19 package org.sleuthkit.autopsy.centralrepository.datamodel;
21 import java.net.UnknownHostException;
22 import java.util.ArrayList;
23 import java.util.List;
24 import java.util.Collection;
25 import java.util.LinkedHashSet;
26 import java.util.stream.Collectors;
27 import java.sql.Connection;
28 import java.sql.PreparedStatement;
29 import java.sql.ResultSet;
30 import java.sql.SQLException;
31 import java.sql.Statement;
32 import java.sql.Types;
33 import java.time.LocalDate;
34 import java.util.HashMap;
37 import java.util.logging.Level;
38 import org.openide.util.NbBundle.Messages;
42 import org.
sleuthkit.datamodel.CaseDbSchemaVersionNumber;
58 private final Map<String, Collection<CorrelationAttribute>>
bulkArtifacts;
66 bulkArtifactsCount = 0;
67 bulkArtifacts =
new HashMap<>();
70 DEFAULT_CORRELATION_TYPES.forEach((type) -> {
71 bulkArtifacts.put(type.getDbTableName(),
new ArrayList<>());
89 public
void newDbInfo(String name, String value) throws EamDbException {
92 PreparedStatement preparedStatement = null;
93 String sql =
"INSERT INTO db_info (name, value) VALUES (?, ?) "
96 preparedStatement = conn.prepareStatement(sql);
97 preparedStatement.setString(1, name);
98 preparedStatement.setString(2, value);
99 preparedStatement.executeUpdate();
100 }
catch (SQLException ex) {
101 throw new EamDbException(
"Error adding new name/value pair to db_info.", ex);
122 PreparedStatement preparedStatement = null;
123 ResultSet resultSet = null;
125 String sql =
"SELECT value FROM db_info WHERE name=?";
127 preparedStatement = conn.prepareStatement(sql);
128 preparedStatement.setString(1, name);
129 resultSet = preparedStatement.executeQuery();
130 if (resultSet.next()) {
131 value = resultSet.getString(
"value");
133 }
catch (SQLException ex) {
156 PreparedStatement preparedStatement = null;
157 String sql =
"UPDATE db_info SET value=? WHERE name=?";
159 preparedStatement = conn.prepareStatement(sql);
160 preparedStatement.setString(1, value);
161 preparedStatement.setString(2, name);
162 preparedStatement.executeUpdate();
163 }
catch (SQLException ex) {
184 if (cRCase != null) {
189 PreparedStatement preparedStatement = null;
191 String sql =
"INSERT INTO cases(case_uid, org_id, case_name, creation_date, case_number, "
192 +
"examiner_name, examiner_email, examiner_phone, notes) "
193 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) "
197 preparedStatement = conn.prepareStatement(sql);
199 preparedStatement.setString(1, eamCase.getCaseUUID());
200 if (null == eamCase.getOrg()) {
201 preparedStatement.setNull(2, Types.INTEGER);
203 preparedStatement.setInt(2, eamCase.getOrg().getOrgID());
205 preparedStatement.setString(3, eamCase.getDisplayName());
206 preparedStatement.setString(4, eamCase.getCreationDate());
207 if (
"".equals(eamCase.getCaseNumber())) {
208 preparedStatement.setNull(5, Types.INTEGER);
210 preparedStatement.setString(5, eamCase.getCaseNumber());
212 if (
"".equals(eamCase.getExaminerName())) {
213 preparedStatement.setNull(6, Types.INTEGER);
215 preparedStatement.setString(6, eamCase.getExaminerName());
217 if (
"".equals(eamCase.getExaminerEmail())) {
218 preparedStatement.setNull(7, Types.INTEGER);
220 preparedStatement.setString(7, eamCase.getExaminerEmail());
222 if (
"".equals(eamCase.getExaminerPhone())) {
223 preparedStatement.setNull(8, Types.INTEGER);
225 preparedStatement.setString(8, eamCase.getExaminerPhone());
227 if (
"".equals(eamCase.getNotes())) {
228 preparedStatement.setNull(9, Types.INTEGER);
230 preparedStatement.setString(9, eamCase.getNotes());
233 preparedStatement.executeUpdate();
234 }
catch (SQLException ex) {
252 if (autopsyCase == null) {
258 autopsyCase.getName(),
260 autopsyCase.getDisplayName(),
261 autopsyCase.getCreatedDate(),
262 autopsyCase.getNumber(),
263 autopsyCase.getExaminer(),
264 autopsyCase.getExaminerEmail(),
265 autopsyCase.getExaminerPhone(),
266 autopsyCase.getCaseNotes());
282 if(eamCase == null) {
288 PreparedStatement preparedStatement = null;
289 String sql =
"UPDATE cases "
290 +
"SET org_id=?, case_name=?, creation_date=?, case_number=?, examiner_name=?, examiner_email=?, examiner_phone=?, notes=? "
291 +
"WHERE case_uid=?";
294 preparedStatement = conn.prepareStatement(sql);
296 if (null == eamCase.getOrg()) {
297 preparedStatement.setNull(1, Types.INTEGER);
299 preparedStatement.setInt(1, eamCase.getOrg().getOrgID());
301 preparedStatement.setString(2, eamCase.getDisplayName());
302 preparedStatement.setString(3, eamCase.getCreationDate());
304 if (
"".equals(eamCase.getCaseNumber())) {
305 preparedStatement.setNull(4, Types.INTEGER);
307 preparedStatement.setString(4, eamCase.getCaseNumber());
309 if (
"".equals(eamCase.getExaminerName())) {
310 preparedStatement.setNull(5, Types.INTEGER);
312 preparedStatement.setString(5, eamCase.getExaminerName());
314 if (
"".equals(eamCase.getExaminerEmail())) {
315 preparedStatement.setNull(6, Types.INTEGER);
317 preparedStatement.setString(6, eamCase.getExaminerEmail());
319 if (
"".equals(eamCase.getExaminerPhone())) {
320 preparedStatement.setNull(7, Types.INTEGER);
322 preparedStatement.setString(7, eamCase.getExaminerPhone());
324 if (
"".equals(eamCase.getNotes())) {
325 preparedStatement.setNull(8, Types.INTEGER);
327 preparedStatement.setString(8, eamCase.getNotes());
330 preparedStatement.setString(9, eamCase.getCaseUUID());
332 preparedStatement.executeUpdate();
333 }
catch (SQLException ex) {
355 PreparedStatement preparedStatement = null;
356 ResultSet resultSet = null;
358 String sql =
"SELECT cases.id as case_id, case_uid, case_name, creation_date, case_number, examiner_name, "
359 +
"examiner_email, examiner_phone, notes, organizations.id as org_id, org_name, poc_name, poc_email, poc_phone "
361 +
"LEFT JOIN organizations ON cases.org_id=organizations.id "
362 +
"WHERE case_uid=?";
365 preparedStatement = conn.prepareStatement(sql);
366 preparedStatement.setString(1, caseUUID);
367 resultSet = preparedStatement.executeQuery();
368 if (resultSet.next()) {
371 }
catch (SQLException ex) {
379 return eamCaseResult;
391 List<CorrelationCase> cases =
new ArrayList<>();
393 PreparedStatement preparedStatement = null;
394 ResultSet resultSet = null;
396 String sql =
"SELECT cases.id as case_id, case_uid, case_name, creation_date, case_number, examiner_name, "
