Autopsy  4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | Static Public Member Functions | List of all members
org.sleuthkit.autopsy.centralrepository.datamodel.EamDb Interface Reference

Inherited by org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.

Public Member Functions

void addArtifactInstance (CorrelationAttributeInstance eamArtifact) throws EamDbException
 
void addAttributeInstanceBulk (CorrelationAttributeInstance eamArtifact) throws EamDbException
 
void addDataSourceObjectId (int rowId, long dataSourceObjectId) throws EamDbException
 
void addReferenceInstance (EamGlobalFileInstance eamGlobalFileInstance, CorrelationAttributeInstance.Type correlationType) throws EamDbException
 
void bulkInsertCases (List< CorrelationCase > cases) throws EamDbException
 
void bulkInsertReferenceTypeEntries (Set< EamGlobalFileInstance > globalInstances, CorrelationAttributeInstance.Type contentType) throws EamDbException
 
void commitAttributeInstancesBulk () throws EamDbException
 
void deleteOrganization (EamOrganization organizationToDelete) throws EamDbException
 
void deleteReferenceSet (int referenceSetID) throws EamDbException
 
List< EamGlobalSetgetAllReferenceSets (CorrelationAttributeInstance.Type correlationType) throws EamDbException
 
List< CorrelationAttributeInstancegetArtifactInstancesByPath (CorrelationAttributeInstance.Type aType, String filePath) throws EamDbException
 
List< CorrelationAttributeInstancegetArtifactInstancesByTypeValue (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException
 
List< CorrelationAttributeInstancegetArtifactInstancesKnownBad (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException
 
List< CorrelationAttributeInstancegetArtifactInstancesKnownBad (CorrelationAttributeInstance.Type aType) throws EamDbException
 
CorrelationCase getCase (Case autopsyCase) throws EamDbException
 
CorrelationCase getCaseById (int caseId) throws EamDbException
 
CorrelationCase getCaseByUUID (String caseUUID) throws EamDbException
 
List< CorrelationCasegetCases () throws EamDbException
 
CorrelationAttributeInstance getCorrelationAttributeInstance (CorrelationAttributeInstance.Type type, CorrelationCase correlationCase, CorrelationDataSource correlationDataSource, String value, String filePath) throws EamDbException, CorrelationAttributeNormalizationException
 
CorrelationAttributeInstance getCorrelationAttributeInstance (CorrelationAttributeInstance.Type type, CorrelationCase correlationCase, CorrelationDataSource correlationDataSource, long objectID) throws EamDbException, CorrelationAttributeNormalizationException
 
CorrelationAttributeInstance.Type getCorrelationTypeById (int typeId) throws EamDbException
 
Long getCountArtifactInstancesByCaseDataSource (CorrelationDataSource correlationDataSource) throws EamDbException
 
Long getCountArtifactInstancesByTypeValue (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException
 
Long getCountArtifactInstancesKnownBad (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException
 
Long getCountUniqueCaseDataSourceTuplesHavingTypeValue (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException
 
Long getCountUniqueDataSources () throws EamDbException
 
CorrelationDataSource getDataSource (CorrelationCase correlationCase, Long caseDbDataSourceId) throws EamDbException
 
CorrelationDataSource getDataSourceById (CorrelationCase correlationCase, int dataSourceId) throws EamDbException
 
List< CorrelationDataSourcegetDataSources () throws EamDbException
 
String getDbInfo (String name) throws EamDbException
 
List< CorrelationAttributeInstance.Type > getDefinedCorrelationTypes () throws EamDbException
 
List< CorrelationAttributeInstance.Type > getEnabledCorrelationTypes () throws EamDbException
 
CoordinationService.Lock getExclusiveMultiUserDbLock () throws EamDbException
 
int getFrequencyPercentage (CorrelationAttributeInstance corAttr) throws EamDbException, CorrelationAttributeNormalizationException
 
List< String > getListCasesHavingArtifactInstancesKnownBad (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException
 
EamOrganization getOrganizationByID (int orgID) throws EamDbException
 
List< EamOrganizationgetOrganizations () throws EamDbException
 
List< EamGlobalFileInstancegetReferenceInstancesByTypeValue (CorrelationAttributeInstance.Type aType, String aValue) throws EamDbException, CorrelationAttributeNormalizationException
 
EamGlobalSet getReferenceSetByID (int globalSetID) throws EamDbException
 
EamOrganization getReferenceSetOrganization (int referenceSetID) throws EamDbException
 
List< CorrelationAttributeInstance.Type > getSupportedCorrelationTypes () throws EamDbException
 
boolean isArtifactKnownBadByReference (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException
 
boolean isFileHashInReferenceSet (String hash, int referenceSetID) throws EamDbException, CorrelationAttributeNormalizationException
 
boolean isValueInReferenceSet (String value, int referenceSetID, int correlationTypeID) throws EamDbException, CorrelationAttributeNormalizationException
 
CorrelationCase newCase (CorrelationCase eamCase) throws EamDbException
 
CorrelationCase newCase (Case autopsyCase) throws EamDbException
 
int newCorrelationType (CorrelationAttributeInstance.Type newType) throws EamDbException
 
CorrelationDataSource newDataSource (CorrelationDataSource eamDataSource) throws EamDbException
 
void newDbInfo (String name, String value) throws EamDbException
 
EamOrganization newOrganization (EamOrganization eamOrg) throws EamDbException
 
int newReferenceSet (EamGlobalSet eamGlobalSet) throws EamDbException
 
void processInstanceTable (CorrelationAttributeInstance.Type type, InstanceTableCallback instanceTableCallback) throws EamDbException
 
void processInstanceTableWhere (CorrelationAttributeInstance.Type type, String whereClause, InstanceTableCallback instanceTableCallback) throws EamDbException
 
boolean referenceSetExists (String referenceSetName, String version) throws EamDbException
 
boolean referenceSetIsValid (int referenceSetID, String referenceSetName, String version) throws EamDbException
 
void reset () throws EamDbException
 
void saveSettings ()
 
void setAttributeInstanceKnownStatus (CorrelationAttributeInstance eamArtifact, TskData.FileKnown knownStatus) throws EamDbException
 
void shutdownConnections () throws EamDbException
 
void updateAttributeInstanceComment (CorrelationAttributeInstance eamArtifact) throws EamDbException
 
void updateCase (CorrelationCase eamCase) throws EamDbException
 
void updateCorrelationType (CorrelationAttributeInstance.Type aType) throws EamDbException
 
void updateDbInfo (String name, String value) throws EamDbException
 
void updateOrganization (EamOrganization updatedOrganization) throws EamDbException
 
void updateSettings ()
 
void upgradeSchema () throws EamDbException, SQLException
 

Static Public Member Functions

static EamDb getInstance () throws EamDbException
 
static boolean isEnabled ()
 

Detailed Description

Main interface for interacting with the database

Definition at line 32 of file EamDb.java.

Member Function Documentation

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addArtifactInstance ( CorrelationAttributeInstance  eamArtifact) throws EamDbException

Inserts new Artifact(s) into the database. Should add associated Case and Data Source first.

Parameters
eamArtifactThe artifact to add

Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.actionPerformed(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addAttributeInstanceBulk ( CorrelationAttributeInstance  eamArtifact) throws EamDbException

Adds an eamArtifact to an internal list to be later added to DB. Artifact can have 1 or more Artifact Instances. Insert will be triggered by a threshold or a call to commitAttributeInstancesBulk().

Parameters
eamArtifactThe artifact to add
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addDataSourceObjectId ( int  rowId,
long  dataSourceObjectId 
) throws EamDbException

Set the data source object id for a specific entry in the data_sources table

Parameters
rowId- the row id for the data_sources table entry
dataSourceObjectId- the object id for the data source from the caseDb

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addReferenceInstance ( EamGlobalFileInstance  eamGlobalFileInstance,
CorrelationAttributeInstance.Type  correlationType 
) throws EamDbException

Add a new reference instance

Parameters
eamGlobalFileInstanceThe reference instance to add
correlationTypeCorrelation Type that this Reference Instance is
Exceptions
EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.bulkInsertCases ( List< CorrelationCase cases) throws EamDbException

Executes a bulk insert of the cases

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.bulkInsertReferenceTypeEntries ( Set< EamGlobalFileInstance globalInstances,
CorrelationAttributeInstance.Type  contentType 
) throws EamDbException

Insert the bulk collection of Global File Instances

Parameters
globalInstancesa Set of EamGlobalFileInstances to insert into the db.
contentTypethe Type of the global instances
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.doInBackground().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.commitAttributeInstancesBulk ( ) throws EamDbException

Executes a bulk insert of the eamArtifacts added from the addAttributeInstanceBulk() method

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.deleteOrganization ( EamOrganization  organizationToDelete) throws EamDbException

Delete an organization if it is not being used by any case.

Parameters
organizationToDeletethe organization to be deleted
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.deleteButtonActionPerformed().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.deleteReferenceSet ( int  referenceSetID) throws EamDbException
List<EamGlobalSet> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getAllReferenceSets ( CorrelationAttributeInstance.Type  correlationType) throws EamDbException

Get all reference sets

Parameters
correlationTypeType of sets to return
Returns
List of all reference sets in the central repository
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getCentralRepoHashSetsFromDatabase().

List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesByPath ( CorrelationAttributeInstance.Type  aType,
String  filePath 
) throws EamDbException

Retrieves eamArtifact instances from the database that are associated with the aType and filePath

Parameters
aTypeEamArtifact.Type to search for
filePathFile path to search for
Returns
List of 0 or more EamArtifactInstances
Exceptions
EamDbException
List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesByTypeValue ( CorrelationAttributeInstance.Type  aType,
String  value 
) throws EamDbException, CorrelationAttributeNormalizationException

Retrieves eamArtifact instances from the database that are associated with the eamArtifactType and eamArtifactValue of the given eamArtifact.

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
List of artifact instances for a given type/value

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelatedInstances(), and org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData().

List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesKnownBad ( CorrelationAttributeInstance.Type  aType,
String  value 
) throws EamDbException, CorrelationAttributeNormalizationException

Gets list of matching eamArtifact instances that have knownStatus = "Bad".

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
List with 0 or more matching eamArtifact instances.
List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesKnownBad ( CorrelationAttributeInstance.Type  aType) throws EamDbException

Gets list of matching eamArtifact instances that have knownStatus = "Bad".

Parameters
aTypeEamArtifact.Type to search for
Returns
List with 0 or more matching eamArtifact instances.
Exceptions
EamDbException
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCase ( Case  autopsyCase) throws EamDbException
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCaseById ( int  caseId) throws EamDbException
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCaseByUUID ( String  caseUUID) throws EamDbException

Retrieves Case details based on Case UUID

Parameters
caseUUIDunique identifier for a case
Returns
The retrieved case

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCaseDetails().

List<CorrelationCase> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCases ( ) throws EamDbException
CorrelationAttributeInstance org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationAttributeInstance ( CorrelationAttributeInstance.Type  type,
CorrelationCase  correlationCase,
CorrelationDataSource  correlationDataSource,
String  value,
String  filePath 
) throws EamDbException, CorrelationAttributeNormalizationException

Find a correlation attribute in the Central Repository database given the instance type, case, data source, value, and file path.

Method exists to support instances added using Central Repository version 1,1 and older

Parameters
typeThe type of instance.
correlationCaseThe case tied to the instance.
correlationDataSourceThe data source tied to the instance.
valueThe value tied to the instance.
filePathThe file path tied to the instance.
Returns
The correlation attribute if it exists; otherwise null.
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getInstanceFromContent(), and org.sleuthkit.autopsy.commonfilesearch.InterCaseSearchResultsProcessor.InterCaseCommonAttributeRowCallback.process().

CorrelationAttributeInstance org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationAttributeInstance ( CorrelationAttributeInstance.Type  type,
CorrelationCase  correlationCase,
CorrelationDataSource  correlationDataSource,
long  objectID 
) throws EamDbException, CorrelationAttributeNormalizationException

Find a correlation attribute in the Central Repository database given the instance type, case, data source, object id.

Parameters
typeThe type of instance.
correlationCaseThe case tied to the instance.
correlationDataSourceThe data source tied to the instance.
objectIDThe object id of the file tied to the instance.
Returns
The correlation attribute if it exists; otherwise null.
Exceptions
EamDbException
CorrelationAttributeInstance.Type org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationTypeById ( int  typeId) throws EamDbException
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountArtifactInstancesByCaseDataSource ( CorrelationDataSource  correlationDataSource) throws EamDbException

Retrieves number of eamArtifact instances in the database that are associated with the given data source.

Parameters
correlationDataSourceData source to search for
Returns
Number of artifact instances having caseDisplayName and dataSource
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountArtifactInstancesByTypeValue ( CorrelationAttributeInstance.Type  aType,
String  value 
) throws EamDbException, CorrelationAttributeNormalizationException

Retrieves number of artifact instances in the database that are associated with the ArtifactType and artifactValue of the given artifact.

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
Number of artifact instances having ArtifactType and ArtifactValue.

Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run().

Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountArtifactInstancesKnownBad ( CorrelationAttributeInstance.Type  aType,
String  value 
) throws EamDbException, CorrelationAttributeNormalizationException

Count matching eamArtifacts instances that have knownStatus = "Bad".

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
Number of matching eamArtifacts
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountUniqueCaseDataSourceTuplesHavingTypeValue ( CorrelationAttributeInstance.Type  aType,
String  value 
) throws EamDbException, CorrelationAttributeNormalizationException

Retrieves number of unique caseDisplayName / dataSource tuples in the database that are associated with the artifactType and artifactValue of the given artifact.

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
Number of unique tuples

Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addCountProperty(), org.sleuthkit.autopsy.commonfilesearch.CommonAttributeCountSearchResults.filterMetadata(), and org.sleuthkit.autopsy.commonfilesearch.CommonAttributeCaseSearchResults.filterValue().

Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountUniqueDataSources ( ) throws EamDbException
CorrelationDataSource org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDataSource ( CorrelationCase  correlationCase,
Long  caseDbDataSourceId 
) throws EamDbException

Retrieves Data Source details based on data source device ID

Parameters
correlationCasethe current CorrelationCase used for ensuring uniqueness of DataSource
caseDbDataSourceIdthe data source device ID number
Returns
The data source

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceAddedTask.run().

CorrelationDataSource org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDataSourceById ( CorrelationCase  correlationCase,
int  dataSourceId 
) throws EamDbException

Retrieves Data Source details based on data source ID

Parameters
correlationCasethe current CorrelationCase used for ensuring uniqueness of DataSource
dataSourceIdthe data source ID number
Returns
The data source

Referenced by org.sleuthkit.autopsy.commonfilesearch.InterCaseSearchResultsProcessor.InterCaseByCaseCallback.process(), and org.sleuthkit.autopsy.commonfilesearch.InterCaseSearchResultsProcessor.InterCaseCommonAttributeRowCallback.process().

List<CorrelationDataSource> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDataSources ( ) throws EamDbException

Retrieves data sources that are in DB

Returns
List of data sources

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources().

String org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDbInfo ( String  name) throws EamDbException

Get the value for the given name from the name/value db_info table.

Parameters
nameName to search for
Returns
value associated with name.
Exceptions
EamDbException
List<CorrelationAttributeInstance.Type> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDefinedCorrelationTypes ( ) throws EamDbException

Get the list of EamArtifact.Type's that are defined in the DB and can be used to correlate artifacts.

Returns
List of EamArtifact.Type's. If none are defined in the database, the default list will be returned.
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), and org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData().

List<CorrelationAttributeInstance.Type> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getEnabledCorrelationTypes ( ) throws EamDbException

Get the list of enabled EamArtifact.Type's that will be used to correlate artifacts.

Returns
List of enabled EamArtifact.Type's. If none are defined in the database, the default list will be returned.
Exceptions
EamDbException
CoordinationService.Lock org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getExclusiveMultiUserDbLock ( ) throws EamDbException

Gets an exclusive lock (if applicable). Will return the lock if successful, null if unsuccessful because locking isn't supported, and throw an exception if we should have been able to get the lock but failed (meaning the database is in use).

Returns
the lock, or null if locking is not supported
Exceptions
EamDbExceptionif the coordination service is running but we fail to get the lock

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().

int org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getFrequencyPercentage ( CorrelationAttributeInstance  corAttr) throws EamDbException, CorrelationAttributeNormalizationException

Calculate the percentage of data sources that have this attribute value.

Parameters
corAttrAttribute type and value to get data about
Returns
Int between 0 and 100

Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCommonalityDetails().

static EamDb org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance ( ) throws EamDbException
static

Get the instance

Returns
The EamDb instance or null if one is not configured.
Exceptions
EamDbException

Definition at line 41 of file EamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.DISABLED, org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.getSelectedPlatform(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.useCentralRepo().

Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.actionPerformed(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.addCorrelationAttributeToList(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addCountProperty(), org.sleuthkit.autopsy.centralrepository.optionspanel.EamDbSettingsDialog.bnOkActionPerformed(), org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.cancel(), org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchAction.createAndShowPanel(), org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.deleteButtonActionPerformed(), org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.deleteIncompleteSet(), org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.doInBackground(), org.sleuthkit.autopsy.commonfilesearch.CommonAttributeCaseSearchResults.filterMetadata(), org.sleuthkit.autopsy.commonfilesearch.CommonAttributeCountSearchResults.filterMetadata(), org.sleuthkit.autopsy.commonfilesearch.CommonAttributeCaseSearchResults.filterValue(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getCentralRepoHashSetsFromDatabase(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelatedInstances(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getInstanceFromContent(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeCorrelationAttributeInstanceUsingTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromContent(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstancesFromBlackboardArtifact(), org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.ManageOrganizationsDialog(), org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources(), org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData(), org.sleuthkit.autopsy.commonfilesearch.InterCaseSearchResultsProcessor.InterCaseByCaseCallback.process(), org.sleuthkit.autopsy.commonfilesearch.InterCaseSearchResultsProcessor.InterCaseCommonAttributeRowCallback.process(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.IngestModuleEventListener.propertyChange(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setEarliestCaseDate(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCaseDetails(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCommonalityDetails(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().

List<String> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getListCasesHavingArtifactInstancesKnownBad ( CorrelationAttributeInstance.Type  aType,
String  value 
) throws EamDbException, CorrelationAttributeNormalizationException

Gets list of distinct case display names, where each case has 1+ Artifact Instance matching eamArtifact with knownStatus = "Bad".

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
List of cases containing this artifact with instances marked as bad
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run().

EamOrganization org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getOrganizationByID ( int  orgID) throws EamDbException

Get an organization having the given ID

Parameters
orgIDThe id to look up
Returns
The organization with the given ID
Exceptions
EamDbException
List<EamOrganization> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getOrganizations ( ) throws EamDbException

Get all organizations

Returns
A list of all organizations
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.populateListAndSelect().

List<EamGlobalFileInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getReferenceInstancesByTypeValue ( CorrelationAttributeInstance.Type  aType,
String  aValue 
) throws EamDbException, CorrelationAttributeNormalizationException

Get all reference entries having a given correlation type and value

Parameters
aTypeType to use for matching
aValueValue to use for matching
Returns
List of all global file instances with a type and value
Exceptions
EamDbException
EamGlobalSet org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getReferenceSetByID ( int  globalSetID) throws EamDbException

Get a global set by ID

Parameters
globalSetIDThe ID to look up
Returns
The global set associated with the ID
Exceptions
EamDbException
EamOrganization org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getReferenceSetOrganization ( int  referenceSetID) throws EamDbException

Get the organization associated with the given reference set.

Parameters
referenceSetIDID of the reference set
Returns
The organization object
Exceptions
EamDbException
List<CorrelationAttributeInstance.Type> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getSupportedCorrelationTypes ( ) throws EamDbException

Get the list of supported EamArtifact.Type's that can be used to correlate artifacts.

Returns
List of supported EamArtifact.Type's. If none are defined in the database, the default list will be returned.
Exceptions
EamDbException
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isArtifactKnownBadByReference ( CorrelationAttributeInstance.Type  aType,
String  value 
) throws EamDbException, CorrelationAttributeNormalizationException

Is the artifact known as bad according to the reference entries?

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
Global known status of the artifact
static boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isEnabled ( )
static

Is the database enabled?

Returns
Is the database enabled

Definition at line 94 of file EamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.DISABLED, org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.getSelectedPlatform(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.useCentralRepo().

Referenced by org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.cancel(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.configureSettings(), org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchAction.createAndShowPanel(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getCentralRepoHashSetsFromDatabase(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelatedInstances(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), org.sleuthkit.autopsy.allcasessearch.AllCasesSearchAction.isEnabled(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.isSupported(), org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources(), org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.ContentTagTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.BlackboardTagTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceAddedTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.CurrentCaseTask.run(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setEarliestCaseDate(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.updateHashSetsFromCentralRepository(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().

boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isFileHashInReferenceSet ( String  hash,
int  referenceSetID 
) throws EamDbException, CorrelationAttributeNormalizationException

Check if the given file hash is in this reference set. Only searches the reference_files table.

Parameters
hash
referenceSetID
Returns
true if the hash is found in the reference set
Exceptions
EamDbException
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isValueInReferenceSet ( String  value,
int  referenceSetID,
int  correlationTypeID 
) throws EamDbException, CorrelationAttributeNormalizationException

Check if the given value is in a specific reference set

Parameters
value
referenceSetID
correlationTypeID
Returns
true if the hash is found in the reference set
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCase ( CorrelationCase  eamCase) throws EamDbException
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCase ( Case  autopsyCase) throws EamDbException

Creates new Case in the database from the given case

Parameters
autopsyCaseThe case to add
int org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCorrelationType ( CorrelationAttributeInstance.Type  newType) throws EamDbException

Add a new EamArtifact.Type to the db.

Parameters
newTypeNew type to add.
Returns
Type.ID for newType
Exceptions
EamDbException
CorrelationDataSource org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newDataSource ( CorrelationDataSource  eamDataSource) throws EamDbException

Creates new Data Source in the database

Parameters
eamDataSourcethe data source to add
Returns
- A CorrelationDataSource object with data source's central repository id

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newDbInfo ( String  name,
String  value 
) throws EamDbException

Add a new name/value pair in the db_info table.

