Static Public Member Functions
static void	addOrUpdateNodeData (final Case autopsyCase, Map< UniquePathKey, NodeData > nodeDataMap, AbstractFile newFile) throws TskCoreException, CentralRepoException

static AbstractFile	getAbstractFileFromNode (Node node)

static BlackboardArtifact	getBlackboardArtifactFromNode (Node node)

static List< AbstractFile >	getCaseDbMatches (CorrelationAttributeInstance corAttr, Case openCase, AbstractFile file) throws NoCurrentCaseException, TskCoreException, CentralRepoException

static Map< UniquePathKey, NodeData >	getCorrelatedInstances (AbstractFile file, String deviceId, String dataSourceName, CorrelationAttributeInstance corAttr)

static Collection< CorrelationAttributeInstance >	getCorrelationAttributeFromOsAccount (Node node, OsAccount osAccount)

static Collection< CorrelationAttributeInstance >	getCorrelationAttributesFromNode (Node node, AbstractFile file)

static String	getEarliestCaseDate () throws CentralRepoException

static String	getPlaceholderUUID ()

static String	makeDataSourceString (String caseUUID, String deviceId, String dataSourceName)

static void	writeOtherOccurrencesToFileAsCSV (File destFile, AbstractFile abstractFile, Collection< CorrelationAttributeInstance > correlationAttList, String dataSourceName, String deviceId) throws IOException

Private Member Functions
	OtherOccurrences ()

Static Private Attributes
static final Logger	logger = Logger.getLogger(OtherOccurrences.class.getName())

static final String	UUID_PLACEHOLDER_STRING = "NoCorrelationAttributeInstance"

Detailed Description

Contains most of the methods for gathering data from the DB and CR for the OtherOccurrencesPanel.

Definition at line 67 of file OtherOccurrences.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.OtherOccurrences ( )

private

Definition at line 73 of file OtherOccurrences.java.

Member Function Documentation

static void org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.addOrUpdateNodeData	(	final Case	autopsyCase,
		Map< UniquePathKey, NodeData >	nodeDataMap,
		AbstractFile	newFile
	)		throws TskCoreException, CentralRepoException

static

Adds the file to the nodeDataMap map if it does not already exist

Parameters

autopsyCase
nodeDataMap
newFile

Exceptions

TskCoreException
CentralRepoException

Definition at line 350 of file OtherOccurrences.java.

References org.sleuthkit.autopsy.centralrepository.application.NodeData.getKnown().

Referenced by org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCorrelatedInstances().

static AbstractFile org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getAbstractFileFromNode ( Node node )

static

Get the associated AbstractFile from a node, if it exists.

Parameters

node The node

Returns: The associated AbstractFile, or null

Definition at line 220 of file OtherOccurrences.java.

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.isSupported().

static BlackboardArtifact org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getBlackboardArtifactFromNode ( Node node )

static

Get the associated BlackboardArtifact from a node, if it exists.

Parameters

node The node

Returns: The associated BlackboardArtifact, or null

Definition at line 199 of file OtherOccurrences.java.

Referenced by org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCorrelationAttributesFromNode(), and org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.isSupported().

static List<AbstractFile> org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCaseDbMatches	(	CorrelationAttributeInstance	corAttr,
		Case	openCase,
		AbstractFile	file
	)		throws NoCurrentCaseException, TskCoreException, CentralRepoException

static

Get all other abstract files in the current case with the same MD5 as the selected node.

Parameters

corAttr	The CorrelationAttribute containing the MD5 to search for
openCase	The current case
file	The current file.

Returns: List of matching AbstractFile objects

Exceptions

NoCurrentCaseException
TskCoreException
CentralRepoException

Definition at line 322 of file OtherOccurrences.java.

Referenced by org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCorrelatedInstances().

static Map<UniquePathKey, NodeData> org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCorrelatedInstances	(	AbstractFile	file,
		String	deviceId,
		String	dataSourceName,
		CorrelationAttributeInstance	corAttr
	)

static

Query the central repo database (if enabled) and the case database to find all artifact instances correlated to the given central repository artifact. If the central repo is not enabled, this will only return files from the current case with matching MD5 hashes.

Parameters

file	The current file.
deviceId	The device ID for the current data source.
dataSourceName	The name of the current data source.
corAttr	CorrelationAttribute to query for

Returns: A collection of correlated artifact instances

Definition at line 255 of file OtherOccurrences.java.

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.OtherOccurrencesPanel.SelectionWorker.doInBackground(), and org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.writeOtherOccurrencesToFileAsCSV().

static Collection<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCorrelationAttributeFromOsAccount	(	Node	node,
		OsAccount	osAccount
	)

static

Determine what attributes can be used for correlation based on the node.

Parameters

node	The node to correlate
osAccount	the osAccount to correlate

Returns: A list of attributes that can be used for correlation

Definition at line 84 of file OtherOccurrences.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCase(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCorrelationTypeById(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.OSACCOUNT_TYPE_ID.

static Collection<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCorrelationAttributesFromNode	(	Node	node,
		AbstractFile	file
	)

static

Determine what attributes can be used for correlation based on the node. If EamDB is not enabled, get the default Files correlation.

Parameters

node	The node to correlate.
file	The file to correlate.

Returns: A list of attributes that can be used for correlation

Definition at line 130 of file OtherOccurrences.java.

static String org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getEarliestCaseDate ( ) throws CentralRepoException

static

Gets the list of Eam Cases and determines the earliest case creation date. Sets the label to display the earliest date string to the user.

Definition at line 395 of file OtherOccurrences.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCases(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), and org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled().

static String org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getPlaceholderUUID ( )

static

Get a placeholder string to use in place of case uuid when it isn't available

Returns: UUID_PLACEHOLDER_STRING

Definition at line 475 of file OtherOccurrences.java.

References org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.UUID_PLACEHOLDER_STRING.

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.OtherOccurrencesFilesTableModel.createNodeKey(), and org.sleuthkit.autopsy.centralrepository.application.UniquePathKey.UniquePathKey().

static String org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.makeDataSourceString	(	String	caseUUID,
		String	deviceId,
		String	dataSourceName
	)

static

Create a unique string to be used as a key for deduping data sources as best as possible

Definition at line 387 of file OtherOccurrences.java.

static void org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.writeOtherOccurrencesToFileAsCSV	(	File	destFile,
		AbstractFile	abstractFile,
		Collection< CorrelationAttributeInstance >	correlationAttList,
		String	dataSourceName,
		String	deviceId
	)		throws IOException

static

Create a cvs file of occurrences for the given parameters.

Parameters

destFile	Output file for the csv data.
abstractFile	Source file.
correlationAttList	List of correclationAttributeInstances, should not be null.
dataSourceName	Name of the data source.
deviceId	Device id.

Exceptions

IOException

Definition at line 444 of file OtherOccurrences.java.

References org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getCorrelatedInstances(), and org.sleuthkit.autopsy.centralrepository.application.NodeData.getCsvItemSeparator().

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.OtherOccurrencesPanel.CSVWorker.doInBackground().

Member Data Documentation

final Logger org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.logger = Logger.getLogger(OtherOccurrences.class.getName())

staticprivate

Definition at line 69 of file OtherOccurrences.java.

final String org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.UUID_PLACEHOLDER_STRING = "NoCorrelationAttributeInstance"

staticprivate

Definition at line 71 of file OtherOccurrences.java.

Referenced by org.sleuthkit.autopsy.centralrepository.application.OtherOccurrences.getPlaceholderUUID().

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java

Static Public Member Functions

Private Member Functions

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation