Autopsy  4.19.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
DataResultFilterNode.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2012-2020 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.directorytree;
20 
21 import java.awt.event.ActionEvent;
22 import java.beans.PropertyVetoException;
23 import java.text.MessageFormat;
24 import java.util.ArrayList;
25 import java.util.Collection;
26 import java.util.HashSet;
27 import java.util.List;
28 import java.util.logging.Level;
29 import javax.swing.AbstractAction;
30 import javax.swing.Action;
31 import org.openide.explorer.ExplorerManager;
32 import org.openide.nodes.AbstractNode;
33 import org.openide.nodes.FilterNode;
34 import org.openide.nodes.Node;
35 import org.openide.nodes.Sheet;
36 import org.openide.util.NbBundle;
37 import org.openide.util.Utilities;
68 import org.sleuthkit.datamodel.AbstractFile;
69 import org.sleuthkit.datamodel.BlackboardArtifact;
70 import org.sleuthkit.datamodel.BlackboardAttribute;
71 import org.sleuthkit.datamodel.Content;
72 import org.sleuthkit.datamodel.DerivedFile;
73 import org.sleuthkit.datamodel.Directory;
74 import org.sleuthkit.datamodel.File;
75 import org.sleuthkit.datamodel.LayoutFile;
76 import org.sleuthkit.datamodel.LocalFile;
77 import org.sleuthkit.datamodel.LocalDirectory;
78 import org.sleuthkit.datamodel.SlackFile;
79 import org.sleuthkit.datamodel.TskException;
80 import org.sleuthkit.datamodel.VirtualDirectory;
81 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
82 import org.sleuthkit.datamodel.DataArtifact;
83 import org.sleuthkit.datamodel.Report;
84 import org.sleuthkit.datamodel.TskCoreException;
85 
91 public class DataResultFilterNode extends FilterNode {
92 
93  private static final Logger LOGGER = Logger.getLogger(DataResultFilterNode.class.getName());
94 
97 
98  // Assumptions are made in GetPreferredActionsDisplayableItemNodeVisitor that
99  // sourceEm is the directory tree explorer manager.
100  private final ExplorerManager sourceEm;
101 
109  public DataResultFilterNode(Node node) {
110  this(node, null);
111  }
112 
122  public DataResultFilterNode(Node node, ExplorerManager em) {
123  super(node, new DataResultFilterChildren(node, em));
124  this.sourceEm = em;
125  }
126 
135  @Override
136  public Action[] getActions(boolean popup) {
137 
138  List<Action> actions = new ArrayList<>();
139  if (this.getOriginal() instanceof DisplayableItemNode) {
140  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
141  List<Action> accept = originalNode.accept(getActionsDIV);
142  if (accept != null) {
143  actions.addAll(accept);
144  }
145  }
146 
147  //actions.add(new IndexContentFilesAction(nodeContent, "Index"));
148  return actions.toArray(new Action[actions.size()]);
149  }
150 
157  @Override
158  public Action getPreferredAction() {
159  final Node original = this.getOriginal();
160  // Once had a org.openide.nodes.ChildFactory$WaitFilterNode passed in
161  if ((original instanceof DisplayableItemNode) == false) {
162  return null;
163  }
164 
165  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
166  return originalNode.accept(getPreferredActionsDIV);
167  }
168 
169  @Override
170  public Node.PropertySet[] getPropertySets() {
171  Node.PropertySet[] propertySets = super.getPropertySets();
172 
173  for (int i = 0; i < propertySets.length; i++) {
174  Node.PropertySet ps = propertySets[i];
175 
176  if (ps.getName().equals(Sheet.PROPERTIES)) {
177  Sheet.Set newPs = new Sheet.Set();
