19 package org.sleuthkit.autopsy.datasourcesummary.datamodel;
21 import java.time.Instant;
22 import java.util.ArrayList;
23 import java.util.Arrays;
24 import java.util.Collections;
25 import java.util.Date;
26 import java.util.HashMap;
27 import java.util.HashSet;
28 import java.util.List;
31 import java.util.TimeZone;
32 import org.joda.time.Interval;
41 import org.
sleuthkit.datamodel.TimelineFilter.RootFilter;
44 import java.util.function.Supplier;
70 private static final long DAY_SECS = 24 * 60 * 60;
75 =
new HashSet<>(Arrays.asList(
76 TimelineEventType.FILE_MODIFIED,
77 TimelineEventType.FILE_ACCESSED,
78 TimelineEventType.FILE_CREATED,
79 TimelineEventType.FILE_CHANGED));
141 TimeZone timeZone = this.timeZoneProvider.get();
142 TimelineManager timelineManager = this.caseProvider.
get().getTimelineManager();
145 Map<Long, DailyActivityAmount> dateCounts =
getTimelineEventsByDay(dataSource, timelineManager, timeZone);
150 for (
long daysFromEpoch : dateCounts.keySet()) {
151 minDay = (minDay == null) ? daysFromEpoch : Math.min(minDay, daysFromEpoch);
152 maxDay = (maxDay == null) ? daysFromEpoch : Math.max(maxDay, daysFromEpoch);
156 if (minDay == null || maxDay == null) {
160 Date minDate =
new Date(minDay * 1000 * DAY_SECS);
161 Date maxDate =
new Date(maxDay * 1000 * DAY_SECS);
165 long minRecentDay = Math.max(maxDay - recentDaysNum + 1, minDay);
184 List<DailyActivityAmount> mostRecentActivityAmt =
new ArrayList<>();
186 for (
long curRecentDay = minRecentDay; curRecentDay <= maxDay; curRecentDay++) {
192 mostRecentActivityAmt.add(countsHandleNotFound);
194 return mostRecentActivityAmt;
209 private Map<Long, DailyActivityAmount>
getTimelineEventsByDay(DataSource dataSource, TimelineManager timelineManager, TimeZone timeZone)
211 RootFilter rootFilter = this.filterFunction.
apply(dataSource);
214 long curRunTime = System.currentTimeMillis();
215 List<TimelineEvent> events = timelineManager.getEvents(
new Interval(1, curRunTime), rootFilter);
218 Map<Long, DailyActivityAmount> dateCounts =
new HashMap<>();
219 for (TimelineEvent evt : events) {
220 long curSecondsFromEpoch = evt.getTime();
221 long curDaysFromEpoch = Instant.ofEpochMilli(curSecondsFromEpoch * 1000)
222 .atZone(timeZone.toZoneId())
229 Date thisDay = prevAmt == null ?
new Date(curDaysFromEpoch * 1000 * DAY_SECS) : prevAmt.
getDay();
232 long curFileEvtCount = prevFileEvtCount + (isFileEvt ? 1 : 0);
233 long curArtifactEvtCount = prevArtifactEvtCount + (isFileEvt ? 0 : 1);
235 dateCounts.put(curDaysFromEpoch,
new DailyActivityAmount(thisDay, curFileEvtCount, curArtifactEvtCount));
261 TimelineSummaryData(Date minDate, Date maxDate, List<DailyActivityAmount> recentDaysActivity, DataSource dataSource) {
264 this.histogramActivity = (recentDaysActivity == null) ? Collections.emptyList() : Collections.unmodifiableList(recentDaysActivity);
static final Set< IngestManager.IngestJobEvent > INGEST_JOB_EVENTS
final Supplier< TimeZone > timeZoneProvider
SleuthkitCaseProvider DEFAULT
final DataSourceFilterFunction filterFunction
DataSource getDataSource()
long getArtifactActivityCount()
RootFilter getDataSourceFilter(DataSource dataSource)
boolean isRefreshRequired(ModuleContentEvent evt)
final List< DailyActivityAmount > histogramActivity
List< DailyActivityAmount > getMostRecentDaysActivity()
final SleuthkitCaseProvider caseProvider
boolean isRefreshRequired(AbstractFile file)
TimelineSummary(SleuthkitCaseProvider caseProvider, Supplier< TimeZone > timeZoneProvider, DataSourceFilterFunction filterFunction)
static final long DAY_SECS
Set< IngestManager.IngestJobEvent > getIngestJobEventUpdates()
RootFilter apply(DataSource dataSource)
static TimelineDataSourceUtils getInstance()
TimelineSummaryData getData(DataSource dataSource, int recentDaysNum)
List< DailyActivityAmount > getMostRecentActivityAmounts(Map< Long, DailyActivityAmount > dateCounts, long minRecentDay, long maxDay)
static String getTimeZoneForDisplays()
final long fileActivityCount
final long artifactActivityCount
long getFileActivityCount()
Map< Long, DailyActivityAmount > getTimelineEventsByDay(DataSource dataSource, TimelineManager timelineManager, TimeZone timeZone)
static final Set< TimelineEventType > FILE_SYSTEM_EVENTS
final DataSource dataSource
boolean isRefreshRequired(IngestManager.IngestJobEvent evt)