397 +
"examiner_email, examiner_phone, notes, organizations.id as org_id, org_name, poc_name, poc_email, poc_phone "
399 +
"LEFT JOIN organizations ON cases.org_id=organizations.id";
402 preparedStatement = conn.prepareStatement(sql);
403 resultSet = preparedStatement.executeQuery();
404 while (resultSet.next()) {
406 cases.add(eamCaseResult);
408 }
catch (SQLException ex) {
409 throw new EamDbException(
"Error getting all cases.", ex);
428 PreparedStatement preparedStatement = null;
430 String sql =
"INSERT INTO data_sources(device_id, case_id, name) VALUES (?, ?, ?) "
434 preparedStatement = conn.prepareStatement(sql);
436 preparedStatement.setString(1, eamDataSource.getDeviceID());
437 preparedStatement.setInt(2, eamDataSource.getCaseID());
438 preparedStatement.setString(3, eamDataSource.getName());
440 preparedStatement.executeUpdate();
441 }
catch (SQLException ex) {
460 if(correlationCase == null) {
467 PreparedStatement preparedStatement = null;
468 ResultSet resultSet = null;
470 String sql =
"SELECT * FROM data_sources WHERE device_id=? AND case_id=?";
473 preparedStatement = conn.prepareStatement(sql);
474 preparedStatement.setString(1, dataSourceDeviceId);
475 preparedStatement.setInt(2, correlationCase.getID());
476 resultSet = preparedStatement.executeQuery();
477 if (resultSet.next()) {
480 }
catch (SQLException ex) {
488 return eamDataSourceResult;
500 List<CorrelationDataSource> dataSources =
new ArrayList<>();
502 PreparedStatement preparedStatement = null;
503 ResultSet resultSet = null;
505 String sql =
"SELECT * FROM data_sources";
508 preparedStatement = conn.prepareStatement(sql);
509 resultSet = preparedStatement.executeQuery();
510 while (resultSet.next()) {
512 dataSources.add(eamDataSourceResult);
514 }
catch (SQLException ex) {
515 throw new EamDbException(
"Error getting all data sources.", ex);
533 if(eamArtifact == null) {
536 if(eamArtifact.getCorrelationType() == null) {
539 if(eamArtifact.getCorrelationValue() == null) {
545 List<CorrelationAttributeInstance> eamInstances = eamArtifact.getInstances();
546 PreparedStatement preparedStatement = null;
550 StringBuilder sql =
new StringBuilder();
551 sql.append(
"INSERT INTO ");
552 sql.append(tableName);
553 sql.append(
"(case_id, data_source_id, value, file_path, known_status, comment) ");
554 sql.append(
"VALUES ((SELECT id FROM cases WHERE case_uid=? LIMIT 1), ");
555 sql.append(
"(SELECT id FROM data_sources WHERE device_id=? AND case_id=? LIMIT 1), ?, ?, ?, ?) ");
559 preparedStatement = conn.prepareStatement(sql.toString());
561 if (!eamArtifact.getCorrelationValue().isEmpty()) {
562 if(eamInstance.getCorrelationCase() == null) {
563 throw new EamDbException(
"CorrelationAttributeInstance has null case");
565 if(eamInstance.getCorrelationDataSource() == null) {
566 throw new EamDbException(
"CorrelationAttributeInstance has null data source");
568 if(eamInstance.getKnownStatus() == null) {
569 throw new EamDbException(
"CorrelationAttributeInstance has null known status");
572 preparedStatement.setString(1, eamInstance.getCorrelationCase().getCaseUUID());
573 preparedStatement.setString(2, eamInstance.getCorrelationDataSource().getDeviceID());
574 preparedStatement.setInt(3, eamInstance.getCorrelationDataSource().getCaseID());
575 preparedStatement.setString(4, eamArtifact.getCorrelationValue());
576 preparedStatement.setString(5, eamInstance.getFilePath());
577 preparedStatement.setByte(6, eamInstance.getKnownStatus().getFileKnownValue());
578 if (
"".equals(eamInstance.getComment())) {
579 preparedStatement.setNull(7, Types.INTEGER);
581 preparedStatement.setString(7, eamInstance.getComment());
584 preparedStatement.executeUpdate();
587 }
catch (SQLException ex) {
588 throw new EamDbException(
"Error inserting new artifact into artifacts table.", ex);
613 List<CorrelationAttributeInstance> artifactInstances =
new ArrayList<>();
616 PreparedStatement preparedStatement = null;
617 ResultSet resultSet = null;
620 StringBuilder sql =
new StringBuilder();
621 sql.append(
"SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id FROM ");
622 sql.append(tableName);
623 sql.append(
" LEFT JOIN cases ON ");
624 sql.append(tableName);
625 sql.append(
".case_id=cases.id");
626 sql.append(
" LEFT JOIN data_sources ON ");
627 sql.append(tableName);
628 sql.append(
".data_source_id=data_sources.id");
629 sql.append(
" WHERE value=?");
632 preparedStatement = conn.prepareStatement(sql.toString());
633 preparedStatement.setString(1, value);
634 resultSet = preparedStatement.executeQuery();
635 while (resultSet.next()) {
637 artifactInstances.add(artifactInstance);
639 }
catch (SQLException ex) {
640 throw new EamDbException(
"Error getting artifact instances by artifactType and artifactValue.", ex);
647 return artifactInstances;
666 if(filePath == null) {
671 List<CorrelationAttributeInstance> artifactInstances =
new ArrayList<>();
674 PreparedStatement preparedStatement = null;
675 ResultSet resultSet = null;
678 StringBuilder sql =
new StringBuilder();
679 sql.append(
"SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id FROM ");
680 sql.append(tableName);
681 sql.append(
" LEFT JOIN cases ON ");
682 sql.append(tableName);
683 sql.append(
".case_id=cases.id");
684 sql.append(
" LEFT JOIN data_sources ON ");
685 sql.append(tableName);
686 sql.append(
".data_source_id=data_sources.id");
687 sql.append(
" WHERE file_path=?");
690 preparedStatement = conn.prepareStatement(sql.toString());
691 preparedStatement.setString(1, filePath.toLowerCase());
692 resultSet = preparedStatement.executeQuery();
693 while (resultSet.next()) {
695 artifactInstances.add(artifactInstance);
697 }
catch (SQLException ex) {
698 throw new EamDbException(
"Error getting artifact instances by artifactType and artifactValue.", ex);
705 return artifactInstances;
729 Long instanceCount = 0L;
730 PreparedStatement preparedStatement = null;
731 ResultSet resultSet = null;
734 StringBuilder sql =
new StringBuilder();
735 sql.append(
"SELECT count(*) FROM ");
736 sql.append(tableName);
737 sql.append(
" WHERE value=?");
740 preparedStatement = conn.prepareStatement(sql.toString());
741 preparedStatement.setString(1, value.toLowerCase());
742 resultSet = preparedStatement.executeQuery();
744 instanceCount = resultSet.getLong(1);