178  newPs.setName(ps.getName());
179  newPs.setDisplayName(ps.getDisplayName());
180  newPs.setShortDescription(ps.getShortDescription());
181 
182  newPs.put(ps.getProperties());
183  newPs.remove(AbstractFsContentNode.HIDE_PARENT);
184  propertySets[i] = newPs;
185  }
186  }
187 
188  return propertySets;
189  }
190 
197  public void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo) {
198  if (getOriginal() instanceof DisplayableItemNode) {
199  ((DisplayableItemNode) getOriginal()).setChildNodeSelectionInfo(selectedChildNodeInfo);
200  }
201  }
202 
211  if (getOriginal() instanceof DisplayableItemNode) {
212  return ((DisplayableItemNode) getOriginal()).getChildNodeSelectionInfo();
213  } else {
214  return null;
215  }
216  }
217 
223  private static class DataResultFilterChildren extends FilterNode.Children {
224 
225  private final ExplorerManager sourceEm;
226  private final boolean filterArtifacts; // display message artifacts in the DataSource subtree
227 
231  private DataResultFilterChildren(Node arg, ExplorerManager sourceEm) {
232  super(arg);
233 
234  filterArtifacts = SelectionContext.getSelectionContext(arg).equals(SelectionContext.DATA_SOURCES);
235 
236  this.sourceEm = sourceEm;
237  }
238 
239  @Override
240  protected Node[] createNodes(Node key) {
241  // if displaying the results from the Data Source tree
242  // filter out artifacts
243 
244  // In older versions of Autopsy, attachments were children of email/message artifacts
245  // and hence email/messages with attachments are shown in the tree data source tree,
246  BlackboardArtifact art = key.getLookup().lookup(BlackboardArtifact.class);
247  if (art != null && filterArtifacts
248  && ((FilterNodeUtils.showMessagesInDatasourceTree() == false)
249  || (FilterNodeUtils.showMessagesInDatasourceTree()
250  && art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()
251  && art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()))) {
252  return new Node[]{};
253  }
254 
255  return new Node[]{new DataResultFilterNode(key, sourceEm)};
256  }
257  }
258 
259  @NbBundle.Messages("DataResultFilterNode.viewSourceArtifact.text=View Source Result")
264  private static class GetPopupActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<List<Action>> {
265 
266  @Override
267  public List<Action> visit(BlackboardArtifactNode ban) {
268  //set up actions for artifact node based on its Content object
269  //TODO all actions need to be consolidated in single place!
270  //they should be set in individual Node subclass and using a utility to get Actions per Content sub-type
271  // TODO UPDATE: There is now a DataModelActionsFactory utility;
272 
273  List<Action> actionsList = new ArrayList<>();
274 
275  //merge predefined specific node actions if bban subclasses have their own
276  for (Action a : ban.getActions(true)) {
277  actionsList.add(a);
278  }
279 
280  //Add seperator between the decorated actions and the actions from the node itself.
281  actionsList.add(null);
282  BlackboardArtifact ba = ban.getLookup().lookup(BlackboardArtifact.class);
283  final int artifactTypeID = ba.getArtifactTypeID();
284 
285  if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
286  || artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
287  if (ban.getLookup().lookup(AbstractFile.class) != null) {
288  // We only want the "View File in Directory" actions if we have a file...it is
289  // possible that we have a keyword hit on a Report.
