19 package org.sleuthkit.datamodel;
 
   21 import com.google.common.collect.ImmutableSet;
 
   22 import com.google.common.eventbus.EventBus;
 
   23 import com.mchange.v2.c3p0.ComboPooledDataSource;
 
   24 import com.mchange.v2.c3p0.DataSources;
 
   25 import com.mchange.v2.c3p0.PooledDataSource;
 
   26 import com.zaxxer.sparsebits.SparseBitSet;
 
   27 import java.beans.PropertyVetoException;
 
   28 import java.io.BufferedInputStream;
 
   29 import java.io.BufferedOutputStream;
 
   31 import java.io.FileInputStream;
 
   32 import java.io.FileOutputStream;
 
   33 import java.io.IOException;
 
   34 import java.io.InputStream;
 
   35 import java.io.OutputStream;
 
   36 import java.io.UnsupportedEncodingException;
 
   37 import java.net.InetAddress;
 
   38 import java.net.URLEncoder;
 
   39 import java.nio.charset.StandardCharsets;
 
   40 import java.nio.file.Paths;
 
   41 import java.sql.Connection;
 
   42 import java.sql.DriverManager;
 
   43 import java.sql.PreparedStatement;
 
   44 import java.sql.ResultSet;
 
   45 import java.sql.SQLException;
 
   46 import java.sql.Statement;
 
   47 import java.text.SimpleDateFormat;
 
   48 import java.util.ArrayList;
 
   49 import java.util.Arrays;
 
   50 import java.util.Collection;
 
   51 import java.util.Collections;
 
   52 import java.util.Date;
 
   53 import java.util.EnumMap;
 
   54 import java.util.HashMap;
 
   55 import java.util.HashSet;
 
   56 import java.util.LinkedHashMap;
 
   57 import java.util.List;
 
   59 import java.util.MissingResourceException;
 
   60 import java.util.ResourceBundle;
 
   62 import java.util.UUID;
 
   63 import java.util.concurrent.ConcurrentHashMap;
 
   64 import java.util.concurrent.locks.ReentrantReadWriteLock;
 
   65 import java.util.logging.Level;
 
   66 import java.util.logging.Logger;
 
   67 import org.postgresql.util.PSQLState;
 
   83 import org.sqlite.SQLiteConfig;
 
   84 import org.sqlite.SQLiteDataSource;
 
   85 import org.sqlite.SQLiteJDBCLoader;
 
   93         private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
 
  102         private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE; 
 
  103         private static final Logger logger = Logger.getLogger(
SleuthkitCase.class.getName());
 
  104         private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
 
  105         private static final int IS_REACHABLE_TIMEOUT_MS = 1000;
 
  106         private static final String SQL_ERROR_CONNECTION_GROUP = 
"08";
 
  107         private static final String SQL_ERROR_AUTHENTICATION_GROUP = 
"28";
 
  108         private static final String SQL_ERROR_PRIVILEGE_GROUP = 
"42";
 
  109         private static final String SQL_ERROR_RESOURCE_GROUP = 
"53";
 
  110         private static final String SQL_ERROR_LIMIT_GROUP = 
"54";
 
  111         private static final String SQL_ERROR_INTERNAL_GROUP = 
"xx";
 
  112         private static final int MIN_USER_DEFINED_TYPE_ID = 10000;
 
  114         private static final Set<String> CORE_TABLE_NAMES = ImmutableSet.of(
 
  116                         "tsk_event_descriptions",
 
  129                         "tsk_files_derived_method",
 
  132                         "blackboard_artifact_tags",
 
  133                         "blackboard_artifacts",
 
  134                         "blackboard_attributes",
 
  135                         "blackboard_artifact_types",
 
  136                         "blackboard_attribute_types",
 
  138                         "file_encoding_types",
 
  139                         "ingest_module_types",
 
  140                         "ingest_job_status_types",
 
  143                         "ingest_job_modules",
 
  146                         "account_relationships",
 
  150         private static final Set<String> CORE_INDEX_NAMES = ImmutableSet.of(
 
  154                         "artifact_artifact_objID",
 
  159                         "relationships_account1",
 
  160                         "relationships_account2",
 
  161                         "relationships_relationship_source_obj_id",
 
  162                         "relationships_date_time",
 
  163                         "relationships_relationship_type",
 
  164                         "relationships_data_source_obj_id",
 
  167                         "events_data_source_obj_id",
 
  168                         "events_file_obj_id",
 
  169                         "events_artifact_id");
 
  171         private static final String TSK_VERSION_KEY = 
"TSK_VER";
 
  172         private static final String SCHEMA_MAJOR_VERSION_KEY = 
"SCHEMA_MAJOR_VERSION";
 
  173         private static final String SCHEMA_MINOR_VERSION_KEY = 
"SCHEMA_MINOR_VERSION";
 
  174         private static final String CREATION_SCHEMA_MAJOR_VERSION_KEY = 
"CREATION_SCHEMA_MAJOR_VERSION";
 
  175         private static final String CREATION_SCHEMA_MINOR_VERSION_KEY = 
"CREATION_SCHEMA_MINOR_VERSION";
 
  177         private final ConnectionPool connections;
 
  178         private final Map<Long, VirtualDirectory> rootIdsToCarvedFileDirs = 
new HashMap<>();
 
  179         private final Map<Long, FileSystem> fileSystemIdMap = 
new HashMap<>(); 
 
  180         private final List<ErrorObserver> sleuthkitCaseErrorObservers = 
new ArrayList<>();
 
  181         private final String databaseName;
 
  182         private final String dbPath;
 
  183         private final DbType dbType;
 
  184         private final String caseDirPath;
 
  186         private String dbBackupPath;
 
  197         private final Map<Long, SparseBitSet> hasChildrenBitSetMap = 
new HashMap<>();
 
  199         private long nextArtifactId; 
 
  204         private final ReentrantReadWriteLock rwLock = 
new ReentrantReadWriteLock(
true);
 
  212         private final Map<String, Set<Long>> deviceIdToDatasourceObjIdMap = 
new HashMap<>();
 
  214         private final EventBus eventBus = 
new EventBus(
"SleuthkitCase-EventBus");
 
  217                 eventBus.register(listener);
 
  221                 eventBus.unregister(listener);
 
  224         void fireTSKEvent(Object event) {
 
  225                 eventBus.post(event);
 
  229         private final Map<Long, Content> frequentlyUsedContentMap = 
new HashMap<>();
 
  231         private Examiner cachedCurrentExaminer = null;
 
  249                 if (info.getHost() == null || info.getHost().isEmpty()) {
 
  250                         throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname")); 
 
  251                 } 
else if (info.getPort() == null || info.getPort().isEmpty()) {
 
  252                         throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort")); 
 
  253                 } 
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
 
  254                         throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername")); 
 
  255                 } 
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
 
  256                         throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword")); 
 
  260                         Class.forName(
"org.postgresql.Driver"); 
 
  261                         Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() + 
":" + info.getPort() + 
"/postgres", info.getUserName(), info.getPassword()); 
 
  265                 } 
catch (SQLException ex) {
 
  267                         String sqlState = ex.getSQLState().toLowerCase();
 
  268                         if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
 
  270                                         if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
 
  272                                                 result = bundle.getString(
"DatabaseConnectionCheck.Port"); 
 
  274                                                 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort"); 
 
  276                                 } 
catch (IOException | MissingResourceException any) {
 
  278                                         result = bundle.getString(
"DatabaseConnectionCheck.Everything"); 
 
  280                         } 
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
 
  281                                 result = bundle.getString(
"DatabaseConnectionCheck.Authentication"); 
 
  282                         } 
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
 
  283                                 result = bundle.getString(
"DatabaseConnectionCheck.Access"); 
 
  284                         } 
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
 
  285                                 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace"); 
 
  286                         } 
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
 
  287                                 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart"); 
 
  288                         } 
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
 
  289                                 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue"); 
 
  291                                 result = bundle.getString(
"DatabaseConnectionCheck.Connection"); 
 
  294                 } 
catch (ClassNotFoundException ex) {
 
  295                         throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation")); 
 
  311                 Class.forName(
"org.sqlite.JDBC");
 
  312                 this.dbPath = dbPath;
 
  313                 this.dbType = dbType;
 
  315                 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
 
  316                 this.databaseName = dbFile.
getName();
 
  317                 this.connections = 
new SQLiteConnections(dbPath);
 
  318                 this.caseHandle = caseHandle;
 
  320                 logSQLiteJDBCDriverInfo();
 
  340         private SleuthkitCase(String host, 
int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType) 
throws Exception {
 
  342                 this.databaseName = dbName;
 
  343                 this.dbType = dbType;
 
  344                 this.caseDirPath = caseDirPath;
 
  345                 this.connections = 
new PostgreSQLConnections(host, port, dbName, userName, password);
 
  346                 this.caseHandle = caseHandle;
 
  350         private void init() throws Exception {
 
  351                 typeIdToArtifactTypeMap = 
new ConcurrentHashMap<>();
 
  352                 typeIdToAttributeTypeMap = 
new ConcurrentHashMap<>();
 
  353                 typeNameToArtifactTypeMap = 
new ConcurrentHashMap<>();
 
  354                 typeNameToAttributeTypeMap = 
new ConcurrentHashMap<>();
 
  360                 initBlackboardArtifactTypes();
 
  361                 initBlackboardAttributeTypes();
 
  362                 initNextArtifactId();
 
  363                 updateDatabaseSchema(null);
 
  365                 try (CaseDbConnection connection = connections.getConnection()) {
 
  366                         initIngestModuleTypes(connection);
 
  367                         initIngestStatusTypes(connection);
 
  368                         initReviewStatuses(connection);
 
  369                         initEncodingTypes(connection);
 
  370                         populateHasChildrenMap(connection);
 
  371                         updateExaminers(connection);
 
  372                         initDBSchemaCreationVersion(connection);
 
  375                 blackboard = 
new Blackboard(
this);
 
  376                 communicationsMgr = 
new CommunicationsManager(
this);
 
  377                 timelineMgr = 
new TimelineManager(
this);
 
  378                 dbAccessManager = 
new CaseDbAccessManager(
this);
 
  379                 taggingMgr = 
new TaggingManager(
this);
 
  387         static Set<String> getCoreTableNames() {
 
  388                 return CORE_TABLE_NAMES;
 
  396         static Set<String> getCoreIndexNames() {
 
  397                 return CORE_INDEX_NAMES;
 
  408         boolean getHasChildren(Content content) {
 
  409                 long objId = content.getId();
 
  410                 long mapIndex = objId / Integer.MAX_VALUE;
 
  411                 int mapValue = (int) (objId % Integer.MAX_VALUE);
 
  413                 synchronized (hasChildrenBitSetMap) {
 
  414                         if (hasChildrenBitSetMap.containsKey(mapIndex)) {
 
  415                                 return hasChildrenBitSetMap.get(mapIndex).get(mapValue);
 
  426         private void setHasChildren(Long objId) {
 
  427                 long mapIndex = objId / Integer.MAX_VALUE;
 
  428                 int mapValue = (int) (objId % Integer.MAX_VALUE);
 
  430                 synchronized (hasChildrenBitSetMap) {
 
  431                         if (hasChildrenBitSetMap.containsKey(mapIndex)) {
 
  432                                 hasChildrenBitSetMap.get(mapIndex).set(mapValue);
 
  434                                 SparseBitSet bitSet = 
new SparseBitSet();
 
  435                                 bitSet.set(mapValue);
 
  436                                 hasChildrenBitSetMap.put(mapIndex, bitSet);
 
  449                 return communicationsMgr;
 
  480                 return dbAccessManager;
 
  498         private void initBlackboardArtifactTypes() throws SQLException, 
TskCoreException {
 
  499                 CaseDbConnection connection = connections.getConnection();
 
  500                 Statement statement = null;
 
  501                 ResultSet resultSet = null;
 
  504                         statement = connection.createStatement();
 
  507                                         statement.execute(
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES (" + type.getTypeID() + 
" , '" + type.getLabel() + 
"', '" + type.getDisplayName() + 
"')"); 
 
  508                                 } 
catch (SQLException ex) {
 
  509                                         resultSet = connection.executeQuery(statement, 
"SELECT COUNT(*) AS count FROM blackboard_artifact_types WHERE artifact_type_id = '" + type.getTypeID() + 
"'"); 
 
  511                                         if (resultSet.getLong(
"count") == 0) {
 
  517                                 this.typeIdToArtifactTypeMap.put(type.getTypeID(), 
new BlackboardArtifact.Type(type));
 
  518                                 this.typeNameToArtifactTypeMap.put(type.getLabel(), 
new BlackboardArtifact.Type(type));
 
  521                                 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ARTIFACT_TYPE.values())).getTypeID() + 1;
 
  522                                 statement.execute(
"ALTER SEQUENCE blackboard_artifact_types_artifact_type_id_seq RESTART WITH " + newPrimaryKeyIndex); 
 
  525                         closeResultSet(resultSet);
 
  526                         closeStatement(statement);
 
  539         private void initBlackboardAttributeTypes() throws SQLException, TskCoreException {
 
  540                 CaseDbConnection connection = connections.getConnection();
 
  541                 Statement statement = null;
 
  542                 ResultSet resultSet = null;
 
  545                         statement = connection.createStatement();
 
  546                         for (ATTRIBUTE_TYPE type : ATTRIBUTE_TYPE.values()) {
 
  548                                         statement.execute(
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES (" + type.getTypeID() + 
", '" + type.getLabel() + 
"', '" + type.getDisplayName() + 
"', '" + type.getValueType().getType() + 
"')"); 
 
  549                                 } 
catch (SQLException ex) {
 
  550                                         resultSet = connection.executeQuery(statement, 
"SELECT COUNT(*) AS count FROM blackboard_attribute_types WHERE attribute_type_id = '" + type.getTypeID() + 
"'"); 
 
  552                                         if (resultSet.getLong(
"count") == 0) {
 
  558                                 this.typeIdToAttributeTypeMap.put(type.getTypeID(), 
new BlackboardAttribute.Type(type));
 
  559                                 this.typeNameToAttributeTypeMap.put(type.getLabel(), 
new BlackboardAttribute.Type(type));
 
  562                                 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ATTRIBUTE_TYPE.values())).getTypeID() + 1;
 
  563                                 statement.execute(
"ALTER SEQUENCE blackboard_attribute_types_attribute_type_id_seq RESTART WITH " + newPrimaryKeyIndex); 
 
  566                         closeResultSet(resultSet);
 
  567                         closeStatement(statement);
 
  582         private void initNextArtifactId() throws SQLException, TskCoreException {
 
  583                 CaseDbConnection connection = connections.getConnection();
 
  584                 Statement statement = null;
 
  585                 ResultSet resultSet = null;
 
  588                         statement = connection.createStatement();
 
  589                         resultSet = connection.executeQuery(statement, 
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts"); 
 
  591                         this.nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
 
  592                         if (this.nextArtifactId == 1) {
 
  593                                 this.nextArtifactId = BASE_ARTIFACT_ID;
 
  596                         closeResultSet(resultSet);
 
  597                         closeStatement(statement);
 
  610         private void initIngestModuleTypes(CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
  611                 Statement statement = null;
 
  612                 ResultSet resultSet = null;
 
  615                         statement = connection.createStatement();
 
  616                         for (IngestModuleType type : IngestModuleType.values()) {
 
  618                                         statement.execute(
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() + 
", '" + type.toString() + 
"');"); 
 
  619                                 } 
catch (SQLException ex) {
 
  620                                         resultSet = connection.executeQuery(statement, 
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() + 
";"); 
 
  622                                         if (resultSet.getLong(
"count") == 0) {
 
  630                         closeResultSet(resultSet);
 
  631                         closeStatement(statement);
 
  643         private void initIngestStatusTypes(CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
  644                 Statement statement = null;
 
  645                 ResultSet resultSet = null;
 
  648                         statement = connection.createStatement();
 
  649                         for (IngestJobStatusType type : IngestJobStatusType.values()) {
 
  651                                         statement.execute(
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() + 
", '" + type.toString() + 
"');"); 
 
  652                                 } 
catch (SQLException ex) {
 
  653                                         resultSet = connection.executeQuery(statement, 
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() + 
";"); 
 
  655                                         if (resultSet.getLong(
"count") == 0) {
 
  663                         closeResultSet(resultSet);
 
  664                         closeStatement(statement);
 
  675         private void initReviewStatuses(CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
  676                 Statement statement = null;
 
  677                 ResultSet resultSet = null;
 
  680                         statement = connection.createStatement();
 
  681                         for (BlackboardArtifact.ReviewStatus status : BlackboardArtifact.ReviewStatus.values()) {
 
  683                                         statement.execute(
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "  
  684                                                         + 
"VALUES (" + status.getID() + 
",'" + status.getName() + 
"','" + status.getDisplayName() + 
"')"); 
 
  685                                 } 
catch (SQLException ex) {
 
  686                                         resultSet = connection.executeQuery(statement, 
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID()); 
 
  688                                         if (resultSet.getLong(
"count") == 0) {
 
  696                         closeResultSet(resultSet);
 
  697                         closeStatement(statement);
 
  709         private void initEncodingTypes(CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
  710                 Statement statement = null;
 
  711                 ResultSet resultSet = null;
 
  714                         statement = connection.createStatement();
 
  715                         for (TskData.EncodingType type : TskData.EncodingType.values()) {
 
  717                                         statement.execute(
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() + 
" , '" + type.name() + 
"')"); 
 
  718                                 } 
catch (SQLException ex) {
 
  719                                         resultSet = connection.executeQuery(statement, 
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType()); 
 
  721                                         if (resultSet.getLong(
"count") == 0) {
 
  729                         closeResultSet(resultSet);
 
  730                         closeStatement(statement);
 
  743         private void updateExaminers(CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
  745                 String loginName = System.getProperty(
"user.name");
 
  746                 if (loginName.isEmpty()) {
 
  747                         logger.log(Level.SEVERE, 
"Cannot determine logged in user name");
 
  753                         PreparedStatement statement;
 
  756                                         statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_POSTGRESQL);
 
  759                                         statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_SQLITE);
 
  762                                         throw new TskCoreException(
"Unknown DB Type: " + 
getDatabaseType().name());
 
  764                         statement.clearParameters();
 
  765                         statement.setString(1, loginName);
 
  766                         connection.executeUpdate(statement);
 
  767                 } 
catch (SQLException ex) {
 
  768                         throw new TskCoreException(
"Error inserting row in tsk_examiners. login name: " + loginName, ex);
 
  781         private void populateHasChildrenMap(CaseDbConnection connection) 
throws TskCoreException {
 
  782                 long timestamp = System.currentTimeMillis();
 
  784                 Statement statement = null;
 
  785                 ResultSet resultSet = null;
 
  788                         statement = connection.createStatement();
 
  789                         resultSet = statement.executeQuery(
"select distinct par_obj_id from tsk_objects"); 
 
  791                         synchronized (hasChildrenBitSetMap) {
 
  792                                 while (resultSet.next()) {
 
  793                                         setHasChildren(resultSet.getLong(
"par_obj_id"));
 
  796                         long delay = System.currentTimeMillis() - timestamp;
 
  797                         logger.log(Level.INFO, 
"Time to initialize parent node cache: {0} ms", delay); 
 
  798                 } 
catch (SQLException ex) {
 
  799                         throw new TskCoreException(
"Error populating parent node cache", ex);
 
  801                         closeResultSet(resultSet);
 
  802                         closeStatement(statement);
 
  813         void addDataSourceToHasChildrenMap() throws TskCoreException {
 
  815                 CaseDbConnection connection = connections.getConnection();
 
  817                         populateHasChildrenMap(connection);
 
  819                         if (connection != null) {
 
  834         private void updateDatabaseSchema(String dbPath) 
throws Exception {
 
  835                 CaseDbConnection connection = connections.getConnection();
 
  836                 ResultSet resultSet = null;
 
  837                 Statement statement = null;
 
  840                         connection.beginTransaction();
 
  842                         boolean hasMinorVersion = 
false;
 
  843                         ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null, 
"tsk_db_info", 
"schema%");
 
  844                         while (columns.next()) {
 
  845                                 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
 
  846                                         hasMinorVersion = 
true;
 
  851                         int dbSchemaMajorVersion;
 
  852                         int dbSchemaMinorVersion = 0; 
 
  854                         statement = connection.createStatement();
 
  855                         resultSet = connection.executeQuery(statement, 
"SELECT schema_ver" 
  856                                         + (hasMinorVersion ? 
", schema_minor_ver" : 
"")
 
  857                                         + 
" FROM tsk_db_info"); 
 
  858                         if (resultSet.next()) {
 
  859                                 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver"); 
 
  860                                 if (hasMinorVersion) {
 
  862                                         dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver"); 
 
  865                                 throw new TskCoreException();
 
  867                         CaseDbSchemaVersionNumber dbSchemaVersion = 
new CaseDbSchemaVersionNumber(dbSchemaMajorVersion, dbSchemaMinorVersion);
 
  874                         if (
false == CURRENT_DB_SCHEMA_VERSION.
isCompatible(dbSchemaVersion)) {
 
  876                                 throw new TskUnsupportedSchemaVersionException(
 
  877                                                 "Unsupported DB schema version " + dbSchemaVersion + 
", the highest supported schema version is " + CURRENT_DB_SCHEMA_VERSION.
getMajor() + 
".X");
 
  878                         } 
else if (dbSchemaVersion.compareTo(CURRENT_DB_SCHEMA_VERSION) < 0) {
 
  881                                 if (null != dbPath) {
 
  884                                         String backupFilePath = dbPath + 
".schemaVer" + dbSchemaVersion.toString() + 
".backup"; 
 
  886                                         dbBackupPath = backupFilePath;
 
  893                                 dbSchemaVersion = updateFromSchema2toSchema3(dbSchemaVersion, connection);
 
  894                                 dbSchemaVersion = updateFromSchema3toSchema4(dbSchemaVersion, connection);
 
  895                                 dbSchemaVersion = updateFromSchema4toSchema5(dbSchemaVersion, connection);
 
  896                                 dbSchemaVersion = updateFromSchema5toSchema6(dbSchemaVersion, connection);
 
  897                                 dbSchemaVersion = updateFromSchema6toSchema7(dbSchemaVersion, connection);
 
  898                                 dbSchemaVersion = updateFromSchema7toSchema7dot1(dbSchemaVersion, connection);
 
  899                                 dbSchemaVersion = updateFromSchema7dot1toSchema7dot2(dbSchemaVersion, connection);
 
  900                                 dbSchemaVersion = updateFromSchema7dot2toSchema8dot0(dbSchemaVersion, connection);
 
  901                                 dbSchemaVersion = updateFromSchema8dot0toSchema8dot1(dbSchemaVersion, connection);
 
  902                                 dbSchemaVersion = updateFromSchema8dot1toSchema8dot2(dbSchemaVersion, connection);
 
  903                                 dbSchemaVersion = updateFromSchema8dot2toSchema8dot3(dbSchemaVersion, connection);
 
  904                                 dbSchemaVersion = updateFromSchema8dot3toSchema8dot4(dbSchemaVersion, connection);
 
  905                                 dbSchemaVersion = updateFromSchema8dot4toSchema8dot5(dbSchemaVersion, connection);
 
  906                                 statement = connection.createStatement();
 
  907                                 connection.executeUpdate(statement, 
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.getMajor() + 
", schema_minor_ver = " + dbSchemaVersion.getMinor()); 
 
  908                                 connection.executeUpdate(statement, 
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMajor() + 
" WHERE name = '" + SCHEMA_MAJOR_VERSION_KEY + 
"'"); 
 
  909                                 connection.executeUpdate(statement, 
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMinor() + 
" WHERE name = '" + SCHEMA_MINOR_VERSION_KEY + 
"'"); 
 
  914                         connection.commitTransaction();
 
  915                 } 
catch (Exception ex) { 
 
  916                         connection.rollbackTransaction();
 
  919                         closeResultSet(resultSet);
 
  920                         closeStatement(statement);
 
  933         private void initDBSchemaCreationVersion(CaseDbConnection connection) 
throws SQLException {
 
  935                 Statement statement = null;
 
  936                 ResultSet resultSet = null;
 
  937                 String createdSchemaMajorVersion = 
"0";
 
  938                 String createdSchemaMinorVersion = 
"0";
 
  941                         statement = connection.createStatement();
 
  942                         resultSet = connection.executeQuery(statement, 
"SELECT name, value FROM tsk_db_info_extended");
 
  943                         while (resultSet.next()) {
 
  944                                 String name = resultSet.getString(
"name");
 
  945                                 if (name.equals(CREATION_SCHEMA_MAJOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MAJOR_VERSION")) {
 
  946                                         createdSchemaMajorVersion = resultSet.getString(
"value");
 
  947                                 } 
else if (name.equals(CREATION_SCHEMA_MINOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MINOR_VERSION")) {
 
  948                                         createdSchemaMinorVersion = resultSet.getString(
"value");
 
  953                         closeResultSet(resultSet);
 
  954                         closeStatement(statement);
 
  958                 caseDBSchemaCreationVersion = 
new CaseDbSchemaVersionNumber(Integer.parseInt(createdSchemaMajorVersion), Integer.parseInt(createdSchemaMinorVersion));
 
  970         public void copyCaseDB(String newDBPath) 
throws IOException {
 
  971                 if (dbPath.isEmpty()) {
 
  972                         throw new IOException(
"Copying case database files is not supported for this type of case database"); 
 
  974                 InputStream in = null;
 
  975                 OutputStream out = null;
 
  978                         InputStream inFile = 
new FileInputStream(dbPath);
 
  979                         in = 
new BufferedInputStream(inFile);
 
  980                         OutputStream outFile = 
new FileOutputStream(newDBPath);
 
  981                         out = 
new BufferedOutputStream(outFile);
 
  982                         int bytesRead = in.read();
 
  983                         while (bytesRead != -1) {
 
  984                                 out.write(bytesRead);
 
  985                                 bytesRead = in.read();
 
  996                         } 
catch (IOException e) {
 
  997                                 logger.log(Level.WARNING, 
"Could not close streams after db copy", e); 
 
 1006         private void logSQLiteJDBCDriverInfo() {
 
 1008                         SleuthkitCase.logger.info(String.format(
"sqlite-jdbc version %s loaded in %s mode", 
 
 1009                                         SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
 
 1010                                         ? 
"native" : 
"pure-java")); 
 
 1011                 } 
catch (Exception ex) {
 
 1012                         SleuthkitCase.logger.log(Level.SEVERE, 
"Error querying case database mode", ex);
 
 1029         @SuppressWarnings(
"deprecation")
 
 1030         private CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
 
 1031                 if (schemaVersion.getMajor() != 2) {
 
 1032                         return schemaVersion;
 
 1034                 Statement statement = null;
 
 1035                 Statement updateStatement = null;
 
 1036                 ResultSet resultSet = null;
 
 1039                         statement = connection.createStatement();
 
 1042                         statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)"); 
 
 1043                         statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)"); 
 
 1044                         statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)"); 
 
 1047                         statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)"); 
 
 1050                         statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;"); 
 
 1051                         statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;"); 
 
 1052                         statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;"); 
 
 1055                         statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;"); 
 
 1058                         statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;"); 
 
 1063                         statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;"); 
 
 1064                         statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);"); 
 
 1065                         statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);"); 
 
 1066                         statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);"); 
 
 1067                         statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);"); 
 
 1068                         statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);"); 
 
 1069                         resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "  
 1070                                         + 
"arts.artifact_type_id AS artifact_type_id "  
 1071                                         + 
"FROM blackboard_attributes AS attrs "  
 1072                                         + 
"INNER JOIN blackboard_artifacts AS arts "  
 1073                                         + 
"WHERE attrs.artifact_id = arts.artifact_id;"); 
 
 1074                         updateStatement = connection.createStatement();
 
 1075                         while (resultSet.next()) {
 
 1076                                 long artifactId = resultSet.getLong(
"artifact_id");
 
 1077                                 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
 
 1078                                 updateStatement.executeUpdate(
 
 1079                                                 "UPDATE blackboard_attributes "  
 1080                                                 + 
"SET artifact_type_id = " + artifactTypeId 
 
 1081                                                 + 
" WHERE blackboard_attributes.artifact_id = " + artifactId + 
";"); 
 
 1090                         HashMap<String, TagName> tagNames = 
new HashMap<String, TagName>();
 
 1094                                 String comment = 
""; 
 
 1096                                 for (BlackboardAttribute attribute : attributes) {
 
 1097                                         if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
 
 1098                                                 name = attribute.getValueString();
 
 1099                                         } 
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
 
 1100                                                 comment = attribute.getValueString();
 
 1103                                 if (!name.isEmpty()) {
 
 1105                                         if (tagNames.containsKey(name)) {
 
 1106                                                 tagName = tagNames.get(name);
 
 1108                                                 tagName = 
addTagName(name, 
"", TagName.HTML_COLOR.NONE); 
 
 1109                                                 tagNames.put(name, tagName);
 
 1111                                         addContentTag(content, tagName, comment, 0, content.getSize() - 1);
 
 1115                                 long taggedArtifactId = -1;
 
 1117                                 String comment = 
""; 
 
 1119                                 for (BlackboardAttribute attribute : attributes) {
 
 1120                                         if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
 
 1121                                                 name = attribute.getValueString();
 
 1122                                         } 
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
 
 1123                                                 comment = attribute.getValueString();
 
 1124                                         } 
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()) {
 
 1125                                                 taggedArtifactId = attribute.getValueLong();
 
 1128                                 if (taggedArtifactId != -1 && !name.isEmpty()) {
 
 1130                                         if (tagNames.containsKey(name)) {
 
 1131                                                 tagName = tagNames.get(name);
 
 1133                                                 tagName = 
addTagName(name, 
"", TagName.HTML_COLOR.NONE); 
 
 1134                                                 tagNames.put(name, tagName);
 
 1140                                         "DELETE FROM blackboard_attributes WHERE artifact_id IN "  
 1141                                         + 
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "  
 1142                                         + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
 
 1143                                         + 
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() + 
");"); 
 
 1145                                         "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "  
 1146                                         + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
 
 1147                                         + 
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() + 
";"); 
 
 1149                         return new CaseDbSchemaVersionNumber(3, 0);
 
 1151                         closeStatement(updateStatement);
 
 1152                         closeResultSet(resultSet);
 
 1153                         closeStatement(statement);
 
 1172         private CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1173                 if (schemaVersion.getMajor() != 3) {
 
 1174                         return schemaVersion;
 
 1177                 Statement statement = null;
 
 1178                 ResultSet resultSet = null;
 
 1179                 Statement queryStatement = null;
 
 1180                 ResultSet queryResultSet = null;
 
 1181                 Statement updateStatement = null;
 
 1186                         statement = connection.createStatement();
 
 1187                         updateStatement = connection.createStatement();
 
 1188                         statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
 
 1189                         resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text " 
 1190                                         + 
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts " 
 1191                                         + 
"WHERE files.obj_id = arts.obj_id AND " 
 1192                                         + 
"arts.artifact_id = attrs.artifact_id AND " 
 1193                                         + 
"arts.artifact_type_id = 1 AND " 
 1194                                         + 
"attrs.attribute_type_id = 62");
 