745 }
catch (SQLException ex) {
746 throw new EamDbException(
"Error getting count of artifact instances by artifactType and artifactValue.", ex);
753 return instanceCount;
758 if (corAttr == null) {
763 Double commonalityPercentage = uniqueTypeValueTuples / uniqueCaseDataSourceTuples * 100;
764 return commonalityPercentage.intValue();
785 Long instanceCount = 0L;
786 PreparedStatement preparedStatement = null;
787 ResultSet resultSet = null;
790 StringBuilder sql =
new StringBuilder();
791 sql.append(
"SELECT count(*) FROM (SELECT DISTINCT case_id, data_source_id FROM ");
792 sql.append(tableName);
793 sql.append(
" WHERE value=?) AS ");
794 sql.append(tableName);
795 sql.append(
"_distinct_case_data_source_tuple");
798 preparedStatement = conn.prepareStatement(sql.toString());
799 preparedStatement.setString(1, value);
800 resultSet = preparedStatement.executeQuery();
802 instanceCount = resultSet.getLong(1);
803 }
catch (SQLException ex) {
804 throw new EamDbException(
"Error counting unique caseDisplayName/dataSource tuples having artifactType and artifactValue.", ex);
811 return instanceCount;
818 Long instanceCount = 0L;
819 PreparedStatement preparedStatement = null;
820 ResultSet resultSet = null;
822 String stmt =
"SELECT count(*) FROM data_sources";
825 preparedStatement = conn.prepareStatement(stmt);
826 resultSet = preparedStatement.executeQuery();
828 instanceCount = resultSet.getLong(1);
829 }
catch (SQLException ex) {
830 throw new EamDbException(
"Error counting data sources.", ex);
837 return instanceCount;
855 Long instanceCount = 0L;
857 PreparedStatement preparedStatement = null;
858 ResultSet resultSet = null;
861 StringBuilder sql =
new StringBuilder();
862 sql.append(
"SELECT 0 ");
867 sql.append(
"+ (SELECT count(*) FROM ");
868 sql.append(table_name);
869 sql.append(
" WHERE case_id=(SELECT id FROM cases WHERE case_uid=?) and data_source_id=(SELECT id FROM data_sources WHERE device_id=?))");
873 preparedStatement = conn.prepareStatement(sql.toString());
875 for (
int i = 0; i < artifactTypes.size(); ++i) {
876 preparedStatement.setString(2 * i + 1, caseUUID);
877 preparedStatement.setString(2 * i + 2, dataSourceID);
880 resultSet = preparedStatement.executeQuery();
882 instanceCount = resultSet.getLong(1);
883 }
catch (SQLException ex) {
884 throw new EamDbException(
"Error counting artifact instances by caseName/dataSource.", ex);
891 return instanceCount;
904 if(eamArtifact.getCorrelationType() == null) {
909 bulkArtifacts.get(eamArtifact.getCorrelationType().getDbTableName()).add(eamArtifact);
910 bulkArtifactsCount++;
912 if (bulkArtifactsCount >= bulkArtifactsThreshold) {
934 PreparedStatement bulkPs = null;
938 if (bulkArtifactsCount == 0) {
945 StringBuilder sql =
new StringBuilder();
946 sql.append(
"INSERT INTO ");
947 sql.append(tableName);
948 sql.append(
" (case_id, data_source_id, value, file_path, known_status, comment) ");
949 sql.append(
"VALUES ((SELECT id FROM cases WHERE case_uid=? LIMIT 1), ");
950 sql.append(
"(SELECT id FROM data_sources WHERE device_id=? AND case_id=? LIMIT 1), ?, ?, ?, ?) ");
953 bulkPs = conn.prepareStatement(sql.toString());
955 Collection<CorrelationAttribute> eamArtifacts = bulkArtifacts.get(type.getDbTableName());
957 List<CorrelationAttributeInstance> eamInstances = eamArtifact.getInstances();
960 if (!eamArtifact.getCorrelationValue().isEmpty()) {
962 if(eamInstance.getCorrelationCase() == null) {
963 throw new EamDbException(
"Correlation attribute instance has null case");
965 if(eamInstance.getCorrelationDataSource() == null) {
966 throw new EamDbException(
"Correlation attribute instance has null data source");
968 if(eamInstance.getKnownStatus()== null) {
969 throw new EamDbException(
"Correlation attribute instance has null known known status");
972 bulkPs.setString(1, eamInstance.getCorrelationCase().getCaseUUID());
973 bulkPs.setString(2, eamInstance.getCorrelationDataSource().getDeviceID());
974 bulkPs.setInt(3, eamInstance.getCorrelationDataSource().getCaseID());
975 bulkPs.setString(4, eamArtifact.getCorrelationValue());
976 bulkPs.setString(5, eamInstance.getFilePath());
977 bulkPs.setByte(6, eamInstance.getKnownStatus().getFileKnownValue());
978 if (
"".equals(eamInstance.getComment())) {
979 bulkPs.setNull(7, Types.INTEGER);
981 bulkPs.setString(7, eamInstance.getComment());
988 bulkPs.executeBatch();
989 bulkArtifacts.get(type.getDbTableName()).clear();
993 bulkArtifactsCount = 0;
995 }
catch (SQLException ex) {
996 throw new EamDbException(
"Error inserting bulk artifacts.", ex);
1012 if (cases.isEmpty()) {
1019 PreparedStatement bulkPs = null;
1021 String sql =
"INSERT INTO cases(case_uid, org_id, case_name, creation_date, case_number, "
1022 +
"examiner_name, examiner_email, examiner_phone, notes) "
1023 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) "
1025 bulkPs = conn.prepareStatement(sql);
1028 bulkPs.setString(1, eamCase.getCaseUUID());
1029 if (null == eamCase.getOrg()) {
1030 bulkPs.setNull(2, Types.INTEGER);
1032 bulkPs.setInt(2, eamCase.getOrg().getOrgID());
1034 bulkPs.setString(3, eamCase.getDisplayName());
1035 bulkPs.setString(4, eamCase.getCreationDate());
1037 if (
"".equals(eamCase.getCaseNumber())) {
1038 bulkPs.setNull(5, Types.INTEGER);
1040 bulkPs.setString(5, eamCase.getCaseNumber());
1042 if (
"".equals(eamCase.getExaminerName())) {
1043 bulkPs.setNull(6, Types.INTEGER);
1045 bulkPs.setString(6, eamCase.getExaminerName());
1047 if (
"".equals(eamCase.getExaminerEmail())) {
1048 bulkPs.setNull(7, Types.INTEGER);
1050 bulkPs.setString(7, eamCase.getExaminerEmail());
1052 if (
"".equals(eamCase.getExaminerPhone())) {
1053 bulkPs.setNull(8, Types.INTEGER);
1055 bulkPs.setString(8, eamCase.getExaminerPhone());
1057 if (
"".equals(eamCase.getNotes())) {
1058 bulkPs.setNull(9, Types.INTEGER);
1060 bulkPs.setString(9, eamCase.getNotes());
1068 if (counter >= bulkArtifactsThreshold) {
1069 bulkPs.executeBatch();
1074 bulkPs.executeBatch();
1075 }
catch (SQLException ex) {
1095 if(eamArtifact == null) {
1096 throw new EamDbException(
"Correlation attribute is null");
1098 if(knownStatus == null) {
1099 throw new EamDbException(
"Known status is null");
1102 throw new EamDbException(
"Error: Artifact must have exactly one (1) Artifact Instance to set as notable.");