290  actionsList.add(new ViewContextAction(
291  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), ban));
292  }
293  } else if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
294  try {
295  if (ba.getAttribute(BlackboardAttribute.Type.TSK_ASSOCIATED_ARTIFACT) != null) {
296  //action to go to the source artifact
297  actionsList.add(new ViewSourceArtifactAction(DataResultFilterNode_viewSourceArtifact_text(), ba));
298 
299  // action to go to the source file of the artifact
300  actionsList.add(new ViewContextAction(
301  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
302  }
303  } catch (TskCoreException ex) {
304  LOGGER.log(Level.WARNING, "Error looking up attributes for artifact with ID=" + ba.getId());
305  }
306  } else {
307  // if the artifact links to another file, add an action to go to
308  // that file
309  Content c = findLinked(ban);
310  if (c != null) {
311  actionsList.add(new ViewContextAction(
312  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), c));
313  }
314  // action to go to the source file of the artifact
315  Content fileContent = ban.getLookup().lookup(AbstractFile.class);
316  if (fileContent == null) {
317  Content content = ban.getLookup().lookup(Content.class);
318  actionsList.add(new ViewContextAction("View Source Content in Directory", content));
319  } else {
320  actionsList.add(new ViewContextAction(
321  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
322  }
323  }
324  Content c = ban.getLookup().lookup(File.class);
325  Node n = null;
326  if (c != null) {
327  n = new FileNode((AbstractFile) c);
328  } else if ((c = ban.getLookup().lookup(Directory.class)) != null) {
329  n = new DirectoryNode((Directory) c);
330  } else if ((c = ban.getLookup().lookup(VirtualDirectory.class)) != null) {
331  n = new VirtualDirectoryNode((VirtualDirectory) c);
332  } else if ((c = ban.getLookup().lookup(LocalDirectory.class)) != null) {
333  n = new LocalDirectoryNode((LocalDirectory) c);
334  } else if ((c = ban.getLookup().lookup(LayoutFile.class)) != null) {
335  n = new LayoutFileNode((LayoutFile) c);
336  } else if ((c = ban.getLookup().lookup(LocalFile.class)) != null
337  || (c = ban.getLookup().lookup(DerivedFile.class)) != null) {
338  n = new LocalFileNode((AbstractFile) c);
339  if (FileTypeExtensions.getArchiveExtensions().contains("." + ((AbstractFile) c).getNameExtension().toLowerCase())) {
340  try {
341  if (c.getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED).size() > 0) {
342  actionsList.add(new ExtractArchiveWithPasswordAction((AbstractFile) c));
343  }
344  } catch (TskCoreException ex) {
345  LOGGER.log(Level.WARNING, "Unable to add unzip with password action to context menus", ex);
346  }
347  }
348  } else if ((c = ban.getLookup().lookup(SlackFile.class)) != null) {
349  n = new SlackFileNode((SlackFile) c);
350  } else if ((c = ban.getLookup().lookup(Report.class)) != null) {
351  actionsList.addAll(DataModelActionsFactory.getActions(c, false));
352  }
353  if (n != null) {
354  final Collection<AbstractFile> selectedFilesList
355  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(AbstractFile.class));
356  actionsList.add(null); // creates a menu separator
357  actionsList.add(new NewWindowViewAction(
358  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInNewWin.text"), n));
359  if (selectedFilesList.size() == 1) {
360  actionsList.add(new ExternalViewerAction(
361  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.openInExtViewer.text"), n));
362  } else {
363  actionsList.add(ExternalViewerShortcutAction.getInstance());
364  }
365  actionsList.add(null); // creates a menu separator
366  actionsList.add(ExtractAction.getInstance());
367  actionsList.add(ExportCSVAction.getInstance());
368  actionsList.add(null); // creates a menu separator
369 
370  // don't show AddContentTagAction for data artifacts.
371  if (!(ban.getArtifact() instanceof DataArtifact)) {
372  actionsList.add(AddContentTagAction.getInstance());
373  }
374 
375  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
376 
377  // don't show DeleteFileContentTagAction for data artifacts.
378  if ((!(ban.getArtifact() instanceof DataArtifact)) && (selectedFilesList.size() == 1)) {
379  actionsList.add(DeleteFileContentTagAction.getInstance());
380  }
381  } else {
382  // There's no specific file associated with the artifact, but
383  // we can still tag the artifact itself
384  actionsList.add(null);
385  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
386  }
387 
388  final Collection<BlackboardArtifact> selectedArtifactsList
389  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class));
390  if (selectedArtifactsList.size() == 1) {
392  }
393 
394  if (n != null) {
395  actionsList.addAll(ContextMenuExtensionPoint.getActions());
396  }
397 
398  return actionsList;
399  }
400 
401  @Override
402  public List<Action> visit(Reports.ReportsListNode ditem) {
403  // The base class Action is "Collapse All", inappropriate.
