ContextViewer.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2019-2021 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.contentviewers.contextviewer;

import java.awt.Component;
import java.awt.Insets;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Comparator;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.logging.Level;
import javax.swing.BoxLayout;
import static javax.swing.ScrollPaneConstants.HORIZONTAL_SCROLLBAR_AS_NEEDED;
import javax.swing.border.EmptyBorder;
import org.apache.commons.lang.StringUtils;
import org.openide.nodes.Node;
import org.openide.util.NbBundle;
import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.contentviewers.layout.ContentViewerDefaults;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;

@ServiceProvider(service = DataContentViewer.class, position = 8)
public final class ContextViewer extends javax.swing.JPanel implements DataContentViewer {

    private static final long serialVersionUID = 1L;
    private static final Logger logger = Logger.getLogger(ContextViewer.class.getName());
    private static final int ARTIFACT_STR_MAX_LEN = 1024;
    private static final int ATTRIBUTE_STR_MAX_LEN = 200;
    
    private final static Insets FIRST_HEADER_INSETS = new Insets(0, 0, 0, 0);
    private final static Insets HEADER_INSETS = new Insets(ContentViewerDefaults.getSectionSpacing(), 0, ContentViewerDefaults.getLineSpacing(), 0);
    private final static Insets DATA_ROW_INSETS = new Insets(0, ContentViewerDefaults.getSectionIndent(), ContentViewerDefaults.getLineSpacing(), 0);

    // defines a list of artifacts that provide context for a file
    private static final List<BlackboardArtifact.ARTIFACT_TYPE> CONTEXT_ARTIFACTS = new ArrayList<>();
    private final List<ContextSourcePanel> contextSourcePanels = new ArrayList<>();
    private final List<ContextUsagePanel> contextUsagePanels = new ArrayList<>();

    static {
        CONTEXT_ARTIFACTS.add(TSK_ASSOCIATED_OBJECT);
    }

    public ContextViewer() {

        initComponents();
        jScrollPane.setHorizontalScrollBarPolicy(HORIZONTAL_SCROLLBAR_AS_NEEDED);
    }

    @SuppressWarnings("unchecked")
    // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
    private void initComponents() {

        jSourcePanel = new javax.swing.JPanel();
        javax.swing.JLabel jSourceLabel = new javax.swing.JLabel();
        jUsagePanel = new javax.swing.JPanel();
        javax.swing.JLabel jUsageLabel = new javax.swing.JLabel();
        jUnknownPanel = new javax.swing.JPanel();
        javax.swing.JLabel jUnknownLabel = new javax.swing.JLabel();
        jScrollPane = new javax.swing.JScrollPane();

        jSourcePanel.setBorder(new EmptyBorder(FIRST_HEADER_INSETS));
        jSourcePanel.setLayout(new javax.swing.BoxLayout(jSourcePanel, javax.swing.BoxLayout.PAGE_AXIS));

        jSourceLabel.setFont(ContentViewerDefaults.getHeaderFont());
        org.openide.awt.Mnemonics.setLocalizedText(jSourceLabel, org.openide.util.NbBundle.getMessage(ContextViewer.class, "ContextViewer.jSourceLabel.text")); // NOI18N
        jSourcePanel.add(jSourceLabel);

        jUsagePanel.setBorder(new EmptyBorder(HEADER_INSETS));
        jUsagePanel.setLayout(new javax.swing.BoxLayout(jUsagePanel, javax.swing.BoxLayout.PAGE_AXIS));

        jUsageLabel.setFont(ContentViewerDefaults.getHeaderFont()
        );
        org.openide.awt.Mnemonics.setLocalizedText(jUsageLabel, org.openide.util.NbBundle.getMessage(ContextViewer.class, "ContextViewer.jUsageLabel.text")); // NOI18N
        jUsagePanel.add(jUsageLabel);

        jUnknownPanel.setLayout(new javax.swing.BoxLayout(jUnknownPanel, javax.swing.BoxLayout.PAGE_AXIS));

        org.openide.awt.Mnemonics.setLocalizedText(jUnknownLabel, org.openide.util.NbBundle.getMessage(ContextViewer.class, "ContextViewer.jUnknownLabel.text")); // NOI18N
        jUnknownLabel.setBorder(new EmptyBorder(DATA_ROW_INSETS));
        jUnknownPanel.add(jUnknownLabel);

        setPreferredSize(new java.awt.Dimension(0, 0));

        jScrollPane.setPreferredSize(new java.awt.Dimension(16, 16));

        javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
        this.setLayout(layout);
        layout.setHorizontalGroup(
            layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
            .addComponent(jScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 509, Short.MAX_VALUE)
        );
        layout.setVerticalGroup(
            layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
            .addComponent(jScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 335, Short.MAX_VALUE)
        );
    }// </editor-fold>//GEN-END:initComponents

