19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.EnumSet;
26 import java.util.List;
27 import java.util.Observable;
28 import java.util.Observer;
30 import java.util.logging.Level;
31 import org.openide.nodes.AbstractNode;
32 import org.openide.nodes.ChildFactory;
33 import org.openide.nodes.Children;
34 import org.openide.nodes.Node;
35 import org.openide.nodes.Sheet;
36 import org.openide.util.NbBundle;
37 import org.openide.util.lookup.Lookups;
76 this.displayName = displayName;
89 return this.displayName;
104 return v.
visit(
this);
116 private static final String
NAME = NbBundle.getMessage(
FileSize.class,
"FileSize.fileSizeRootNode.name");
121 super.setDisplayName(NAME);
122 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/file-size-16.png");
132 return v.
visit(
this);
137 Sheet s = super.createSheet();
138 Sheet.Set ss = s.get(Sheet.PROPERTIES);
140 ss = Sheet.createPropertiesSet();
144 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.name.name"),
145 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.name.displayName"),
146 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.name.desc"),
153 return getClass().getName();
160 public static class FileSizeRootChildren extends ChildFactory<org.sleuthkit.autopsy.datamodel.FileSize.FileSizeFilter> {
191 private final PropertyChangeListener
pcl = (PropertyChangeEvent evt) -> {
192 String eventType = evt.getPropertyName();
206 }
catch (IllegalStateException notUsed) {
223 }
catch (IllegalStateException notUsed) {
230 if (evt.getNewValue() == null) {
263 super(Children.create(
new FileSizeChildren(filter, skCase, null),
true), Lookups.singleton(filter.
getDisplayName()));
276 super(Children.create(
new FileSizeChildren(filter, skCase, o),
true), Lookups.singleton(filter.
getDisplayName()));
279 o.addObserver(
new FileSizeNodeObserver());
283 super.setName(filter.
getName());
286 this.setShortDescription(tooltip);
287 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/file-size-16.png");
305 public void update(Observable o, Object arg) {
311 final long numVisibleChildren = FileSizeChildren.calculateItems(skCase, filter);
312 super.setDisplayName(filter.
getDisplayName() +
" (" + numVisibleChildren +
")");
317 return v.
visit(
this);
322 Sheet s = super.createSheet();
323 Sheet.Set ss = s.get(Sheet.PROPERTIES);
325 ss = Sheet.createPropertiesSet();
329 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.filterType.name"),
330 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.filterType.displayName"),
331 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.filterType.desc"),
346 static class FileSizeChildren
extends ChildFactory.Detachable<AbstractFile> {
348 private final SleuthkitCase
skCase;
360 FileSizeChildren(
FileSizeFilter filter, SleuthkitCase skCase, Observable o) {
362 this.filter = filter;
367 protected void addNotify() {
368 if (notifier != null) {
369 notifier.addObserver(observer);
374 protected void removeNotify() {
375 if (notifier != null) {
376 notifier.deleteObserver(observer);
380 private final Observer observer =
new FileSizeChildrenObserver();
386 public void update(Observable o, Object arg) {
392 protected boolean createKeys(List<AbstractFile> list) {
393 list.addAll(runFsQuery());
401 query =
"(size >= 50000000 AND size < 200000000)";
404 query =
"(size >= 200000000 AND size < 1000000000)";
408 query =
"(size >= 1000000000)";
412 throw new IllegalArgumentException(
"Unsupported filter type to get files by size: " + filter);
416 query = query +
" AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType() +
")";
420 query +=
" AND (known != " + TskData.FileKnown.KNOWN.getFileKnownValue()
421 +
" OR known IS NULL)";
425 if(UserPreferences.hideSlackFilesInViewsTree()) {
426 query +=
" AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType() +
")";
432 private List<AbstractFile> runFsQuery() {
433 List<AbstractFile> ret =
new ArrayList<>();
436 String query = makeQuery(filter);
438 ret = skCase.findAllFilesWhere(query);
439 }
catch (Exception e) {
440 logger.log(Level.SEVERE,
"Error getting files for the file size view: " + e.getMessage());
451 static long calculateItems(SleuthkitCase sleuthkitCase, FileSizeFilter filter) {
453 return sleuthkitCase.countFilesWhere(makeQuery(filter));
454 }
catch (TskCoreException ex) {
455 logger.log(Level.SEVERE,
"Error getting files by size search view count", ex);
462 return key.accept(
new ContentVisitor.Default<AbstractNode>() {
463 public FileNode visit(AbstractFile f) {
464 return new FileNode(f, false);
467 public FileNode visit(FsContent f) {
468 return new FileNode(f,
false);
472 public FileNode visit(LayoutFile f) {
473 return new FileNode(f,
false);
477 public FileNode visit(File f) {
478 return new FileNode(f,
false);
482 public FileNode visit(Directory f) {
483 return new FileNode(f,
false);
487 public FileNode visit(LocalFile f) {
488 return new FileNode(f,
false);
492 public FileNode visit(DerivedFile f) {
493 return new FileNode(f,
false);
497 public FileNode visit(VirtualDirectory f) {
498 return new FileNode(f,
false);
502 public FileNode visit(SlackFile f) {
503 return new FileNode(f,
false);
507 protected AbstractNode defaultVisit(Content di) {
508 throw new UnsupportedOperationException(
509 NbBundle.getMessage(
this.getClass(),
510 "FileSize.exception.notSupported.msg",
void update(Observable o, Object arg)
FileSize(SleuthkitCase skCase)
public< T > T accept(AutopsyItemVisitor< T > v)
void removeIngestModuleEventListener(final PropertyChangeListener listener)
SleuthkitCase getSleuthkitCase()
static synchronized IngestManager getInstance()
static boolean hideKnownFilesInViewsTree()
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
boolean createKeys(List< FileSizeFilter > list)
Node createNodeForKey(FileSizeFilter key)
final PropertyChangeListener pcl
void addIngestJobEventListener(final PropertyChangeListener listener)
FileSizeFilter(int id, String name, String displayName)
void addIngestModuleEventListener(final PropertyChangeListener listener)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
void update(Observable o, Object arg)
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
FileSizeRootChildren(SleuthkitCase skCase)
static final Set< Case.Events > CASE_EVENTS_OF_INTEREST