404  return null;
405  }
406 
407  @Override
408  public List<Action> visit(FileTypesNode fileTypes) {
409  return defaultVisit(fileTypes);
410  }
411 
412  @Override
413  protected List<Action> defaultVisit(DisplayableItemNode ditem) {
414  //preserve the default node's actions
415  List<Action> actions = new ArrayList<>();
416 
417  for (Action action : ditem.getActions(true)) {
418  actions.add(action);
419  }
420 
421  return actions;
422  }
423 
424  private Content findLinked(BlackboardArtifactNode ba) {
425  BlackboardArtifact art = ba.getLookup().lookup(BlackboardArtifact.class);
426  Content c = null;
427  try {
428  for (BlackboardAttribute attr : art.getAttributes()) {
429  if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) {
430  switch (attr.getAttributeType().getValueType()) {
431  case INTEGER:
432  int i = attr.getValueInt();
433  if (i != -1) {
434  c = art.getSleuthkitCase().getContentById(i);
435  }
436  break;
437  case LONG:
438  long l = attr.getValueLong();
439  if (l != -1) {
440  c = art.getSleuthkitCase().getContentById(l);
441  }
442  break;
443  }
444  }
445  }
446  } catch (TskException ex) {
447  Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error getting linked file", ex); //NON-NLS
448  }
449  return c;
450  }
451 
452  }
453 
454  /*
455  * Action for double-click / preferred action on nodes.
456  */
457  private class GetPreferredActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<AbstractAction> {
458 
459  @Override
460  public AbstractAction visit(InstanceCountNode icn) {
461  return null;
462  }
463 
464  @Override
465  public AbstractAction visit(InstanceCaseNode icn) {
466  return null;
467  }
468 
469  @Override
470  public AbstractAction visit(InstanceDataSourceNode icn) {
471  return null;
472  }
473 
474  @Override
475  public AbstractAction visit(CommonAttributeValueNode md5n) {
476  return null;
477  }
478 
479  @Override
480  public AbstractAction visit(CaseDBCommonAttributeInstanceNode fin) {
481  return null;
482  }
483 
484  @Override
485  public AbstractAction visit(CentralRepoCommonAttributeInstanceNode iccan) {
486  return null;
487  }
488 
489  @Override
490  public AbstractAction visit(BlackboardArtifactNode ban) {
491 
492  Action preferredAction = ban.getPreferredAction();
493  if(preferredAction instanceof AbstractAction) {
494  return (AbstractAction) preferredAction;
495  }
496 
497  BlackboardArtifact artifact = ban.getArtifact();
498  try {
499  if ((artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID())
500  || (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_MESSAGE.getTypeID())) {
501  if (artifact.hasChildren()) {
502  return openChild(ban);
503  }
504  }
505  } catch (TskCoreException ex) {
506  LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting children from blackboard artifact{0}.", artifact.getArtifactID()), ex); //NON-NLS
507  }
508  return new ViewContextAction(
509  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInDir.text"), ban);
510  }
511 
512  @Override
513  public AbstractAction visit(DirectoryNode dn) {
514  if (dn.getDisplayName().equals(DirectoryNode.DOTDOTDIR)) {
515  return openParent(dn);
516  } else if (dn.getDisplayName().equals(DirectoryNode.DOTDIR) == false) {
517  return openChild(dn);
518  } else {
519  return null;
520  }
521  }
522 
523  @Override
524  public AbstractAction visit(FileNode fn) {
525  if (fn.hasContentChildren()) {
526  return openChild(fn);
527  } else {
528  return null;
529  }
530  }
531 
532  @Override
533  public AbstractAction visit(LocalFileNode dfn) {
534  if (dfn.hasContentChildren()) {
535  return openChild(dfn);
536  } else {
537  return null;
538  }
539  }
540 
541  @Override