 1195                         while (resultSet.next()) {
 
 1196                                 updateStatement.executeUpdate(
 
 1198                                                 + 
"SET mime_type = '" + resultSet.getString(
"value_text") + 
"' "  
 1199                                                 + 
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") + 
";"); 
 
 1204                         statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
 
 1205                         resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types"); 
 
 1206                         while (resultSet.next()) {
 
 1207                                 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
 
 1208                                 String attributeLabel = resultSet.getString(
"type_name");
 
 1209                                 if (attributeTypeId < MIN_USER_DEFINED_TYPE_ID) {
 
 1210                                         updateStatement.executeUpdate(
 
 1211                                                         "UPDATE blackboard_attribute_types "  
 1212                                                         + 
"SET value_type = " + ATTRIBUTE_TYPE.fromLabel(attributeLabel).getValueType().getType() + 
" "  
 1213                                                         + 
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId + 
";"); 
 
 1219                         queryStatement = connection.createStatement();
 
 1220                         statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
 
 1221                         resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
 
 1222                         while (resultSet.next()) {
 
 1223                                 long objectId = resultSet.getLong(
"obj_id");
 
 1224                                 String timeZone = 
"";
 
 1225                                 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
 
 1226                                 if (queryResultSet.next()) {
 
 1227                                         timeZone = queryResultSet.getString(
"tzone");
 
 1229                                 queryResultSet.close();
 
 1230                                 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) " 
 1231                                                 + 
"VALUES(" + objectId + 
", '" + UUID.randomUUID().toString() + 
"' , '" + timeZone + 
"');");
 
 1245                         statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
 
 1246                         resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
 
 1247                         while (resultSet.next()) {
 
 1248                                 long fileId = resultSet.getLong(
"obj_id");
 
 1249                                 long dataSourceId = getDataSourceObjectId(connection, fileId);
 
 1250                                 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId + 
" WHERE obj_id = " + fileId + 
";");
 
 1253                         statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)"); 
 
 1254                         statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)"); 
 
 1255                         if (this.dbType.equals(DbType.SQLITE)) {
 
 1256                                 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));"); 
 
 1257                                 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));"); 
 
 1259                                 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));"); 
 
 1260                                 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));"); 
 
 1263                         statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));"); 
 
 1264                         initIngestModuleTypes(connection);
 
 1265                         initIngestStatusTypes(connection);
 
 1267                         return new CaseDbSchemaVersionNumber(4, 0);
 
 1270                         closeResultSet(queryResultSet);
 
 1271                         closeStatement(queryStatement);
 
 1272                         closeStatement(updateStatement);
 
 1273                         closeResultSet(resultSet);
 
 1274                         closeStatement(statement);
 
 1292         private CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1293                 if (schemaVersion.getMajor() != 4) {
 
 1294                         return schemaVersion;
 
 1297                 Statement statement = null;
 
 1301                         statement = connection.createStatement();
 
 1302                         statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
 
 1312                         statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
 
 1315                         statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
 
 1316                         initEncodingTypes(connection);
 
 1323                         initReviewStatuses(connection);
 
 1328                         statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
 
 1330                         return new CaseDbSchemaVersionNumber(5, 0);
 
 1333                         closeStatement(statement);
 
 1351         private CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1352                 if (schemaVersion.getMajor() != 5) {
 
 1353                         return schemaVersion;
 
 1360                 Statement statement = null;
 
 1361                 ResultSet resultSet = null;
 
 1367                         statement = connection.createStatement();
 
 1368                         statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
 
 1370                         resultSet = connection.executeQuery(statement, 
"SELECT COUNT(*) AS count FROM review_statuses"); 
 
 1372                         if (resultSet.getLong(
"count") == 0) {
 
 1381                                 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
 
 1384                         return new CaseDbSchemaVersionNumber(6, 0);
 
 1387                         closeResultSet(resultSet);
 
 1388                         closeStatement(statement);
 
 1406         private CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1407                 if (schemaVersion.getMajor() != 6) {
 
 1408                         return schemaVersion;
 
 1414                 Statement statement = null;
 
 1415                 Statement updstatement = null;
 
 1416                 ResultSet resultSet = null;
 
 1419                         statement = connection.createStatement();
 
 1420                         updstatement = connection.createStatement();
 
 1421                         statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
 
 1423                         resultSet = connection.executeQuery(statement, 
"SELECT obj_id,name FROM tsk_files"); 
 
 1424                         while (resultSet.next()) {
 
 1425                                 long objID = resultSet.getLong(
"obj_id");
 
 1426                                 String name = resultSet.getString(
"name");
 
 1427                                 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" + 
escapeSingleQuotes(extractExtension(name)) + 
"' " 
 1428                                                 + 
"WHERE obj_id = " + objID);
 
 1431                         statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
 
 1434                         statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
 
 1436                         return new CaseDbSchemaVersionNumber(7, 0);
 
 1439                         closeResultSet(resultSet);
 
 1440                         closeStatement(statement);
 
 1441                         closeStatement(updstatement);
 
 1459         private CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1460                 if (schemaVersion.getMajor() != 7) {
 
 1461                         return schemaVersion;
 
 1464                 if (schemaVersion.getMinor() != 0) {
 
 1465                         return schemaVersion;
 
 1471                 Statement statement = null;
 
 1472                 ResultSet resultSet = null;
 
 1475                         statement = connection.createStatement();
 
 1478                         if (schemaVersion.getMinor() == 0) {
 
 1480                                 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
 
 1482                         return new CaseDbSchemaVersionNumber(7, 1);
 
 1485                         closeResultSet(resultSet);
 
 1486                         closeStatement(statement);
 
 1504         private CaseDbSchemaVersionNumber updateFromSchema7dot1toSchema7dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1505                 if (schemaVersion.getMajor() != 7) {
 
 1506                         return schemaVersion;
 
 1509                 if (schemaVersion.getMinor() != 1) {
 
 1510                         return schemaVersion;
 
 1513                 Statement statement = null;
 
 1514                 Statement updstatement = null;
 
 1515                 ResultSet resultSet = null;
 
 1519                         statement = connection.createStatement();
 
 1520                         statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1");
 
 1523                         updstatement = connection.createStatement();
 
 1524                         resultSet = connection.executeQuery(statement, 
"SELECT artifact_id, obj_id FROM blackboard_artifacts"); 
 
 1525                         while (resultSet.next()) {
 
 1526                                 long artifact_id = resultSet.getLong(
"artifact_id");
 
 1527                                 long obj_id = resultSet.getLong(
"obj_id");
 
 1528                                 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
 
 1529                                 updstatement.executeUpdate(
"UPDATE blackboard_artifacts SET data_source_obj_id = " + data_source_obj_id + 
" " 
 1530                                                 + 
"WHERE artifact_id = " + artifact_id);
 
 1532                         closeResultSet(resultSet);
 
 1533                         closeStatement(statement);
 
 1534                         closeStatement(updstatement);
 
 1539                         statement = connection.createStatement();
 
 1540                         statement.execute(
"ALTER TABLE tag_names ADD COLUMN knownStatus INTEGER NOT NULL DEFAULT " + TskData.FileKnown.UNKNOWN.getFileKnownValue());
 
 1543                         if (this.dbType.equals(DbType.SQLITE)) {
 
 1544                                 statement.execute(
"CREATE TABLE account_types (account_type_id INTEGER PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
 
 1545                                 statement.execute(
"CREATE TABLE accounts (account_id INTEGER PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL,  UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
 
 1546                                 statement.execute(
"CREATE TABLE account_relationships (relationship_id INTEGER PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL,  date_time INTEGER, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
 
 1548                                 statement.execute(
"CREATE TABLE account_types (account_type_id BIGSERIAL PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
 
 1549                                 statement.execute(
"CREATE TABLE accounts (account_id BIGSERIAL PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL,  UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
 
 1550                                 statement.execute(
"CREATE TABLE account_relationships  (relationship_id BIGSERIAL PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time BIGINT, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
 
 1554                         statement.execute(
"CREATE INDEX artifact_artifact_objID ON blackboard_artifacts(artifact_obj_id)");
 
 1555                         statement.execute(
"CREATE INDEX relationships_account1  ON account_relationships(account1_id)");
 
 1556                         statement.execute(
"CREATE INDEX relationships_account2  ON account_relationships(account2_id)");
 
 1557                         statement.execute(
"CREATE INDEX relationships_relationship_source_obj_id  ON account_relationships(relationship_source_obj_id)");
 
 1558                         statement.execute(
"CREATE INDEX relationships_date_time  ON account_relationships(date_time)");
 
 1559                         statement.execute(
"CREATE INDEX relationships_relationship_type  ON account_relationships(relationship_type)");
 
 1560                         statement.execute(
"CREATE INDEX relationships_data_source_obj_id  ON account_relationships(data_source_obj_id)");
 
 1562                         return new CaseDbSchemaVersionNumber(7, 2);
 
 1564                         closeResultSet(resultSet);
 
 1565                         closeStatement(statement);
 
 1566                         closeStatement(updstatement);
 
 1584         private CaseDbSchemaVersionNumber updateFromSchema7dot2toSchema8dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1585                 if (schemaVersion.getMajor() != 7) {
 
 1586                         return schemaVersion;
 
 1589                 if (schemaVersion.getMinor() != 2) {
 
 1590                         return schemaVersion;
 
 1593                 Statement updateSchemaStatement = connection.createStatement();
 
 1594                 Statement getExistingReportsStatement = connection.createStatement();
 
 1595                 ResultSet resultSet = null;
 
 1596                 ResultSet existingReports = null;
 
 1604                         updateSchemaStatement.execute(
"ALTER TABLE reports RENAME TO old_reports");
 
 1607                         updateSchemaStatement.execute(
"CREATE TABLE reports (obj_id BIGSERIAL PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id))");
 
 1610                         existingReports = getExistingReportsStatement.executeQuery(
"SELECT * FROM old_reports");
 
 1611                         while (existingReports.next()) {
 
 1612                                 String path = existingReports.getString(2);
 
 1613                                 long crtime = existingReports.getInt(3);
 
 1614                                 String sourceModule = existingReports.getString(4);
 
 1615                                 String reportName = existingReports.getString(5);
 
 1617                                 PreparedStatement insertObjectStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
 
 1618                                 insertObjectStatement.clearParameters();
 
 1619                                 insertObjectStatement.setNull(1, java.sql.Types.BIGINT);
 
 1620                                 insertObjectStatement.setLong(2, TskData.ObjectType.REPORT.getObjectType());
 
 1621                                 connection.executeUpdate(insertObjectStatement);
 
 1622                                 resultSet = insertObjectStatement.getGeneratedKeys();
 
 1623                                 if (!resultSet.next()) {
 
 1624                                         throw new TskCoreException(String.format(
"Failed to INSERT report %s (%s) in tsk_objects table", reportName, path));
 
 1626                                 long objectId = resultSet.getLong(1); 
 
 1629                                 PreparedStatement insertReportStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
 
 1630                                 insertReportStatement.clearParameters();
 
 1631                                 insertReportStatement.setLong(1, objectId);
 
 1632                                 insertReportStatement.setString(2, path);
 
 1633                                 insertReportStatement.setLong(3, crtime);
 
 1634                                 insertReportStatement.setString(4, sourceModule);
 
 1635                                 insertReportStatement.setString(5, reportName);
 
 1636                                 connection.executeUpdate(insertReportStatement);
 
 1640                         updateSchemaStatement.execute(
"DROP TABLE old_reports");
 
 1642                         return new CaseDbSchemaVersionNumber(8, 0);
 
 1644                         closeResultSet(resultSet);
 
 1645                         closeResultSet(existingReports);
 
 1646                         closeStatement(updateSchemaStatement);
 
 1647                         closeStatement(getExistingReportsStatement);
 
 1665         private CaseDbSchemaVersionNumber updateFromSchema8dot0toSchema8dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1666                 if (schemaVersion.getMajor() != 8) {
 
 1667                         return schemaVersion;
 
 1670                 if (schemaVersion.getMinor() != 0) {
 
 1671                         return schemaVersion;
 
 1676                 try (Statement statement = connection.createStatement();) {
 
 1678                         if (this.dbType.equals(DbType.SQLITE)) {
 
 1679                                 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id INTEGER PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name) )");
 
 1680                                 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
 
 1681                                 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
 
 1683                                 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id BIGSERIAL PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name))");
 
 1684                                 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
 
 1685                                 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
 
 1688                         return new CaseDbSchemaVersionNumber(8, 1);
 
 1707         private CaseDbSchemaVersionNumber updateFromSchema8dot1toSchema8dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1708                 if (schemaVersion.getMajor() != 8) {
 
 1709                         return schemaVersion;
 
 1712                 if (schemaVersion.getMinor() != 1) {
 
 1713                         return schemaVersion;
 
 1718                 try (Statement statement = connection.createStatement();) {
 
 1719                         statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha1 TEXT DEFAULT NULL");
 
 1720                         statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha256 TEXT DEFAULT NULL");
 
 1722                         statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_details TEXT");
 
 1730                         statement.execute(
"CREATE TABLE tsk_db_info_extended (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
 
 1731                         ResultSet result = statement.executeQuery(
"SELECT tsk_ver FROM tsk_db_info");
 
 1733                         statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + TSK_VERSION_KEY + 
"', '" + result.getLong(
"tsk_ver") + 
"')");
 
 1734                         statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MAJOR_VERSION_KEY + 
"', '8')");
 
 1735                         statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MINOR_VERSION_KEY + 
"', '2')");
 
 1736                         statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MAJOR_VERSION_KEY + 
"', '0')");
 
 1737                         statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MINOR_VERSION_KEY + 
"', '0')");
 
 1739                         String primaryKeyType;
 
 1742                                         primaryKeyType = 
"BIGSERIAL";
 
 1745                                         primaryKeyType = 
"INTEGER";
 
 1748                                         throw new TskCoreException(
"Unsupported data base type: " + 
getDatabaseType().toString());
 
 1752                         statement.execute(
"CREATE TABLE tsk_event_types (" 
 1753                                         + 
" event_type_id " + primaryKeyType + 
" PRIMARY KEY, " 
 1754                                         + 
" display_name TEXT UNIQUE NOT NULL, " 
 1755                                         + 
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
 
 1756                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1757                                         + 
" values( 0, 'Event Types', null)");
 
 1758                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1759                                         + 
" values(1, 'File System', 0)");
 
 1760                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1761                                         + 
" values(2, 'Web Activity', 0)");
 
 1762                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1763                                         + 
" values(3, 'Misc Types', 0)");
 
 1764                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1765                                         + 
" values(4, 'Modified', 1)");
 
 1766                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1767                                         + 
" values(5, 'Accessed', 1)");
 
 1768                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1769                                         + 
" values(6, 'Created', 1)");
 
 1770                         statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1771                                         + 
" values(7, 'Changed', 1)");
 
 1774                         statement.execute(
"CREATE TABLE tsk_event_descriptions (" 
 1775                                         + 
" event_description_id " + primaryKeyType + 
" PRIMARY KEY, " 
 1776                                         + 
" full_description TEXT NOT NULL, " 
 1777                                         + 
" med_description TEXT, " 
 1778                                         + 
" short_description TEXT," 
 1779                                         + 
" data_source_obj_id BIGINT NOT NULL, " 
 1780                                         + 
" file_obj_id BIGINT NOT NULL, " 
 1781                                         + 
" artifact_id BIGINT, " 
 1782                                         + 
" hash_hit INTEGER NOT NULL, "  
 1783                                         + 
" tagged INTEGER NOT NULL, "  
 1784                                         + 
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), " 
 1785                                         + 
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), " 
 1786                                         + 
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))" 
 1789                         statement.execute(
"CREATE TABLE tsk_events ( " 
 1790                                         + 
" event_id " + primaryKeyType + 
" PRIMARY KEY, " 
 1791                                         + 
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ," 
 1792                                         + 
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ," 
 1793                                         + 
" time INTEGER NOT NULL) " 
 1797                         statement.execute(
"CREATE INDEX events_time ON tsk_events(time)");
 
 1798                         statement.execute(
"CREATE INDEX events_type ON tsk_events(event_type_id)");
 
 1799                         statement.execute(
"CREATE INDEX events_data_source_obj_id  ON tsk_event_descriptions(data_source_obj_id) ");
 
 1800                         statement.execute(
"CREATE INDEX events_file_obj_id  ON tsk_event_descriptions(file_obj_id) ");
 
 1801                         statement.execute(
"CREATE INDEX events_artifact_id  ON tsk_event_descriptions(artifact_id) ");
 
 1802                         statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id,  time) ");
 
 1803                         return new CaseDbSchemaVersionNumber(8, 2);
 
 1823         private CaseDbSchemaVersionNumber updateFromSchema8dot2toSchema8dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1824                 if (schemaVersion.getMajor() != 8) {
 
 1825                         return schemaVersion;
 
 1828                 if (schemaVersion.getMinor() != 2) {
 
 1829                         return schemaVersion;
 
 1834                 ResultSet resultSet = null;
 
 1836                 try (Statement statement = connection.createStatement();) {
 
 1841                         String primaryKeyType;
 
 1844                                         primaryKeyType = 
"BIGSERIAL";
 
 1847                                         primaryKeyType = 
"INTEGER";
 
 1850                                         throw new TskCoreException(
"Unsupported data base type: " + 
getDatabaseType().toString());
 
 1854                         statement.execute(
"CREATE TABLE IF NOT EXISTS tsk_event_types (" 
 1855                                         + 
" event_type_id " + primaryKeyType + 
" PRIMARY KEY, " 
 1856                                         + 
" display_name TEXT UNIQUE NOT NULL, " 
 1857                                         + 
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
 
 1859                         resultSet = statement.executeQuery(
"SELECT * from tsk_event_types");
 
 1863                         if (!resultSet.next()) {
 
 1865                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1866                                                 + 
" values( 0, 'Event Types', null)");
 
 1867                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1868                                                 + 
" values(1, 'File System', 0)");
 
 1869                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1870                                                 + 
" values(2, 'Web Activity', 0)");
 
 1871                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1872                                                 + 
" values(3, 'Misc Types', 0)");
 
 1873                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1874                                                 + 
" values(4, 'Modified', 1)");
 
 1875                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1876                                                 + 
" values(5, 'Accessed', 1)");
 
 1877                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1878                                                 + 
" values(6, 'Created', 1)");
 
 1879                                 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)" 
 1880                                                 + 
" values(7, 'Changed', 1)");
 
 1885                         statement.execute(
"DROP TABLE IF EXISTS tsk_events");
 
 1889                         statement.execute(
"DROP TABLE IF EXISTS tsk_event_descriptions");
 
 1892                         statement.execute(
"CREATE TABLE tsk_event_descriptions (" 
 1893                                         + 
" event_description_id " + primaryKeyType + 
" PRIMARY KEY, " 
 1894                                         + 
" full_description TEXT NOT NULL, " 
 1895                                         + 
" med_description TEXT, " 
 1896                                         + 
" short_description TEXT," 
 1897                                         + 
" data_source_obj_id BIGINT NOT NULL, " 
 1898                                         + 
" file_obj_id BIGINT NOT NULL, " 
 1899                                         + 
" artifact_id BIGINT, " 
 1900                                         + 
" hash_hit INTEGER NOT NULL, "  
 1901                                         + 
" tagged INTEGER NOT NULL, "  
 1902                                         + 
" UNIQUE(full_description, file_obj_id, artifact_id), " 
 1903                                         + 
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), " 
 1904                                         + 
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), " 
 1905                                         + 
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))" 
 1909                         statement.execute(
"CREATE TABLE tsk_events ( " 
 1910                                         + 
" event_id " + primaryKeyType + 
" PRIMARY KEY, " 
 1911                                         + 
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ," 
 1912                                         + 
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ," 
 1913                                         + 
" time INTEGER NOT NULL, " 
 1914                                         + 
" UNIQUE (event_type_id, event_description_id, time))" 
 1918                         statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MAJOR_VERSION' WHERE name = 'CREATED_SCHEMA_MAJOR_VERSION'");
 
 1919                         statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MINOR_VERSION' WHERE name = 'CREATED_SCHEMA_MINOR_VERSION'");
 
 1921                         return new CaseDbSchemaVersionNumber(8, 3);
 
 1923                         closeResultSet(resultSet);
 
 1949         private CaseDbSchemaVersionNumber updateFromSchema8dot3toSchema8dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 1950                 if (schemaVersion.getMajor() != 8) {
 
 1951                         return schemaVersion;
 
 1954                 if (schemaVersion.getMinor() != 3) {
 
 1955                         return schemaVersion;
 
 1958                 Statement statement = connection.createStatement();
 
 1959                 ResultSet results = null;
 
 1966                                 throw new TskCoreException(
"Unsupported data base type: " + 
getDatabaseType().toString());
 
 1972                                         results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns " 
 1973                                                         + 
"WHERE table_name='tsk_event_descriptions' and column_name='file_obj_id'");
 
 1974                                         if (results.next()) {
 
 1976                                                 statement.execute(
"ALTER TABLE tsk_event_descriptions " 
 1977                                                                 + 
"RENAME COLUMN file_obj_id TO content_obj_id");
 
 1981                                                 statement.execute(
"CREATE TABLE temp_tsk_events ( " 
 1982                                                                 + 
" event_id BIGSERIAL PRIMARY KEY, " 
 1983                                                                 + 
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ," 
 1984                                                                 + 
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id)," 
 1985                                                                 + 
" time BIGINT NOT NULL, " 
 1986                                                                 + 
" UNIQUE (event_type_id, event_description_id, time))" 
 1990                                                 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, " 
 1991                                                                 + 
"event_description_id, time) SELECT * FROM tsk_events");
 
 1994                                                 statement.execute(
"DROP TABLE tsk_events");
 
 1997                                                 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
 
 2000                                                 statement.execute(
"CREATE INDEX events_data_source_obj_id  ON tsk_event_descriptions(data_source_obj_id) ");
 
 2001                                                 statement.execute(
"CREATE INDEX events_content_obj_id  ON tsk_event_descriptions(content_obj_id) ");
 
 2002                                                 statement.execute(
"CREATE INDEX events_artifact_id  ON tsk_event_descriptions(artifact_id) ");
 
 2003                                                 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id,  time) ");
 
 2004                                                 statement.execute(
"CREATE INDEX events_time  ON tsk_events(time) ");
 
 2008                                         boolean hasMisnamedColumn = 
false;
 
 2009                                         results = statement.executeQuery(
"pragma table_info('tsk_event_descriptions')");
 
 2010                                         while (results.next()) {
 
 2011                                                 if (results.getString(
"name") != null && results.getString(
"name").equals(
"file_obj_id")) {
 
 2012                                                         hasMisnamedColumn = 
true;
 
 2017                                         if (hasMisnamedColumn) {
 
 2019                                                 statement.execute(
"CREATE TABLE temp_tsk_event_descriptions (" 
 2020                                                                 + 
" event_description_id INTEGER PRIMARY KEY, " 
 2021                                                                 + 
" full_description TEXT NOT NULL, " 
 2022                                                                 + 
" med_description TEXT, " 
 2023                                                                 + 
" short_description TEXT," 
 2024                                                                 + 
" data_source_obj_id BIGINT NOT NULL, " 
 2025                                                                 + 
" content_obj_id BIGINT NOT NULL, " 
 2026                                                                 + 
" artifact_id BIGINT, " 
 2027                                                                 + 
" hash_hit INTEGER NOT NULL, "  
 2028                                                                 + 
" tagged INTEGER NOT NULL, "  
 2029                                                                 + 
" UNIQUE(full_description, content_obj_id, artifact_id), " 
 2030                                                                 + 
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), " 
 2031                                                                 + 
" FOREIGN KEY(content_obj_id) REFERENCES tsk_files(obj_id), " 
 2032                                                                 + 
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))" 
 2035                                                 statement.execute(
"CREATE TABLE temp_tsk_events ( " 
 2036                                                                 + 
" event_id INTEGER PRIMARY KEY, " 
 2037                                                                 + 
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ," 
 2038                                                                 + 
" event_description_id BIGINT NOT NULL REFERENCES temp_tsk_event_descriptions(event_description_id)," 
 2039                                                                 + 
" time INTEGER NOT NULL, " 
 2040                                                                 + 
" UNIQUE (event_type_id, event_description_id, time))" 
 2044                                                 statement.execute(
"INSERT INTO temp_tsk_event_descriptions(event_description_id, full_description, " 
 2045                                                                 + 
"med_description, short_description, data_source_obj_id, content_obj_id, artifact_id, " 
 2046                                                                 + 
"hash_hit, tagged) SELECT * FROM tsk_event_descriptions");
 
 2048                                                 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, " 
 2049                                                                 + 
"event_description_id, time) SELECT * FROM tsk_events");
 
 2052                                                 statement.execute(
"DROP TABLE tsk_events");
 
 2053                                                 statement.execute(
"DROP TABLE tsk_event_descriptions");
 
 2056                                                 statement.execute(
"ALTER TABLE temp_tsk_event_descriptions RENAME TO tsk_event_descriptions");
 
 2057                                                 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
 
 2060                                                 statement.execute(
"CREATE INDEX events_data_source_obj_id  ON tsk_event_descriptions(data_source_obj_id) ");
 
 2061                                                 statement.execute(
"CREATE INDEX events_content_obj_id  ON tsk_event_descriptions(content_obj_id) ");
 
 2062                                                 statement.execute(
"CREATE INDEX events_artifact_id  ON tsk_event_descriptions(artifact_id) ");
 
 2063                                                 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id,  time) ");
 
 2064                                                 statement.execute(
"CREATE INDEX events_time  ON tsk_events(time) ");
 
 2068                                         throw new TskCoreException(
"Unsupported data base type: " + 
getDatabaseType().toString());
 
 2072                         if (this.dbType.equals(DbType.SQLITE)) {
 
 2073                                 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id INTEGER PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
 
 2075                                 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id BIGSERIAL PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
 
 2079                         insertAccountTypeIfNotExists(statement, 
"IMO", 
"IMO");
 
 2080                         insertAccountTypeIfNotExists(statement, 
"LINE", 
"LINE");
 
 2081                         insertAccountTypeIfNotExists(statement, 
"SKYPE", 
"Skype");
 
 2082                         insertAccountTypeIfNotExists(statement, 
"TANGO", 
"Tango");
 
 2083                         insertAccountTypeIfNotExists(statement, 
"TEXTNOW", 
"TextNow");
 
 2084                         insertAccountTypeIfNotExists(statement, 
"THREEMA", 
"ThreeMa");
 
 2085                         insertAccountTypeIfNotExists(statement, 
"VIBER", 
"Viber");
 
 2086                         insertAccountTypeIfNotExists(statement, 
"XENDER", 
"Xender");
 
 2087                         insertAccountTypeIfNotExists(statement, 
"ZAPYA", 
"Zapya");
 
 2088                         insertAccountTypeIfNotExists(statement, 
"SHAREIT", 
"ShareIt");
 
 2090                         return new CaseDbSchemaVersionNumber(8, 4);
 
 2092                         closeResultSet(results);
 
 2093                         closeStatement(statement);
 
 2098         private CaseDbSchemaVersionNumber updateFromSchema8dot4toSchema8dot5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 2099                 if (schemaVersion.getMajor() != 8) {
 
 2100                         return schemaVersion;
 
 2103                 if (schemaVersion.getMinor() != 4) {
 
 2104                         return schemaVersion;
 
 2107                 Statement statement = connection.createStatement();
 
 2112                                         statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id BIGSERIAL PRIMARY KEY, name TEXT UNIQUE)");
 
 2113                                         statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id BIGINT REFERENCES tsk_tag_sets(tag_set_id)");
 
 2116                                         statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id INTEGER PRIMARY KEY, name TEXT UNIQUE)");
 
 2117                                         statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id INTEGER REFERENCES tsk_tag_sets(tag_set_id)");
 
 2121                         statement.execute(
"ALTER TABLE tag_names ADD COLUMN rank INTEGER");
 
 2123                         String insertStmt = 
"INSERT INTO tsk_tag_sets (name) VALUES ('Project VIC')";
 
 2125                                 statement.execute(insertStmt, Statement.RETURN_GENERATED_KEYS);
 
 2127                                 statement.execute(insertStmt);
 
 2129                         try (ResultSet resultSet = statement.getGeneratedKeys()) {
 
 2130                                 if (resultSet != null && resultSet.next()) {
 
 2131                                         int tagSetId = resultSet.getInt(1);
 
 2133                                         String updateQuery = 
"UPDATE tag_names SET tag_set_id = %d, color = '%s', rank = %d, display_name = '%s' WHERE display_name = '%s'";
 
 2134                                         statement.executeUpdate(String.format(updateQuery, tagSetId, 
"Red", 1, 
"Child Exploitation (Illegal)", 
"CAT-1: Child Exploitation (Illegal)"));
 
 2135                                         statement.executeUpdate(String.format(updateQuery, tagSetId, 
"Lime", 2, 
"Child Exploitation (Non-Illegal/Age Difficult)", 
"CAT-2: Child Exploitation (Non-Illegal/Age Difficult)"));
 
 2136                                         statement.executeUpdate(String.format(updateQuery, tagSetId, 
"Yellow", 3, 
"CGI/Animation (Child Exploitive)", 
"CAT-3: CGI/Animation (Child Exploitive)"));
 
 2137                                         statement.executeUpdate(String.format(updateQuery, tagSetId, 
"Purple", 4, 
"Exemplar/Comparison (Internal Use Only)", 
"CAT-4: Exemplar/Comparison (Internal Use Only)"));
 
 2138                                         statement.executeUpdate(String.format(updateQuery, tagSetId, 
"Fuchsia", 5, 
"Non-pertinent", 
"CAT-5: Non-pertinent"));
 
 2140                                         String 
deleteContentTag = 
"DELETE FROM content_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
 
 2141                                         String deleteArtifactTag = 
"DELETE FROM blackboard_artifact_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
 
 2142                                         String deleteCat0 = 
"DELETE FROM tag_names WHERE display_name = 'CAT-0: Uncategorized'";
 
 2143                                         statement.executeUpdate(deleteContentTag);
 
 2144                                         statement.executeUpdate(deleteArtifactTag);
 
 2145                                         statement.executeUpdate(deleteCat0);
 
 2148                                         throw new TskCoreException(
"Failed to retrieve the default tag_set_id from DB");
 
 2158                                         statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
 
 2161                                         statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1;");
 
 2164                         Statement updateStatement = connection.createStatement();
 
 2165                         try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id FROM tsk_fs_info")) {
 
 2166                                 while (resultSet.next()) {
 
 2167                                         long fsId = resultSet.getLong(
"obj_id");
 
 2168                                         long dataSourceId = getDataSourceObjectId(connection, fsId);
 
 2169                                         updateStatement.executeUpdate(
"UPDATE tsk_fs_info SET data_source_obj_id = " + dataSourceId + 
" WHERE obj_id = " + fsId + 
";");
 
 2172                                 closeStatement(updateStatement);
 
 2175                         return new CaseDbSchemaVersionNumber(8, 5);
 
 2178                         closeStatement(statement);
 
 2194         private void insertAccountTypeIfNotExists(Statement statement, String type_name, String display_name) 
throws TskCoreException, SQLException {
 
 2196                 String insertSQL = String.format(
"INTO account_types(type_name, display_name) VALUES ('%s', '%s')", type_name, display_name);
 
 2199                                 insertSQL = 
"INSERT " + insertSQL + 
" ON CONFLICT DO NOTHING"; 
 
 2202                                 insertSQL = 
"INSERT OR IGNORE " + insertSQL;
 
 2205                                 throw new TskCoreException(
"Unknown DB Type: " + 
getDatabaseType().name());
 
 2207                 statement.execute(insertSQL); 
 
 2217         static String extractExtension(
final String fileName) {
 
 2219                 int i = fileName.lastIndexOf(
".");
 
 2221                 if ((i > 0) && ((i + 1) < fileName.length())) {
 
 2222                         ext = fileName.substring(i + 1);
 
 2233                 return ext.toLowerCase();
 
 2257                 return CURRENT_DB_SCHEMA_VERSION;
 
 2267                 return caseDBSchemaCreationVersion;
 
 2286                 return dbBackupPath;
 
 2313                 return databaseName;
 
 2333                         rwLock.writeLock().lock();
 
 2344                         rwLock.writeLock().unlock();
 
 2355                         rwLock.readLock().lock();
 
 2366                         rwLock.readLock().unlock();
 
 2386                 } 
catch (Exception ex) {
 
 2387                         throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
 
 2417                         return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType());
 
 2418                 } 
catch (PropertyVetoException exp) {
 
 2420                         throw new TskCoreException(exp.getMessage(), exp);
 
 2424                 } 
catch (Exception exp) {
 
 2426                         throw new TskCoreException(exp.getMessage(), exp); 
 
 2441                         CaseDatabaseFactory factory = 
new CaseDatabaseFactory(dbPath);
 
 2442                         factory.createCaseDatabase();
 
 2446                 } 
catch (Exception ex) {
 
 2447                         throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
 
 2467                 String databaseName = createCaseDataBaseName(caseName);
 
 2481                         CaseDatabaseFactory factory = 
new CaseDatabaseFactory(databaseName, info);
 
 2482                         factory.createCaseDatabase();
 
 2485                         return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
 
 2486                                         databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType());
 
 2487                 } 
catch (PropertyVetoException exp) {
 
 2489                         throw new TskCoreException(exp.getMessage(), exp);
 
 2490                 } 
catch (Exception exp) {
 
 2492                         throw new TskCoreException(exp.getMessage(), exp); 
 
 2505         private static String createCaseDataBaseName(String candidateDbName) {
 
 2507                 if (!candidateDbName.isEmpty()) {
 
 2511                         dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]", 
"_"); 
 
 2516                         dbName = dbName.replaceAll(
"[\\p{Cntrl}]", 
"_"); 
 
 2521                         dbName = dbName.replaceAll(
"[ /?:'\"\\\\]", 
"_"); 
 
 2526                         dbName = dbName.toLowerCase();
 
 2532                         if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) == 
'_'))) {
 
 2533                                 dbName = 
"_" + dbName;
 
 2540                         if (dbName.length() > MAX_DB_NAME_LEN_BEFORE_TIMESTAMP) {
 
 2541                                 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
 
 2553                 SimpleDateFormat dateFormat = 
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
 
 2554                 Date date = 
new Date();
 
 2555                 dbName = dbName + 
"_" + dateFormat.format(date);
 
 2570                 if (cachedCurrentExaminer != null) {
 
 2571                         return cachedCurrentExaminer;
 
 2573                 String loginName = System.getProperty(
"user.name");
 
 2574                 if (loginName == null || loginName.isEmpty()) {
 
 2575                         throw new TskCoreException(
"Failed to determine logged in user name.");
 
 2578                 CaseDbConnection connection = connections.getConnection();
 
 2580                 ResultSet resultSet = null;
 
 2582                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME);
 
 2583                         statement.clearParameters();
 
 2584                         statement.setString(1, loginName);
 
 2585                         resultSet = connection.executeQuery(statement);
 
 2586                         if (resultSet.next()) {
 
 2587                                 cachedCurrentExaminer = 
new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"display_name"));
 
 2588                                 return cachedCurrentExaminer;
 
 2590                                 throw new TskCoreException(
"Error getting examaminer for name = " + loginName);
 
 2593                 } 
catch (SQLException ex) {
 
 2594                         throw new TskCoreException(
"Error getting examaminer for name = " + loginName, ex);
 
 2596                         closeResultSet(resultSet);
 
 2612         Examiner getExaminerById(
long id) 
throws TskCoreException {
 
 2614                 CaseDbConnection connection = connections.getConnection();
 
 2616                 ResultSet resultSet = null;
 
 2618                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_ID);
 
 2619                         statement.clearParameters();
 
 2620                         statement.setLong(1, 
id);
 
 2621                         resultSet = connection.executeQuery(statement);
 
 2622                         if (resultSet.next()) {
 
 2623                                 return new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"full_name"));
 
 2625                                 throw new TskCoreException(
"Error getting examaminer for id = " + 
id);
 
 2627                 } 
catch (SQLException ex) {
 
 2628                         throw new TskCoreException(
"Error getting examaminer for id = " + 
id, ex);
 
 2630                         closeResultSet(resultSet);
 
 2654                 return this.caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath, 
this);
 
 2666                 CaseDbConnection connection = connections.getConnection();
 
 2669                 ResultSet rs = null;
 
 2671                         s = connection.createStatement();
 
 2672                         rs = connection.executeQuery(s, 
"SELECT obj_id, type FROM tsk_objects "  
 2673                                         + 
"WHERE par_obj_id IS NULL"); 
 
 2674                         Collection<ObjectInfo> infos = 
new ArrayList<ObjectInfo>();
 
 2676                                 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), 
ObjectType.
valueOf(rs.getShort(
"type")))); 
 
 2679                         List<Content> rootObjs = 
new ArrayList<Content>();
 
 2680                         for (ObjectInfo i : infos) {
 
 2681                                 if (null != i.type) {
 
 2692                                                                 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
 
 2698                                                         throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
 
 2703                 } 
catch (SQLException ex) {
 
 2704                         throw new TskCoreException(
"Error getting root objects", ex);
 
 2724         List<Long> getDataSourceObjIds(String deviceId) 
throws TskCoreException {
 
 2727                 synchronized (deviceIdToDatasourceObjIdMap) {
 
 2728                         if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
 
 2729                                 return new ArrayList<Long>(deviceIdToDatasourceObjIdMap.get(deviceId));
 
 2732                         CaseDbConnection connection = connections.getConnection();
 
 2735                         ResultSet rs = null;
 
 2737                                 s = connection.createStatement();
 
 2738                                 rs = connection.executeQuery(s, 
"SELECT obj_id FROM data_source_info WHERE device_id = '" + deviceId + 
"'"); 
 
 2739                                 List<Long> dataSourceObjIds = 
new ArrayList<Long>();
 
 2741                                         dataSourceObjIds.add(rs.getLong(
"obj_id"));
 
 2744                                         long ds_obj_id = rs.getLong(
"obj_id");
 
 2745                                         if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
 
 2746                                                 deviceIdToDatasourceObjIdMap.get(deviceId).add(ds_obj_id);
 
 2748                                                 deviceIdToDatasourceObjIdMap.put(deviceId, 
new HashSet<Long>(Arrays.asList(ds_obj_id)));
 
 2751                                 return dataSourceObjIds;
 
 2752                         } 
catch (SQLException ex) {
 
 2753                                 throw new TskCoreException(
"Error getting data sources", ex);
 
 2780                 CaseDbConnection connection = connections.getConnection();
 
 2782                 Statement statement = null;
 
 2783                 ResultSet resultSet = null;
 
 2784                 Statement statement2 = null;
 
 2785                 ResultSet resultSet2 = null;
 
 2787                         statement = connection.createStatement();
 
 2788                         statement2 = connection.createStatement();
 
 2789                         resultSet = connection.executeQuery(statement,
 
 2790                                         "SELECT ds.obj_id, ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name " 
 2791                                         + 
"FROM data_source_info AS ds " 
 2792                                         + 
"LEFT JOIN tsk_image_info AS img " 
 2793                                         + 
"ON ds.obj_id = img.obj_id"); 
 
 2795                         List<DataSource> dataSourceList = 
new ArrayList<DataSource>();
 
 2798                         while (resultSet.next()) {
 
 2800                                 Long objectId = resultSet.getLong(
"obj_id");
 
 2801                                 String deviceId = resultSet.getString(
"device_id");
 
 2802                                 String timezone = resultSet.getString(
"time_zone");
 
 2803                                 String type = resultSet.getString(
"type");
 
 2811                                         resultSet2 = connection.executeQuery(statement2, 
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId); 
 
 2812                                         String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") : 
"";
 
 2820                                         String parentPath = 
"/"; 
 
 2821                                         dataSource = 
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, 
FileKnown.
UNKNOWN, parentPath);
 
 2826                                         Long ssize = resultSet.getLong(
"ssize");
 
 2827                                         Long size = resultSet.getLong(
"size");
 
 2828                                         String md5 = resultSet.getString(
"md5");
 
 2829                                         String sha1 = resultSet.getString(
"sha1");
 
 2830                                         String sha256 = resultSet.getString(
"sha256");
 
 2831                                         String name = resultSet.getString(
"display_name");
 
 2833                                         List<String> imagePaths = imagePathsMap.get(objectId);
 
 2835                                                 if (imagePaths.size() > 0) {
 
 2836                                                         String path = imagePaths.get(0);
 
 2837                                                         name = (
new java.io.File(path)).getName();
 
 2843                                         dataSource = 
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
 
 2844                                                         imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
 
 2847                                 dataSourceList.add(dataSource);
 
 2850                         return dataSourceList;
 
 2852                 } 
catch (SQLException ex) {
 
 2853                         throw new TskCoreException(
"Error getting data sources", ex);
 
 2855                         closeResultSet(resultSet);
 
 2856                         closeStatement(statement);
 
 2857                         closeResultSet(resultSet2);
 
 2858                         closeStatement(statement2);
 
 2885                 CaseDbConnection connection = connections.getConnection();
 
 2887                 Statement statement = null;
 
 2888                 ResultSet resultSet = null;
 
 2889                 Statement statement2 = null;
 
 2890                 ResultSet resultSet2 = null;
 
 2892                         statement = connection.createStatement();
 
 2893                         statement2 = connection.createStatement();
 
 2894                         resultSet = connection.executeQuery(statement,
 
 2895                                         "SELECT ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name " 
 2896                                         + 
"FROM data_source_info AS ds " 
 2897                                         + 
"LEFT JOIN tsk_image_info AS img " 
 2898                                         + 
"ON ds.obj_id = img.obj_id " 
 2899                                         + 
"WHERE ds.obj_id = " + objectId); 
 
 2900                         if (resultSet.next()) {
 
 2901                                 String deviceId = resultSet.getString(
"device_id");
 
 2902                                 String timezone = resultSet.getString(
"time_zone");
 
 2903                                 String type = resultSet.getString(
"type");
 
 2911                                         resultSet2 = connection.executeQuery(statement2, 
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId); 
 
 2912                                         String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") : 
"";
 
 2919                                         String parentPath = 
"/"; 
 
 2920                                         dataSource = 
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, 
FileKnown.
UNKNOWN, parentPath);
 
 2925                                         Long ssize = resultSet.getLong(
"ssize");
 
 2926                                         Long size = resultSet.getLong(
"size");
 
 2927                                         String md5 = resultSet.getString(
"md5");
 
 2928                                         String sha1 = resultSet.getString(
"sha1");
 
 2929                                         String sha256 = resultSet.getString(
"sha256");
 
 2930                                         String name = resultSet.getString(
"display_name");
 
 2932                                         List<String> imagePaths = getImagePathsById(objectId);
 
 2934                                                 if (imagePaths.size() > 0) {
 
 2935                                                         String path = imagePaths.get(0);
 
 2936                                                         name = (
new java.io.File(path)).getName();
 
 2942                                         dataSource = 
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
 
 2943                                                         imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
 
 2946                                 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
 
 2948                 } 
catch (SQLException ex) {
 
 2949                         throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
 
 2951                         closeResultSet(resultSet);
 
 2952                         closeStatement(statement);
 
 2953                         closeResultSet(resultSet2);
 
 2954                         closeStatement(statement2);
 
 2973                 return getArtifactsHelper(
"blackboard_artifacts.artifact_type_id = " + artifactTypeID);
 
 2987                 CaseDbConnection connection = connections.getConnection();
 
 2989                 ResultSet rs = null;
 
 2992                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE);
 
 2993                         statement.clearParameters();
 
 2994                         statement.setLong(1, objId);
 
 2995                         rs = connection.executeQuery(statement);
 
 2998                                 count = rs.getLong(
"count");
 
 3001                 } 
catch (SQLException ex) {
 
 3002                         throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
 
 3021                 CaseDbConnection connection = connections.getConnection();
 
 3023                 ResultSet rs = null;
 
 3026                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE);
 
 3027                         statement.clearParameters();
 
 3028                         statement.setInt(1, artifactTypeID);
 
 3029                         rs = connection.executeQuery(statement);
 
 3032                                 count = rs.getLong(
"count");
 
 3035                 } 
catch (SQLException ex) {
 
 3036                         throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
 
 3056                 CaseDbConnection connection = connections.getConnection();
 
 3058                 ResultSet rs = null;
 
 3061                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE);
 
 3062                         statement.clearParameters();
 
 3063                         statement.setInt(2, artifactTypeID);
 
 3064                         statement.setLong(1, dataSourceID);
 
 3065                         rs = connection.executeQuery(statement);
 
 3068                                 count = rs.getLong(
"count");
 
 3071                 } 
catch (SQLException ex) {
 
 3072                         throw new TskCoreException(String.format(
"Error getting number of blackboard artifacts by type (%d) and data source (%d)", artifactTypeID, dataSourceID), ex);
 
 3095                 CaseDbConnection connection = connections.getConnection();
 
 3098                 ResultSet rs = null;
 
 3100                         s = connection.createStatement();
 
 3101                         rs = connection.executeQuery(s, 
"SELECT DISTINCT arts.artifact_id AS artifact_id, "  
 3102                                         + 
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, " 
 3103                                         + 
"types.type_name AS type_name, types.display_name AS display_name, " 
 3104                                         + 
" arts.review_status_id AS review_status_id "  
 3105                                         + 
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "  
 3106                                         + 
"WHERE arts.artifact_id = attrs.artifact_id "  
 3107                                         + 
" AND attrs.attribute_type_id = " + attrType.getTypeID() 
 
 3108                                         + 
" AND attrs.value_text = '" + value + 
"'" 
 3109                                         + 
" AND types.artifact_type_id=arts.artifact_type_id" 
 3111                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3113                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3114                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3118                 } 
catch (SQLException ex) {
 
 3119                         throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
 
 3146                 String valSubStr = 
"%" + subString; 
 
 3147                 if (startsWith == 
false) {
 
 3150                 CaseDbConnection connection = connections.getConnection();
 
 3153                 ResultSet rs = null;
 
 3155                         s = connection.createStatement();
 
 3156                         rs = connection.executeQuery(s, 
"SELECT DISTINCT arts.artifact_id AS artifact_id, "  
 3157                                         + 
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "  
 3158                                         + 
" types.type_name AS type_name, types.display_name AS display_name, "  
 3159                                         + 
" arts.review_status_id AS review_status_id "  
 3160                                         + 
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "  
 3161                                         + 
" WHERE arts.artifact_id = attrs.artifact_id "  
 3162                                         + 
" AND attrs.attribute_type_id = " + attrType.getTypeID() 
 
 3163                                         + 
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr + 
"')" 
 3164                                         + 
" AND types.artifact_type_id=arts.artifact_type_id " 
 3166                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3168                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3169                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3173                 } 
catch (SQLException ex) {
 
 3174                         throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
 
 3198                 CaseDbConnection connection = connections.getConnection();
 
 3201                 ResultSet rs = null;
 
 3203                         s = connection.createStatement();
 
 3204                         rs = connection.executeQuery(s, 
"SELECT DISTINCT arts.artifact_id AS artifact_id, "  
 3205                                         + 
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, " 
 3206                                         + 
" types.type_name AS type_name, types.display_name AS display_name, " 
 3207                                         + 
" arts.review_status_id AS review_status_id  " 
 3208                                         + 
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "  
 3209                                         + 
"WHERE arts.artifact_id = attrs.artifact_id "  
 3210                                         + 
" AND attrs.attribute_type_id = " + attrType.getTypeID() 
 
 3211                                         + 
" AND attrs.value_int32 = " + value 
 
 3212                                         + 
" AND types.artifact_type_id=arts.artifact_type_id " 
 3214                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3216                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3217                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3221                 } 
catch (SQLException ex) {
 
 3222                         throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
 
 3246                 CaseDbConnection connection = connections.getConnection();
 
 3249                 ResultSet rs = null;
 
 3251                         s = connection.createStatement();
 
 3252                         rs = connection.executeQuery(s, 
"SELECT DISTINCT arts.artifact_id AS artifact_id, "  
 3253                                         + 
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, " 
 3254                                         + 
" types.type_name AS type_name, types.display_name AS display_name, " 
 3255                                         + 
" arts.review_status_id AS review_status_id " 
 3256                                         + 
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "  
 3257                                         + 
" WHERE arts.artifact_id = attrs.artifact_id "  
 3258                                         + 
" AND attrs.attribute_type_id = " + attrType.getTypeID() 
 
 3259                                         + 
" AND attrs.value_int64 = " + value 
 
 3260                                         + 
" AND types.artifact_type_id=arts.artifact_type_id " 
 3262                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3264                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3265                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3269                 } 
catch (SQLException ex) {
 
 3270                         throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
 
 3294                 CaseDbConnection connection = connections.getConnection();
 
 3297                 ResultSet rs = null;
 
 3299                         s = connection.createStatement();
 
 3300                         rs = connection.executeQuery(s, 
"SELECT DISTINCT arts.artifact_id AS artifact_id, "  
 3301                                         + 
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, " 
 3302                                         + 
" types.type_name AS type_name, types.display_name AS display_name, " 
 3303                                         + 
" arts.review_status_id AS review_status_id " 
 3304                                         + 
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "  
 3305                                         + 
" WHERE arts.artifact_id = attrs.artifact_id "  
 3306                                         + 
" AND attrs.attribute_type_id = " + attrType.getTypeID() 
 
 3307                                         + 
" AND attrs.value_double = " + value 
 
 3308                                         + 
" AND types.artifact_type_id=arts.artifact_type_id " 
 3310                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3312                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3313                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3317                 } 
catch (SQLException ex) {
 
 3318                         throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
 
 3342                 CaseDbConnection connection = connections.getConnection();
 
 3345                 ResultSet rs = null;
 
 3347                         s = connection.createStatement();
 
 3348                         rs = connection.executeQuery(s, 
"SELECT DISTINCT arts.artifact_id AS artifact_id, "  
 3349                                         + 
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, " 
 3350                                         + 
" types.type_name AS type_name, types.display_name AS display_name, " 
 3351                                         + 
" arts.review_status_id AS review_status_id " 
 3352                                         + 
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "  
 3353                                         + 
" WHERE arts.artifact_id = attrs.artifact_id "  
 3354                                         + 
" AND attrs.attribute_type_id = " + attrType.getTypeID() 
 
 3355                                         + 
" AND attrs.value_byte = " + value 
 
 3356                                         + 
" AND types.artifact_type_id=arts.artifact_type_id " 
 3358                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3360                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3361                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3365                 } 
catch (SQLException ex) {
 
 3366                         throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
 
 3383                 CaseDbConnection connection = connections.getConnection();
 
 3386                 ResultSet rs = null;
 
 3388                         s = connection.createStatement();
 
 3389                         rs = connection.executeQuery(s, 
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types"); 
 
 3393                                                 rs.getString(
"type_name"), rs.getString(
"display_name")));
 
 3395                         return artifactTypes;
 
 3396                 } 
catch (SQLException ex) {
 
 3397                         throw new TskCoreException(
"Error getting artifact types", ex); 
 
 3415                 String typeIdList = 
"";
 
 3422                 String query = 
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts " 
 3423                                 + 
"WHERE artifact_type_id IN (" + typeIdList + 
")";
 
 3424                 CaseDbConnection connection = connections.getConnection();
 
 3427                 ResultSet rs = null;
 
 3429                         s = connection.createStatement();
 
 3430                         rs = connection.executeQuery(s, query);
 
 3436                 } 
catch (SQLException ex) {
 
 3437                         throw new TskCoreException(
"Error getting artifact types in use", ex);
 
 3457                 CaseDbConnection connection = connections.getConnection();
 
 3460                 ResultSet rs = null;
 
 3462                         s = connection.createStatement();
 
 3463                         rs = connection.executeQuery(s,
 
 3464                                         "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, " 
 3465                                         + 
"types.type_name AS type_name, types.display_name AS display_name " 
 3466                                         + 
"FROM blackboard_artifact_types AS types " 
 3467                                         + 
"INNER JOIN blackboard_artifacts AS arts " 
 3468                                         + 
"ON arts.artifact_type_id = types.artifact_type_id"); 
 
 3472                                                 rs.getString(
"type_name"), rs.getString(
"display_name")));
 
 3474                         return uniqueArtifactTypes;
 
 3475                 } 
catch (SQLException ex) {
 
 3476                         throw new TskCoreException(
"Error getting attribute types", ex);
 
 3493                 CaseDbConnection connection = connections.getConnection();
 
 3496                 ResultSet rs = null;
 
 3498                         s = connection.createStatement();
 
 3499                         rs = connection.executeQuery(s, 
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types"); 
 
 3505                         return attribute_types;
 
 3506                 } 
catch (SQLException ex) {
 
 3507                         throw new TskCoreException(
"Error getting attribute types", ex);
 
 3528                 CaseDbConnection connection = connections.getConnection();
 
 3531                 ResultSet rs = null;
 
 3533                         s = connection.createStatement();
 
 3534                         rs = connection.executeQuery(s, 
"SELECT COUNT(*) AS count FROM blackboard_attribute_types"); 
 
 3537                                 count = rs.getInt(
"count");
 
 3540                 } 
catch (SQLException ex) {
 
 3541                         throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
 
 3562         ArrayList<BlackboardArtifact> getArtifactsHelper(String whereClause) 
throws TskCoreException {
 
 3563                 CaseDbConnection connection = connections.getConnection();
 
 3565                 ResultSet rs = null;
 
 3567                         Statement statement = connection.createStatement();
 
 3568                         String query = 
"SELECT blackboard_artifacts.artifact_id AS artifact_id, " 
 3569                                         + 
"blackboard_artifacts.obj_id AS obj_id, " 
 3570                                         + 
"blackboard_artifacts.artifact_obj_id AS artifact_obj_id, " 
 3571                                         + 
"blackboard_artifacts.data_source_obj_id AS data_source_obj_id, " 
 3572                                         + 
"blackboard_artifact_types.artifact_type_id AS artifact_type_id, " 
 3573                                         + 
"blackboard_artifact_types.type_name AS type_name, " 
 3574                                         + 
"blackboard_artifact_types.display_name AS display_name, " 
 3575                                         + 
"blackboard_artifacts.review_status_id AS review_status_id " 
 3576                                         + 
"FROM blackboard_artifacts, blackboard_artifact_types " 
 3577                                         + 
"WHERE blackboard_artifacts.artifact_type_id = blackboard_artifact_types.artifact_type_id " 
 3579                                         + 
" AND " + whereClause;
 
 3580                         rs = connection.executeQuery(statement, query);
 
 3581                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3583                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3584                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3588                 } 
catch (SQLException ex) {
 
 3589                         throw new TskCoreException(
"Error getting or creating a blackboard artifact", ex);
 
 3609         private long getArtifactsCountHelper(
int artifactTypeID, 
long obj_id) 
throws TskCoreException {
 
 3610                 CaseDbConnection connection = connections.getConnection();
 
 3612                 ResultSet rs = null;
 
 3615                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE);
 
 3616                         statement.clearParameters();
 
 3617                         statement.setLong(1, obj_id);
 
 3618                         statement.setInt(2, artifactTypeID);
 
 3619                         rs = connection.executeQuery(statement);
 
 3622                                 count = rs.getLong(
"count");
 
 3625                 } 
catch (SQLException ex) {
 
 3626                         throw new TskCoreException(
"Error getting blackboard artifact count", ex);
 
 3647                 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id + 
" AND blackboard_artifact_types.type_name = '" + artifactTypeName + 
"';");
 
 3663                 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id + 
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID + 
";");
 
 3695                 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
 
 3696                 if (artifactTypeID == -1) {
 
 3699                 return getArtifactsCountHelper(artifactTypeID, obj_id);
 
 3715                 return getArtifactsCountHelper(artifactTypeID, obj_id);
 
 3731                 return getArtifactsCountHelper(artifactType.getTypeID(), obj_id);
 
 3746                 return getArtifactsHelper(
"blackboard_artifact_types.type_name = '" + artifactTypeName + 
"';");
 
 3761                 return getArtifactsHelper(
"blackboard_artifact_types.artifact_type_id = " + artifactType.getTypeID() + 
";");
 
 3778                 CaseDbConnection connection = connections.getConnection();
 
 3781                 ResultSet rs = null;
 
 3783                         s = connection.createStatement();
 
 3784                         rs = connection.executeQuery(s, 
"SELECT DISTINCT arts.artifact_id AS artifact_id, "  
 3785                                         + 
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, " 
 3786                                         + 
"types.type_name AS type_name, types.display_name AS display_name," 
 3787                                         + 
"arts.review_status_id AS review_status_id " 
 3788                                         + 
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "  
 3789                                         + 
"WHERE arts.artifact_id = attrs.artifact_id "  
 3790                                         + 
"AND attrs.attribute_type_id = " + attrType.getTypeID() 
 
 3791                                         + 
" AND arts.artifact_type_id = " + artifactType.getTypeID() 
 
 3792                                         + 
" AND attrs.value_text = '" + value + 
"'"  
 3793                                         + 
" AND types.artifact_type_id=arts.artifact_type_id" 
 3795                         ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 3797                                 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3798                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3802                 } 
catch (SQLException ex) {
 
 3803                         throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
 
 3823                 CaseDbConnection connection = connections.getConnection();
 
 3825                 ResultSet rs = null;
 
 3828                         s = connection.createStatement();
 
 3829                         rs = connection.executeQuery(s, 
"SELECT arts.artifact_id AS artifact_id, " 
 3830                                         + 
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, " 
 3831                                         + 
"types.type_name AS type_name, types.display_name AS display_name," 
 3832                                         + 
"arts.review_status_id AS review_status_id " 
 3833                                         + 
"FROM blackboard_artifacts AS arts, blackboard_artifact_types AS types " 
 3834                                         + 
"WHERE arts.artifact_id = " + artifactID
 
 3835                                         + 
" AND arts.artifact_type_id = types.artifact_type_id");
 
 3837                                 return new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 3838                                                 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
 
 3846                                 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
 
 3848                 } 
catch (SQLException ex) {
 
 3849                         throw new TskCoreException(
"Error getting a blackboard artifact. " + ex.getMessage(), ex);
 
 3866                 CaseDbConnection connection = connections.getConnection();
 
 3869                         addBlackBoardAttribute(attr, artifactTypeId, connection);
 
 3870                 } 
catch (SQLException ex) {
 
 3871                         throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
 
 3888                 CaseDbConnection connection = connections.getConnection();
 
 3891                         connection.beginTransaction();
 
 3893                                 addBlackBoardAttribute(attr, artifactTypeId, connection);
 
 3895                         connection.commitTransaction();
 
 3896                 } 
catch (SQLException ex) {
 
 3897                         connection.rollbackTransaction();
 
 3898                         throw new TskCoreException(
"Error adding blackboard attributes", ex);
 
 3905         private void addBlackBoardAttribute(
BlackboardAttribute attr, 
int artifactTypeId, CaseDbConnection connection) 
throws SQLException, TskCoreException {
 
 3906                 PreparedStatement statement;
 
 3907                 switch (attr.getAttributeType().getValueType()) {
 
 3910                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_STRING_ATTRIBUTE);
 
 3911                                 statement.clearParameters();
 
 3912                                 statement.setString(7, attr.getValueString());
 
 3915                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_BYTE_ATTRIBUTE);
 
 3916                                 statement.clearParameters();
 
 3917                                 statement.setBytes(7, attr.getValueBytes());
 
 3920                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INT_ATTRIBUTE);
 
 3921                                 statement.clearParameters();
 
 3922                                 statement.setInt(7, attr.getValueInt());
 
 3925                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
 
 3926                                 statement.clearParameters();
 
 3927                                 statement.setLong(7, attr.getValueLong());
 
 3930                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DOUBLE_ATTRIBUTE);
 
 3931                                 statement.clearParameters();
 
 3932                                 statement.setDouble(7, attr.getValueDouble());
 
 3935                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
 
 3936                                 statement.clearParameters();
 
 3937                                 statement.setLong(7, attr.getValueLong());
 
 3940                                 throw new TskCoreException(
"Unrecognized artifact attribute value type");
 
 3942                 statement.setLong(1, attr.getArtifactID());
 
 3943                 statement.setInt(2, artifactTypeId);
 
 3944                 statement.setString(3, attr.getSourcesCSV());
 
 3945                 statement.setString(4, 
"");
 
 3946                 statement.setInt(5, attr.getAttributeType().getTypeID());
 
 3947                 statement.setLong(6, attr.getAttributeType().getValueType().getType());
 
 3948                 connection.executeUpdate(statement);
 
 3961         String addSourceToArtifactAttribute(BlackboardAttribute attr, String source) 
throws TskCoreException {
 
 3969                 if (null == source || source.isEmpty()) {
 
 3970                         throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
 
 3972                 CaseDbConnection connection = connections.getConnection();
 
 3974                 Statement queryStmt = null;
 
 3975                 Statement updateStmt = null;
 
 3976                 ResultSet result = null;
 
 3977                 String newSources = 
"";
 
 3979                         connection.beginTransaction();
 
 3980                         String valueClause = 
"";
 
 3981                         BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
 
 3982                         if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
 
 3983                                 switch (valueType) {
 
 3989                                                 valueClause = 
" value_int32 = " + attr.getValueInt();
 
 3993                                                 valueClause = 
" value_int64 = " + attr.getValueLong();
 
 3996                                                 valueClause = 
" value_double = " + attr.getValueDouble();
 
 3999                                                 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
 
 4001                                 String query = 
"SELECT source FROM blackboard_attributes WHERE" 
 4002                                                 + 
" artifact_id = " + attr.getArtifactID()
 
 4003                                                 + 
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
 
 4004                                                 + 
" AND value_type = " + attr.getAttributeType().getValueType().getType()
 
 4005                                                 + 
" AND " + valueClause + 
";";
 
 4006                                 queryStmt = connection.createStatement();
 
 4007                                 updateStmt = connection.createStatement();
 
 4008                                 result = connection.executeQuery(queryStmt, query);
 
 4015                                 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
 
 4016                                 statement.clearParameters();
 
 4017                                 statement.setLong(1, attr.getArtifactID());
 
 4018                                 statement.setLong(2, attr.getAttributeType().getTypeID());
 
 4019                                 statement.setBytes(3, attr.getValueBytes());
 
 4020                                 result = connection.executeQuery(statement);
 
 4022                         while (result.next()) {
 
 4023                                 String oldSources = result.getString(
"source");
 
 4024                                 if (null != oldSources && !oldSources.isEmpty()) {
 
 4025                                         Set<String> uniqueSources = 
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
 
 4026                                         if (!uniqueSources.contains(source)) {
 
 4027                                                 newSources = oldSources + 
"," + source;
 
 4029                                                 newSources = oldSources;
 
 4032                                         newSources = source;
 
 4034                                 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
 
 4035                                         String update = 
"UPDATE blackboard_attributes SET source = '" + newSources + 
"' WHERE" 
 4036                                                         + 
" artifact_id = " + attr.getArtifactID()
 
 4037                                                         + 
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
 
 4038                                                         + 
" AND value_type = " + attr.getAttributeType().getValueType().getType()
 
 4039                                                         + 
" AND " + valueClause + 
";";
 
 4040                                         connection.executeUpdate(updateStmt, update);
 
 4047                                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
 
 4048                                         statement.clearParameters();
 
 4049                                         statement.setString(1, newSources);
 
 4050                                         statement.setLong(2, attr.getArtifactID());
 
 4051                                         statement.setLong(3, attr.getAttributeType().getTypeID());
 
 4052                                         statement.setBytes(4, attr.getValueBytes());
 
 4053                                         connection.executeUpdate(statement);
 
 4056                         connection.commitTransaction();
 
 4058                 } 
catch (SQLException ex) {
 
 4059                         connection.rollbackTransaction();
 
 4060                         throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
 
 4062                         closeResultSet(result);
 
 4063                         closeStatement(updateStmt);
 
 4064                         closeStatement(queryStmt);
 
 4085                 CaseDbConnection connection = connections.getConnection();
 
 4088                 ResultSet rs = null;
 
 4090                         connection.beginTransaction();
 
 4091                         s = connection.createStatement();
 
 4092                         rs = connection.executeQuery(s, 
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeString + 
"'"); 
 
 4095                                 rs = connection.executeQuery(s, 
"SELECT MAX(attribute_type_id) AS highest_id FROM blackboard_attribute_types");
 
 4098                                         maxID = rs.getInt(
"highest_id");
 
 4099                                         if (maxID < MIN_USER_DEFINED_TYPE_ID) {
 
 4100                                                 maxID = MIN_USER_DEFINED_TYPE_ID;
 
 4105                                 connection.executeUpdate(s, 
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES ('" + maxID + 
"', '" + attrTypeString + 
"', '" + displayName + 
"', '" + valueType.getType() + 
"')"); 
 
 4107                                 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
 
 4108                                 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
 
 4109                                 connection.commitTransaction();
 
 4112                                 throw new TskDataException(
"The attribute type that was added was already within the system.");
 
 4115                 } 
catch (SQLException ex) {
 
 4116                         connection.rollbackTransaction();
 
 4117                         throw new TskCoreException(
"Error adding attribute type", ex);
 
 4137                 if (this.typeNameToAttributeTypeMap.containsKey(attrTypeName)) {
 
 4138                         return this.typeNameToAttributeTypeMap.get(attrTypeName);
 
 4140                 CaseDbConnection connection = connections.getConnection();
 
 4143                 ResultSet rs = null;
 
 4145                         s = connection.createStatement();
 
 4146                         rs = connection.executeQuery(s, 
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName + 
"'"); 
 
 4151                                 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
 
 4152                                 this.typeNameToAttributeTypeMap.put(attrTypeName, type);
 
 4155                 } 
catch (SQLException ex) {
 
 4156                         throw new TskCoreException(
"Error getting attribute type id", ex);
 
 4176                 if (this.typeIdToAttributeTypeMap.containsKey(typeID)) {
 
 4177                         return this.typeIdToAttributeTypeMap.get(typeID);
 
 4179                 CaseDbConnection connection = connections.getConnection();
 
 4182                 ResultSet rs = null;
 
 4184                         s = connection.createStatement();
 
 4185                         rs = connection.executeQuery(s, 
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE attribute_type_id = " + typeID + 
""); 
 
 4186                         BlackboardAttribute.Type type = null;
 
 4188                                 type = 
new BlackboardAttribute.Type(rs.getInt(
"attribute_type_id"), rs.getString(
"type_name"),
 
 4189                                                 rs.getString(
"display_name"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(rs.getLong(
"value_type")));
 
 4190                                 this.typeIdToAttributeTypeMap.put(typeID, type);
 
 4191                                 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
 
 4194                 } 
catch (SQLException ex) {
 
 4195                         throw new TskCoreException(
"Error getting attribute type id", ex);
 
 4215                 if (this.typeNameToArtifactTypeMap.containsKey(artTypeName)) {
 
 4216                         return this.typeNameToArtifactTypeMap.get(artTypeName);
 
 4218                 CaseDbConnection connection = connections.getConnection();
 
 4221                 ResultSet rs = null;
 
 4223                         s = connection.createStatement();
 
 4224                         rs = connection.executeQuery(s, 
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE type_name = '" + artTypeName + 
"'"); 
 
 4228                                                 rs.getString(
"type_name"), rs.getString(
"display_name"));
 
 4229                                 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
 
 4230                                 this.typeNameToArtifactTypeMap.put(artTypeName, type);
 
 4233                 } 
catch (SQLException ex) {
 
 4234                         throw new TskCoreException(
"Error getting artifact type from the database", ex);
 
 4254                 if (this.typeIdToArtifactTypeMap.containsKey(artTypeId)) {
 
 4255                         return typeIdToArtifactTypeMap.get(artTypeId);
 
 4257                 CaseDbConnection connection = connections.getConnection();
 
 4260                 ResultSet rs = null;
 
 4262                         s = connection.createStatement();
 
 4263                         rs = connection.executeQuery(s, 
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE artifact_type_id = " + artTypeId + 
""); 
 
 4264                         BlackboardArtifact.Type type = null;
 
 4266                                 type = 
new BlackboardArtifact.Type(rs.getInt(
"artifact_type_id"),
 
 4267                                                 rs.getString(
"type_name"), rs.getString(
"display_name"));
 
 4268                                 this.typeIdToArtifactTypeMap.put(artTypeId, type);
 
 4269                                 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
 
 4272                 } 
catch (SQLException ex) {
 
 4273                         throw new TskCoreException(
"Error getting artifact type from the database", ex);
 
 4295                 CaseDbConnection connection = connections.getConnection();
 
 4298                 ResultSet rs = null;
 
 4300                         connection.beginTransaction();
 
 4301                         s = connection.createStatement();
 
 4302                         rs = connection.executeQuery(s, 
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName + 
"'"); 
 
 4305                                 rs = connection.executeQuery(s, 
"SELECT MAX(artifact_type_id) AS highest_id FROM blackboard_artifact_types");
 
 4308                                         maxID = rs.getInt(
"highest_id");
 
 4309                                         if (maxID < MIN_USER_DEFINED_TYPE_ID) {
 
 4310                                                 maxID = MIN_USER_DEFINED_TYPE_ID;
 
 4315                                 connection.executeUpdate(s, 
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES ('" + maxID + 
"', '" + artifactTypeName + 
"', '" + displayName + 
"')"); 
 
 4317                                 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
 
 4318                                 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
 
 4319                                 connection.commitTransaction();
 
 4322                                 throw new TskDataException(
"The attribute type that was added was already within the system.");
 
 4324                 } 
catch (SQLException ex) {
 
 4325                         connection.rollbackTransaction();
 
 4326                         throw new TskCoreException(
"Error adding artifact type", ex);
 
 4336                 CaseDbConnection connection = connections.getConnection();
 
 4338                 ResultSet rs = null;
 
 4340                         Statement statement = connection.createStatement();
 
 4341                         rs = connection.executeQuery(statement, 
"SELECT attrs.artifact_id AS artifact_id, " 
 4342                                         + 
"attrs.source AS source, attrs.context AS context, attrs.attribute_type_id AS attribute_type_id, " 
 4343                                         + 
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, " 
 4344                                         + 
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, " 
 4345                                         + 
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, " 
 4346                                         + 
"types.type_name AS type_name, types.display_name AS display_name " 
 4347                                         + 
"FROM blackboard_attributes AS attrs, blackboard_attribute_types AS types WHERE attrs.artifact_id = " + artifact.getArtifactID()
 
 4348                                         + 
" AND attrs.attribute_type_id = types.attribute_type_id");
 
 4349                         ArrayList<BlackboardAttribute> attributes = 
new ArrayList<BlackboardAttribute>();
 
 4351                                 int attributeTypeId = rs.getInt(
"attribute_type_id");
 
 4352                                 String attributeTypeName = rs.getString(
"type_name");
 
 4354                                 if (this.typeIdToAttributeTypeMap.containsKey(attributeTypeId)) {
 
 4355                                         attributeType = this.typeIdToAttributeTypeMap.get(attributeTypeId);
 
 4358                                                         rs.getString(
"display_name"),
 
 4360                                         this.typeIdToAttributeTypeMap.put(attributeTypeId, attributeType);
 
 4361                                         this.typeNameToAttributeTypeMap.put(attributeTypeName, attributeType);
 
 4365                                                 rs.getLong(
"artifact_id"),
 
 4367                                                 rs.getString(
"source"),
 
 4368                                                 rs.getString(
"context"),
 
 4369                                                 rs.getInt(
"value_int32"),
 
 4370                                                 rs.getLong(
"value_int64"),
 
 4371                                                 rs.getDouble(
"value_double"),
 
 4372                                                 rs.getString(
"value_text"),
 
 4373                                                 rs.getBytes(
"value_byte"), this
 
 4375                                 attributes.add(attr);
 
 4378                 } 
catch (SQLException ex) {
 
 4379                         throw new TskCoreException(
"Error getting attributes for artifact, artifact id = " + artifact.getArtifactID(), ex);
 
 4400                 CaseDbConnection connection = connections.getConnection();
 
 4403                 ResultSet rs = null;
 
 4405                         s = connection.createStatement();
 
 4406                         rs = connection.executeQuery(s, 
"SELECT blackboard_attributes.artifact_id AS artifact_id, " 
 4407                                         + 
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, " 
 4408                                         + 
"blackboard_attributes.attribute_type_id AS attribute_type_id, " 
 4409                                         + 
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, " 
 4410                                         + 
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, " 
 4411                                         + 
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double " 
 4412                                         + 
"FROM blackboard_attributes " + whereClause); 
 
 4413                         ArrayList<BlackboardAttribute> matches = 
new ArrayList<BlackboardAttribute>();
 
 4419                                                 rs.getLong(
"artifact_id"),
 
 4421                                                 rs.getString(
"source"),
 
 4422                                                 rs.getString(
"context"),
 
 4423                                                 rs.getInt(
"value_int32"),
 
 4424                                                 rs.getLong(
"value_int64"),
 
 4425                                                 rs.getDouble(
"value_double"),
 
 4426                                                 rs.getString(
"value_text"),
 
 4427                                                 rs.getBytes(
"value_byte"), this
 
 4432                 } 
catch (SQLException ex) {
 
 4433                         throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
 
 4454                 CaseDbConnection connection = connections.getConnection();
 
 4456                 ResultSet rs = null;
 
 4459                         s = connection.createStatement();
 
 4460                         rs = connection.executeQuery(s, 
"SELECT blackboard_artifacts.artifact_id AS artifact_id, " 
 4461                                         + 
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.data_source_obj_id AS data_source_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, " 
 4462                                         + 
"blackboard_artifacts.review_status_id AS review_status_id  " 
 4463                                         + 
"FROM blackboard_artifacts " + whereClause); 
 
 4464                         ArrayList<BlackboardArtifact> matches = 
new ArrayList<BlackboardArtifact>();
 
 4470                                                 type.getTypeID(), type.getTypeName(), type.getDisplayName(),
 
 4472                                 matches.add(artifact);
 
 4475                 } 
catch (SQLException ex) {
 
 4476                         throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
 
 4515                 return newBlackboardArtifact(artifactType.getTypeID(), obj_id, artifactType.getLabel(), artifactType.getDisplayName());
 
 4519                 CaseDbConnection connection = connections.getConnection();
 
 4521                 ResultSet resultSet = null;
 
 4524                         long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
 
 4526                         PreparedStatement statement = null;
 
 4528                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.POSTGRESQL_INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
 
 4529                                 statement.clearParameters();
 
 4530                                 statement.setLong(1, obj_id);
 
 4531                                 statement.setLong(2, artifact_obj_id);
 
 4532                                 statement.setLong(3, data_source_obj_id);
 
 4533                                 statement.setInt(4, artifact_type_id);
 
 4536                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
 
 4537                                 statement.clearParameters();
 
 4538                                 this.nextArtifactId++;
 
 4539                                 statement.setLong(1, this.nextArtifactId);
 
 4540                                 statement.setLong(2, obj_id);
 
 4541                                 statement.setLong(3, artifact_obj_id);
 
 4542                                 statement.setLong(4, data_source_obj_id);
 
 4543                                 statement.setInt(5, artifact_type_id);
 
 4546                         connection.executeUpdate(statement);
 
 4547                         resultSet = statement.getGeneratedKeys();
 
 4549                         return new BlackboardArtifact(
this, resultSet.getLong(1), 
 
 4550                                         obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, artifactTypeName, artifactDisplayName, BlackboardArtifact.ReviewStatus.UNDECIDED, 
true);
 
 4551                 } 
catch (SQLException ex) {
 
 4552                         throw new TskCoreException(
"Error creating a blackboard artifact", ex);
 
 4554                         closeResultSet(resultSet);
 
 4572         boolean getContentHasChildren(Content content) 
throws TskCoreException {
 
 4573                 CaseDbConnection connection = connections.getConnection();
 
 4575                 ResultSet rs = null;
 
 4578                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
 
 4579                         statement.clearParameters();
 
 4580                         statement.setLong(1, content.getId());
 
 4581                         rs = connection.executeQuery(statement);
 
 4582                         boolean hasChildren = 
false;
 
 4584                                 hasChildren = rs.getInt(
"count") > 0;
 
 4587                 } 
catch (SQLException e) {
 
 4588                         throw new TskCoreException(
"Error checking for children of parent " + content, e);
 
 4608         int getContentChildrenCount(Content content) 
throws TskCoreException {
 
 4610                 if (!this.getHasChildren(content)) {
 
 4614                 CaseDbConnection connection = connections.getConnection();
 
 4616                 ResultSet rs = null;
 
 4619                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
 
 4620                         statement.clearParameters();
 
 4621                         statement.setLong(1, content.getId());
 
 4622                         rs = connection.executeQuery(statement);
 
 4623                         int countChildren = -1;
 
 4625                                 countChildren = rs.getInt(
"count");
 
 4627                         return countChildren;
 
 4628                 } 
catch (SQLException e) {
 
 4629                         throw new TskCoreException(
"Error checking for children of parent " + content, e);
 
 4648         List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type) 
throws TskCoreException {
 
 4649                 CaseDbConnection connection = connections.getConnection();
 
 4651                 ResultSet rs = null;
 
 4653                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
 
 4654                         statement.clearParameters();
 
 4655                         long parentId = parent.getId();
 
 4656                         statement.setLong(1, parentId);
 
 4657                         statement.setShort(2, type.getFileType());
 
 4658                         rs = connection.executeQuery(statement);
 
 4659                         return fileChildren(rs, connection, parentId);
 
 4660                 } 
catch (SQLException ex) {
 
 4661                         throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
 
 4678         List<Content> getAbstractFileChildren(Content parent) 
throws TskCoreException {
 
 4679                 CaseDbConnection connection = connections.getConnection();
 
 4681                 ResultSet rs = null;
 
 4683                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
 
 4684                         statement.clearParameters();
 
 4685                         long parentId = parent.getId();
 
 4686                         statement.setLong(1, parentId);
 
 4687                         rs = connection.executeQuery(statement);
 
 4688                         return fileChildren(rs, connection, parentId);
 
 4689                 } 
catch (SQLException ex) {
 
 4690                         throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
 
 4709         List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type) 
throws TskCoreException {
 
 4710                 CaseDbConnection connection = connections.getConnection();
 
 4712                 ResultSet rs = null;
 
 4714                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
 
 4715                         statement.clearParameters();
 
 4716                         statement.setLong(1, parent.getId());
 
 4717                         statement.setShort(2, type.getFileType());
 
 4718                         rs = connection.executeQuery(statement);
 
 4719                         List<Long> children = 
new ArrayList<Long>();
 
 4721                                 children.add(rs.getLong(
"obj_id"));
 
 4724                 } 
catch (SQLException ex) {
 
 4725                         throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
 
 4742         List<Long> getAbstractFileChildrenIds(Content parent) 
throws TskCoreException {
 
 4743                 CaseDbConnection connection = connections.getConnection();
 
 4745                 ResultSet rs = null;
 
 4747                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
 
 4748                         statement.clearParameters();
 
 4749                         statement.setLong(1, parent.getId());
 
 4750                         rs = connection.executeQuery(statement);
 
 4751                         List<Long> children = 
new ArrayList<Long>();
 
 4753                                 children.add(rs.getLong(
"obj_id"));
 
 4756                 } 
catch (SQLException ex) {
 
 4757                         throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
 
 4775         List<Long> getBlackboardArtifactChildrenIds(Content parent) 
throws TskCoreException {
 
 4776                 CaseDbConnection connection = connections.getConnection();
 
 4778                 ResultSet rs = null;
 
 4780                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
 
 4781                         statement.clearParameters();
 
 4782                         statement.setLong(1, parent.getId());
 
 4783                         rs = connection.executeQuery(statement);
 
 4784                         List<Long> children = 
new ArrayList<Long>();
 
 4786                                 children.add(rs.getLong(
"obj_id"));
 
 4789                 } 
catch (SQLException ex) {
 
 4790                         throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
 
 4807         List<Content> getBlackboardArtifactChildren(Content parent) 
throws TskCoreException {
 
 4809                 long parentId = parent.getId();
 
 4810                 ArrayList<BlackboardArtifact> artsArray = getArtifactsHelper(
"blackboard_artifacts.obj_id = " + parentId + 
";");
 
 4812                 List<Content> lc = 
new ArrayList<Content>();
 
 4813                 lc.addAll(artsArray);
 
 4825         Collection<ObjectInfo> getChildrenInfo(Content c) 
throws TskCoreException {
 
 4826                 CaseDbConnection connection = connections.getConnection();
 
 4829                 ResultSet rs = null;
 
 4831                         s = connection.createStatement();
 
 4832                         rs = connection.executeQuery(s, 
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "  
 4833                                         + 
"FROM tsk_objects LEFT JOIN tsk_files "  
 4834                                         + 
"ON tsk_objects.obj_id = tsk_files.obj_id "  
 4835                                         + 
"WHERE tsk_objects.par_obj_id = " + c.getId()
 
 4836                                         + 
" ORDER BY tsk_objects.obj_id"); 
 
 4837                         Collection<ObjectInfo> infos = 
new ArrayList<ObjectInfo>();
 
 4839                                 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")))); 
 
 4842                 } 
catch (SQLException ex) {
 
 4843                         throw new TskCoreException(
"Error getting Children Info for Content", ex);
 
 4862         ObjectInfo getParentInfo(Content c) 
throws TskCoreException {
 
 4863                 return getParentInfo(c.getId());
 
 4876         ObjectInfo getParentInfo(
long contentId) 
throws TskCoreException {
 
 4877                 CaseDbConnection connection = connections.getConnection();
 
 4880                 ResultSet rs = null;
 
 4882                         s = connection.createStatement();
 
 4883                         rs = connection.executeQuery(s, 
"SELECT parent.obj_id AS obj_id, parent.type AS type "  
 4884                                         + 
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "  
 4885                                         + 
"ON child.par_obj_id = parent.obj_id "  
 4886                                         + 
"WHERE child.obj_id = " + contentId); 
 
 4888                                 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
 
 4892                 } 
catch (SQLException ex) {
 
 4893                         throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
 
 4912         Directory getParentDirectory(FsContent fsc) 
throws TskCoreException {
 
 4917                         ObjectInfo parentInfo = getParentInfo(fsc);
 
 4918                         if (parentInfo == null) {
 
 4921                         Directory parent = null;
 
 4922                         if (parentInfo.type == ObjectType.ABSTRACTFILE) {
 
 4923                                 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
 
 4925                                 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() + 
") has wrong type to be directory: " + parentInfo.type);
 
 4944                 Content content = frequentlyUsedContentMap.get(
id);
 
 4945                 if (null != content) {
 
 4949                 CaseDbConnection connection = connections.getConnection();
 
 4952                 ResultSet rs = null;
 
 4957                         s = connection.createStatement();
 
 4958                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_objects WHERE obj_id = " + 
id + 
" LIMIT  1"); 
 
 4962                         parentId = rs.getLong(
"par_obj_id"); 
 
 4964                 } 
catch (SQLException ex) {
 
 4965                         throw new TskCoreException(
"Error getting Content by ID.", ex);
 
 4977                                 frequentlyUsedContentMap.put(
id, content);
 
 4980                                 content = getVolumeSystemById(
id, parentId);
 
 4983                                 content = getVolumeById(
id, parentId);
 
 4984                                 frequentlyUsedContentMap.put(
id, content);
 
 4987                                 content = getPoolById(
id, parentId);
 
 4990                                 content = getFileSystemById(
id, parentId);
 
 4991                                 frequentlyUsedContentMap.put(
id, content);
 
 5002                                         frequentlyUsedContentMap.put(
id, content);
 
 5012                                 throw new TskCoreException(
"Could not obtain Content object with ID: " + 
id);
 
 5025         String getFilePath(
long id) {
 
 5026                 CaseDbConnection connection;
 
 5028                         connection = connections.getConnection();
 
 5029                 } 
catch (TskCoreException ex) {
 
 5030                         logger.log(Level.SEVERE, 
"Error getting file path for file " + 
id, ex); 
 
 5033                 String filePath = null;
 
 5035                 ResultSet rs = null;
 
 5037                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
 
 5038                         statement.clearParameters();
 
 5039                         statement.setLong(1, 
id);
 
 5040                         rs = connection.executeQuery(statement);
 
 5042                                 filePath = rs.getString(
"path");
 
 5044                 } 
catch (SQLException ex) {
 
 5045                         logger.log(Level.SEVERE, 
"Error getting file path for file " + 
id, ex); 
 
 5061         TskData.EncodingType getEncodingType(
long id) {
 
 5062                 CaseDbConnection connection;
 
 5064                         connection = connections.getConnection();
 
 5065                 } 
catch (TskCoreException ex) {
 
 5066                         logger.log(Level.SEVERE, 
"Error getting file path for file " + 
id, ex); 
 
 5069                 TskData.EncodingType type = TskData.EncodingType.NONE;
 
 5071                 ResultSet rs = null;
 
 5073                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
 
 5074                         statement.clearParameters();
 
 5075                         statement.setLong(1, 
id);
 
 5076                         rs = connection.executeQuery(statement);
 
 5078                                 type = TskData.EncodingType.valueOf(rs.getInt(1));
 
 5080                 } 
catch (SQLException ex) {
 
 5081                         logger.log(Level.SEVERE, 
"Error getting encoding type for file " + 
id, ex); 
 
 5098         String getFileParentPath(
long objectId, CaseDbConnection connection) {
 
 5099                 String parentPath = null;
 
 5101                 ResultSet rs = null;
 
 5103                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
 
 5104                         statement.clearParameters();
 
 5105                         statement.setLong(1, objectId);
 
 5106                         rs = connection.executeQuery(statement);
 
 5108                                 parentPath = rs.getString(
"parent_path");
 
 5110                 } 
catch (SQLException ex) {
 
 5111                         logger.log(Level.SEVERE, 
"Error getting file parent_path for file " + objectId, ex); 
 
 5127         String getFileName(
long objectId, CaseDbConnection connection) {
 
 5128                 String fileName = null;
 
 5130                 ResultSet rs = null;
 
 5132                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
 
 5133                         statement.clearParameters();
 
 5134                         statement.setLong(1, objectId);
 
 5135                         rs = connection.executeQuery(statement);
 
 5137                                 fileName = rs.getString(
"name");
 
 5139                 } 
catch (SQLException ex) {
 
 5140                         logger.log(Level.SEVERE, 
"Error getting file parent_path for file " + objectId, ex); 
 
 5158         DerivedFile.DerivedMethod getDerivedMethod(
long id) 
throws TskCoreException {
 
 5159                 CaseDbConnection connection = connections.getConnection();
 
 5160                 DerivedFile.DerivedMethod method = null;
 
 5162                 ResultSet rs1 = null;
 
 5163                 ResultSet rs2 = null;
 
 5165                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
 
 5166                         statement.clearParameters();
 
 5167                         statement.setLong(1, 
id);
 
 5168                         rs1 = connection.executeQuery(statement);
 
 5170                                 int method_id = rs1.getInt(
"derived_id");
 
 5171                                 String rederive = rs1.getString(
"rederive");
 
 5172                                 method = 
new DerivedFile.DerivedMethod(method_id, rederive);
 
 5173                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
 
 5174                                 statement.clearParameters();
 
 5175                                 statement.setInt(1, method_id);
 
 5176                                 rs2 = connection.executeQuery(statement);
 
 5178                                         method.setToolName(rs2.getString(
"tool_name"));
 
 5179                                         method.setToolVersion(rs2.getString(
"tool_version"));
 
 5180                                         method.setOther(rs2.getString(
"other"));
 
 5183                 } 
catch (SQLException e) {
 
 5184                         logger.log(Level.SEVERE, 
"Error getting derived method for file: " + 
id, e); 
 
 5186                         closeResultSet(rs2);
 
 5187                         closeResultSet(rs1);
 
 5205                 CaseDbConnection connection = connections.getConnection();
 
 5227                 ResultSet rs = null;
 
 5229                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_BY_ID);
 
 5230                         statement.clearParameters();
 
 5231                         statement.setLong(1, objectId);
 
 5232                         rs = connection.executeQuery(statement);
 
 5233                         List<AbstractFile> files = resultSetToAbstractFiles(rs, connection);
 
 5234                         if (files.size() > 0) {
 
 5235                                 return files.get(0);
 
 5239                 } 
catch (SQLException ex) {
 
 5240                         throw new TskCoreException(
"Error getting file by id, id = " + objectId, ex);
 
 5258                 CaseDbConnection connection = connections.getConnection();
 
 5260                 ResultSet rs = null;
 
 5262                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID);
 
 5263                         statement.clearParameters();
 
 5264                         statement.setLong(1, 
id);
 
 5265                         rs = connection.executeQuery(statement);
 
 5266                         List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
 
 5267                         if (artifacts.size() > 0) {
 
 5268                                 return artifacts.get(0);
 
 5272                 } 
catch (SQLException ex) {
 
 5273                         throw new TskCoreException(
"Error getting artifacts by artifact_obj_id, artifact_obj_id = " + 
id, ex);
 
 5292                 CaseDbConnection connection = connections.getConnection();
 
 5294                 ResultSet rs = null;
 
 5296                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_ID);
 
 5297                         statement.clearParameters();
 
 5298                         statement.setLong(1, 
id);
 
 5299                         rs = connection.executeQuery(statement);
 
 5300                         List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
 
 5301                         if (artifacts.size() > 0) {
 
 5302                                 return artifacts.get(0);
 
 5306                 } 
catch (SQLException ex) {
 
 5307                         throw new TskCoreException(
"Error getting artifacts by artifact id, artifact id = " + 
id, ex);
 
 5327         private long getFileSystemId(
long fileId, CaseDbConnection connection) {
 
 5329                 ResultSet rs = null;
 
 5332                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_SYSTEM_BY_OBJECT);
 
 5333                         statement.clearParameters();
 
 5334                         statement.setLong(1, fileId);
 
 5335                         rs = connection.executeQuery(statement);
 
 5337                                 ret = rs.getLong(
"fs_obj_id");
 
 5342                 } 
catch (SQLException e) {
 
 5343                         logger.log(Level.SEVERE, 
"Error checking file system id of a file, id = " + fileId, e); 
 
 5363                 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId()); 
 
 5364                 CaseDbConnection connection = connections.getConnection();
 
 5366                 Statement statement = null;
 
 5367                 ResultSet resultSet = null;
 
 5369                         statement = connection.createStatement();
 
 5370                         resultSet = connection.executeQuery(statement, query);
 
 5372                         return (resultSet.getLong(
"count") > 0L);
 
 5373                 } 
catch (SQLException ex) {
 
 5374                         throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
 
 5376                         closeResultSet(resultSet);
 
 5377                         closeStatement(statement);
 
 5394         public List<AbstractFile> 
findFiles(
Content dataSource, String fileName) 
throws TskCoreException {
 
 5395                 List<AbstractFile> files = 
new ArrayList<AbstractFile>();
 
 5396                 CaseDbConnection connection = connections.getConnection();
 
 5398                 ResultSet resultSet = null;
 
 5400                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME);
 
 5401                         statement.clearParameters();
 
 5402                         statement.setString(1, fileName.toLowerCase());
 
 5403                         statement.setLong(2, dataSource.getId());
 
 5404                         resultSet = connection.executeQuery(statement);
 
 5405                         files.addAll(resultSetToAbstractFiles(resultSet, connection));
 
 5406                 } 
catch (SQLException e) {
 
 5407                         throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
 
 5409                         closeResultSet(resultSet);
 
 5429         public List<AbstractFile> 
findFiles(
Content dataSource, String fileName, String dirSubString) 
throws TskCoreException {
 
 5430                 List<AbstractFile> files = 
new ArrayList<AbstractFile>();
 
 5431                 CaseDbConnection connection = connections.getConnection();
 
 5433                 ResultSet resultSet = null;
 
 5435                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
 
 5436                         statement.clearParameters();
 
 5437                         statement.setString(1, fileName.toLowerCase());
 
 5438                         statement.setString(2, 
"%" + dirSubString.toLowerCase() + 
"%"); 
 
 5439                         statement.setLong(3, dataSource.getId());
 
 5440                         resultSet = connection.executeQuery(statement);
 
 5441                         files.addAll(resultSetToAbstractFiles(resultSet, connection));
 
 5442                 } 
catch (SQLException e) {
 
 5443                         throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
 
 5445                         closeResultSet(resultSet);
 
 5471                         if (null != localTrans) {
 
 5474                                 } 
catch (TskCoreException ex2) {
 
 5475                                         logger.log(Level.SEVERE, 
"Failed to rollback transaction after exception", ex2);
 
 5493         private long addObject(
long parentId, 
int objectType, CaseDbConnection connection) 
throws SQLException {
 
 5494                 ResultSet resultSet = null;
 
 5498                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
 
 5499                         statement.clearParameters();
 
 5500                         if (parentId != 0) {
 
 5501                                 statement.setLong(1, parentId);
 
 5503                                 statement.setNull(1, java.sql.Types.BIGINT);
 
 5505                         statement.setInt(2, objectType);
 
 5506                         connection.executeUpdate(statement);
 
 5507                         resultSet = statement.getGeneratedKeys();
 
 5509                         if (resultSet.next()) {
 
 5510                                 if (parentId != 0) {
 
 5511                                         setHasChildren(parentId);
 
 5513                                 return resultSet.getLong(1); 
 
 5515                                 throw new SQLException(
"Error inserting object with parent " + parentId + 
" into tsk_objects");
 
 5518                         closeResultSet(resultSet);
 
 5541                 if (transaction == null) {
 
 5542                         throw new TskCoreException(
"Passed null CaseDbTransaction");
 
 5545                 ResultSet resultSet = null;
 
 5548                         CaseDbConnection connection = transaction.getConnection();
 
 5553                                 if (isRootDirectory((AbstractFile) parent, transaction)) {
 
 5556                                         parentPath = ((AbstractFile) parent).getParentPath() + parent.
getName() + 
"/"; 
 
 5570                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 5571                         statement.clearParameters();
 
 5572                         statement.setLong(1, newObjId);
 
 5575                         if (0 != parentId) {
 
 5576                                 long parentFs = this.getFileSystemId(parentId, connection);
 
 5577                                 if (parentFs != -1) {
 
 5578                                         statement.setLong(2, parentFs);
 
 5580                                         statement.setNull(2, java.sql.Types.BIGINT);
 
 5583                                 statement.setNull(2, java.sql.Types.BIGINT);
 
 5587                         statement.setString(3, directoryName);
 
 5591                         statement.setShort(5, (
short) 1);
 
 5595                         statement.setShort(6, dirType.
getValue());
 
 5597                         statement.setShort(7, metaType.
getValue());
 
 5601                         statement.setShort(8, dirFlag.
getValue());
 
 5604                         statement.setShort(9, metaFlags);
 
 5607                         statement.setLong(10, 0);
 
 5610                         statement.setNull(11, java.sql.Types.BIGINT);
 
 5611                         statement.setNull(12, java.sql.Types.BIGINT);
 
 5612                         statement.setNull(13, java.sql.Types.BIGINT);
 
 5613                         statement.setNull(14, java.sql.Types.BIGINT);
 
 5615                         statement.setNull(15, java.sql.Types.VARCHAR); 
 
 5617                         statement.setNull(17, java.sql.Types.VARCHAR); 
 
 5620                         statement.setString(18, parentPath);
 
 5623                         long dataSourceObjectId;
 
 5624                         if (0 == parentId) {
 
 5625                                 dataSourceObjectId = newObjId;
 
 5627                                 dataSourceObjectId = getDataSourceObjectId(connection, parentId);
 
 5629                         statement.setLong(19, dataSourceObjectId);
 
 5632                         statement.setString(20, null);
 
 5633                         connection.executeUpdate(statement);
 
 5635                         return new VirtualDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
 
 5638                 } 
catch (SQLException e) {
 
 5639                         throw new TskCoreException(
"Error creating virtual directory '" + directoryName + 
"'", e);
 
 5641                         closeResultSet(resultSet);
 
 5663                 } 
catch (TskCoreException ex) {
 
 5666                         } 
catch (TskCoreException ex2) {
 
 5667                                 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
 
 5691                 if (transaction == null) {
 
 5692                         throw new TskCoreException(
"Passed null CaseDbTransaction");
 
 5695                 ResultSet resultSet = null;
 
 5698                         CaseDbConnection connection = transaction.getConnection();
 
 5701                         if ((parent == null) || isRootDirectory(parent, transaction)) {
 
 5714                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 5715                         statement.clearParameters();
 
 5716                         statement.setLong(1, newObjId);
 
 5719                         statement.setNull(2, java.sql.Types.BIGINT);
 
 5722                         statement.setString(3, directoryName);
 
 5726                         statement.setShort(5, (
short) 1);
 
 5730                         statement.setShort(6, dirType.
getValue());
 
 5732                         statement.setShort(7, metaType.
getValue());
 
 5736                         statement.setShort(8, dirFlag.
getValue());
 
 5739                         statement.setShort(9, metaFlags);
 
 5742                         statement.setLong(10, 0);
 
 5745                         statement.setNull(11, java.sql.Types.BIGINT);
 
 5746                         statement.setNull(12, java.sql.Types.BIGINT);
 
 5747                         statement.setNull(13, java.sql.Types.BIGINT);
 
 5748                         statement.setNull(14, java.sql.Types.BIGINT);
 
 5750                         statement.setNull(15, java.sql.Types.VARCHAR); 
 
 5752                         statement.setNull(17, java.sql.Types.VARCHAR); 
 
 5755                         statement.setString(18, parentPath);
 
 5758                         long dataSourceObjectId = getDataSourceObjectId(connection, parentId);
 
 5759                         statement.setLong(19, dataSourceObjectId);
 
 5762                         statement.setString(20, null);
 
 5764                         connection.executeUpdate(statement);
 
 5766                         return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
 
 5769                 } 
catch (SQLException e) {
 
 5770                         throw new TskCoreException(
"Error creating local directory '" + directoryName + 
"'", e);
 
 5772                         closeResultSet(resultSet);
 
 5797                 Statement statement = null;
 
 5801                         CaseDbConnection connection = transaction.getConnection();
 
 5806                         statement = connection.createStatement();
 
 5807                         statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) " 
 5808                                         + 
"VALUES(" + newObjId + 
", '" + deviceId + 
"', '" + timeZone + 
"');");
 
 5817                         PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 5818                         preparedStatement.clearParameters();
 
 5819                         preparedStatement.setLong(1, newObjId);
 
 5820                         preparedStatement.setNull(2, java.sql.Types.BIGINT);
 
 5821                         preparedStatement.setString(3, rootDirectoryName);
 
 5823                         preparedStatement.setShort(5, (
short) 1);
 
 5827                         preparedStatement.setShort(7, metaType.
getValue());
 
 5829                         preparedStatement.setShort(8, dirFlag.
getValue());
 
 5832                         preparedStatement.setShort(9, metaFlags);
 
 5833                         preparedStatement.setLong(10, 0);
 
 5834                         preparedStatement.setNull(11, java.sql.Types.BIGINT);
 
 5835                         preparedStatement.setNull(12, java.sql.Types.BIGINT);
 
 5836                         preparedStatement.setNull(13, java.sql.Types.BIGINT);
 
 5837                         preparedStatement.setNull(14, java.sql.Types.BIGINT);
 
 5838                         preparedStatement.setNull(15, java.sql.Types.VARCHAR); 
 
 5840                         preparedStatement.setNull(17, java.sql.Types.VARCHAR); 
 
 5841                         String parentPath = 
"/"; 
 
 5842                         preparedStatement.setString(18, parentPath);
 
 5843                         preparedStatement.setLong(19, newObjId);
 
 5844                         preparedStatement.setString(20, null); 
 
 5845                         connection.executeUpdate(preparedStatement);
 
 5847                         return new LocalFilesDataSource(
this, newObjId, newObjId, deviceId, rootDirectoryName, dirType, metaType, dirFlag, metaFlags, timeZone, null, 
FileKnown.
UNKNOWN, parentPath);
 
 5849                 } 
catch (SQLException ex) {
 
 5850                         throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
 
 5852                         closeStatement(statement);
 
 5877                         String timezone, String md5, String sha1, String sha256,
 
 5881                 Statement statement = null;
 
 5884                         CaseDbConnection connection = transaction.getConnection();
 
 5889                         PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
 
 5890                         preparedStatement.clearParameters();
 
 5891                         preparedStatement.setLong(1, newObjId);
 
 5892                         preparedStatement.setShort(2, (
short) type.getValue());
 
 5893                         preparedStatement.setLong(3, sectorSize);
 
 5894                         preparedStatement.setString(4, timezone);
 
 5896                         long savedSize = size < 0 ? 0 : size;
 
 5897                         preparedStatement.setLong(5, savedSize);
 
 5898                         preparedStatement.setString(6, md5);
 
 5899                         preparedStatement.setString(7, sha1);
 
 5900                         preparedStatement.setString(8, sha256);
 
 5901                         preparedStatement.setString(9, displayName);
 
 5902                         connection.executeUpdate(preparedStatement);
 
 5905                         for (
int i = 0; i < imagePaths.size(); i++) {
 
 5906                                 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
 
 5907                                 preparedStatement.clearParameters();
 
 5908                                 preparedStatement.setLong(1, newObjId);
 
 5909                                 preparedStatement.setString(2, imagePaths.get(i));
 
 5910                                 preparedStatement.setLong(3, i);
 
 5911                                 connection.executeUpdate(preparedStatement);
 
 5915                         preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO);
 
 5916                         statement = connection.createStatement();
 
 5917                         preparedStatement.setLong(1, newObjId);
 
 5918                         preparedStatement.setString(2, deviceId);
 
 5919                         preparedStatement.setString(3, timezone);
 
 5920                         connection.executeUpdate(preparedStatement);
 
 5923                         String name = displayName;
 
 5924                         if (name == null || name.isEmpty()) {
 
 5925                                 if (imagePaths.size() > 0) {
 
 5926                                         String path = imagePaths.get(0);
 
 5927                                         name = (
new java.io.File(path)).getName();
 
 5932                         return new Image(
this, newObjId, type.getValue(), deviceId, sectorSize, name,
 
 5933                                         imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, savedSize);
 
 5934                 } 
catch (SQLException ex) {
 
 5935                         if (!imagePaths.isEmpty()) {
 
 5936                                 throw new TskCoreException(String.format(
"Error adding image with path %s to database", imagePaths.get(0)), ex);
 
 5938                                 throw new TskCoreException(String.format(
"Error adding image with display name %s to database", displayName), ex);
 
 5941                         closeStatement(statement);
 
 5964                         CaseDbConnection connection = transaction.getConnection();
 
 5965                         long newObjId = addObject(parentObjId, 
TskData.
ObjectType.
VS.getObjectType(), connection);
 
 5969                         PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_INFO);
 
 5970                         preparedStatement.clearParameters();
 
 5971                         preparedStatement.setLong(1, newObjId);
 
 5972                         preparedStatement.setShort(2, (
short) type.getVsType());
 
 5973                         preparedStatement.setLong(3, imgOffset);
 
 5974                         preparedStatement.setLong(4, blockSize);
 
 5975                         connection.executeUpdate(preparedStatement);
 
 5978                         return new VolumeSystem(
this, newObjId, 
"", type.getVsType(), imgOffset, blockSize);
 
 5979                 } 
catch (SQLException ex) {
 
 5980                         throw new TskCoreException(String.format(
"Error creating volume system with parent ID %d and image offset %d",
 
 5981                                         parentObjId, imgOffset), ex);
 
 6002         public Volume addVolume(
long parentObjId, 
long addr, 
long start, 
long length, String desc,
 
 6005                 Statement statement = null;
 
 6008                         CaseDbConnection connection = transaction.getConnection();
 
 6013                         PreparedStatement preparedStatement;
 
 6015                                 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL);
 
 6017                                 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_SQLITE);
 
 6019                         preparedStatement.clearParameters();
 
 6020                         preparedStatement.setLong(1, newObjId);
 
 6021                         preparedStatement.setLong(2, addr);
 
 6022                         preparedStatement.setLong(3, start);
 
 6023                         preparedStatement.setLong(4, length);
 
 6024                         preparedStatement.setString(5, desc);
 
 6025                         preparedStatement.setShort(6, (
short) flags);
 
 6026                         connection.executeUpdate(preparedStatement);
 
 6029                         return new Volume(
this, newObjId, addr, start, length, flags, desc);
 
 6030                 } 
catch (SQLException ex) {
 
 6031                         throw new TskCoreException(String.format(
"Error creating volume with address %d and parent ID %d", addr, parentObjId), ex);
 
 6033                         closeStatement(statement);
 
 6051                 Statement statement = null;
 
 6054                         CaseDbConnection connection = transaction.getConnection();
 
 6059                         PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_POOL_INFO);
 
 6060                         preparedStatement.clearParameters();
 
 6061                         preparedStatement.setLong(1, newObjId);
 
 6062                         preparedStatement.setShort(2, type.getValue());
 
 6063                         connection.executeUpdate(preparedStatement);
 
 6066                         return new Pool(
this, newObjId, type.getName(), type.getValue());
 
 6067                 } 
catch (SQLException ex) {
 
 6068                         throw new TskCoreException(String.format(
"Error creating pool with type %d and parent ID %d", type.getValue(), parentObjId), ex);
 
 6070                         closeStatement(statement);
 
 6094                         long rootInum, 
long firstInum, 
long lastInum, String displayName,
 
 6097                 Statement statement = null;
 
 6100                         CaseDbConnection connection = transaction.getConnection();
 
 6101                         long newObjId = addObject(parentObjId, 
TskData.
ObjectType.
FS.getObjectType(), connection);
 
 6104                         long dataSourceId = getDataSourceObjectId(connection, newObjId);
 
 6108                         PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FS_INFO);
 
 6109                         preparedStatement.clearParameters();
 
 6110                         preparedStatement.setLong(1, newObjId);
 
 6111                         preparedStatement.setLong(2, dataSourceId);
 
 6112                         preparedStatement.setLong(3, imgOffset);
 
 6113                         preparedStatement.setInt(4, type.getValue());
 
 6114                         preparedStatement.setLong(5, blockSize);
 
 6115                         preparedStatement.setLong(6, blockCount);
 
 6116                         preparedStatement.setLong(7, rootInum);
 
 6117                         preparedStatement.setLong(8, firstInum);
 
 6118                         preparedStatement.setLong(9, lastInum);
 
 6119                         preparedStatement.setString(10, displayName);
 
 6120                         connection.executeUpdate(preparedStatement);
 
 6123                         return new FileSystem(
this, newObjId, displayName, imgOffset, type, blockSize, blockCount, rootInum,
 
 6124                                         firstInum, lastInum);
 
 6125                 } 
catch (SQLException ex) {
 
 6126                         throw new TskCoreException(String.format(
"Error creating file system with image offset %d and parent ID %d",
 
 6127                                         imgOffset, parentObjId), ex);
 
 6129                         closeStatement(statement);
 
 6161                         long metaAddr, 
int metaSeq,
 
 6164                         long ctime, 
long crtime, 
long atime, 
long mtime,
 
 6165                         boolean isFile, 
Content parent) 
throws TskCoreException {
 
 6170                 Statement queryStatement = null;
 
 6172                         CaseDbConnection connection = transaction.getConnection();
 
 6181                                 AbstractFile parentFile = (AbstractFile) parent;
 
 6182                                 if (isRootDirectory(parentFile, transaction)) {
 
 6185                                         parentPath = parentFile.
getParentPath() + parent.getName() + 
"/"; 
 
 6191                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE);
 
 6192                         statement.clearParameters();
 
 6193                         statement.setLong(1, objectId);                                                                                 
 
 6194                         statement.setLong(2, fsObjId);                                                                                  
 
 6195                         statement.setLong(3, dataSourceObjId);                                                                  
 
 6196                         statement.setShort(4, (
short) attrType.getValue());                                             
 
 6197                         statement.setInt(5, attrId);                                                                                    
 
 6198                         statement.setString(6, fileName);                                                                               
 
 6199                         statement.setLong(7, metaAddr);                                                                                 
 
 6200                         statement.setInt(8, metaSeq);                                                                                   
 
 6202                         statement.setShort(10, (
short) 1);                                                                              
 
 6204                         statement.setShort(11, dirType.
getValue());                                                             
 
 6206                         statement.setShort(12, metaType.
getValue());                                                    
 
 6207                         statement.setShort(13, dirFlag.getValue());                                                             
 
 6208                         statement.setShort(14, metaFlags);                                                                              
 
 6209                         statement.setLong(15, size < 0 ? 0 : size);
 
 6210                         statement.setLong(16, ctime);
 
 6211                         statement.setLong(17, crtime);
 
 6212                         statement.setLong(18, atime);
 
 6213                         statement.setLong(19, mtime);
 
 6214                         statement.setString(20, parentPath);
 
 6215                         final String extension = extractExtension(fileName);
 
 6216                         statement.setString(21, extension);
 
 6218                         connection.executeUpdate(statement);
 
 6220                         DerivedFile derivedFile = 
new DerivedFile(
this, objectId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
 
 6221                                         size, ctime, crtime, atime, mtime, null, null, parentPath, null, parent.getId(), null, null, extension);
 
 6223                         timelineManager.addEventsForNewFile(derivedFile, connection);
 
 6229                                         attrType, attrId, fileName, metaAddr, metaSeq,
 
 6230                                         dirType, metaType, dirFlag, metaFlags,
 
 6231                                         size, ctime, crtime, atime, mtime,
 
 6232                                         (
short) 0, 0, 0, null, null, parentPath, null,
 
 6235                 } 
catch (SQLException ex) {
 
 6236                         logger.log(Level.WARNING, 
"Failed to add file system file", ex);
 
 6238                         closeStatement(queryStatement);
 
 6239                         if (null != transaction) {
 
 6242                                 } 
catch (TskCoreException ex2) {
 
 6243                                         logger.log(Level.SEVERE, 
"Failed to rollback transaction after exception", ex2);
 
 6259                 CaseDbConnection connection = connections.getConnection();
 
 6262                 ResultSet rs = null;
 
 6264                         s = connection.createStatement();
 
 6265                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_files WHERE"  
 6267                                         + 
" AND obj_id = data_source_obj_id" 
 6268                                         + 
" ORDER BY dir_type, LOWER(name)"); 
 
 6269                         List<VirtualDirectory> virtDirRootIds = 
new ArrayList<VirtualDirectory>();
 
 6271                                 virtDirRootIds.add(virtualDirectory(rs, connection));
 
 6273                         return virtDirRootIds;
 
 6274                 } 
catch (SQLException ex) {
 
 6275                         throw new TskCoreException(
"Error getting local files virtual folder id", ex);
 
 6297                 assert (null != fileRanges);
 
 6298                 if (null == fileRanges) {
 
 6299                         throw new TskCoreException(
"TskFileRange object is null");
 
 6302                 assert (null != parent);
 
 6303                 if (null == parent) {
 
 6304                         throw new TskCoreException(
"Conent is null");
 
 6308                 Statement statement = null;
 
 6309                 ResultSet resultSet = null;
 
 6313                         CaseDbConnection connection = transaction.getConnection();
 
 6315                         List<LayoutFile> fileRangeLayoutFiles = 
new ArrayList<LayoutFile>();
 
 6323                                 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
 
 6332                                 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 6333                                 prepStmt.clearParameters();
 
 6334                                 prepStmt.setLong(1, fileRangeId); 
 
 6335                                 prepStmt.setNull(2, java.sql.Types.BIGINT); 
 
 6336                                 prepStmt.setString(3, 
"Unalloc_" + parent.getId() + 
"_" + fileRange.getByteStart() + 
"_" + end_byte_in_parent); 
 
 6338                                 prepStmt.setNull(5, java.sql.Types.BIGINT); 
 
 6343                                 prepStmt.setLong(10, fileRange.getByteLen()); 
 
 6344                                 prepStmt.setNull(11, java.sql.Types.BIGINT); 
 
 6345                                 prepStmt.setNull(12, java.sql.Types.BIGINT); 
 
 6346                                 prepStmt.setNull(13, java.sql.Types.BIGINT); 
 
 6347                                 prepStmt.setNull(14, java.sql.Types.BIGINT); 
 
 6348                                 prepStmt.setNull(15, java.sql.Types.VARCHAR); 
 
 6350                                 prepStmt.setNull(17, java.sql.Types.VARCHAR); 
 
 6351                                 prepStmt.setNull(18, java.sql.Types.VARCHAR); 
 
 6352                                 prepStmt.setLong(19, parent.getId()); 
 
 6355                                 prepStmt.setString(20, null);
 
 6356                                 connection.executeUpdate(prepStmt);
 
 6363                                 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
 
 6364                                 prepStmt.clearParameters();
 
 6365                                 prepStmt.setLong(1, fileRangeId); 
 
 6366                                 prepStmt.setLong(2, fileRange.getByteStart()); 
 
 6367                                 prepStmt.setLong(3, fileRange.getByteLen()); 
 
 6368                                 prepStmt.setLong(4, fileRange.getSequence()); 
 
 6369                                 connection.executeUpdate(prepStmt);
 
 6374                                 fileRangeLayoutFiles.add(
new LayoutFile(
this,
 
 6377                                                 Long.toString(fileRange.getSequence()),
 
 6383                                                 fileRange.getByteLen(),
 
 6387                                                 parent.getUniquePath(),
 
 6393                         return fileRangeLayoutFiles;
 
 6395                 } 
catch (SQLException ex) {
 
 6396                         throw new TskCoreException(
"Failed to add layout files to case database", ex);
 
 6398                         closeResultSet(resultSet);
 
 6399                         closeStatement(statement);
 
 6401                         if (null != transaction) {
 
 6404                                 } 
catch (TskCoreException ex2) {
 
 6405                                         logger.log(Level.SEVERE, 
"Failed to rollback transaction after exception", ex2);
 
 6423                 assert (null != carvingResult);
 
 6424                 if (null == carvingResult) {
 
 6425                         throw new TskCoreException(
"Carving is null");
 
 6427                 assert (null != carvingResult.getParent());
 
 6428                 if (null == carvingResult.getParent()) {
 
 6429                         throw new TskCoreException(
"Carving result has null parent");
 
 6431                 assert (null != carvingResult.getCarvedFiles());
 
 6432                 if (null == carvingResult.getCarvedFiles()) {
 
 6433                         throw new TskCoreException(
"Carving result has null carved files");
 
 6436                 Statement statement = null;
 
 6437                 ResultSet resultSet = null;
 
 6438                 long newCacheKey = 0; 
 
 6441                         CaseDbConnection connection = transaction.getConnection();
 
 6450                         while (null != root) {
 
 6465                         if (null == carvedFilesDir) {
 
 6466                                 List<Content> rootChildren;
 
 6468                                         rootChildren = ((FileSystem) root).getRootDirectory().
getChildren();
 
 6472                                 for (
Content child : rootChildren) {
 
 6478                                 if (null == carvedFilesDir) {
 
 6479                                         long parId = root.
getId();
 
 6481                                         if (root instanceof FileSystem) {
 
 6482                                                 Content rootDir = ((FileSystem) root).getRootDirectory();
 
 6483                                                 parId = rootDir.
getId();
 
 6487                                 newCacheKey = root.
getId();
 
 6488                                 rootIdsToCarvedFileDirs.put(newCacheKey, carvedFilesDir);
 
 6495                         String parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() + 
"/";
 
 6496                         List<LayoutFile> carvedFiles = 
new ArrayList<LayoutFile>();
 
 6512                                 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 6513                                 prepStmt.clearParameters();
 
 6514                                 prepStmt.setLong(1, carvedFileId); 
 
 6516                                         prepStmt.setLong(2, root.
getId()); 
 
 6518                                         prepStmt.setNull(2, java.sql.Types.BIGINT); 
 
 6520                                 prepStmt.setString(3, carvedFile.getName()); 
 
 6522                                 prepStmt.setShort(5, (
short) 1); 
 
 6527                                 prepStmt.setLong(10, carvedFile.getSizeInBytes()); 
 
 6528                                 prepStmt.setNull(11, java.sql.Types.BIGINT); 
 
 6529                                 prepStmt.setNull(12, java.sql.Types.BIGINT); 
 
 6530                                 prepStmt.setNull(13, java.sql.Types.BIGINT); 
 
 6531                                 prepStmt.setNull(14, java.sql.Types.BIGINT); 
 
 6532                                 prepStmt.setNull(15, java.sql.Types.VARCHAR); 
 
 6534                                 prepStmt.setNull(17, java.sql.Types.VARCHAR); 
 
 6535                                 prepStmt.setString(18, parentPath); 
 
 6537                                 prepStmt.setString(20, extractExtension(carvedFile.getName())); 
 
 6538                                 connection.executeUpdate(prepStmt);
 
 6545                                 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
 
 6546                                 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
 
 6547                                         prepStmt.clearParameters();
 
 6548                                         prepStmt.setLong(1, carvedFileId); 
 
 6549                                         prepStmt.setLong(2, tskFileRange.getByteStart()); 
 
 6550                                         prepStmt.setLong(3, tskFileRange.getByteLen()); 
 
 6551                                         prepStmt.setLong(4, tskFileRange.getSequence()); 
 
 6552                                         connection.executeUpdate(prepStmt);
 
 6561                                                 carvedFile.getName(),
 
 6567                                                 carvedFile.getSizeInBytes(),
 
 6579                 } 
catch (SQLException ex) {
 
 6580                         throw new TskCoreException(
"Failed to add carved files to case database", ex);
 
 6582                         closeResultSet(resultSet);
 
 6583                         closeStatement(statement);
 
 6585                         if (null != transaction) {
 
 6588                                 } 
catch (TskCoreException ex2) {
 
 6589                                         logger.log(Level.SEVERE, 
"Failed to rollback transaction after exception", ex2);
 
 6591                                 if (0 != newCacheKey) {
 
 6592                                         rootIdsToCarvedFileDirs.remove(newCacheKey);
 
 6629                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
 6630                         boolean isFile, 
Content parentObj,
 
 6631                         String rederiveDetails, String toolName, String toolVersion,
 
 6634                 localPath = localPath.replaceAll(
"^[/\\\\]+", 
"");
 
 6639                 CaseDbConnection connection = transaction.getConnection();
 
 6641                         final long parentId = parentObj.
getId();
 
 6642                         String parentPath = 
"";
 
 6646                                 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() + 
'/'; 
 
 6658                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 6659                         statement.clearParameters();
 
 6660                         statement.setLong(1, newObjId);
 
 6663                         long fsObjId = this.getFileSystemId(parentId, connection);
 
 6664                         if (fsObjId != -1) {
 
 6665                                 statement.setLong(2, fsObjId);
 
 6667                                 statement.setNull(2, java.sql.Types.BIGINT);
 
 6669                         statement.setString(3, fileName);
 
 6673                         statement.setShort(5, (
short) 1);
 
 6677                         statement.setShort(6, dirType.
getValue());
 
 6679                         statement.setShort(7, metaType.
getValue());
 
 6683                         statement.setShort(8, dirFlag.
getValue());
 
 6686                         statement.setShort(9, metaFlags);
 
 6690                         long savedSize = size < 0 ? 0 : size;
 
 6691                         statement.setLong(10, savedSize);
 
 6695                         statement.setLong(11, ctime);
 
 6696                         statement.setLong(12, crtime);
 
 6697                         statement.setLong(13, atime);
 
 6698                         statement.setLong(14, mtime);
 
 6700                         statement.setNull(15, java.sql.Types.VARCHAR); 
 
 6702                         statement.setNull(17, java.sql.Types.VARCHAR); 
 
 6705                         statement.setString(18, parentPath);
 
 6708                         long dataSourceObjId = getDataSourceObjectId(connection, parentId);
 
 6709                         statement.setLong(19, dataSourceObjId);
 
 6710                         final String extension = extractExtension(fileName);
 
 6712                         statement.setString(20, extension);
 
 6714                         connection.executeUpdate(statement);
 
 6717                         addFilePath(connection, newObjId, localPath, encodingType);
 
 6719                         DerivedFile derivedFile = 
new DerivedFile(
this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
 
 6720                                         savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
 
 6722                         timelineManager.addEventsForNewFile(derivedFile, connection);
 
 6726                 } 
catch (SQLException ex) {
 
 6727                         connection.rollbackTransaction();
 
 6728                         throw new TskCoreException(
"Failed to add derived file to case database", ex);
 
 6765                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
 6766                         boolean isFile, String mimeType,
 
 6767                         String rederiveDetails, String toolName, String toolVersion,
 
 6771                 localPath = localPath.replaceAll(
"^[/\\\\]+", 
"");
 
 6773                 CaseDbConnection connection = connections.getConnection();
 
 6775                 ResultSet rs = null;
 
 6778                         connection.beginTransaction();
 
 6779                         final long parentId = parentObj.
getId();
 
 6780                         String parentPath = 
"";
 
 6784                                 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() + 
'/'; 
 
 6788                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_DERIVED_FILE);
 
 6789                         statement.clearParameters();
 
 6796                         statement.setShort(2, dirType.
getValue());
 
 6798                         statement.setShort(3, metaType.
getValue());
 
 6802                         statement.setShort(4, dirFlag.
getValue());
 
 6805                         statement.setShort(5, metaFlags);
 
 6809                         long savedSize = size < 0 ? 0 : size;
 
 6810                         statement.setLong(6, savedSize);
 
 6814                         statement.setLong(7, ctime);
 
 6815                         statement.setLong(8, crtime);
 
 6816                         statement.setLong(9, atime);
 
 6817                         statement.setLong(10, mtime);
 
 6818                         statement.setString(11, mimeType);
 
 6819                         statement.setString(12, String.valueOf(derivedFile.
getId()));
 
 6820                         connection.executeUpdate(statement);
 
 6823                         updateFilePath(connection, derivedFile.
getId(), localPath, encodingType);
 
 6825                         connection.commitTransaction();
 
 6827                         long dataSourceObjId = getDataSourceObjectId(connection, parentId);
 
 6828                         final String extension = extractExtension(derivedFile.
getName());
 
 6829                         return new DerivedFile(
this, derivedFile.
getId(), dataSourceObjId, derivedFile.
getName(), dirType, metaType, dirFlag, metaFlags,
 
 6830                                         savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
 
 6831                 } 
catch (SQLException ex) {
 
 6832                         connection.rollbackTransaction();
 
 6833                         throw new TskCoreException(
"Failed to add derived file to case database", ex);
 
 6861                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
 6867                         LocalFile created = 
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
 
 6872                         if (null != localTrans) {
 
 6875                                 } 
catch (TskCoreException ex2) {
 
 6876                                         logger.log(Level.SEVERE, 
"Failed to rollback transaction after exception", ex2);
 
 6907                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
 6912                                 size, ctime, crtime, atime, mtime,
 
 6914                                 isFile, encodingType,
 
 6915                                 parent, transaction);
 
 6946                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
 6947                         String md5, 
FileKnown known, String mimeType,
 
 6950                 CaseDbConnection connection = transaction.getConnection();
 
 6951                 Statement queryStatement = null;
 
 6963                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 6964                         statement.clearParameters();
 
 6965                         statement.setLong(1, objectId);
 
 6966                         statement.setNull(2, java.sql.Types.BIGINT); 
 
 6967                         statement.setString(3, fileName);
 
 6969                         statement.setShort(5, (
short) 1);
 
 6971                         statement.setShort(6, dirType.
getValue());
 
 6973                         statement.setShort(7, metaType.
getValue());
 
 6975                         statement.setShort(8, dirFlag.
getValue());
 
 6977                         statement.setShort(9, metaFlags);
 
 6979                         long savedSize = size < 0 ? 0 : size;
 
 6980                         statement.setLong(10, savedSize);
 
 6981                         statement.setLong(11, ctime);
 
 6982                         statement.setLong(12, crtime);
 
 6983                         statement.setLong(13, atime);
 
 6984                         statement.setLong(14, mtime);
 
 6985                         statement.setString(15, md5);
 
 6986                         if (known != null) {
 
 6987                                 statement.setByte(16, known.getFileKnownValue());
 
 6991                         statement.setString(17, mimeType);
 
 6993                         long dataSourceObjId;
 
 6996                                 AbstractFile parentFile = (AbstractFile) parent;
 
 6997                                 if (isRootDirectory(parentFile, transaction)) {
 
 7000                                         parentPath = parentFile.
getParentPath() + parent.getName() + 
"/"; 
 
 7005                                 dataSourceObjId = getDataSourceObjectId(connection, parent.getId());
 
 7007                         statement.setString(18, parentPath);
 
 7008                         statement.setLong(19, dataSourceObjId);
 
 7009                         final String extension = extractExtension(fileName);
 
 7010                         statement.setString(20, extension);
 
 7012                         connection.executeUpdate(statement);
 
 7013                         addFilePath(connection, objectId, localPath, encodingType);
 
 7023                                         ctime, crtime, atime, mtime,
 
 7024                                         mimeType, md5, known,
 
 7025                                         parent.getId(), parentPath,
 
 7028                                         encodingType, extension);
 
 7032                 } 
catch (SQLException ex) {
 
 7033                         throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
 
 7035                         closeStatement(queryStatement);
 
 7052                 CaseDbConnection connection = transaction.getConnection();
 
 7053                 Statement statement = null;
 
 7054                 ResultSet resultSet = null;
 
 7057                         String query = String.format(
"SELECT ParentRow.type AS parent_type, ParentRow.obj_id AS parent_object_id " 
 7058                                         + 
"FROM tsk_objects ParentRow JOIN tsk_objects ChildRow ON ChildRow.par_obj_id = ParentRow.obj_id " 
 7059                                         + 
"WHERE ChildRow.obj_id = %s;", file.
getId());
 
 7061                         statement = connection.createStatement();
 
 7062                         resultSet = statement.executeQuery(query);
 
 7063                         if (resultSet.next()) {
 
 7064                                 long parentId = resultSet.getLong(
"parent_object_id");
 
 7065                                 if (parentId == 0) {
 
 7068                                 int type = resultSet.getInt(
"parent_type");
 
 7069                                 return (type == TskData.ObjectType.IMG.getObjectType()
 
 7070                                                 || type == TskData.ObjectType.VS.getObjectType()
 
 7071                                                 || type == TskData.ObjectType.VOL.getObjectType()
 
 7072                                                 || type == TskData.ObjectType.FS.getObjectType());
 
 7077                 } 
catch (SQLException ex) {
 
 7078                         throw new TskCoreException(String.format(
"Failed to lookup parent of file (%s) with id %d", file.
getName(), file.
getId()), ex);
 
 7080                         closeResultSet(resultSet);
 
 7081                         closeStatement(statement);
 
 7107                         long ctime, 
long crtime, 
long atime, 
long mtime,
 
 7108                         List<TskFileRange> fileRanges,
 
 7109                         Content parent) 
throws TskCoreException {
 
 7111                 if (null == parent) {
 
 7112                         throw new TskCoreException(
"Parent can not be null");
 
 7117                         parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() + 
'/'; 
 
 7123                 Statement statement = null;
 
 7124                 ResultSet resultSet = null;
 
 7127                         CaseDbConnection connection = transaction.getConnection();
 
 7143                         PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
 
 7144                         prepStmt.clearParameters();
 
 7145                         prepStmt.setLong(1, newFileId); 
 
 7148                         if (0 != parent.getId()) {
 
 7149                                 long parentFs = this.getFileSystemId(parent.getId(), connection);
 
 7150                                 if (parentFs != -1) {
 
 7151                                         prepStmt.setLong(2, parentFs);
 
 7153                                         prepStmt.setNull(2, java.sql.Types.BIGINT);
 
 7156                                 prepStmt.setNull(2, java.sql.Types.BIGINT);
 
 7158                         prepStmt.setString(3, fileName); 
 
 7160                         prepStmt.setShort(5, (
short) 0); 
 
 7163                         prepStmt.setShort(8, dirFlag.getValue()); 
 
 7164                         prepStmt.setShort(9, metaFlag.getValue()); 
 
 7166                         long savedSize = size < 0 ? 0 : size;
 
 7167                         prepStmt.setLong(10, savedSize);   
 
 7168                         prepStmt.setLong(11, ctime);  
 
 7169                         prepStmt.setLong(12, crtime); 
 
 7170                         prepStmt.setLong(13, atime);  
 
 7171                         prepStmt.setLong(14, mtime);  
 
 7172                         prepStmt.setNull(15, java.sql.Types.VARCHAR); 
 
 7174                         prepStmt.setNull(17, java.sql.Types.VARCHAR); 
 
 7175                         prepStmt.setString(18, parentPath); 
 
 7176                         prepStmt.setLong(19, parent.getDataSource().getId()); 
 
 7178                         prepStmt.setString(20, extractExtension(fileName));                             
 
 7179                         connection.executeUpdate(prepStmt);
 
 7186                         prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
 
 7188                                 prepStmt.clearParameters();
 
 7189                                 prepStmt.setLong(1, newFileId); 
 
 7190                                 prepStmt.setLong(2, tskFileRange.getByteStart()); 
 
 7191                                 prepStmt.setLong(3, tskFileRange.getByteLen()); 
 
 7192                                 prepStmt.setLong(4, tskFileRange.getSequence()); 
 
 7193                                 connection.executeUpdate(prepStmt);
 
 7201                                         parent.getDataSource().getId(),
 
 7207                                         metaFlag.getValue(),
 
 7209                                         ctime, crtime, atime, mtime,
 
 7219                 } 
catch (SQLException ex) {
 
 7220                         throw new TskCoreException(
"Failed to add layout file " + fileName + 
" to case database", ex);
 
 7222                         closeResultSet(resultSet);
 
 7223                         closeStatement(statement);
 
 7225                         if (null != transaction) {
 
 7228                                 } 
catch (TskCoreException ex2) {
 
 7229                                         logger.log(Level.SEVERE, 
"Failed to rollback transaction after exception", ex2);
 
 7247         private long getDataSourceObjectId(CaseDbConnection connection, 
long objectId) 
throws TskCoreException {
 
 7249                 Statement statement = null;
 
 7250                 ResultSet resultSet = null;
 
 7252                         statement = connection.createStatement();
 
 7253                         long dataSourceObjId;
 
 7254                         long ancestorId = objectId;
 
 7256                                 dataSourceObjId = ancestorId;
 
 7257                                 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
 
 7258                                 resultSet = statement.executeQuery(query);
 
 7259                                 if (resultSet.next()) {
 
 7260                                         ancestorId = resultSet.getLong(
"par_obj_id");
 
 7262                                         throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
 
 7266                         } 
while (0 != ancestorId); 
 
 7267                         return dataSourceObjId;
 
 7268                 } 
catch (SQLException ex) {
 
 7269                         throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
 
 7271                         closeResultSet(resultSet);
 
 7272                         closeStatement(statement);
 
 7288         private void addFilePath(CaseDbConnection connection, 
long objId, String path, TskData.EncodingType type) throws SQLException {
 
 7289                 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LOCAL_PATH);
 
 7290                 statement.clearParameters();
 
 7291                 statement.setLong(1, objId);
 
 7292                 statement.setString(2, path);
 
 7293                 statement.setInt(3, type.getType());
 
 7294                 connection.executeUpdate(statement);
 
 7308         private void updateFilePath(CaseDbConnection connection, 
long objId, String path, TskData.EncodingType type) throws SQLException {
 
 7309                 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_LOCAL_PATH);
 
 7310                 statement.clearParameters();
 
 7311                 statement.setString(1, path);
 
 7312                 statement.setInt(2, type.getType());
 
 7313                 statement.setLong(3, objId);
 
 7314                 connection.executeUpdate(statement);
 
 7333                 return findFiles(dataSource, fileName, parentFile.getName());
 
 7348                 CaseDbConnection connection = connections.getConnection();
 
 7351                 ResultSet rs = null;
 
 7353                         s = connection.createStatement();
 
 7354                         rs = connection.executeQuery(s, 
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause); 
 
 7356                         return rs.getLong(
"count");
 
 7357                 } 
catch (SQLException e) {
 
 7358                         throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
 
 7385                 CaseDbConnection connection = connections.getConnection();
 
 7388                 ResultSet rs = null;
 
 7390                         s = connection.createStatement();
 
 7391                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_files WHERE " + sqlWhereClause); 
 
 7392                         return resultSetToAbstractFiles(rs, connection);
 
 7393                 } 
catch (SQLException e) {
 
 7394                         throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
 
 7416                 CaseDbConnection connection = connections.getConnection();
 
 7419                 ResultSet rs = null;
 
 7421                         s = connection.createStatement();
 
 7422                         rs = connection.executeQuery(s, 
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause); 
 
 7423                         List<Long> ret = 
new ArrayList<Long>();
 
 7425                                 ret.add(rs.getLong(
"obj_id"));
 
 7428                 } 
catch (SQLException e) {
 
 7429                         throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
 
 7449         public List<AbstractFile> 
openFiles(
Content dataSource, String filePath) 
throws TskCoreException {
 
 7456                 int lastSlash = path.lastIndexOf(
'/'); 
 
 7459                 if (lastSlash == path.length()) {
 
 7460                         path = path.substring(0, lastSlash - 1);
 
 7461                         lastSlash = path.lastIndexOf(
'/'); 
 
 7464                 String parentPath = path.substring(0, lastSlash);
 
 7465                 String fileName = path.substring(lastSlash);
 
 7467                 return findFiles(dataSource, fileName, parentPath);
 
 7481                 CaseDbConnection connection = connections.getConnection();
 
 7484                 ResultSet rs = null;
 
 7486                         s = connection.createStatement();
 
 7487                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_file_layout WHERE obj_id = " + 
id + 
" ORDER BY sequence");
 
 7488                         List<TskFileRange> ranges = 
new ArrayList<TskFileRange>();
 
 7491                                                 rs.getLong(
"byte_len"), rs.getLong(
"sequence")); 
 
 7495                 } 
catch (SQLException ex) {
 
 7496                         throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " + 
id, ex);
 
 7516                 CaseDbConnection connection = connections.getConnection();
 
 7518                 Statement s1 = null;
 
 7519                 ResultSet rs1 = null;
 
 7520                 Statement s2 = null;
 
 7521                 ResultSet rs2 = null;
 
 7523                         s1 = connection.createStatement();
 
 7524                         rs1 = connection.executeQuery(s1, 
"SELECT tsk_image_info.type, tsk_image_info.ssize, tsk_image_info.tzone, tsk_image_info.size, tsk_image_info.md5, tsk_image_info.sha1, tsk_image_info.sha256, tsk_image_info.display_name, data_source_info.device_id " 
 7525                                         + 
"FROM tsk_image_info " 
 7526                                         + 
"INNER JOIN data_source_info ON tsk_image_info.obj_id = data_source_info.obj_id " 
 7527                                         + 
"WHERE tsk_image_info.obj_id = " + 
id); 
 
 7529                                 s2 = connection.createStatement();
 
 7530                                 rs2 = connection.executeQuery(s2, 
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + 
id); 
 
 7531                                 List<String> imagePaths = 
new ArrayList<String>();
 
 7532                                 while (rs2.next()) {
 
 7533                                         imagePaths.add(rs2.getString(
"name"));
 
 7535                                 long type = rs1.getLong(
"type"); 
 
 7536                                 long ssize = rs1.getLong(
"ssize"); 
 
 7537                                 String tzone = rs1.getString(
"tzone"); 
 
 7538                                 long size = rs1.getLong(
"size"); 
 
 7539                                 String md5 = rs1.getString(
"md5"); 
 
 7540                                 String sha1 = rs1.getString(
"sha1"); 
 
 7541                                 String sha256 = rs1.getString(
"sha256"); 
 
 7542                                 String name = rs1.getString(
"display_name");
 
 7544                                         if (imagePaths.size() > 0) {
 
 7545                                                 String path = imagePaths.get(0);
 
 7546                                                 name = (
new java.io.File(path)).getName();
 
 7551                                 String device_id = rs1.getString(
"device_id");
 
 7553                                 return new Image(
this, 
id, type, device_id, ssize, name,
 
 7554                                                 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, sha1, sha256, size);
 
 7556                                 throw new TskCoreException(
"No image found for id: " + 
id);
 
 7558                 } 
catch (SQLException ex) {
 
 7559                         throw new TskCoreException(
"Error getting Image by id, id = " + 
id, ex);
 
 7561                         closeResultSet(rs2);
 
 7563                         closeResultSet(rs1);
 
 7582                 CaseDbConnection connection = connections.getConnection();
 
 7585                 ResultSet rs = null;
 
 7587                         s = connection.createStatement();
 
 7588                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_vs_info "  
 7589                                         + 
"where obj_id = " + 
id); 
 
 7591                                 long type = rs.getLong(
"vs_type"); 
 
 7592                                 long imgOffset = rs.getLong(
"img_offset"); 
 
 7593                                 long blockSize = rs.getLong(
"block_size"); 
 
 7595                                 vs.setParent(parent);
 
 7598                                 throw new TskCoreException(
"No volume system found for id:" + 
id);
 
 7600                 } 
catch (SQLException ex) {
 
 7601                         throw new TskCoreException(
"Error getting Volume System by ID.", ex);
 
 7618         VolumeSystem getVolumeSystemById(
long id, 
long parentId) 
throws TskCoreException {
 
 7619                 VolumeSystem vs = getVolumeSystemById(
id, null);
 
 7620                 vs.setParentId(parentId);
 
 7635         FileSystem getFileSystemById(
long id, Image parent) 
throws TskCoreException {
 
 7636                 return getFileSystemByIdHelper(
id, parent);
 
 7647         FileSystem getFileSystemById(
long id, 
long parentId) 
throws TskCoreException {
 
 7649                 FileSystem fs = getFileSystemById(
id, vol);
 
 7650                 fs.setParentId(parentId);
 
 7665         FileSystem getFileSystemById(
long id, Volume parent) 
throws TskCoreException {
 
 7666                 return getFileSystemByIdHelper(
id, parent);
 
 7680         Pool getPoolById(
long id, Content parent) 
throws TskCoreException {
 
 7681                 return getPoolByIdHelper(
id, parent);
 
 7692         Pool getPoolById(
long id, 
long parentId) 
throws TskCoreException {
 
 7693                 Pool pool = getPoolById(
id, null);
 
 7694                 pool.setParentId(parentId);
 
 7709         private Pool getPoolByIdHelper(
long id, Content parent) 
throws TskCoreException {
 
 7712                 try (CaseDbConnection connection = connections.getConnection();
 
 7713                                 Statement s = connection.createStatement();
 
 7714                                 ResultSet rs = connection.executeQuery(s, 
"SELECT * FROM tsk_pool_info "  
 7715                                                 + 
"where obj_id = " + 
id);) { 
 
 7717                                 Pool pool = 
new Pool(
this, rs.getLong(
"obj_id"), TskData.TSK_POOL_TYPE_ENUM.valueOf(rs.getLong(
"pool_type")).getName(), rs.getLong(
"pool_type"));
 
 7718                                 pool.setParent(parent);
 
 7722                                 throw new TskCoreException(
"No pool found for ID:" + 
id);
 
 7724                 } 
catch (SQLException ex) {
 
 7725                         throw new TskCoreException(
"Error getting Pool by ID", ex);
 
 7742         private FileSystem getFileSystemByIdHelper(
long id, Content parent) 
throws TskCoreException {
 
 7746                 synchronized (fileSystemIdMap) {
 
 7747                         if (fileSystemIdMap.containsKey(
id)) {
 
 7748                                 return fileSystemIdMap.get(
id);
 
 7751                 CaseDbConnection connection = connections.getConnection();
 
 7754                 ResultSet rs = null;
 
 7756                         s = connection.createStatement();
 
 7757                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_fs_info "  
 7758                                         + 
"where obj_id = " + 
id); 
 
 7760                                 TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt(
"fs_type")); 
 
 7761                                 FileSystem fs = 
new FileSystem(
this, rs.getLong(
"obj_id"), 
"", rs.getLong(
"img_offset"), 
 
 7762                                                 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"), 
 
 7763                                                 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum")); 
 
 7764                                 fs.setParent(parent);
 
 7766                                 synchronized (fileSystemIdMap) {
 
 7767                                         fileSystemIdMap.put(
id, fs);
 
 7771                                 throw new TskCoreException(
"No file system found for id:" + 
id);
 
 7773                 } 
catch (SQLException ex) {
 
 7774                         throw new TskCoreException(
"Error getting File System by ID", ex);
 
 7794         Volume getVolumeById(
long id, VolumeSystem parent) 
throws TskCoreException {
 
 7795                 CaseDbConnection connection = connections.getConnection();
 
 7798                 ResultSet rs = null;
 
 7800                         s = connection.createStatement();
 
 7801                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_vs_parts "  
 7802                                         + 
"where obj_id = " + 
id); 
 
 7813                                         description = rs.getString(
"desc");
 
 7814                                 } 
catch (Exception ex) {
 
 7815                                         description = rs.getString(
"descr");
 
 7817                                 Volume vol = 
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"), 
 
 7818                                                 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"), 
 
 7820                                 vol.setParent(parent);
 
 7823                                 throw new TskCoreException(
"No volume found for id:" + 
id);
 
 7825                 } 
catch (SQLException ex) {
 
 7826                         throw new TskCoreException(
"Error getting Volume by ID", ex);
 
 7843         Volume getVolumeById(
long id, 
long parentId) 
throws TskCoreException {
 
 7844                 Volume vol = getVolumeById(
id, null);
 
 7845                 vol.setParentId(parentId);
 
 7860         Directory getDirectoryById(
long id, FileSystem parentFs) 
throws TskCoreException {
 
 7861                 CaseDbConnection connection = connections.getConnection();
 
 7864                 ResultSet rs = null;
 
 7866                         s = connection.createStatement();
 
 7867                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_files "  
 7868                                         + 
"WHERE obj_id = " + 
id);
 
 7869                         Directory temp = null; 
 
 7871                                 final short type = rs.getShort(
"type"); 
 
 7872                                 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
 
 7873                                         if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
 
 7874                                                         || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) { 
 
 7875                                                 temp = directory(rs, parentFs);
 
 7877                                 } 
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
 
 7878                                         throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " + 
id);
 
 7881                                 throw new TskCoreException(
"No Directory found for id:" + 
id);
 
 7884                 } 
catch (SQLException ex) {
 
 7885                         throw new TskCoreException(
"Error getting Directory by ID", ex);
 
 7904                 List<FileSystem> fileSystems = 
new ArrayList<>();
 
 7905                 CaseDbConnection connection = connections.getConnection();
 
 7909                 ResultSet rs = null;
 
 7910                 String queryStr = 
"SELECT * FROM tsk_fs_info WHERE data_source_obj_id = " + image.getId();
 
 7912                         s = connection.createStatement();
 
 7913                         rs = connection.executeQuery(s, queryStr); 
 
 7917                                                 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"), 
 
 7918                                                 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum")); 
 
 7920                                 fileSystems.add(fs);
 
 7922                 } 
catch (SQLException ex) {
 
 7923                         throw new TskCoreException(
"Error looking up files systems. Query: " + queryStr, ex); 
 
 7943         List<Content> getImageChildren(
Image img) 
throws TskCoreException {
 
 7944                 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
 
 7945                 List<Content> children = 
new ArrayList<Content>();
 
 7946                 for (ObjectInfo info : childInfos) {
 
 7947                         if (null != info.type) {
 
 7948                                 switch (info.type) {
 
 7950                                                 children.add(getVolumeSystemById(info.id, img));
 
 7953                                                 children.add(getPoolById(info.id, img));
 
 7956                                                 children.add(getFileSystemById(info.id, img));
 
 7974                                                 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
 
 7991         List<Long> getImageChildrenIds(Image img) 
throws TskCoreException {
 
 7992                 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
 
 7993                 List<Long> children = 
new ArrayList<Long>();
 
 7994                 for (ObjectInfo info : childInfos) {
 
 7995                         if (info.type == ObjectType.VS
 
 7996                                         || info.type == ObjectType.POOL
 
 7997                                         || info.type == ObjectType.FS
 
 7998                                         || info.type == ObjectType.ABSTRACTFILE
 
 7999                                         || info.type == ObjectType.ARTIFACT) {
 
 8000                                 children.add(info.id);
 
 8001                         } 
else if (info.type == ObjectType.REPORT) {
 
 8004                                 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
 
 8020         List<Content> getPoolChildren(Pool pool) 
throws TskCoreException {
 
 8021                 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
 
 8022                 List<Content> children = 
new ArrayList<Content>();
 
 8023                 for (ObjectInfo info : childInfos) {
 
 8024                         if (null != info.type) {
 
 8025                                 switch (info.type) {
 
 8027                                                 children.add(getVolumeSystemById(info.id, pool));
 
 8042                                                 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
 
 8059         List<Long> getPoolChildrenIds(Pool pool) 
throws TskCoreException {
 
 8060                 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
 
 8061                 List<Long> children = 
new ArrayList<Long>();
 
 8062                 for (ObjectInfo info : childInfos) {
 
 8063                         if (info.type == ObjectType.VS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
 
 8064                                 children.add(info.id);
 
 8066                                 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
 
 8082         List<Content> getVolumeSystemChildren(VolumeSystem vs) 
throws TskCoreException {
 
 8083                 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
 
 8084                 List<Content> children = 
new ArrayList<Content>();
 
 8085                 for (ObjectInfo info : childInfos) {
 
 8086                         if (null != info.type) {
 
 8087                                 switch (info.type) {
 
 8089                                                 children.add(getVolumeById(info.id, vs));
 
 8104                                                 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
 
 8121         List<Long> getVolumeSystemChildrenIds(VolumeSystem vs) 
throws TskCoreException {
 
 8122                 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
 
 8123                 List<Long> children = 
new ArrayList<Long>();
 
 8124                 for (ObjectInfo info : childInfos) {
 
 8125                         if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
 
 8126                                 children.add(info.id);
 
 8128                                 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
 
 8144         List<Content> getVolumeChildren(Volume vol) 
throws TskCoreException {
 
 8145                 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
 
 8146                 List<Content> children = 
new ArrayList<Content>();
 
 8147                 for (ObjectInfo info : childInfos) {
 
 8148                         if (null != info.type) {
 
 8149                                 switch (info.type) {
 
 8151                                                 children.add(getPoolById(info.id, vol));
 
 8154                                                 children.add(getFileSystemById(info.id, vol));
 
 8169                                                 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
 
 8186         List<Long> getVolumeChildrenIds(Volume vol) 
throws TskCoreException {
 
 8187                 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
 
 8188                 final List<Long> children = 
new ArrayList<Long>();
 
 8189                 for (ObjectInfo info : childInfos) {
 
 8190                         if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
 
 8191                                 children.add(info.id);
 
 8193                                 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
 
 8212         public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone) 
throws TskCoreException {
 
 8213                 long imageId = this.caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone, 
this);
 
 8227                 CaseDbConnection connection = connections.getConnection();
 
 8229                 Statement s1 = null;
 
 8230                 Statement s2 = null;
 
 8231                 ResultSet rs1 = null;
 
 8232                 ResultSet rs2 = null;
 
 8234                         s1 = connection.createStatement();
 
 8235                         rs1 = connection.executeQuery(s1, 
"SELECT obj_id FROM tsk_image_info"); 
 
 8236                         s2 = connection.createStatement();
 
 8237                         Map<Long, List<String>> imgPaths = 
new LinkedHashMap<Long, List<String>>();
 
 8238                         while (rs1.next()) {
 
 8239                                 long obj_id = rs1.getLong(
"obj_id"); 
 
 8240                                 rs2 = connection.executeQuery(s2, 
"SELECT * FROM tsk_image_names WHERE obj_id = " + obj_id); 
 
 8241                                 List<String> paths = 
new ArrayList<String>();
 
 8242                                 while (rs2.next()) {
 
 8243                                         paths.add(rs2.getString(
"name"));
 
 8247                                 imgPaths.put(obj_id, paths);
 
 8250                 } 
catch (SQLException ex) {
 
 8251                         throw new TskCoreException(
"Error getting image paths.", ex);
 
 8253                         closeResultSet(rs2);
 
 8255                         closeResultSet(rs1);
 
 8272         private List<String> getImagePathsById(
long objectId) 
throws TskCoreException {
 
 8273                 List<String> imagePaths = 
new ArrayList<String>();
 
 8274                 CaseDbConnection connection = connections.getConnection();
 
 8276                 Statement statement = null;
 
 8277                 ResultSet resultSet = null;
 
 8279                         statement = connection.createStatement();
 
 8280                         resultSet = connection.executeQuery(statement, 
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + objectId); 
 
 8281                         while (resultSet.next()) {
 
 8282                                 imagePaths.add(resultSet.getString(
"name"));
 
 8284                 } 
catch (SQLException ex) {
 
 8285                         throw new TskCoreException(String.format(
"Error getting image names with obj_id = %d", objectId), ex);
 
 8287                         closeResultSet(resultSet);
 
 8288                         closeStatement(statement);
 
 8303                 CaseDbConnection connection = connections.getConnection();
 
 8306                 ResultSet rs = null;
 
 8308                         s = connection.createStatement();
 
 8309                         rs = connection.executeQuery(s, 
"SELECT obj_id FROM tsk_image_info"); 
 
 8310                         Collection<Long> imageIDs = 
new ArrayList<Long>();
 
 8312                                 imageIDs.add(rs.getLong(
"obj_id")); 
 
 8314                         List<Image> images = 
new ArrayList<Image>();
 
 8315                         for (
long id : imageIDs) {
 
 8319                 } 
catch (SQLException ex) {
 
 8320                         throw new TskCoreException(
"Error retrieving images.", ex);
 
 8339         public void setImagePaths(
long obj_id, List<String> paths) 
throws TskCoreException {
 
 8340                 CaseDbConnection connection = connections.getConnection();
 
 8342                 PreparedStatement statement = null;
 
 8344                         connection.beginTransaction();
 
 8345                         statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_IMAGE_NAME);
 
 8346                         statement.clearParameters();
 
 8347                         statement.setLong(1, obj_id);
 
 8348                         connection.executeUpdate(statement);
 
 8349                         for (
int i = 0; i < paths.size(); i++) {
 
 8350                                 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
 
 8351                                 statement.clearParameters();
 
 8352                                 statement.setLong(1, obj_id);
 
 8353                                 statement.setString(2, paths.get(i));
 
 8354                                 statement.setLong(3, i);
 
 8355                                 connection.executeUpdate(statement);
 
 8357                         connection.commitTransaction();
 
 8358                 } 
catch (SQLException ex) {
 
 8359                         connection.rollbackTransaction();
 
 8360                         throw new TskCoreException(
"Error updating image paths.", ex);
 
 8378         void deleteDataSource(
long dataSourceObjectId) 
throws TskCoreException {
 
 8379                 CaseDbConnection connection = connections.getConnection();
 
 8380                 Statement statement = null;
 
 8383                         statement = connection.createStatement();
 
 8384                         connection.beginTransaction();
 
 8387                         statement.execute(
"DELETE FROM tsk_objects WHERE obj_id = " + dataSourceObjectId);
 
 8390                         String accountSql = 
"DELETE FROM accounts WHERE account_id in (SELECT account_id FROM accounts " 
 8391                                         + 
"WHERE account_id NOT IN (SELECT account1_id FROM account_relationships) " 
 8392                                         + 
"AND account_id NOT IN (SELECT account2_id FROM account_relationships))";
 
 8393                         statement.execute(accountSql);
 
 8394                         connection.commitTransaction();
 
 8395                 } 
catch (SQLException ex) {
 
 8396                         connection.rollbackTransaction();
 
 8397                         throw new TskCoreException(
"Error deleting data source.", ex);
 
 8429         private List<AbstractFile> resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection) 
throws SQLException {
 
 8430                 ArrayList<AbstractFile> results = 
new ArrayList<AbstractFile>();
 
 8433                                 final short type = rs.getShort(
"type"); 
 
 8434                                 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()
 
 8435                                                 && (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
 
 8437                                         if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) { 
 
 8438                                                 result = directory(rs, null);
 
 8440                                                 result = file(rs, null);
 
 8442                                         results.add(result);
 
 8443                                 } 
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()
 
 8444                                                 || (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) { 
 
 8445                                         final VirtualDirectory virtDir = virtualDirectory(rs, connection);
 
 8446                                         results.add(virtDir);
 
 8447                                 } 
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR.getFileType()) {
 
 8448                                         final LocalDirectory localDir = localDirectory(rs);
 
 8449                                         results.add(localDir);
 
 8450                                 } 
else if (type == TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType()
 
 8451                                                 || type == TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.getFileType()
 
 8452                                                 || type == TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType()
 
 8453                                                 || type == TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType()) {
 
 8454                                         TSK_DB_FILES_TYPE_ENUM atype = TSK_DB_FILES_TYPE_ENUM.valueOf(type);
 
 8455                                         String parentPath = rs.getString(
"parent_path"); 
 
 8456                                         if (parentPath == null) {
 
 8459                                         LayoutFile lf = 
new LayoutFile(
this,
 
 8460                                                         rs.getLong(
"obj_id"), 
 
 8461                                                         rs.getLong(
"data_source_obj_id"),
 
 8462                                                         rs.getString(
"name"), 
 
 8464                                                         TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8465                                                         TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"), 
 
 8467                                                         rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"), 
 
 8468                                                         rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type")); 
 
 8470                                 } 
else if (type == TSK_DB_FILES_TYPE_ENUM.DERIVED.getFileType()) {
 
 8471                                         final DerivedFile df;
 
 8472                                         df = derivedFile(rs, connection, AbstractContent.UNKNOWN_ID);
 
 8474                                 } 
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL.getFileType()) {
 
 8476                                         lf = localFile(rs, connection, AbstractContent.UNKNOWN_ID);
 
 8478                                 } 
else if (type == TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType()) {
 
 8479                                         final SlackFile sf = slackFile(rs, null);
 
 8483                 } 
catch (SQLException e) {
 
 8484                         logger.log(Level.SEVERE, 
"Error getting abstract files from result set", e); 
 
 8504                                 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"), 
 
 8505                                 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")), 
 
 8506                                 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"), 
 
 8507                                 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8508                                 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8509                                 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), 
 
 8510                                 rs.getShort(
"meta_flags"), rs.getLong(
"size"), 
 
 8511                                 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"), 
 
 8512                                 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"), 
 
 8513                                 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), 
 
 8514                                 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension")); 
 
 8515                 f.setFileSystem(fs);
 
 8530         Directory directory(ResultSet rs, FileSystem fs) 
throws SQLException {
 
 8531                 Directory dir = 
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"), 
 
 8532                                 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")), 
 
 8533                                 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"), 
 
 8534                                 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8535                                 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8536                                 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), 
 
 8537                                 rs.getShort(
"meta_flags"), rs.getLong(
"size"), 
 
 8538                                 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"), 
 
 8539                                 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"), 
 
 8540                                 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), 
 
 8541                                 rs.getString(
"parent_path")); 
 
 8542                 dir.setFileSystem(fs);
 
 8556         VirtualDirectory virtualDirectory(ResultSet rs, CaseDbConnection connection) 
throws SQLException {
 
 8557                 String parentPath = rs.getString(
"parent_path"); 
 
 8558                 if (parentPath == null) {
 
 8562                 long objId = rs.getLong(
"obj_id");
 
 8563                 long dsObjId = rs.getLong(
"data_source_obj_id");
 
 8564                 if (objId == dsObjId) { 
 
 8566                         String deviceId = 
"";
 
 8567                         String timeZone = 
"";
 
 8569                         ResultSet rsDataSourceInfo = null;
 
 8573                                 s = connection.createStatement();
 