1105 List<CorrelationAttributeInstance> eamInstances = eamArtifact.
getInstances();
1109 throw new EamDbException(
"Correlation case is null");
1112 throw new EamDbException(
"Correlation data source is null");
1117 PreparedStatement preparedUpdate = null;
1118 PreparedStatement preparedQuery = null;
1119 ResultSet resultSet = null;
1123 StringBuilder sqlQuery =
new StringBuilder();
1124 sqlQuery.append(
"SELECT id FROM ");
1125 sqlQuery.append(tableName);
1126 sqlQuery.append(
" WHERE case_id=(SELECT id FROM cases WHERE case_uid=?) ");
1127 sqlQuery.append(
"AND data_source_id=(SELECT id FROM data_sources WHERE device_id=?) ");
1128 sqlQuery.append(
"AND value=? ");
1129 sqlQuery.append(
"AND file_path=?");
1131 StringBuilder sqlUpdate =
new StringBuilder();
1132 sqlUpdate.append(
"UPDATE ");
1133 sqlUpdate.append(tableName);
1134 sqlUpdate.append(
" SET known_status=?, comment=? ");
1135 sqlUpdate.append(
"WHERE id=?");
1138 preparedQuery = conn.prepareStatement(sqlQuery.toString());
1142 preparedQuery.setString(4, eamInstance.
getFilePath());
1143 resultSet = preparedQuery.executeQuery();
1144 if (resultSet.next()) {
1145 int instance_id = resultSet.getInt(
"id");
1146 preparedUpdate = conn.prepareStatement(sqlUpdate.toString());
1148 preparedUpdate.setByte(1, knownStatus.getFileKnownValue());
1153 preparedUpdate.setNull(2, Types.INTEGER);
1155 preparedUpdate.setString(2, eamInstance.
getComment());
1157 preparedUpdate.setInt(3, instance_id);
1159 preparedUpdate.executeUpdate();
1167 if (null == correlationCaseWithId) {
1174 eamArtifact.
getInstances().get(0).setKnownStatus(knownStatus);
1178 }
catch (SQLException ex) {
1179 throw new EamDbException(
"Error getting/setting artifact instance knownStatus=" + knownStatus.getName(), ex);
1205 List<CorrelationAttributeInstance> artifactInstances =
new ArrayList<>();
1208 PreparedStatement preparedStatement = null;
1209 ResultSet resultSet = null;
1212 StringBuilder sql =
new StringBuilder();
1213 sql.append(
"SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id FROM ");
1214 sql.append(tableName);
1215 sql.append(
" LEFT JOIN cases ON ");
1216 sql.append(tableName);
1217 sql.append(
".case_id=cases.id");
1218 sql.append(
" LEFT JOIN data_sources ON ");
1219 sql.append(tableName);
1220 sql.append(
".data_source_id=data_sources.id");
1221 sql.append(
" WHERE value=? AND known_status=?");
1224 preparedStatement = conn.prepareStatement(sql.toString());
1225 preparedStatement.setString(1, value);
1226 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1227 resultSet = preparedStatement.executeQuery();
1228 while (resultSet.next()) {
1230 artifactInstances.add(artifactInstance);
1232 }
catch (SQLException ex) {
1233 throw new EamDbException(
"Error getting notable artifact instances.", ex);
1240 return artifactInstances;
1259 Long badInstances = 0L;
1260 PreparedStatement preparedStatement = null;
1261 ResultSet resultSet = null;
1264 StringBuilder sql =
new StringBuilder();
1265 sql.append(
"SELECT count(*) FROM ");
1266 sql.append(tableName);
1267 sql.append(
" WHERE value=? AND known_status=?");
1270 preparedStatement = conn.prepareStatement(sql.toString());
1271 preparedStatement.setString(1, value);
1272 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1273 resultSet = preparedStatement.executeQuery();
1275 badInstances = resultSet.getLong(1);
1276 }
catch (SQLException ex) {
1277 throw new EamDbException(
"Error getting count of notable artifact instances.", ex);
1284 return badInstances;
1307 Collection<String> caseNames =
new LinkedHashSet<>();
1309 PreparedStatement preparedStatement = null;
1310 ResultSet resultSet = null;
1313 StringBuilder sql =
new StringBuilder();
1314 sql.append(
"SELECT DISTINCT case_name FROM ");
1315 sql.append(tableName);
1316 sql.append(
" INNER JOIN cases ON ");
1317 sql.append(tableName);
1318 sql.append(
".case_id=cases.id WHERE ");
1319 sql.append(tableName);
1320 sql.append(
".value=? AND ");
1321 sql.append(tableName);
1322 sql.append(
".known_status=?");
1325 preparedStatement = conn.prepareStatement(sql.toString());
1326 preparedStatement.setString(1, value);
1327 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1328 resultSet = preparedStatement.executeQuery();
1329 while (resultSet.next()) {
1330 caseNames.add(resultSet.getString(
"case_name"));
1332 }
catch (SQLException ex) {
1333 throw new EamDbException(
"Error getting notable artifact instances.", ex);
1340 return caseNames.stream().collect(Collectors.toList());
1364 PreparedStatement preparedStatement = null;
1365 String sql =
"DELETE FROM reference_sets WHERE id=?";
1368 preparedStatement = conn.prepareStatement(sql);
1369 preparedStatement.setInt(1, referenceSetID);
1370 preparedStatement.executeUpdate();
1371 }
catch (SQLException ex) {
1372 throw new EamDbException(
"Error deleting reference set " + referenceSetID, ex);
1389 PreparedStatement preparedStatement = null;
1390 String sql =
"DELETE FROM %s WHERE reference_set_id=?";
1396 preparedStatement = conn.prepareStatement(String.format(sql, fileTableName));
1397 preparedStatement.setInt(1, referenceSetID);