    @Override
    public void setNode(Node selectedNode) {
        if ((selectedNode == null) || (!isSupported(selectedNode))) {
            resetComponent();
            return;
        }

        AbstractFile file = selectedNode.getLookup().lookup(AbstractFile.class);
        try {
            populatePanels(file);
        } catch (NoCurrentCaseException | TskCoreException ex) {
            logger.log(Level.SEVERE, String.format("Exception displaying context for file %s", file.getName()), ex); //NON-NLS
        }
    }

    @NbBundle.Messages({
        "ContextViewer.title=Context",
        "ContextViewer.toolTip=Displays context for selected file."
    })

    @Override
    public String getTitle() {
        return Bundle.ContextViewer_title();
    }

    @Override
    public String getToolTip() {
        return Bundle.ContextViewer_toolTip();
    }

    @Override
    public DataContentViewer createInstance() {
        return new ContextViewer();
    }

    @Override
    public Component getComponent() {
        return this;
    }

    @Override
    public void resetComponent() {
        contextSourcePanels.clear();
        contextUsagePanels.clear();
    }

    @Override
    public boolean isSupported(Node node) {

        // check if the node has an abstract file and the file has any context defining artifacts.
        if (node.getLookup().lookup(AbstractFile.class) != null) {
            AbstractFile abstractFile = node.getLookup().lookup(AbstractFile.class);
            for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
                List<BlackboardArtifact> artifactsList;
                try {
                    artifactsList = abstractFile.getArtifacts(artifactType);
                    if (!artifactsList.isEmpty()) {
                        return true;
                    }
                } catch (TskCoreException ex) {
                    logger.log(Level.SEVERE, String.format("Exception while looking up context artifacts for file %s", abstractFile), ex); //NON-NLS
                }
            }

        }

        return false;
    }

    @Override
    public int isPreferred(Node node) {
        // this is a low preference viewer.
        return 1;
    }

    @NbBundle.Messages({
        "ContextViewer.unknownSource=Unknown ",
    })
    private void populatePanels(AbstractFile sourceFile) throws NoCurrentCaseException, TskCoreException {

        SleuthkitCase tskCase = Case.getCurrentCaseThrows().getSleuthkitCase();
        
        // Check for all context artifacts
        boolean foundASource = false;
        for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
            List<BlackboardArtifact> artifactsList = tskCase.getBlackboardArtifacts(artifactType, sourceFile.getId());

            foundASource = !artifactsList.isEmpty();
            for (BlackboardArtifact contextArtifact : artifactsList) {
                addAssociatedArtifactToPanel(contextArtifact);
            }
        }
        javax.swing.JPanel contextContainer = new javax.swing.JPanel();
        contextContainer.setLayout(new BoxLayout(contextContainer, BoxLayout.Y_AXIS));
        contextContainer.setBorder(new EmptyBorder(ContentViewerDefaults.getPanelInsets()));
        
        contextContainer.add(jSourcePanel);
        
        if (contextSourcePanels.isEmpty()) {
            contextContainer.add(jUnknownPanel);
        } else {
            for (javax.swing.JPanel sourcePanel : contextSourcePanels) {
                contextContainer.add(sourcePanel);
                contextContainer.setAlignmentX(0);
            }
        }
        contextContainer.add(jUsagePanel);
        if (contextUsagePanels.isEmpty()) {
            contextContainer.add(jUnknownPanel);
        } else {
            for (javax.swing.JPanel usagePanel : contextUsagePanels) {
                contextContainer.add(usagePanel);
                contextContainer.setAlignmentX(0);
            }
        }
        
        contextContainer.setBackground(ContentViewerDefaults.getPanelBackground());
        contextContainer.setEnabled(foundASource);
        contextContainer.setVisible(foundASource);
        jScrollPane.getViewport().setView(contextContainer);
        jScrollPane.setEnabled(foundASource);
        jScrollPane.setVisible(foundASource);
        jScrollPane.repaint();
        jScrollPane.revalidate();
        