 8574                                 rsDataSourceInfo = connection.executeQuery(s, 
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objId);
 
 8575                                 if (rsDataSourceInfo.next()) {
 
 8576                                         deviceId = rsDataSourceInfo.getString(
"device_id");
 
 8577                                         timeZone = rsDataSourceInfo.getString(
"time_zone");
 
 8579                         } 
catch (SQLException ex) {
 
 8580                                 logger.log(Level.SEVERE, 
"Error data source info for datasource id " + objId, ex); 
 
 8582                                 closeResultSet(rsDataSourceInfo);
 
 8587                         return new LocalFilesDataSource(
this,
 
 8590                                         rs.getString(
"name"),
 
 8591                                         TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8592                                         TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8593                                         TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
 
 8594                                         rs.getShort(
"meta_flags"),
 
 8596                                         rs.getString(
"md5"),
 
 8597                                         FileKnown.valueOf(rs.getByte(
"known")),
 
 8600                         final VirtualDirectory vd = 
new VirtualDirectory(
this,
 
 8602                                         rs.getString(
"name"), 
 
 8603                                         TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8604                                         TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8605                                         TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), 
 
 8606                                         rs.getShort(
"meta_flags"), rs.getString(
"md5"), 
 
 8607                                         FileKnown.valueOf(rs.getByte(
"known")), parentPath); 
 
 8621         LocalDirectory localDirectory(ResultSet rs) 
throws SQLException {
 
 8622                 String parentPath = rs.getString(
"parent_path"); 
 
 8623                 if (parentPath == null) {
 
 8626                 final LocalDirectory ld = 
new LocalDirectory(
this, rs.getLong(
"obj_id"), 
 
 8627                                 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), 
 
 8628                                 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8629                                 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8630                                 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), 
 
 8631                                 rs.getShort(
"meta_flags"), rs.getString(
"md5"), 
 
 8632                                 FileKnown.valueOf(rs.getByte(
"known")), parentPath); 
 
 8649         private DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection, 
long parentId) 
throws SQLException {
 
 8650                 boolean hasLocalPath = rs.getBoolean(
"has_path"); 
 
 8651                 long objId = rs.getLong(
"obj_id"); 
 
 8652                 String localPath = null;
 
 8653                 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
 
 8655                         ResultSet rsFilePath = null;
 
 8658                                 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
 
 8659                                 statement.clearParameters();
 
 8660                                 statement.setLong(1, objId);
 
 8661                                 rsFilePath = connection.executeQuery(statement);
 
 8662                                 if (rsFilePath.next()) {
 
 8663                                         localPath = rsFilePath.getString(
"path");
 
 8664                                         encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
 
 8666                         } 
catch (SQLException ex) {
 
 8667                                 logger.log(Level.SEVERE, 
"Error getting encoding type for file " + objId, ex); 
 
 8669                                 closeResultSet(rsFilePath);
 
 8673                 String parentPath = rs.getString(
"parent_path"); 
 
 8674                 if (parentPath == null) {
 
 8677                 final DerivedFile df = 
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
 
 8678                                 rs.getString(
"name"), 
 
 8679                                 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8680                                 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8681                                 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"), 
 
 8683                                 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"), 
 
 8684                                 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), 
 
 8685                                 parentPath, localPath, parentId, rs.getString(
"mime_type"),
 
 8686                                 encodingType, rs.getString(
"extension"));
 
 8703         private LocalFile localFile(ResultSet rs, CaseDbConnection connection, 
long parentId) 
throws SQLException {
 
 8704                 long objId = rs.getLong(
"obj_id"); 
 
 8705                 String localPath = null;
 
 8706                 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
 
 8707                 if (rs.getBoolean(
"has_path")) {
 
 8708                         ResultSet rsFilePath = null;
 
 8711                                 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
 
 8712                                 statement.clearParameters();
 
 8713                                 statement.setLong(1, objId);
 
 8714                                 rsFilePath = connection.executeQuery(statement);
 
 8715                                 if (rsFilePath.next()) {
 
 8716                                         localPath = rsFilePath.getString(
"path");
 
 8717                                         encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
 
 8719                         } 
catch (SQLException ex) {
 
 8720                                 logger.log(Level.SEVERE, 
"Error getting encoding type for file " + objId, ex); 
 
 8722                                 closeResultSet(rsFilePath);
 
 8726                 String parentPath = rs.getString(
"parent_path"); 
 
 8727                 if (null == parentPath) {
 
 8730                 LocalFile file = 
new LocalFile(
this, objId, rs.getString(
"name"), 
 
 8731                                 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")), 
 
 8732                                 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8733                                 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8734                                 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"), 
 
 8736                                 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"), 
 
 8737                                 rs.getString(
"mime_type"), rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), 
 
 8738                                 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
 
 8739                                 localPath, encodingType, rs.getString(
"extension"));
 
 8756                                 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"), 
 
 8757                                 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")), 
 
 8758                                 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"), 
 
 8759                                 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), 
 
 8760                                 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")), 
 
 8761                                 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), 
 
 8762                                 rs.getShort(
"meta_flags"), rs.getLong(
"size"), 
 
 8763                                 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"), 
 
 8764                                 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"), 
 
 8765                                 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), 
 
 8766                                 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension")); 
 
 8767                 f.setFileSystem(fs);
 
 8782         List<Content> fileChildren(ResultSet rs, CaseDbConnection connection, 
long parentId) 
throws SQLException {
 
 8783                 List<Content> children = 
new ArrayList<Content>();
 
 8786                         TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
 
 8791                                                 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
 
 8793                                                         if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
 
 8794                                                                 result = directory(rs, null);
 
 8796                                                                 result = file(rs, null);
 
 8798                                                         children.add(result);
 
 8800                                                         VirtualDirectory virtDir = virtualDirectory(rs, connection);
 
 8801                                                         children.add(virtDir);
 
 8805                                                 VirtualDirectory virtDir = virtualDirectory(rs, connection);
 
 8806                                                 children.add(virtDir);
 
 8809                                                 LocalDirectory localDir = localDirectory(rs);
 
 8810                                                 children.add(localDir);
 
 8812                                         case UNALLOC_BLOCKS:
 
 8816                                                 String parentPath = rs.getString(
"parent_path");
 
 8817                                                 if (parentPath == null) {
 
 8820                                                 final LayoutFile lf = 
new LayoutFile(
this, rs.getLong(
"obj_id"),
 
 8821                                                                 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), type,
 
 8822                                                                 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
 
 8823                                                                 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
 
 8824                                                                 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
 
 8826                                                                 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
 
 8827                                                                 rs.getString(
"md5"),
 
 8828                                                                 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
 
 8833                                                 final DerivedFile df = derivedFile(rs, connection, parentId);
 
 8837                                                 final LocalFile lf = localFile(rs, connection, parentId);
 
 8842                                                 final SlackFile sf = slackFile(rs, null);
 
 8869         private List<BlackboardArtifact> resultSetToArtifacts(ResultSet rs) 
throws SQLException, TskCoreException {
 
 8870                 ArrayList<BlackboardArtifact> artifacts = 
new ArrayList<BlackboardArtifact>();
 
 8873                                 BlackboardArtifact.Type artifactType = 
getArtifactType(rs.getInt(
"artifact_type_id"));
 
 8874                                 if (artifactType != null) {
 
 8875                                         artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
 
 8876                                                         rs.getInt(
"artifact_type_id"), artifactType.getTypeName(), artifactType.getDisplayName(),
 
 8877                                                         BlackboardArtifact.ReviewStatus.withID(rs.getInt(
"review_status_id"))));
 
 8879                                         throw new TskCoreException(
"Error looking up artifact type ID " + rs.getInt(
"artifact_type_id") + 
" from artifact " + rs.getLong(
"artifact_id"));
 
 8882                 } 
catch (SQLException e) {
 
 8883                         logger.log(Level.SEVERE, 
"Error getting artifacts from result set", e); 
 
 8946         CaseDbConnection getConnection() throws TskCoreException {
 
 8947                 return connections.getConnection();
 
 8950         synchronized String getUniqueCaseIdentifier() throws TskCoreException {
 
 8951                 if (caseHandle != null) {
 
 8952                         return caseHandle.getCaseDbIdentifier();
 
 8954                 throw new TskCoreException(
"Case has been closed");
 
 8973                         connections.close();
 
 8974                 } 
catch (TskCoreException ex) {
 
 8975                         logger.log(Level.SEVERE, 
"Error closing database connection pool.", ex); 
 
 8978                 fileSystemIdMap.clear();
 
 8981                         if (this.caseHandle != null) {
 
 8982                                 this.caseHandle.free();
 
 8983                                 this.caseHandle = null;
 
 8985                 } 
catch (TskCoreException ex) {
 
 8986                         logger.log(Level.SEVERE, 
"Error freeing case handle.", ex); 
 
 9005                 long id = file.getId();
 
 9006                 FileKnown currentKnown = file.getKnown();
 
 9007                 if (currentKnown.compareTo(fileKnown) > 0) {
 
 9010                 CaseDbConnection connection = connections.getConnection();
 
 9012                 Statement statement = null;
 
 9014                         statement = connection.createStatement();
 
 9015                         connection.executeUpdate(statement, 
"UPDATE tsk_files "  
 9016                                         + 
"SET known='" + fileKnown.getFileKnownValue() + 
"' "  
 9017                                         + 
"WHERE obj_id=" + id); 
 
 9019                         file.setKnown(fileKnown);
 
 9020                 } 
catch (SQLException ex) {
 
 9021                         throw new TskCoreException(
"Error setting Known status.", ex);
 
 9023                         closeStatement(statement);
 
 9038         void setFileName(String name, 
long objId) 
throws TskCoreException {
 
 9040                 CaseDbConnection connection = connections.getConnection();
 
 9044                         preparedStatement.clearParameters();
 
 9045                         preparedStatement.setString(1, name);
 
 9046                         preparedStatement.setLong(2, objId);
 
 9047                         connection.executeUpdate(preparedStatement);
 
 9048                 } 
catch (SQLException ex) {
 
 9049                         throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
 
 9064         void setImageName(String name, 
long objId) 
throws TskCoreException {
 
 9066                 CaseDbConnection connection = connections.getConnection();
 
 9069                         PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_NAME);
 
 9070                         preparedStatement.clearParameters();
 
 9071                         preparedStatement.setString(1, name);
 
 9072                         preparedStatement.setLong(2, objId);
 
 9073                         connection.executeUpdate(preparedStatement);
 
 9074                 } 
catch (SQLException ex) {
 
 9075                         throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
 
 9092                 CaseDbConnection connection = connections.getConnection();
 
 9093                 Statement statement = null;
 
 9094                 ResultSet rs = null;
 
 9097                         statement = connection.createStatement();
 
 9098                         connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
 
 9099                         file.setMIMEType(mimeType);
 
 9100                 } 
catch (SQLException ex) {
 
 9101                         throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
 
 9104                         closeStatement(statement);
 
 9119         void setMd5Hash(
AbstractFile file, String md5Hash) 
throws TskCoreException {
 
 9120                 if (md5Hash == null) {
 
 9123                 long id = file.getId();
 
 9124                 CaseDbConnection connection = connections.getConnection();
 
 9127                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
 
 9128                         statement.clearParameters();
 
 9129                         statement.setString(1, md5Hash.toLowerCase());
 
 9130                         statement.setLong(2, 
id);
 
 9131                         connection.executeUpdate(statement);
 
 9132                         file.setMd5Hash(md5Hash.toLowerCase());
 
 9133                 } 
catch (SQLException ex) {
 
 9134                         throw new TskCoreException(
"Error setting MD5 hash", ex);
 
 9150         void setMd5ImageHash(Image img, String md5Hash) 
throws TskCoreException {
 
 9151                 if (md5Hash == null) {
 
 9154                 long id = img.getId();
 
 9155                 CaseDbConnection connection = connections.getConnection();
 
 9158                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_MD5);
 
 9159                         statement.clearParameters();
 
 9160                         statement.setString(1, md5Hash.toLowerCase());
 
 9161                         statement.setLong(2, 
id);
 
 9162                         connection.executeUpdate(statement);
 
 9163                 } 
catch (SQLException ex) {
 
 9164                         throw new TskCoreException(
"Error setting MD5 hash", ex);
 
 9181         String getMd5ImageHash(Image img) 
throws TskCoreException {
 
 9182                 long id = img.getId();
 
 9183                 CaseDbConnection connection = connections.getConnection();
 
 9185                 ResultSet rs = null;
 
 9188                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_MD5);
 
 9189                         statement.clearParameters();
 
 9190                         statement.setLong(1, 
id);
 
 9191                         rs = connection.executeQuery(statement);
 
 9193                                 hash = rs.getString(
"md5");
 
 9196                 } 
catch (SQLException ex) {
 
 9197                         throw new TskCoreException(
"Error getting MD5 hash", ex);
 
 9214         void setSha1ImageHash(Image img, String sha1Hash) 
throws TskCoreException {
 
 9215                 if (sha1Hash == null) {
 
 9218                 long id = img.getId();
 
 9219                 CaseDbConnection connection = connections.getConnection();
 
 9222                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA1);
 
 9223                         statement.clearParameters();
 
 9224                         statement.setString(1, sha1Hash.toLowerCase());
 
 9225                         statement.setLong(2, 
id);
 
 9226                         connection.executeUpdate(statement);
 
 9227                 } 
catch (SQLException ex) {
 
 9228                         throw new TskCoreException(
"Error setting SHA1 hash", ex);
 
 9245         String getSha1ImageHash(Image img) 
throws TskCoreException {
 
 9246                 long id = img.getId();
 
 9247                 CaseDbConnection connection = connections.getConnection();
 
 9249                 ResultSet rs = null;
 
 9252                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA1);
 
 9253                         statement.clearParameters();
 
 9254                         statement.setLong(1, 
id);
 
 9255                         rs = connection.executeQuery(statement);
 
 9257                                 hash = rs.getString(
"sha1");
 
 9260                 } 
catch (SQLException ex) {
 
 9261                         throw new TskCoreException(
"Error getting SHA1 hash", ex);
 
 9278         void setSha256ImageHash(Image img, String sha256Hash) 
throws TskCoreException {
 
 9279                 if (sha256Hash == null) {
 
 9282                 long id = img.getId();
 
 9283                 CaseDbConnection connection = connections.getConnection();
 
 9286                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA256);
 
 9287                         statement.clearParameters();
 
 9288                         statement.setString(1, sha256Hash.toLowerCase());
 
 9289                         statement.setLong(2, 
id);
 
 9290                         connection.executeUpdate(statement);
 
 9291                 } 
catch (SQLException ex) {
 
 9292                         throw new TskCoreException(
"Error setting SHA256 hash", ex);
 
 9309         String getSha256ImageHash(Image img) 
throws TskCoreException {
 
 9310                 long id = img.getId();
 
 9311                 CaseDbConnection connection = connections.getConnection();
 
 9313                 ResultSet rs = null;
 
 9316                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA256);
 
 9317                         statement.clearParameters();
 
 9318                         statement.setLong(1, 
id);
 
 9319                         rs = connection.executeQuery(statement);
 
 9321                                 hash = rs.getString(
"sha256");
 
 9324                 } 
catch (SQLException ex) {
 
 9325                         throw new TskCoreException(
"Error setting SHA256 hash", ex);
 
 9341         void setAcquisitionDetails(DataSource datasource, String details) 
throws TskCoreException {
 
 9343                 long id = datasource.getId();
 
 9344                 CaseDbConnection connection = connections.getConnection();
 
 9347                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
 
 9348                         statement.clearParameters();
 
 9349                         statement.setString(1, details);
 
 9350                         statement.setLong(2, 
id);
 
 9351                         connection.executeUpdate(statement);
 
 9352                 } 
catch (SQLException ex) {
 
 9353                         throw new TskCoreException(
"Error setting acquisition details", ex);
 
 9369         void setAcquisitionDetails(
long dataSourceId, String details, CaseDbTransaction trans) 
throws TskCoreException {
 
 9372                         CaseDbConnection connection = trans.getConnection();
 
 9373                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
 
 9374                         statement.clearParameters();
 
 9375                         statement.setString(1, details);
 
 9376                         statement.setLong(2, dataSourceId);
 
 9377                         connection.executeUpdate(statement);
 
 9378                 } 
catch (SQLException ex) {
 
 9379                         throw new TskCoreException(
"Error setting acquisition details", ex);
 
 9394         String getAcquisitionDetails(DataSource datasource) 
throws TskCoreException {
 
 9395                 long id = datasource.getId();
 
 9396                 CaseDbConnection connection = connections.getConnection();
 
 9398                 ResultSet rs = null;
 
 9401                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_DETAILS);
 
 9402                         statement.clearParameters();
 
 9403                         statement.setLong(1, 
id);
 
 9404                         rs = connection.executeQuery(statement);
 
 9406                                 hash = rs.getString(
"acquisition_details");
 
 9409                 } 
catch (SQLException ex) {
 
 9410                         throw new TskCoreException(
"Error setting acquisition details", ex);
 
 9429                 if (newStatus == null) {
 
 9432                 CaseDbConnection connection = connections.getConnection();
 
 9434                 Statement statement = null;
 
 9436                         statement = connection.createStatement();
 
 9437                         connection.executeUpdate(statement, 
"UPDATE blackboard_artifacts " 
 9438                                         + 
" SET review_status_id=" + newStatus.getID()
 
 9439                                         + 
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
 
 9440                 } 
catch (SQLException ex) {
 
 9441                         throw new TskCoreException(
"Error setting review status", ex);
 
 9443                         closeStatement(statement);
 
 9460                 CaseDbConnection connection = connections.getConnection();
 
 9463                 ResultSet rs = null;
 
 9465                         s = connection.createStatement();
 
 9466                         Short contentShort = contentType.getValue();
 
 9467                         rs = connection.executeQuery(s, 
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() + 
"'"); 
 
 9470                                 count = rs.getInt(
"count");
 
 9473                 } 
catch (SQLException ex) {
 
 9474                         throw new TskCoreException(
"Error getting number of objects.", ex);
 
 9492                 String escapedText = null;
 
 9494                         escapedText = text.replaceAll(
"'", 
"''");
 
 9507                 if (md5Hash == null) {
 
 9510                 CaseDbConnection connection;
 
 9512                         connection = connections.getConnection();
 
 9513                 } 
catch (TskCoreException ex) {
 
 9514                         logger.log(Level.SEVERE, 
"Error finding files by md5 hash " + md5Hash, ex); 
 
 9519                 ResultSet rs = null;
 
 9521                         s = connection.createStatement();
 
 9522                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_files WHERE "  
 9523                                         + 
" md5 = '" + md5Hash.toLowerCase() + 
"' "  
 9525                         return resultSetToAbstractFiles(rs, connection);
 
 9526                 } 
catch (SQLException ex) {
 
 9527                         logger.log(Level.WARNING, 
"Error querying database.", ex); 
 
 9544                 CaseDbConnection connection;
 
 9546                         connection = connections.getConnection();
 
 9547                 } 
catch (TskCoreException ex) {
 
 9548                         logger.log(Level.SEVERE, 
"Error checking md5 hashing status", ex); 
 
 9551                 boolean allFilesAreHashed = 
false;
 
 9554                 ResultSet rs = null;
 
 9556                         s = connection.createStatement();
 
 9557                         rs = connection.executeQuery(s, 
"SELECT COUNT(*) AS count FROM tsk_files "  
 9559                                         + 
"AND md5 IS NULL "  
 9560                                         + 
"AND size > '0'"); 
 
 9561                         if (rs.next() && rs.getInt(
"count") == 0) {
 
 9562                                 allFilesAreHashed = 
true;
 
 9564                 } 
catch (SQLException ex) {
 
 9565                         logger.log(Level.WARNING, 
"Failed to query whether all files have MD5 hashes", ex); 
 
 9572                 return allFilesAreHashed;
 
 9581                 CaseDbConnection connection;
 
 9583                         connection = connections.getConnection();
 
 9584                 } 
catch (TskCoreException ex) {
 
 9585                         logger.log(Level.SEVERE, 
"Error getting database connection for hashed files count", ex); 
 
 9591                 ResultSet rs = null;
 
 9593                         s = connection.createStatement();
 
 9594                         rs = connection.executeQuery(s, 
"SELECT COUNT(*) AS count FROM tsk_files "  
 9595                                         + 
"WHERE md5 IS NOT NULL "  
 9596                                         + 
"AND size > '0'"); 
 
 9598                                 count = rs.getInt(
"count");
 
 9600                 } 
catch (SQLException ex) {
 
 9601                         logger.log(Level.WARNING, 
"Failed to query for all the files.", ex); 
 
 9621                 CaseDbConnection connection = connections.getConnection();
 
 9623                 ResultSet resultSet = null;
 
 9626                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES);
 
 9627                         resultSet = connection.executeQuery(statement);
 
 9628                         ArrayList<TagName> tagNames = 
new ArrayList<>();
 
 9629                         while (resultSet.next()) {
 
 9630                                 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
 9632                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"))); 
 
 9635                 } 
catch (SQLException ex) {
 
 9636                         throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
 
 9638                         closeResultSet(resultSet);
 
 9655                 CaseDbConnection connection = connections.getConnection();
 
 9657                 ResultSet resultSet = null;
 
 9660                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE);
 
 9661                         resultSet = connection.executeQuery(statement);
 
 9662                         ArrayList<TagName> tagNames = 
new ArrayList<>();
 
 9663                         while (resultSet.next()) {
 
 9664                                 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
 9666                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"))); 
 
 9669                 } 
catch (SQLException ex) {
 
 9670                         throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
 
 9672                         closeResultSet(resultSet);
 
 9692                 ArrayList<TagName> tagNames = 
new ArrayList<TagName>();
 
 9698                 CaseDbConnection connection = connections.getConnection();
 
 9700                 ResultSet resultSet = null;
 
 9703                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE);
 
 9704                         statement.setLong(1, dsObjId);
 
 9705                         statement.setLong(2, dsObjId);
 
 9706                         resultSet = connection.executeQuery(statement); 
 
 9707                         while (resultSet.next()) {
 
 9708                                 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
 9710                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"))); 
 
 9713                 } 
catch (SQLException ex) {
 
 9714                         throw new TskCoreException(
"Failed to get tag names in use for data source objID : " + dsObjId, ex);
 
 9716                         closeResultSet(resultSet);
 
 9755                 CaseDbConnection connection = connections.getConnection();
 
 9757                 ResultSet resultSet = null;
 
 9759                         PreparedStatement statement;
 
 9761                         statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OR_UPDATE_TAG_NAME, Statement.RETURN_GENERATED_KEYS);
 
 9762                         statement.clearParameters();
 
 9763                         statement.setString(5, description);
 
 9764                         statement.setString(6, color.getName());
 
 9765                         statement.setByte(7, knownStatus.getFileKnownValue());
 
 9766                         statement.setString(1, displayName);
 
 9767                         statement.setString(2, description);
 
 9768                         statement.setString(3, color.getName());
 
 9769                         statement.setByte(4, knownStatus.getFileKnownValue());
 
 9770                         connection.executeUpdate(statement);
 
 9771                         resultSet = statement.getGeneratedKeys();
 
 9774                         long tagId = resultSet.getLong(1);
 
 9777                         statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAME_BY_ID);
 
 9778                         statement.clearParameters();
 
 9779                         statement.setLong(1, tagId);
 
 9780                         resultSet = connection.executeQuery(statement);
 
 9783                         return new TagName(tagId, displayName, description, color, knownStatus, resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
 
 9785                 } 
catch (SQLException ex) {
 
 9786                         throw new TskCoreException(
"Error adding row for " + displayName + 
" tag name to tag_names table", ex);
 
 9788                         closeResultSet(resultSet);
 
 9819                 CaseDbConnection connection = connections.getConnection();
 
 9823                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_CONTENT_TAG);
 
 9824                         statement.clearParameters();
 
 9825                         statement.setLong(1, tag.getId());
 
 9826                         connection.executeUpdate(statement);
 
 9827                 } 
catch (SQLException ex) {
 
 9828                         throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() + 
")", ex);
 
 9844                 CaseDbConnection connection = connections.getConnection();
 
 9846                 ResultSet resultSet = null;
 
 9852                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS);
 
 9853                         resultSet = connection.executeQuery(statement);
 
 9854                         ArrayList<ContentTag> tags = 
new ArrayList<ContentTag>();
 
 9855                         while (resultSet.next()) {
 
 9856                                 TagName tagName = 
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
 9858                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));  
 
 9860                                 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
 
 9861                                                 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name")));  
 
 9864                 } 
catch (SQLException ex) {
 
 9865                         throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
 
 9867                         closeResultSet(resultSet);
 
 9884                 if (tagName.getId() == 
Tag.ID_NOT_SET) {
 
 9885                         throw new TskCoreException(
"TagName object is invalid, id not set");
 
 9887                 CaseDbConnection connection = connections.getConnection();
 
 9889                 ResultSet resultSet = null;
 
 9892                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME);
 
 9893                         statement.clearParameters();
 
 9894                         statement.setLong(1, tagName.getId());
 
 9895                         resultSet = connection.executeQuery(statement);
 
 9896                         if (resultSet.next()) {
 
 9897                                 return resultSet.getLong(
"count");
 
 9899                                 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() + 
")");
 
 9901                 } 
catch (SQLException ex) {
 
 9902                         throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() + 
")", ex);
 
 9904                         closeResultSet(resultSet);
 
 9927                 if (tagName.getId() == 
Tag.ID_NOT_SET) {
 
 9928                         throw new TskCoreException(
"TagName object is invalid, id not set");
 
 9931                 CaseDbConnection connection = connections.getConnection();
 
 9933                 ResultSet resultSet = null;
 
 9938                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
 
 9939                         statement.clearParameters();
 
 9940                         statement.setLong(1, tagName.getId());
 
 9941                         statement.setLong(2, dsObjId);
 
 9943                         resultSet = connection.executeQuery(statement);
 
 9944                         if (resultSet.next()) {
 
 9945                                 return resultSet.getLong(
"count");
 
 9947                                 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() + 
")" + 
" for dsObjId = " + dsObjId);
 
 9949                 } 
catch (SQLException ex) {
 
 9950                         throw new TskCoreException(
"Failed to get content_tags row count for  tag_name_id = " + tagName.getId() + 
"data source objID : " + dsObjId, ex);
 
 9952                         closeResultSet(resultSet);
 
 9970                 CaseDbConnection connection = connections.getConnection();
 
 9972                 ResultSet resultSet = null;
 
 9980                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID);
 
 9981                         statement.clearParameters();
 
 9982                         statement.setLong(1, contentTagID);
 
 9983                         resultSet = connection.executeQuery(statement);
 
 9985                         while (resultSet.next()) {
 
 9986                                 TagName tagName = 
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
 9988                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
 
 9990                                                 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
 
 9994                 } 
catch (SQLException ex) {
 
 9995                         throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
 
 9997                         closeResultSet(resultSet);
 
10016                 if (tagName.getId() == 
Tag.ID_NOT_SET) {
 
10017                         throw new TskCoreException(
"TagName object is invalid, id not set");
 
10019                 CaseDbConnection connection = connections.getConnection();
 
10021                 ResultSet resultSet = null;
 
10027                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME);
 
10028                         statement.clearParameters();
 
10029                         statement.setLong(1, tagName.getId());
 
10030                         resultSet = connection.executeQuery(statement);
 
10031                         ArrayList<ContentTag> tags = 
new ArrayList<ContentTag>();
 
10032                         while (resultSet.next()) {
 
10034                                                 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));  
 
10039                 } 
catch (SQLException ex) {
 
10040                         throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() + 
")", ex);
 
10042                         closeResultSet(resultSet);
 
10043                         connection.close();
 
10062                 CaseDbConnection connection = connections.getConnection();
 
10064                 ResultSet resultSet = null;
 
10073                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
 
10074                         statement.clearParameters();
 
10075                         statement.setLong(1, tagName.getId());
 
10076                         statement.setLong(2, dsObjId);
 
10077                         resultSet = connection.executeQuery(statement);
 
10078                         ArrayList<ContentTag> tags = 
new ArrayList<ContentTag>();
 
10079                         while (resultSet.next()) {
 
10081                                                 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));  
 
10086                 } 
catch (SQLException ex) {
 
10087                         throw new TskCoreException(
"Failed to get content_tags row count for  tag_name_id = " + tagName.getId() + 
" data source objID : " + dsObjId, ex);
 
10089                         closeResultSet(resultSet);
 
10090                         connection.close();
 
10107                 CaseDbConnection connection = connections.getConnection();
 
10109                 ResultSet resultSet = null;
 
10116                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT);
 
10117                         statement.clearParameters();
 
10118                         statement.setLong(1, content.getId());
 
10119                         resultSet = connection.executeQuery(statement);
 
10120                         ArrayList<ContentTag> tags = 
new ArrayList<ContentTag>();
 
10121                         while (resultSet.next()) {
 
10122                                 TagName tagName = 
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
10124                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));  
 
10126                                                 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));  
 
10130                 } 
catch (SQLException ex) {
 
10131                         throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() + 
")", ex);
 
10133                         closeResultSet(resultSet);
 
10134                         connection.close();
 
10164                 CaseDbConnection connection = connections.getConnection();
 
10168                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_ARTIFACT_TAG);
 
10169                         statement.clearParameters();
 
10170                         statement.setLong(1, tag.getId());
 
10171                         connection.executeUpdate(statement);
 
10172                 } 
catch (SQLException ex) {
 
10173                         throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() + 
")", ex);
 
10175                         connection.close();
 
10190                 CaseDbConnection connection = connections.getConnection();
 
10192                 ResultSet resultSet = null;
 
10198                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS);
 
10199                         resultSet = connection.executeQuery(statement);
 
10200                         ArrayList<BlackboardArtifactTag> tags = 
new ArrayList<>();
 
10201                         while (resultSet.next()) {
 
10202                                 TagName tagName = 
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
10204                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));  
 
10208                                                 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));  
 
10212                 } 
catch (SQLException ex) {
 
10213                         throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
 
10215                         closeResultSet(resultSet);
 
10216                         connection.close();
 
10232                 if (tagName.getId() == 
Tag.ID_NOT_SET) {
 
10233                         throw new TskCoreException(
"TagName object is invalid, id not set");
 
10235                 CaseDbConnection connection = connections.getConnection();
 
10237                 ResultSet resultSet = null;
 
10240                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME);
 
10241                         statement.clearParameters();
 
10242                         statement.setLong(1, tagName.getId());
 
10243                         resultSet = connection.executeQuery(statement);
 
10244                         if (resultSet.next()) {
 
10245                                 return resultSet.getLong(
"count");
 
10247                                 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() + 
")");
 
10249                 } 
catch (SQLException ex) {
 
10250                         throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() + 
")", ex);
 
10252                         closeResultSet(resultSet);
 
10253                         connection.close();
 
10274                 if (tagName.getId() == 
Tag.ID_NOT_SET) {
 
10275                         throw new TskCoreException(
"TagName object is invalid, id not set");
 
10278                 CaseDbConnection connection = connections.getConnection();
 
10280                 ResultSet resultSet = null;
 
10285                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE);
 
10286                         statement.clearParameters();
 
10287                         statement.setLong(1, tagName.getId());
 