1398 preparedStatement.executeUpdate();
1399 }
catch (SQLException ex) {
1400 throw new EamDbException(
"Error deleting files from reference set " + referenceSetID, ex);
1421 if(refSet == null) {
1455 Long matchingInstances = 0L;
1456 PreparedStatement preparedStatement = null;
1457 ResultSet resultSet = null;
1458 String sql =
"SELECT count(*) FROM %s WHERE value=? AND reference_set_id=?";
1463 preparedStatement = conn.prepareStatement(String.format(sql, fileTableName));
1464 preparedStatement.setString(1, value);
1465 preparedStatement.setInt(2, referenceSetID);
1466 resultSet = preparedStatement.executeQuery();
1468 matchingInstances = resultSet.getLong(1);
1469 }
catch (SQLException ex) {
1470 throw new EamDbException(
"Error determining if value (" + value +
") is in reference set " + referenceSetID, ex);
1477 return 0 < matchingInstances;
1501 Long badInstances = 0L;
1502 PreparedStatement preparedStatement = null;
1503 ResultSet resultSet = null;
1504 String sql =
"SELECT count(*) FROM %s WHERE value=? AND known_status=?";
1508 preparedStatement.setString(1, value);
1509 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1510 resultSet = preparedStatement.executeQuery();
1512 badInstances = resultSet.getLong(1);
1513 }
catch (SQLException ex) {
1514 throw new EamDbException(
"Error determining if artifact is notable by reference.", ex);
1521 return 0 < badInstances;
1535 if(eamOrg == null) {
1540 ResultSet generatedKeys = null;
1541 PreparedStatement preparedStatement = null;
1542 String sql =
"INSERT INTO organizations(org_name, poc_name, poc_email, poc_phone) VALUES (?, ?, ?, ?) "
1546 preparedStatement = conn.prepareStatement(sql, Statement.RETURN_GENERATED_KEYS);
1547 preparedStatement.setString(1, eamOrg.getName());
1548 preparedStatement.setString(2, eamOrg.getPocName());
1549 preparedStatement.setString(3, eamOrg.getPocEmail());
1550 preparedStatement.setString(4, eamOrg.getPocPhone());
1552 preparedStatement.executeUpdate();
1553 generatedKeys = preparedStatement.getGeneratedKeys();
1554 if (generatedKeys.next()) {
1555 return generatedKeys.getLong(1);
1557 throw new SQLException(
"Creating user failed, no ID obtained.");
1559 }
catch (SQLException ex) {
1560 throw new EamDbException(
"Error inserting new organization.", ex);
1579 List<EamOrganization> orgs =
new ArrayList<>();
1580 PreparedStatement preparedStatement = null;
1581 ResultSet resultSet = null;
1582 String sql =
"SELECT * FROM organizations";
1585 preparedStatement = conn.prepareStatement(sql);
1586 resultSet = preparedStatement.executeQuery();
1587 while (resultSet.next()) {
1592 }
catch (SQLException ex) {
1593 throw new EamDbException(
"Error getting all organizations.", ex);
1614 PreparedStatement preparedStatement = null;
1615 ResultSet resultSet = null;
1616 String sql =
"SELECT * FROM organizations WHERE id=?";
1619 preparedStatement = conn.prepareStatement(sql);
1620 preparedStatement.setInt(1, orgID);
1621 resultSet = preparedStatement.executeQuery();
1625 }
catch (SQLException ex) {
1626 throw new EamDbException(
"Error getting organization by id.", ex);
1645 if(globalSet == null) {
1646 throw new EamDbException(
"Reference set with ID " + referenceSetID +
" not found");
1661 if(updatedOrganization == null) {
1666 PreparedStatement preparedStatement = null;
1667 String sql =
"UPDATE organizations SET org_name = ?, poc_name = ?, poc_email = ?, poc_phone = ? WHERE id = ?";
1669 preparedStatement = conn.prepareStatement(sql);
1670 preparedStatement.setString(1, updatedOrganization.getName());
1671 preparedStatement.setString(2, updatedOrganization.getPocName());
1672 preparedStatement.setString(3, updatedOrganization.getPocEmail());
1673 preparedStatement.setString(4, updatedOrganization.getPocPhone());
1674 preparedStatement.setInt(5, updatedOrganization.getOrgID());
1675 preparedStatement.executeUpdate();
1676 }
catch (SQLException ex) {
1684 @Messages({
"AbstractSqlEamDb.deleteOrganization.inUseException.message=Can not delete organization "
1685 +
"which is currently in use by a case or reference set in the central repository.",
1686 "AbstractSqlEamDb.deleteOrganization.errorDeleting.message=Error executing query when attempting to delete organization by id."})
1689 if(organizationToDelete == null) {
1694 PreparedStatement checkIfUsedStatement = null;
1695 ResultSet resultSet = null;
1696 String checkIfUsedSql =
"SELECT (select count(*) FROM cases WHERE org_id=?) + (select count(*) FROM reference_sets WHERE org_id=?)";
1697 PreparedStatement deleteOrgStatement = null;
1698 String deleteOrgSql =
"DELETE FROM organizations WHERE id=?";
1700 checkIfUsedStatement = conn.prepareStatement(checkIfUsedSql);
1701 checkIfUsedStatement.setInt(1, organizationToDelete.
getOrgID());
1702 checkIfUsedStatement.setInt(2, organizationToDelete.
getOrgID());
1703 resultSet = checkIfUsedStatement.executeQuery();
1705 if (resultSet.getLong(1) > 0) {
1706 throw new EamDbException(Bundle.AbstractSqlEamDb_deleteOrganization_inUseException_message());
1708 deleteOrgStatement = conn.prepareStatement(deleteOrgSql);
1709 deleteOrgStatement.setInt(1, organizationToDelete.