Parameters
nameKey to set
valueValue to set
Exceptions
EamDbException
EamOrganization org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newOrganization ( EamOrganization  eamOrg) throws EamDbException

Add a new organization

Parameters
eamOrgThe organization to add
Returns
The organization with the org ID set.
Exceptions
EamDbException
int org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newReferenceSet ( EamGlobalSet  eamGlobalSet) throws EamDbException

Add a new Global Set

Parameters
eamGlobalSetThe global set to add
Returns
The ID of the new global set
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.doInBackground().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.processInstanceTable ( CorrelationAttributeInstance.Type  type,
InstanceTableCallback  instanceTableCallback 
) throws EamDbException

Process the Artifact instance in the EamDb

Parameters
typeEamArtifact.Type to search for
instanceTableCallbackcallback to process the instance
Exceptions
EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.processInstanceTableWhere ( CorrelationAttributeInstance.Type  type,
String  whereClause,
InstanceTableCallback  instanceTableCallback 
) throws EamDbException

Process the Artifact instance in the EamDb

Parameters
typeEamArtifact.Type to search for
instanceTableCallbackcallback to process the instance
whereClausequery string to execute
Exceptions
EamDbException
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.referenceSetExists ( String  referenceSetName,
String  version 
) throws EamDbException

Check whether a reference set with the given name/version is in the central repo. Used to check for name collisions when creating reference sets.

Parameters
referenceSetName
version
Returns
true if a matching set is found
Exceptions
EamDbException
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.referenceSetIsValid ( int  referenceSetID,
String  referenceSetName,
String  version 
) throws EamDbException

Check whether a reference set with the given parameters exists in the central repository. Used to check whether reference sets saved in the settings are still present.

Parameters
referenceSetID
referenceSetName
version
Returns
true if a matching entry exists in the central repository
Exceptions
EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.reset ( ) throws EamDbException

Reset the database (testing method)

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.saveSettings ( )

Save settings

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.setAttributeInstanceKnownStatus ( CorrelationAttributeInstance  eamArtifact,
TskData.FileKnown  knownStatus 
) throws EamDbException

Sets an eamArtifact instance to the given known status. If eamArtifact exists, it is updated. If eamArtifact does not exist nothing happens

Parameters
eamArtifactArtifact containing exactly one (1) ArtifactInstance.
knownStatusThe status to change the artifact to

Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.ContentTagTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.BlackboardTagTask.run(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.shutdownConnections ( ) throws EamDbException

Shutdown the connection pool.

This closes the connection pool including all idle database connections. It will not close active/in-use connections. Thus, it is vital that there are no in-use connections when you call this method.

Exceptions
EamDbExceptionif there is a problem closing the connection pool.

Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.EamDbSettingsDialog.bnOkActionPerformed(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateAttributeInstanceComment ( CorrelationAttributeInstance  eamArtifact) throws EamDbException

Update a correlation attribute instance comment in the database with that in the associated CorrelationAttribute object.

Parameters
eamArtifactThe correlation attribute whose database instance will be updated.
Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.actionPerformed().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateCase ( CorrelationCase  eamCase) throws EamDbException

Updates an existing Case in the database

Parameters
eamCaseThe case to update
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateCorrelationType ( CorrelationAttributeInstance.Type  aType) throws EamDbException

Update a EamArtifact.Type.

Parameters
aTypeEamArtifact.Type to update.
Exceptions
EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateDbInfo ( String  name,
String  value 
) throws EamDbException

Update the value for a name in the name/value db_info table.

Parameters
nameName to find
valueValue to assign to name.
Exceptions
EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateOrganization ( EamOrganization  updatedOrganization) throws EamDbException

Update an existing organization.

Parameters
updatedOrganizationthe values the Organization with the same ID will be updated to in the database.
Exceptions
EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateSettings ( )

Update settings

When using updateSettings, if any database settings have changed, you should call shutdownConnections() before using any API methods. That will ensure that any old connections are closed and all new connections will be made using the new settings.

Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.EamDbSettingsDialog.bnOkActionPerformed().

void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.upgradeSchema ( ) throws EamDbException, SQLException

Upgrade the schema of the database (if needed)

Exceptions
EamDbException

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().


The documentation for this interface was generated from the following file:

Copyright © 2012-2018 Basis Technology. Generated on: Tue Dec 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.