542  public AbstractAction visit(Reports.ReportNode reportNode) {
543  return reportNode.getPreferredAction();
544  }
545 
546  @Override
547  protected AbstractAction defaultVisit(DisplayableItemNode c) {
548  return openChild(c);
549  }
550 
551  @Override
552  public AbstractAction visit(FileTypesNode fileTypes) {
553  return openChild(fileTypes);
554  }
555 
564  private AbstractAction openChild(final AbstractNode dataModelNode) {
565  // get the current selection from the directory tree explorer manager,
566  // which is a DirectoryTreeFilterNode. One of that node's children
567  // is a DirectoryTreeFilterNode that wraps the dataModelNode. We need
568  // to set that wrapped node as the selection and root context of the
569  // directory tree explorer manager (sourceEm)
570  if(sourceEm == null || sourceEm.getSelectedNodes().length == 0) {
571  return null;
572  }
573  final Node currentSelectionInDirectoryTree = sourceEm.getSelectedNodes()[0];
574 
575  return new AbstractAction() {
576  @Override
577  public void actionPerformed(ActionEvent e) {
578  if (currentSelectionInDirectoryTree != null) {
579  // Find the filter version of the passed in dataModelNode.
580  final org.openide.nodes.Children children = currentSelectionInDirectoryTree.getChildren();
581  // This call could break if the DirectoryTree is re-implemented with lazy ChildFactory objects.
582  Node newSelection = children.findChild(dataModelNode.getName());
583 
584  /*
585  * We got null here when we were viewing a ZIP file in
586  * the Views -> Archives area and double clicking on it
587  * got to this code. It tried to find the child in the
588  * tree and didn't find it. An exception was then thrown
589  * from setting the selected node to be null.
590  */
591  if (newSelection != null) {
592  try {
593  sourceEm.setExploredContextAndSelection(newSelection, new Node[]{newSelection});
594  } catch (PropertyVetoException ex) {
595  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
596  logger.log(Level.WARNING, "Error: can't open the selected directory.", ex); //NON-NLS
597  }
598  }
599  }
600  }
601  };
602  }
603 
612  private AbstractAction openParent(AbstractNode node) {
613  if(sourceEm == null) {
614  return null;
615  }
616  // @@@ Why do we ignore node?
617  Node[] selectedFilterNodes = sourceEm.getSelectedNodes();
618  Node selectedFilterNode = selectedFilterNodes[0];
619  final Node parentNode = selectedFilterNode.getParentNode();
620 
621  return new AbstractAction() {
622  @Override
623  public void actionPerformed(ActionEvent e) {
624  try {
625  sourceEm.setSelectedNodes(new Node[]{parentNode});
626  } catch (PropertyVetoException ex) {
627  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
628  logger.log(Level.WARNING, "Error: can't open the parent directory.", ex); //NON-NLS
629  }
630  }
631  };
632  }
633  }
634 }
abstract< T > T accept(DisplayableItemNodeVisitor< T > visitor)
static List< Action > getActions(File file, boolean isArtifactSource)
static final DisplayableItemNodeVisitor< List< Action > > getActionsDIV
static synchronized AddBlackboardArtifactTagAction getInstance()
static synchronized DeleteFileBlackboardArtifactTagAction getInstance()
static synchronized ExportCSVAction getInstance()
static synchronized ExtractAction getInstance()
void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo)
static synchronized DeleteFileContentTagAction getInstance()
final DisplayableItemNodeVisitor< AbstractAction > getPreferredActionsDIV
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static synchronized AddContentTagAction getInstance()

Copyright © 2012-2021 Basis Technology. Generated on: Fri Aug 6 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.