getOrgID());
1710 deleteOrgStatement.executeUpdate();
1711 }
catch (SQLException ex) {
1712 throw new EamDbException(Bundle.AbstractSqlEamDb_deleteOrganization_errorDeleting_message(), ex);
1732 if(eamGlobalSet == null){
1736 if(eamGlobalSet.getFileKnownStatus() == null){
1737 throw new EamDbException(
"File known status on the EamGlobalSet is null");
1740 if(eamGlobalSet.getType() == null){
1746 PreparedStatement preparedStatement1 = null;
1747 PreparedStatement preparedStatement2 = null;
1748 ResultSet resultSet = null;
1749 String sql1 =
"INSERT INTO reference_sets(org_id, set_name, version, known_status, read_only, type, import_date) VALUES (?, ?, ?, ?, ?, ?, ?) "
1751 String sql2 =
"SELECT id FROM reference_sets WHERE org_id=? AND set_name=? AND version=? AND import_date=? LIMIT 1";
1754 preparedStatement1 = conn.prepareStatement(sql1);
1755 preparedStatement1.setInt(1, eamGlobalSet.getOrgID());
1756 preparedStatement1.setString(2, eamGlobalSet.getSetName());
1757 preparedStatement1.setString(3, eamGlobalSet.getVersion());
1758 preparedStatement1.setInt(4, eamGlobalSet.getFileKnownStatus().getFileKnownValue());
1759 preparedStatement1.setBoolean(5, eamGlobalSet.isReadOnly());
1760 preparedStatement1.setInt(6, eamGlobalSet.getType().getId());
1761 preparedStatement1.setString(7, eamGlobalSet.getImportDate().toString());
1763 preparedStatement1.executeUpdate();
1765 preparedStatement2 = conn.prepareStatement(sql2);
1766 preparedStatement2.setInt(1, eamGlobalSet.getOrgID());
1767 preparedStatement2.setString(2, eamGlobalSet.getSetName());
1768 preparedStatement2.setString(3, eamGlobalSet.getVersion());
1769 preparedStatement2.setString(4, eamGlobalSet.getImportDate().toString());
1771 resultSet = preparedStatement2.executeQuery();
1773 return resultSet.getInt(
"id");
1775 }
catch (SQLException ex) {
1798 PreparedStatement preparedStatement1 = null;
1799 ResultSet resultSet = null;
1800 String sql1 =
"SELECT * FROM reference_sets WHERE id=?";
1803 preparedStatement1 = conn.prepareStatement(sql1);
1804 preparedStatement1.setInt(1, referenceSetID);
1805 resultSet = preparedStatement1.executeQuery();
1806 if(resultSet.next()) {
1812 }
catch (SQLException ex) {
1813 throw new EamDbException(
"Error getting reference set by id.", ex);
1833 if(correlationType == null){
1834 throw new EamDbException(
"Correlation type is null");
1837 List<EamGlobalSet> results =
new ArrayList<>();
1840 PreparedStatement preparedStatement1 = null;
1841 ResultSet resultSet = null;
1842 String sql1 =
"SELECT * FROM reference_sets WHERE type=" + correlationType.getId();
1845 preparedStatement1 = conn.prepareStatement(sql1);
1846 resultSet = preparedStatement1.executeQuery();
1847 while (resultSet.next()) {
1851 }
catch (SQLException ex) {
1852 throw new EamDbException(
"Error getting reference sets.", ex);
1872 throw new EamDbException(
"known status of EamGlobalFileInstance is null");
1874 if(correlationType == null){
1875 throw new EamDbException(
"Correlation type is null");
1880 PreparedStatement preparedStatement = null;
1882 String sql =
"INSERT INTO %s(reference_set_id, value, known_status, comment) VALUES (?, ?, ?, ?) "
1887 preparedStatement.setInt(1, eamGlobalFileInstance.
getGlobalSetID());
1888 preparedStatement.setString(2, eamGlobalFileInstance.
getMD5Hash());
1889 preparedStatement.setByte(3, eamGlobalFileInstance.
getKnownStatus().getFileKnownValue());
1890 preparedStatement.setString(4, eamGlobalFileInstance.
getComment());
1891 preparedStatement.executeUpdate();
1892 }
catch (SQLException ex) {
1893 throw new EamDbException(
"Error inserting new reference instance into reference_ table.", ex);
1914 PreparedStatement preparedStatement1 = null;
1915 ResultSet resultSet = null;
1916 String sql1 =
"SELECT * FROM reference_sets WHERE set_name=? AND version=?";
1919 preparedStatement1 = conn.prepareStatement(sql1);
1920 preparedStatement1.setString(1, referenceSetName);
1921 preparedStatement1.setString(2, version);
1922 resultSet = preparedStatement1.executeQuery();
1923 return (resultSet.next());
1925 }
catch (SQLException ex) {
1926 throw new EamDbException(
"Error testing whether reference set exists (name: " + referenceSetName
1927 +
" version: " + version, ex);
1942 if(contentType == null) {
1943 throw new EamDbException(
"Null correlation type");
1945 if(globalInstances == null) {
1946 throw new EamDbException(
"Null set of EamGlobalFileInstance");
1951 PreparedStatement bulkPs = null;
1953 conn.setAutoCommit(
false);
1956 String sql =
"INSERT INTO %s(reference_set_id, value, known_status, comment) VALUES (?, ?, ?, ?) "
1962 if(globalInstance.getKnownStatus() == null){
1963 throw new EamDbException(
"EamGlobalFileInstance with value " + globalInstance.getMD5Hash() +
" has null known status");
1966 bulkPs.setInt(1, globalInstance.getGlobalSetID());
1967 bulkPs.setString(2, globalInstance.getMD5Hash());
1968 bulkPs.setByte(3, globalInstance.getKnownStatus().getFileKnownValue());
1969 bulkPs.setString(4, globalInstance.getComment());
1973 bulkPs.executeBatch();
1975 }
catch (SQLException | EamDbException ex) {
1978 }
catch (SQLException ex2) {
1981 throw new EamDbException(
"Error inserting bulk artifacts.", ex);
2006 List<EamGlobalFileInstance> globalFileInstances =
new ArrayList<>();
2007 PreparedStatement preparedStatement1 = null;
2008 ResultSet resultSet = null;
2009 String sql1 =
"SELECT * FROM %s WHERE value=?";
2013 preparedStatement1.setString(1, aValue);
2014 resultSet = preparedStatement1.executeQuery();
2015 while (resultSet.next()) {
2018 return globalFileInstances;
2020 }
catch (SQLException ex) {
2021 throw new EamDbException(
"Error getting reference instances by type and value.", ex);
2040 if (newType == null) {
2041 throw new EamDbException(
"null correlation type");
2046 PreparedStatement preparedStatement = null;
2047 PreparedStatement preparedStatementQuery = null;
2048 ResultSet resultSet = null;
2053 if (-1 == newType.getId()) {
2054 insertSql =
"INSERT INTO correlation_types(display_name, db_table_name, supported, enabled) VALUES (?, ?, ?, ?) " +
getConflictClause();
2056 insertSql =
"INSERT INTO correlation_types(id, display_name, db_table_name, supported, enabled) VALUES (?, ?, ?, ?, ?) " +
getConflictClause();
2058 querySql =
"SELECT * FROM correlation_types WHERE display_name=? AND db_table_name=?";
2061 preparedStatement = conn.prepareStatement(insertSql);
2063 if (-1 == newType.getId()) {
2064 preparedStatement.setString(1, newType.getDisplayName());
2065 preparedStatement.setString(2, newType.getDbTableName());
2066 preparedStatement.setInt(3, newType.isSupported() ? 1 : 0);
2067 preparedStatement.setInt(4, newType.isEnabled() ? 1 : 0);
2069 preparedStatement.setInt(1, newType.getId());
2070 preparedStatement.setString(2, newType.getDisplayName());
2071 preparedStatement.setString(3, newType.getDbTableName());
2072 preparedStatement.setInt(4, newType.isSupported() ? 1 : 0);
2073 preparedStatement.setInt(5, newType.isEnabled() ? 1 : 0);
2076 preparedStatement.executeUpdate();
2078 preparedStatementQuery = conn.prepareStatement(querySql);
2079 preparedStatementQuery.setString(1, newType.getDisplayName());
2080 preparedStatementQuery.setString(2, newType.getDbTableName());
2082 resultSet = preparedStatementQuery.executeQuery();
2083 if (resultSet.next()) {
2085 typeId = correlationType.getId();
2087 }
catch (SQLException ex) {
2088 throw new EamDbException(
"Error inserting new correlation type.", ex);
2103 PreparedStatement preparedStatement = null;
2104 ResultSet resultSet = null;
2105 String sql =
"SELECT * FROM correlation_types";
2108 preparedStatement = conn.prepareStatement(sql);
2109 resultSet = preparedStatement.executeQuery();
2110 while (resultSet.next()) {
2115 }
catch (SQLException ex) {
2116 throw new EamDbException(
"Error getting all correlation types.", ex);
2138 PreparedStatement preparedStatement = null;
2139 ResultSet resultSet = null;
2140 String sql =
"SELECT * FROM correlation_types WHERE enabled=1";
2143 preparedStatement = conn.prepareStatement(sql);
2144 resultSet = preparedStatement.executeQuery();
2145 while (resultSet.next()) {
2150 }
catch (SQLException ex) {
2151 throw new EamDbException(
"Error getting enabled correlation types.", ex);
2173 PreparedStatement preparedStatement = null;
2174 ResultSet resultSet = null;
2175 String sql =
"SELECT * FROM correlation_types WHERE supported=1";
2178 preparedStatement = conn.prepareStatement(sql);
2179 resultSet = preparedStatement.executeQuery();
2180 while (resultSet.next()) {
2185 }
catch (SQLException ex) {
2186 throw new EamDbException(
"Error getting supported correlation types.", ex);
2205 PreparedStatement preparedStatement = null;
2206 String sql =
"UPDATE correlation_types SET display_name=?, db_table_name=?, supported=?, enabled=? WHERE id=?";
2209 preparedStatement = conn.prepareStatement(sql);
2210 preparedStatement.setString(1, aType.getDisplayName());
2211 preparedStatement.setString(2, aType.getDbTableName());
2212 preparedStatement.setInt(3, aType.isSupported() ? 1 : 0);
2213 preparedStatement.setInt(4, aType.isEnabled() ? 1 : 0);
2214 preparedStatement.setInt(5, aType.getId());
2215 preparedStatement.executeUpdate();
2217 }
catch (SQLException ex) {
2218 throw new EamDbException(
"Error updating correlation type.", ex);
2240 PreparedStatement preparedStatement = null;
2241 ResultSet resultSet = null;
2242 String sql =
"SELECT * FROM correlation_types WHERE id=?";
2245 preparedStatement = conn.prepareStatement(sql);
2246 preparedStatement.setInt(1, typeId);
2247 resultSet = preparedStatement.executeQuery();
2248 if(resultSet.next()) {
2252 throw new EamDbException(
"Failed to find entry for correlation type ID = " + typeId);
2255 }
catch (SQLException ex) {
2256 throw new EamDbException(
"Error getting correlation type by id.", ex);
2275 if (null == resultSet) {
2281 resultSet.getInt(
"org_id");
2282 if (!resultSet.wasNull()) {
2285 resultSet.getString(
"org_name"),
2286 resultSet.getString(
"poc_name"),
2287 resultSet.getString(
"poc_email"),
2288 resultSet.getString(
"poc_phone"));
2298 eamCase.
setNotes(resultSet.getString(
"notes"));
2304 if (null == resultSet) {
2309 resultSet.getInt(
"case_id"),
2310 resultSet.getInt(
"id"),
2311 resultSet.getString(
"device_id"),
2312 resultSet.getString(
"name")
2315 return eamDataSource;
2319 if (null == resultSet) {
2324 resultSet.getInt(
"id"),
2325 resultSet.getString(
"display_name"),
2326 resultSet.getString(
"db_table_name"),
2327 resultSet.getBoolean(
"supported"),
2328 resultSet.getBoolean(
"enabled")
2331 return eamArtifactType;
2345 if (null == resultSet) {
2349 new CorrelationCase(resultSet.getInt(
"case_id"), resultSet.getString(
"case_uid"), resultSet.getString(
"case_name")),
2350 new CorrelationDataSource(-1, resultSet.getInt(
"case_id"), resultSet.getString(
"device_id"), resultSet.getString(
"name")),
2351 resultSet.getString(
"file_path"),
2352 resultSet.getString(
"comment"),
2353 TskData.FileKnown.valueOf(resultSet.getByte(
"known_status"))
2356 return eamArtifactInstance;
2360 if (null == resultSet) {
2365 resultSet.getInt(
"id"),
2366 resultSet.getString(
"org_name"),
2367 resultSet.getString(
"poc_name"),
2368 resultSet.getString(
"poc_email"),
2369 resultSet.getString(
"poc_phone")
2372 return eamOrganization;
2376 if (null == resultSet) {
2381 resultSet.getInt(
"id"),
2382 resultSet.getInt(
"org_id"),
2383 resultSet.getString(
"set_name"),
2384 resultSet.getString(
"version"),
2385 TskData.FileKnown.valueOf(resultSet.getByte(
"known_status")),
2386 resultSet.getBoolean(
"read_only"),
2388 LocalDate.parse(resultSet.getString(
"import_date"))
2391 return eamGlobalSet;
2395 if (null == resultSet) {
2400 resultSet.getInt(
"id"),
2401 resultSet.getInt(
"reference_set_id"),
2402 resultSet.getString(
"value"),
2403 TskData.FileKnown.valueOf(resultSet.getByte(
"known_status")),
2404 resultSet.getString(
"comment")
2407 return eamGlobalFileInstance;
2418 ResultSet resultSet = null;
2419 Statement statement;
2420 Connection conn = null;
2424 conn.setAutoCommit(
false);
2425 statement = conn.createStatement();
2427 int minorVersion = 0;
2428 int majorVersion = 0;
2429 resultSet = statement.executeQuery(
"SELECT value FROM db_info WHERE name='SCHEMA_MINOR_VERSION'");
2430 if (resultSet.next()) {
2431 String minorVersionStr = resultSet.getString(
"value");
2433 minorVersion = Integer.parseInt(minorVersionStr);
2434 }
catch (NumberFormatException ex) {
2435 throw new EamDbException(
"Bad value for schema minor version (" + minorVersionStr +
") - database is corrupt");
2439 resultSet = statement.executeQuery(
"SELECT value FROM db_info WHERE name='SCHEMA_VERSION'");
2440 if (resultSet.next()) {
2441 String majorVersionStr = resultSet.getString(
"value");