        
    }

    private void addAssociatedArtifactToPanel(BlackboardArtifact artifact) throws TskCoreException {

        if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getTypeID() == artifact.getArtifactTypeID()) {
            BlackboardAttribute associatedArtifactAttribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
            if (associatedArtifactAttribute != null) {
                long artifactId = associatedArtifactAttribute.getValueLong();
                BlackboardArtifact associatedArtifact = artifact.getSleuthkitCase().getBlackboardArtifact(artifactId);

                addArtifactToPanels(associatedArtifact);
            }
        }
    }

    @NbBundle.Messages({
        "ContextViewer.attachmentSource=Attached to: ",
        "ContextViewer.downloadSource=Downloaded from: ",
        "ContextViewer.recentDocs=Recent Documents: ",
        "ContextViewer.programExecution=Program Execution: "
    })
    private void addArtifactToPanels(BlackboardArtifact associatedArtifact) throws TskCoreException {
        Long dateTime = getArtifactDateTime(associatedArtifact);
        if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == associatedArtifact.getArtifactTypeID()
                || BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == associatedArtifact.getArtifactTypeID()) {
            String sourceName = Bundle.ContextViewer_attachmentSource();
            String sourceText = msgArtifactToAbbreviatedString(associatedArtifact);
            ContextSourcePanel sourcePanel = new ContextSourcePanel(sourceName, sourceText, associatedArtifact, dateTime);
            sourcePanel.setBorder(new EmptyBorder(DATA_ROW_INSETS));
            sourcePanel.setAlignmentX(0);
            contextSourcePanels.add(sourcePanel);

        } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == associatedArtifact.getArtifactTypeID()
                || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == associatedArtifact.getArtifactTypeID()) {
            String sourceName = Bundle.ContextViewer_downloadSource();
            String sourceText = webDownloadArtifactToString(associatedArtifact);
            ContextSourcePanel sourcePanel = new ContextSourcePanel(sourceName, sourceText, associatedArtifact, dateTime);
            sourcePanel.setBorder(new EmptyBorder(DATA_ROW_INSETS));
            sourcePanel.setAlignmentX(0);
            contextSourcePanels.add(sourcePanel);

        } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == associatedArtifact.getArtifactTypeID()) {
            String sourceName = Bundle.ContextViewer_recentDocs();
            String sourceText = recentDocArtifactToString(associatedArtifact);
            ContextUsagePanel usagePanel = new ContextUsagePanel(sourceName, sourceText, associatedArtifact, dateTime); 
            usagePanel.setBorder(new EmptyBorder(DATA_ROW_INSETS));
            usagePanel.setAlignmentX(0);
            contextUsagePanels.add(usagePanel);
            
        } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == associatedArtifact.getArtifactTypeID()) {
            String sourceName = Bundle.ContextViewer_programExecution();
            String sourceText = programExecArtifactToString(associatedArtifact);
            ContextUsagePanel usagePanel = new ContextUsagePanel(sourceName, sourceText, associatedArtifact, dateTime);    
            usagePanel.setBorder(new EmptyBorder(DATA_ROW_INSETS));
            usagePanel.setAlignmentX(0);
            contextUsagePanels.add(usagePanel);
        }
        
        Collections.sort(contextSourcePanels, new SortByDateTime());
        Collections.sort(contextUsagePanels, new SortByDateTime());
    }

    @NbBundle.Messages({
        "ContextViewer.downloadURL=URL",
        "ContextViewer.downloadedOn=On"
    })
    private String webDownloadArtifactToString(BlackboardArtifact artifact) throws TskCoreException {
        StringBuilder sb = new StringBuilder(ARTIFACT_STR_MAX_LEN);
        Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);

        if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifact.getArtifactTypeID()
                || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == artifact.getArtifactTypeID()) {
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, attributesMap, Bundle.ContextViewer_downloadURL());
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, attributesMap, Bundle.ContextViewer_downloadedOn());
        }
        return sb.toString();
    }

    @NbBundle.Messages({
        "ContextViewer.on=Opened at",
        "ContextViewer.unknown=Opened at unknown time"
    })
    private String recentDocArtifactToString(BlackboardArtifact artifact) throws TskCoreException {
        StringBuilder sb = new StringBuilder(ARTIFACT_STR_MAX_LEN);
        Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
        
        BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
        
        if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifact.getArtifactTypeID()) {
            if (attribute != null && attribute.getValueLong() > 0) {
                appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_on());
            } else {
                sb.append(Bundle.ContextViewer_unknown());
            }
        }
        return sb.toString();
    }

    @NbBundle.Messages({
        "ContextViewer.runOn=Program Run On",
        "ContextViewer.runUnknown= Program Run at unknown time"
    })
    private String programExecArtifactToString(BlackboardArtifact artifact) throws TskCoreException {
        StringBuilder sb = new StringBuilder(ARTIFACT_STR_MAX_LEN);
        Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
        
        BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
        
        if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifact.getArtifactTypeID()) {
            if (attribute != null && attribute.getValueLong() > 0) {
                appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_runOn());
            } else {
                sb.append(Bundle.ContextViewer_runUnknown());
            }
        }
        return sb.toString();
    }

    @NbBundle.Messages({
        "ContextViewer.message=Message",
        "ContextViewer.email=Email",
        "ContextViewer.messageFrom=From",
        "ContextViewer.messageTo=To",
        "ContextViewer.messageOn=On",})
    private String msgArtifactToAbbreviatedString(BlackboardArtifact artifact) throws TskCoreException {

        StringBuilder sb = new StringBuilder(ARTIFACT_STR_MAX_LEN);
        Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);

        if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifact.getArtifactTypeID()) {
            sb.append(Bundle.ContextViewer_message()).append(' ');
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, attributesMap, Bundle.ContextViewer_messageFrom());
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, attributesMap, Bundle.ContextViewer_messageTo());
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_messageOn());
        } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifact.getArtifactTypeID()) {
            sb.append(Bundle.ContextViewer_email()).append(' ');
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM, attributesMap, Bundle.ContextViewer_messageFrom());
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO, attributesMap, Bundle.ContextViewer_messageTo());
            appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, attributesMap, Bundle.ContextViewer_messageOn());
        }
        return sb.toString();
    }

    private void appendAttributeString(StringBuilder sb, BlackboardAttribute.ATTRIBUTE_TYPE attribType,
            Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap, String prependStr) {

        BlackboardAttribute attribute = attributesMap.get(attribType);
        if (attribute != null) {
            String attrVal = attribute.getDisplayString();
            if (!StringUtils.isEmpty(attrVal)) {
                if (!StringUtils.isEmpty(prependStr)) {
                    sb.append(prependStr).append(' ');
                }
                sb.append(StringUtils.abbreviate(attrVal, ATTRIBUTE_STR_MAX_LEN)).append(' ');
            }
        }
    }

    private Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> getAttributesMap(BlackboardArtifact artifact) throws TskCoreException {
        Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributeMap = new HashMap<>();

        List<BlackboardAttribute> attributeList = artifact.getAttributes();
        for (BlackboardAttribute attribute : attributeList) {
            BlackboardAttribute.ATTRIBUTE_TYPE type = BlackboardAttribute.ATTRIBUTE_TYPE.fromID(attribute.getAttributeType().getTypeID());
            attributeMap.put(type, attribute);
        }

        return attributeMap;
    }
    
    interface DateTimePanel {
        Long getDateTime();
    }
    
    private Long getArtifactDateTime(BlackboardArtifact artifact) throws TskCoreException {
        BlackboardAttribute attribute =  artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME));
        
        if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifact.getArtifactTypeID()) {
            attribute =  artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT));
        } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifact.getArtifactTypeID()
                || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == artifact.getArtifactTypeID()) {
            attribute =  artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED));
        }
        return (attribute != null ? attribute.getValueLong() : null);
    }
    
    class SortByDateTime implements Comparator<DateTimePanel> {

        @Override
        public int compare(DateTimePanel panel1, DateTimePanel panel2) {
            Long dateTime1 = panel1.getDateTime();
            Long dateTime2 = panel2.getDateTime();
            
            if(dateTime1 == null && dateTime2 == null) {
                return 0;
            } else if(dateTime1 == null) {
                return -1;
            } else if(dateTime2 == null) {
                return 1;
            }
            
            return dateTime1.compareTo(dateTime2);
        }
        
    }


    // Variables declaration - do not modify//GEN-BEGIN:variables
    private javax.swing.JScrollPane jScrollPane;
    private javax.swing.JPanel jSourcePanel;
    private javax.swing.JPanel jUnknownPanel;
    private javax.swing.JPanel jUsagePanel;
    // End of variables declaration//GEN-END:variables
}