeNode
class  ByMimeTypeNodeChildren
class  FileTypesByMimeTypeRefresher
class  MediaSubTypeNode
class  MediaSubTypeNodeChildren
class  MediaTypeNode
class  MediaTypeNodeChildren

Static Public Member Functions

static boolean isEmptyMimeTypeNode (Node node)

Private Member Functions

String createBaseWhereExpr ()
void populateHashMap ()
void refreshMimeTypes ()
void removeListeners ()

Private Attributes

final HashMap< String, Map< String, Long > > existingMimeTypeCounts = new HashMap<>()
final PropertyChangeListener pcl
final RefreshThrottler refreshThrottler
final FileTypes typesRoot

Static Private Attributes

static final Set< Case.Events > CASE_EVENTS_OF_INTEREST = EnumSet.of(Case.Events.DATA_SOURCE_ADDED, Case.Events.CURRENT_CASE)
static final Set< IngestManager.IngestJobEvent > INGEST_JOB_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestJobEvent.COMPLETED, IngestManager.IngestJobEvent.CANCELLED)
static final Logger logger = Logger.getLogger(FileTypesByMimeType.class.getName())

Detailed Description

Class which contains the Nodes for the 'By Mime Type' view located in the File Types view, shows all files with a mime type. Will initially be empty until file type identification has been performed. Contains a Property Change Listener which is checking for changes in IngestJobEvent Completed or Canceled and IngestModuleEvent Content Changed.

Definition at line 62 of file

Member Function Documentation

String org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.createBaseWhereExpr ( )

Create the base expression used as the where clause in the queries for files by mime type. Filters out certain kinds of files and directories, and known/slack files based on user preferences.

The base expression to be used in the where clause of queries for files by mime type.

Definition at line 101 of file

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.MediaSubTypeNodeChildren.makeKeys(), and org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap().

static boolean org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.isEmptyMimeTypeNode ( Node  node)

Method to check if the node in question is a ByMimeTypeNode which is empty.

nodethe Node which you wish to check.
True if originNode is an instance of ByMimeTypeNode and is empty, false otherwise.

Definition at line 198 of file

void org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap ( )
void org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.refreshMimeTypes ( )

Checking for a current case is a stop gap measure until a different way of handling the closing of cases is worked out. Currently, remote events may be received for a case that is already closed.

Case is closed, do nothing.

Definition at line 207 of file

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap().

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.FileTypesByMimeTypeRefresher.refresh().

void org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.removeListeners ( )

Member Data Documentation

final Set<Case.Events> org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.CASE_EVENTS_OF_INTEREST = EnumSet.of(Case.Events.DATA_SOURCE_ADDED, Case.Events.CURRENT_CASE)
final HashMap<String, Map<String, Long> > org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.existingMimeTypeCounts = new HashMap<>()

The nodes of this tree will be determined dynamically by the mimetypes which exist in the database. This hashmap will store them with the media type as the key and a Map, from media subtype to count, as the value.

Definition at line 72 of file

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.ByMimeTypeNodeChildren.createKeys(), and org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap().

final Set<IngestManager.IngestJobEvent> org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.INGEST_JOB_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestJobEvent.COMPLETED, IngestManager.IngestJobEvent.CANCELLED)

Definition at line 65 of file

final Logger org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.logger = Logger.getLogger(FileTypesByMimeType.class.getName())

Definition at line 64 of file

final PropertyChangeListener org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.pcl

The pcl is in the class because it has the easiest mechanisms to add and remove itself during its life cycles.

Definition at line 83 of file

final RefreshThrottler org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.refreshThrottler

RefreshThrottler is used to limit the number of refreshes performed when CONTENT_CHANGED and DATA_ADDED ingest module events are received.

Definition at line 91 of file

final FileTypes org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.typesRoot

Root of the File Types tree. Used to provide single answer to question: Should the child counts be shown next to the nodes?

Definition at line 77 of file

The documentation for this class was generated from the following file:

Copyright © 2012-2021 Basis Technology. Generated on: Thu Jul 8 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.