2443 majorVersion = Integer.parseInt(majorVersionStr);
2444 }
catch (NumberFormatException ex) {
2445 throw new EamDbException(
"Bad value for schema version (" + majorVersionStr +
") - database is corrupt");
2449 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(majorVersion, minorVersion);
2451 LOGGER.log(Level.INFO,
"Central Repository is up to date");
2456 if (dbSchemaVersion.compareTo(
new CaseDbSchemaVersionNumber(1, 1)) < 0) {
2457 statement.execute(
"ALTER TABLE reference_sets ADD COLUMN known_status INTEGER;");
2458 statement.execute(
"ALTER TABLE reference_sets ADD COLUMN read_only BOOLEAN;");
2459 statement.execute(
"ALTER TABLE reference_sets ADD COLUMN type INTEGER;");
2464 EamDbUtil.insertDefaultOrganization(conn);
2467 if (!updateSchemaVersion(conn)) {
2468 throw new EamDbException(
"Error updating schema version");
2473 }
catch (SQLException | EamDbException ex) {
2478 }
catch (SQLException ex2) {
2479 LOGGER.log(Level.SEVERE,
"Database rollback failed", ex2);
String getCorrelationValue()
CorrelationAttribute.Type getCorrelationTypeById(int typeId)
void bulkInsertCases(List< CorrelationCase > cases)
TskData.FileKnown getKnownStatus()
int getFrequencyPercentage(CorrelationAttribute corAttr)
CorrelationCase getCase(Case autopsyCase)
List< CorrelationAttributeInstance > getArtifactInstancesByTypeValue(CorrelationAttribute.Type aType, String value)
void deleteReferenceSet(int referenceSetID)
CorrelationCase newCase(Case autopsyCase)
void updateOrganization(EamOrganization updatedOrganization)
void addArtifact(CorrelationAttribute eamArtifact)
CorrelationCase getEamCaseFromResultSet(ResultSet resultSet)
void setCreationDate(String creationDate)
List< EamOrganization > getOrganizations()
EamOrganization getReferenceSetOrganization(int referenceSetID)
Type getCorrelationType()
static final int FILES_TYPE_ID
synchronized CorrelationCase newCase(CorrelationCase eamCase)
abstract Connection connect()
void updateCorrelationType(CorrelationAttribute.Type aType)
List< EamGlobalFileInstance > getReferenceInstancesByTypeValue(CorrelationAttribute.Type aType, String aValue)
void prepareBulkArtifact(CorrelationAttribute eamArtifact)
static void closeResultSet(ResultSet resultSet)
Long getCountArtifactInstancesByCaseDataSource(String caseUUID, String dataSourceID)
Long getCountArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
int newReferenceSet(EamGlobalSet eamGlobalSet)
List< String > getListCasesHavingArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
String getDbInfo(String name)
Long getCountUniqueDataSources()
void deleteReferenceSetEntry(int referenceSetID)
List< CorrelationDataSource > getDataSources()
int bulkArtifactsThreshold
void setExaminerPhone(String examinerPhone)
void setExaminerName(String examinerName)
void setCaseNumber(String caseNumber)
final List< CorrelationAttribute.Type > DEFAULT_CORRELATION_TYPES
void deleteReferenceSetEntries(int referenceSetID)
abstract String getConflictClause()
void deleteOrganization(EamOrganization organizationToDelete)
CorrelationAttribute.Type getCorrelationTypeById(int typeId)
static String correlationTypeToReferenceTableName(CorrelationAttribute.Type type)
EamOrganization getOrganizationByID(int orgID)
void setOrg(EamOrganization org)
List< CorrelationAttributeInstance > getArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
List< CorrelationAttributeInstance > getArtifactInstancesByPath(CorrelationAttribute.Type aType, String filePath)
long newOrganization(EamOrganization eamOrg)
static EamDb getInstance()
void setNotes(String notes)
List< CorrelationAttribute.Type > getDefinedCorrelationTypes()
static void closeConnection(Connection conn)
boolean isValueInReferenceSet(String value, int referenceSetID, int correlationTypeID)
EamGlobalSet getReferenceSetByID(int referenceSetID)
void addReferenceInstance(EamGlobalFileInstance eamGlobalFileInstance, CorrelationAttribute.Type correlationType)
void setArtifactInstanceKnownStatus(CorrelationAttribute eamArtifact, TskData.FileKnown knownStatus)
boolean referenceSetExists(String referenceSetName, String version)
boolean isFileHashInReferenceSet(String hash, int referenceSetID)
CorrelationAttribute.Type getCorrelationTypeFromResultSet(ResultSet resultSet)
boolean isArtifactKnownBadByReference(CorrelationAttribute.Type aType, String value)
List< CorrelationAttributeInstance > getInstances()
CorrelationAttributeInstance getEamArtifactInstanceFromResultSet(ResultSet resultSet)
void updateCase(CorrelationCase eamCase)
EamGlobalSet getEamGlobalSetFromResultSet(ResultSet resultSet)
EamOrganization getEamOrganizationFromResultSet(ResultSet resultSet)
CorrelationDataSource getCorrelationDataSource()
void bulkInsertReferenceTypeEntries(Set< EamGlobalFileInstance > globalInstances, CorrelationAttribute.Type contentType)
List< CorrelationAttribute.Type > getSupportedCorrelationTypes()
Long getCountArtifactInstancesByTypeValue(CorrelationAttribute.Type aType, String value)
CorrelationCase getCaseByUUID(String caseUUID)
static String correlationTypeToInstanceTableName(CorrelationAttribute.Type type)
Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttribute.Type aType, String value)
CorrelationDataSource getEamDataSourceFromResultSet(ResultSet resultSet)
void bulkInsertArtifacts()
static final CaseDbSchemaVersionNumber CURRENT_DB_SCHEMA_VERSION
CorrelationDataSource getDataSource(CorrelationCase correlationCase, String dataSourceDeviceId)
List< CorrelationAttribute.Type > getEnabledCorrelationTypes()
List< CorrelationCase > getCases()
void newDataSource(CorrelationDataSource eamDataSource)
synchronized static Logger getLogger(String name)
static List< CorrelationAttribute.Type > getDefaultCorrelationTypes()
boolean referenceSetIsValid(int referenceSetID, String setName, String version)
int newCorrelationType(CorrelationAttribute.Type newType)
EamGlobalFileInstance getEamGlobalFileInstanceFromResultSet(ResultSet resultSet)
CorrelationCase getCorrelationCase()
void newDbInfo(String name, String value)
static EamOrganization getDefault()
List< EamGlobalSet > getAllReferenceSets(CorrelationAttribute.Type correlationType)
static final Logger LOGGER
void setExaminerEmail(String examinerEmail)
final Map< String, Collection< CorrelationAttribute > > bulkArtifacts
static void closePreparedStatement(PreparedStatement preparedStatement)
void updateDbInfo(String name, String value)