10288                         statement.setLong(2, dsObjId);
 
10289                         resultSet = connection.executeQuery(statement);
 
10290                         if (resultSet.next()) {
 
10291                                 return resultSet.getLong(
"count");
 
10293                                 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() + 
")" + 
" for dsObjId = " + dsObjId);
 
10295                 } 
catch (SQLException ex) {
 
10296                         throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for  tag_name_id = " + tagName.getId() + 
"data source objID : " + dsObjId, ex);
 
10298                         closeResultSet(resultSet);
 
10299                         connection.close();
 
10316                 if (tagName.getId() == 
Tag.ID_NOT_SET) {
 
10317                         throw new TskCoreException(
"TagName object is invalid, id not set");
 
10319                 CaseDbConnection connection = connections.getConnection();
 
10321                 ResultSet resultSet = null;
 
10327                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME);
 
10328                         statement.clearParameters();
 
10329                         statement.setLong(1, tagName.getId());
 
10330                         resultSet = connection.executeQuery(statement);
 
10331                         ArrayList<BlackboardArtifactTag> tags = 
new ArrayList<BlackboardArtifactTag>();
 
10332                         while (resultSet.next()) {
 
10336                                                 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));  
 
10340                 } 
catch (SQLException ex) {
 
10341                         throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() + 
")", ex);
 
10343                         closeResultSet(resultSet);
 
10344                         connection.close();
 
10365                 if (tagName.getId() == 
Tag.ID_NOT_SET) {
 
10366                         throw new TskCoreException(
"TagName object is invalid, id not set");
 
10369                 CaseDbConnection connection = connections.getConnection();
 
10371                 ResultSet resultSet = null;
 
10379                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
 
10380                         statement.clearParameters();
 
10381                         statement.setLong(1, tagName.getId());
 
10382                         statement.setLong(2, dsObjId);
 
10383                         resultSet = connection.executeQuery(statement);
 
10384                         ArrayList<BlackboardArtifactTag> tags = 
new ArrayList<BlackboardArtifactTag>();
 
10385                         while (resultSet.next()) {
 
10389                                                 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));  
 
10393                 } 
catch (SQLException ex) {
 
10394                         throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for  tag_name_id = " + tagName.getId() + 
"data source objID : " + dsObjId, ex);
 
10396                         closeResultSet(resultSet);
 
10397                         connection.close();
 
10416                 CaseDbConnection connection = connections.getConnection();
 
10418                 ResultSet resultSet = null;
 
10426                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID);
 
10427                         statement.clearParameters();
 
10428                         statement.setLong(1, artifactTagID);
 
10429                         resultSet = connection.executeQuery(statement);
 
10431                         while (resultSet.next()) {
 
10432                                 TagName tagName = 
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
10434                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
 
10438                                                 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
 
10442                 } 
catch (SQLException ex) {
 
10443                         throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
 
10445                         closeResultSet(resultSet);
 
10446                         connection.close();
 
10465                 CaseDbConnection connection = connections.getConnection();
 
10467                 ResultSet resultSet = null;
 
10474                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT);
 
10475                         statement.clearParameters();
 
10476                         statement.setLong(1, artifact.getArtifactID());
 
10477                         resultSet = connection.executeQuery(statement);
 
10478                         ArrayList<BlackboardArtifactTag> tags = 
new ArrayList<>();
 
10479                         while (resultSet.next()) {
 
10480                                 TagName tagName = 
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
 
10482                                                 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));  
 
10485                                                 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));  
 
10489                 } 
catch (SQLException ex) {
 
10490                         throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() + 
")", ex);
 
10492                         closeResultSet(resultSet);
 
10493                         connection.close();
 
10507                 CaseDbConnection connection = connections.getConnection();
 
10511                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_PATH);
 
10512                         statement.clearParameters();
 
10513                         statement.setString(1, newPath);
 
10514                         statement.setLong(2, objectId);
 
10515                         connection.executeUpdate(statement);
 
10516                 } 
catch (SQLException ex) {
 
10517                         throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
 
10519                         connection.close();
 
10537         public Report addReport(String localPath, String sourceModuleName, String reportName) 
throws TskCoreException {
 
10538                 return addReport(localPath, sourceModuleName, reportName, null);
 
10559                 String relativePath = 
""; 
 
10560                 long createTime = 0;
 
10561                 String localPathLower = localPath.toLowerCase();
 
10563                 if (localPathLower.startsWith(
"http")) {
 
10564                         relativePath = localPathLower;
 
10565                         createTime = System.currentTimeMillis() / 1000;
 
10576                                 int length = 
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
 
10577                                 relativePath = 
new File(localPath.substring(localPathLower.length() - length)).getPath();
 
10578                         } 
catch (IllegalArgumentException ex) {
 
10579                                 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
 
10580                                 throw new TskCoreException(errorMessage, ex);
 
10584                                 java.io.File tempFile = 
new java.io.File(localPath);
 
10586                                 createTime = tempFile.lastModified() / 1000;
 
10587                         } 
catch (Exception ex) {
 
10588                                 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
 
10593                 CaseDbConnection connection = connections.getConnection();
 
10595                 ResultSet resultSet = null;
 
10599                         long parentObjId = 0;
 
10600                         if (parent != null) {
 
10601                                 parentObjId = parent.getId();
 
10606                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
 
10607                         statement.clearParameters();
 
10608                         statement.setLong(1, objectId);
 
10609                         statement.setString(2, relativePath);
 
10610                         statement.setLong(3, createTime);
 
10611                         statement.setString(4, sourceModuleName);
 
10612                         statement.setString(5, reportName);
 
10613                         connection.executeUpdate(statement);
 
10614                         return new Report(
this, objectId, localPath, createTime, sourceModuleName, reportName, parent);
 
10615                 } 
catch (SQLException ex) {
 
10616                         throw new TskCoreException(
"Error adding report " + localPath + 
" to reports table", ex);
 
10618                         closeResultSet(resultSet);
 
10619                         connection.close();
 
10633                 CaseDbConnection connection = connections.getConnection();
 
10635                 ResultSet resultSet = null;
 
10636                 ResultSet parentResultSet = null;
 
10637                 PreparedStatement statement = null;
 
10638                 Statement parentStatement = null;
 
10641                         statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORTS);
 
10642                         parentStatement = connection.createStatement();
 
10643                         resultSet = connection.executeQuery(statement);
 
10644                         ArrayList<Report> reports = 
new ArrayList<Report>();
 
10645                         while (resultSet.next()) {
 
10646                                 String localpath = resultSet.getString(
"path");
 
10647                                 if (localpath.toLowerCase().startsWith(
"http") == 
false) {
 
10649                                         localpath = Paths.get(
getDbDirPath(), localpath).normalize().toString(); 
 
10654                                 long reportId = resultSet.getLong(
"obj_id"); 
 
10655                                 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", reportId);
 
10656                                 parentResultSet = parentStatement.executeQuery(parentQuery);
 
10657                                 if (parentResultSet.next()) {
 
10658                                         long parentId = parentResultSet.getLong(
"par_obj_id");  
 
10661                                 parentResultSet.close();
 
10663                                 reports.add(
new Report(
this,
 
10666                                                 resultSet.getLong(
"crtime"), 
 
10667                                                 resultSet.getString(
"src_module_name"), 
 
10668                                                 resultSet.getString(
"report_name"),
 
10672                 } 
catch (SQLException ex) {
 
10673                         throw new TskCoreException(
"Error querying reports table", ex);
 
10675                         closeResultSet(resultSet);
 
10676                         closeResultSet(parentResultSet);
 
10677                         closeStatement(statement);
 
10678                         closeStatement(parentStatement);
 
10680                         connection.close();
 
10695                 CaseDbConnection connection = connections.getConnection();
 
10697                 PreparedStatement statement = null;
 
10698                 Statement parentStatement = null;
 
10699                 ResultSet resultSet = null;
 
10700                 ResultSet parentResultSet = null;
 
10704                         statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORT_BY_ID);
 
10705                         parentStatement = connection.createStatement();
 
10706                         statement.clearParameters();
 
10707                         statement.setLong(1, 
id);
 
10708                         resultSet = connection.executeQuery(statement);
 
10710                         if (resultSet.next()) {
 
10713                                 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", 
id);
 
10714                                 parentResultSet = parentStatement.executeQuery(parentQuery);
 
10715                                 if (parentResultSet.next()) {
 
10716                                         long parentId = parentResultSet.getLong(
"par_obj_id"); 
 
10720                                 report = 
new Report(
this, resultSet.getLong(
"obj_id"), 
 
10721                                                 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(), 
 
10722                                                 resultSet.getLong(
"crtime"), 
 
10723                                                 resultSet.getString(
"src_module_name"), 
 
10724                                                 resultSet.getString(
"report_name"),
 
10727                                 throw new TskCoreException(
"No report found for id: " + 
id);
 
10729                 } 
catch (SQLException ex) {
 
10730                         throw new TskCoreException(
"Error querying reports table for id: " + 
id, ex);
 
10732                         closeResultSet(resultSet);
 
10733                         closeResultSet(parentResultSet);
 
10734                         closeStatement(statement);
 
10735                         closeStatement(parentStatement);
 
10736                         connection.close();
 
10751                 CaseDbConnection connection = connections.getConnection();
 
10755                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT);
 
10756                         statement.setLong(1, report.getId());
 
10757                         connection.executeUpdate(statement);
 
10758                 } 
catch (SQLException ex) {
 
10759                         throw new TskCoreException(
"Error querying reports table", ex);
 
10761                         connection.close();
 
10766         static void closeResultSet(ResultSet resultSet) {
 
10767                 if (resultSet != null) {
 
10770                         } 
catch (SQLException ex) {
 
10771                                 logger.log(Level.SEVERE, 
"Error closing ResultSet", ex); 
 
10776         static void closeStatement(Statement statement) {
 
10777                 if (statement != null) {
 
10780                         } 
catch (SQLException ex) {
 
10781                                 logger.log(Level.SEVERE, 
"Error closing Statement", ex); 
 
10795         void setIngestJobEndDateTime(
long ingestJobId, 
long endDateTime) 
throws TskCoreException {
 
10796                 CaseDbConnection connection = connections.getConnection();
 
10799                         Statement statement = connection.createStatement();
 
10800                         statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime + 
" WHERE ingest_job_id=" + ingestJobId + 
";");
 
10801                 } 
catch (SQLException ex) {
 
10802                         throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId + 
".", ex);
 
10804                         connection.close();
 
10809         void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status) 
throws TskCoreException {
 
10810                 CaseDbConnection connection = connections.getConnection();
 
10813                         Statement statement = connection.createStatement();
 
10814                         statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() + 
" WHERE ingest_job_id=" + ingestJobId + 
";");
 
10815                 } 
catch (SQLException ex) {
 
10816                         throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId + 
".", ex);
 
10818                         connection.close();
 
10840                 CaseDbConnection connection = connections.getConnection();
 
10842                 ResultSet resultSet = null;
 
10843                 Statement statement;
 
10845                         connection.beginTransaction();
 
10846                         statement = connection.createStatement();
 
10847                         PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_JOB, Statement.RETURN_GENERATED_KEYS);
 
10848                         insertStatement.setLong(1, dataSource.getId());
 
10849                         insertStatement.setString(2, hostName);
 
10850                         insertStatement.setLong(3, jobStart.getTime());
 
10851                         insertStatement.setLong(4, jobEnd.getTime());
 
10852                         insertStatement.setInt(5, status.ordinal());
 
10853                         insertStatement.setString(6, settingsDir);
 
10854                         connection.executeUpdate(insertStatement);
 
10855                         resultSet = insertStatement.getGeneratedKeys();
 
10857                         long id = resultSet.getLong(1); 
 
10858                         for (
int i = 0; i < ingestModules.size(); i++) {
 
10860                                 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) " 
10861                                                 + 
"VALUES (" + 
id + 
", " + ingestModule.
getIngestModuleId() + 
", " + i + 
");");
 
10865                         connection.commitTransaction();
 
10866                         return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart, 
"", ingestModules, 
this);
 
10867                 } 
catch (SQLException ex) {
 
10868                         connection.rollbackTransaction();
 
10869                         throw new TskCoreException(
"Error adding the ingest job.", ex);
 
10871                         closeResultSet(resultSet);
 
10872                         connection.close();
 
10891                 CaseDbConnection connection = connections.getConnection();
 
10892                 ResultSet resultSet = null;
 
10893                 Statement statement = null;
 
10894                 String uniqueName = factoryClassName + 
"-" + displayName + 
"-" + type.toString() + 
"-" + version;
 
10897                         statement = connection.createStatement();
 
10898                         resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName + 
"'");
 
10899                         if (!resultSet.next()) {
 
10902                                 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_MODULE, Statement.RETURN_GENERATED_KEYS);
 
10903                                 insertStatement.setString(1, displayName);
 
10904                                 insertStatement.setString(2, uniqueName);
 
10905                                 insertStatement.setInt(3, type.ordinal());
 
10906                                 insertStatement.setString(4, version);
 
10907                                 connection.executeUpdate(insertStatement);
 
10908                                 resultSet = statement.getGeneratedKeys();
 
10910                                 long id = resultSet.getLong(1); 
 
10915                                 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
 
10916                                                 resultSet.getString(
"unique_name"), 
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
 
10918                 } 
catch (SQLException ex) {
 
10920                                 closeStatement(statement);
 
10921                                 statement = connection.createStatement();
 
10922                                 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName + 
"'");
 
10923                                 if (resultSet.next()) {
 
10924                                         return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
 
10927                                         throw new TskCoreException(
"Couldn't add new module to database.", ex);
 
10929                         } 
catch (SQLException ex1) {
 
10930                                 throw new TskCoreException(
"Couldn't add new module to database.", ex1);
 
10933                         closeResultSet(resultSet);
 
10934                         closeStatement(statement);
 
10935                         connection.close();
 
10948                 CaseDbConnection connection = connections.getConnection();
 
10949                 ResultSet resultSet = null;
 
10950                 Statement statement = null;
 
10951                 List<IngestJobInfo> ingestJobs = 
new ArrayList<IngestJobInfo>();
 
10954                         statement = connection.createStatement();
 
10955                         resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
 
10956                         while (resultSet.next()) {
 
10957                                 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
 
10958                                                 resultSet.getString(
"host_name"), 
new Date(resultSet.getLong(
"start_date_time")),
 
10960                                                 resultSet.getString(
"settings_dir"), this.getIngestModules(resultSet.getInt(
"ingest_job_id"), connection), 
this));
 
10963                 } 
catch (SQLException ex) {
 
10964                         throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
 
10966                         closeResultSet(resultSet);
 
10967                         closeStatement(statement);
 
10968                         connection.close();
 
10983         private List<IngestModuleInfo> getIngestModules(
int ingestJobId, CaseDbConnection connection) 
throws SQLException {
 
10984                 ResultSet resultSet = null;
 
10985                 Statement statement = null;
 
10986                 List<IngestModuleInfo> ingestModules = 
new ArrayList<IngestModuleInfo>();
 
10989                         statement = connection.createStatement();
 
10990                         resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, " 
10991                                         + 
"ingest_job_modules.pipeline_position AS pipeline_position, " 
10992                                         + 
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, " 
10993                                         + 
"ingest_modules.type_id AS type_id, ingest_modules.version AS version " 
10994                                         + 
"FROM ingest_job_modules, ingest_modules " 
10995                                         + 
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId + 
" " 
10996                                         + 
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id " 
10997                                         + 
"ORDER BY (ingest_job_modules.pipeline_position);");
 
10998                         while (resultSet.next()) {
 
10999                                 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
 
11000                                                 resultSet.getString(
"unique_name"), 
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
 
11002                         return ingestModules;
 
11004                         closeResultSet(resultSet);
 
11005                         closeStatement(statement);
 
11030         long addImageJNI(TskData.TSK_IMG_TYPE_ENUM type, 
long sectorSize, 
long size,
 
11031                         String timezone, String md5, String sha1, String sha256,
 
11032                         String deviceId, String collectionDetails,
 
11033                         CaseDbTransaction transaction) 
throws TskCoreException {
 
11037                         CaseDbConnection connection = transaction.getConnection();
 
11038                         long newObjId = addObject(0, TskData.ObjectType.IMG.getObjectType(), connection);
 
11042                         PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
 
11043                         preparedStatement.clearParameters();
 
11044                         preparedStatement.setLong(1, newObjId);
 
11045                         preparedStatement.setShort(2, (
short) type.getValue());
 
11046                         preparedStatement.setLong(3, sectorSize);
 
11047                         preparedStatement.setString(4, timezone);
 
11049                         long savedSize = size < 0 ? 0 : size;
 
11050                         preparedStatement.setLong(5, savedSize);
 
11051                         preparedStatement.setString(6, md5);
 
11052                         preparedStatement.setString(7, sha1);
 
11053                         preparedStatement.setString(8, sha256);
 
11054                         preparedStatement.setString(9, null);
 
11055                         connection.executeUpdate(preparedStatement);
 
11058                         preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO_WITH_ACQ_DETAIL);
 
11059                         preparedStatement.setLong(1, newObjId);
 
11060                         preparedStatement.setString(2, deviceId);
 
11061                         preparedStatement.setString(3, timezone);
 
11062                         preparedStatement.setString(4, collectionDetails);
 
11063                         connection.executeUpdate(preparedStatement);
 
11066                 } 
catch (SQLException ex) {
 
11067                         throw new TskCoreException(String.format(
"Error adding image to database"), ex);
 
11084         void addImageNameJNI(
long objId, String name, 
long sequence,
 
11085                         CaseDbTransaction transaction) 
throws TskCoreException {
 
11088                         CaseDbConnection connection = transaction.getConnection();
 
11089                         PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
 
11090                         preparedStatement.clearParameters();
 
11091                         preparedStatement.setLong(1, objId);
 
11092                         preparedStatement.setString(2, name);
 
11093                         preparedStatement.setLong(3, sequence);
 
11094                         connection.executeUpdate(preparedStatement);
 
11095                 } 
catch (SQLException ex) {
 
11096                         throw new TskCoreException(String.format(
"Error adding image name %s to image with object ID %d", name, objId), ex);
 
11144         long addFileJNI(
long parentObjId,
 
11145                         Long fsObjId, 
long dataSourceObjId,
 
11147                         Integer attrType, Integer attrId, String name,
 
11148                         Long metaAddr, Long metaSeq,
 
11149                         int dirType, 
int metaType, 
int dirFlags, 
int metaFlags,
 
11151                         Long crtime, Long ctime, Long atime, Long mtime,
 
11152                         Integer meta_mode, Integer gid, Integer uid,
 
11153                         String md5, TskData.FileKnown known,
 
11154                         String escaped_path, String extension,
 
11155                         boolean hasLayout, CaseDbTransaction transaction) 
throws TskCoreException {
 
11157                 Statement queryStatement = null;
 
11160                         CaseDbConnection connection = transaction.getConnection();
 
11164                         long objectId = addObject(parentObjId, TskData.ObjectType.ABSTRACTFILE.getObjectType(), connection);
 
11169                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE_All_FIELDS);
 
11170                         statement.clearParameters();
 
11171                         if (fsObjId != null) {
 
11172                                 statement.setLong(1, fsObjId);                      
 
11174                                 statement.setNull(1, java.sql.Types.BIGINT);
 
11176                         statement.setLong(2, objectId);                                 
 
11177                         statement.setLong(3, dataSourceObjId);                  
 
11178                         statement.setShort(4, (
short) fsType);          
 
11179                         if (attrType != null) {
 
11180                                 statement.setShort(5, attrType.shortValue());  
 
11182                                 statement.setNull(5, java.sql.Types.SMALLINT);
 
11184                         if (attrId != null) {
 
11185                                 statement.setInt(6, attrId);                            
 
11187                                 statement.setNull(6, java.sql.Types.INTEGER);
 
11189                         statement.setString(7, name);                                   
 
11190                         if (metaAddr != null) {
 
11191                                 statement.setLong(8, metaAddr);                         
 
11193                                 statement.setNull(8, java.sql.Types.BIGINT);
 
11195                         if (metaSeq != null) {
 
11196                                 statement.setInt(9, metaSeq.intValue());        
 
11198                                 statement.setNull(9, java.sql.Types.INTEGER);
 
11200                         statement.setShort(10, (
short) dirType);                        
 
11201                         statement.setShort(11, (
short) metaType);               
 
11202                         statement.setShort(12, (
short) dirFlags);               
 
11203                         statement.setShort(13, (
short) metaFlags);              
 
11204                         statement.setLong(14, size < 0 ? 0 : size);     
 
11205                         if (crtime != null) {
 
11206                                 statement.setLong(15, crtime);              
 
11208                                 statement.setNull(15, java.sql.Types.BIGINT);
 
11210                         if (ctime != null) {
 
11211                                 statement.setLong(16, ctime);               
 
11213                                 statement.setNull(16, java.sql.Types.BIGINT);
 
11215                         if (atime != null) {
 
11216                                 statement.setLong(17, atime);               
 
11218                                 statement.setNull(17, java.sql.Types.BIGINT);
 
11220                         if (mtime != null) {
 
11221                                 statement.setLong(18, mtime);               
 
11223                                 statement.setNull(18, java.sql.Types.BIGINT);
 
11225                         if (meta_mode != null) {
 
11226                                 statement.setLong(19, meta_mode);           
 
11228                                 statement.setNull(19, java.sql.Types.BIGINT);
 
11231                                 statement.setLong(20, gid);                 
 
11233                                 statement.setNull(20, java.sql.Types.BIGINT);
 
11236                                 statement.setLong(21, uid);                 
 
11238                                 statement.setNull(21, java.sql.Types.BIGINT);
 
11240                         statement.setString(22, md5);                   
 
11241                         statement.setInt(23, known.getFileKnownValue());
 
11242                         statement.setString(24, escaped_path);          
 
11243                         statement.setString(25, extension);             
 
11245                                 statement.setInt(26, 1);                    
 
11247                                 statement.setNull(26, java.sql.Types.INTEGER);
 
11249                         connection.executeUpdate(statement);
 
11253                                         && TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType() != fsType
 
11254                                         && (!name.equals(
".")) && (!name.equals(
".."))) {
 
11256                                 DerivedFile derivedFile = 
new DerivedFile(
this, objectId, dataSourceObjId, name,
 
11257                                                 TSK_FS_NAME_TYPE_ENUM.valueOf((
short) dirType),
 
11258                                                 TSK_FS_META_TYPE_ENUM.valueOf((
short) metaType),
 
11259                                                 TSK_FS_NAME_FLAG_ENUM.valueOf(dirFlags),
 
11261                                                 size, ctime, crtime, atime, mtime, null, null, escaped_path, null, parentObjId, null, null, extension);
 
11263                                 timelineManager.addEventsForNewFileQuiet(derivedFile, connection);
 
11267                 } 
catch (SQLException ex) {
 
11268                         throw new TskCoreException(
"Failed to add file system file", ex);
 
11270                         closeStatement(queryStatement);
 
11287         void addLayoutFileRangeJNI(
long objId, 
long byteStart, 
long byteLen,
 
11288                         long seq, CaseDbTransaction transaction) 
throws TskCoreException {
 
11291                         CaseDbConnection connection = transaction.getConnection();
 
11293                         PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
 
11294                         prepStmt.clearParameters();
 
11295                         prepStmt.setLong(1, objId);
 
11296                         prepStmt.setLong(2, byteStart);
 
11297                         prepStmt.setLong(3, byteLen);
 
11298                         prepStmt.setLong(4, seq);
 
11299                         connection.executeUpdate(prepStmt);
 
11300                 } 
catch (SQLException ex) {
 
11301                         throw new TskCoreException(
"Error adding layout range to file with obj ID " + objId, ex);
 
11310         static class ObjectInfo {
 
11313                 private TskData.ObjectType type;
 
11315                 ObjectInfo(
long id, ObjectType type) {
 
11324                 TskData.ObjectType getType() {
 
11329         private interface DbCommand {
 
11331                 void execute() throws SQLException;
 
11334         private enum PREPARED_STATEMENT {
 
11336                 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "  
11337                                 + 
"WHERE artifact_type_id = ?"), 
 
11338                 COUNT_ARTIFACTS_OF_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()), 
 
11339                 COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE data_source_obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()), 
 
11340                 COUNT_ARTIFACTS_FROM_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()), 
 
11341                 COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()), 
 
11342                 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "  
11343                                 + 
"FROM tsk_objects INNER JOIN tsk_files "  
11344                                 + 
"ON tsk_objects.obj_id=tsk_files.obj_id "  
11345                                 + 
"WHERE (tsk_objects.par_obj_id = ? ) "  
11346                                 + 
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"), 
 
11347                 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "  
11348                                 + 
"FROM tsk_objects INNER JOIN tsk_files "  
11349                                 + 
"ON tsk_objects.obj_id=tsk_files.obj_id "  
11350                                 + 
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "  
11351                                 + 
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"), 
 
11352                 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "  
11353                                 + 
"FROM tsk_objects INNER JOIN tsk_files "  
11354                                 + 
"ON tsk_objects.obj_id=tsk_files.obj_id "  
11355                                 + 
"WHERE (tsk_objects.par_obj_id = ?)"), 
 
11356                 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "  
11357                                 + 
"FROM tsk_objects INNER JOIN tsk_files "  
11358                                 + 
"ON tsk_objects.obj_id=tsk_files.obj_id "  
11359                                 + 
"WHERE (tsk_objects.par_obj_id = ? "  
11360                                 + 
"AND tsk_files.type = ? )"), 
 
11361                 SELECT_FILE_BY_ID(
"SELECT * FROM tsk_files WHERE obj_id = ? LIMIT 1"), 
 
11362                 SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
 
11363                 SELECT_ARTIFACT_BY_ARTIFACT_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_id = ? LIMIT 1"),
 
11364                 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "  
11365                                 + 
"VALUES (?, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() + 
")"), 
 
11366                 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "  
11367                                 + 
"VALUES (DEFAULT, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() + 
")"), 
 
11368                 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "  
11369                                 + 
"VALUES (?,?,?,?,?,?,?)"), 
 
11370                 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "  
11371                                 + 
"VALUES (?,?,?,?,?,?,?)"), 
 
11372                 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "  
11373                                 + 
"VALUES (?,?,?,?,?,?,?)"), 
 
11374                 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "  
11375                                 + 
"VALUES (?,?,?,?,?,?,?)"), 
 
11376                 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "  
11377                                 + 
"VALUES (?,?,?,?,?,?,?)"), 
 
11378                 SELECT_FILES_BY_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"), 
 
11379                 SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"), 
 
11380                 UPDATE_FILE_MD5(
"UPDATE tsk_files SET md5 = ? WHERE obj_id = ?"), 
 
11381                 UPDATE_IMAGE_MD5(
"UPDATE tsk_image_info SET md5 = ? WHERE obj_id = ?"), 
 
11382                 UPDATE_IMAGE_SHA1(
"UPDATE tsk_image_info SET sha1 = ? WHERE obj_id = ?"), 
 
11383                 UPDATE_IMAGE_SHA256(
"UPDATE tsk_image_info SET sha256 = ? WHERE obj_id = ?"), 
 
11384                 SELECT_IMAGE_MD5(
"SELECT md5 FROM tsk_image_info WHERE obj_id = ?"), 
 
11385                 SELECT_IMAGE_SHA1(
"SELECT sha1 FROM tsk_image_info WHERE obj_id = ?"), 
 
11386                 SELECT_IMAGE_SHA256(
"SELECT sha256 FROM tsk_image_info WHERE obj_id = ?"), 
 
11387                 UPDATE_ACQUISITION_DETAILS(
"UPDATE data_source_info SET acquisition_details = ? WHERE obj_id = ?"), 
 
11388                 SELECT_ACQUISITION_DETAILS(
"SELECT acquisition_details FROM data_source_info WHERE obj_id = ?"), 
 
11389                 SELECT_LOCAL_PATH_FOR_FILE(
"SELECT path FROM tsk_files_path WHERE obj_id = ?"), 
 
11390                 SELECT_ENCODING_FOR_FILE(
"SELECT encoding_type FROM tsk_files_path WHERE obj_id = ?"), 
 
11391                 SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE(
"SELECT path, encoding_type FROM tsk_files_path WHERE obj_id = ?"), 
 
11392                 SELECT_PATH_FOR_FILE(
"SELECT parent_path FROM tsk_files WHERE obj_id = ?"), 
 
11393                 SELECT_FILE_NAME(
"SELECT name FROM tsk_files WHERE obj_id = ?"), 
 
11394                 SELECT_DERIVED_FILE(
"SELECT derived_id, rederive FROM tsk_files_derived WHERE obj_id = ?"), 
 
11395                 SELECT_FILE_DERIVATION_METHOD(
"SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"), 
 
11396                 SELECT_MAX_OBJECT_ID(
"SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"), 
 
11397                 INSERT_OBJECT(
"INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"), 
 
11398                 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, known, mime_type, parent_path, data_source_obj_id,extension) "  
11399                                 + 
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"), 
 
11400                 INSERT_FILE_SYSTEM_FILE(
"INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, parent_path, extension)" 
11401                                 + 
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"), 
 
11402                 INSERT_FILE_SYSTEM_FILE_All_FIELDS(
"INSERT INTO tsk_files (fs_obj_id, obj_id, data_source_obj_id, type, attr_type, attr_id, name, meta_addr, meta_seq, dir_type, meta_type, dir_flags, meta_flags, size, crtime, ctime, atime, mtime, mode, gid, uid, md5, known, parent_path, extension, has_layout)" 
11403                                 + 
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"), 
 
11404                 UPDATE_DERIVED_FILE(
"UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?,  meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ?  " 
11405                                 + 
"WHERE obj_id = ?"), 
 
11406                 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "  
11407                                 + 
"VALUES (?, ?, ?, ?)"), 
 
11408                 INSERT_LOCAL_PATH(
"INSERT INTO tsk_files_path (obj_id, path, encoding_type) VALUES (?, ?, ?)"), 
 
11409                 UPDATE_LOCAL_PATH(
"UPDATE tsk_files_path SET path = ?, encoding_type = ? WHERE obj_id = ?"), 
 
11410                 COUNT_CHILD_OBJECTS_BY_PARENT(
"SELECT COUNT(obj_id) AS count FROM tsk_objects WHERE par_obj_id = ?"), 
 
11411                 SELECT_FILE_SYSTEM_BY_OBJECT(
"SELECT fs_obj_id from tsk_files WHERE obj_id=?"), 
 
11412                 SELECT_TAG_NAMES(
"SELECT * FROM tag_names"), 
 
11413                 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "  
11414                                 + 
"WHERE tag_name_id IN "  
11415                                 + 
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"), 
 
11416                 SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE(
"SELECT * FROM tag_names " 
11417                                 + 
"WHERE tag_name_id IN " 
11418                                 + 
"( SELECT content_tags.tag_name_id as tag_name_id " 
11419                                 + 
"FROM content_tags as content_tags, tsk_files as tsk_files" 
11420                                 + 
" WHERE content_tags.obj_id = tsk_files.obj_id" 
11421                                 + 
" AND tsk_files.data_source_obj_id =  ?" 
11423                                 + 
"SELECT artifact_tags.tag_name_id as tag_name_id " 
11424                                 + 
" FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts " 
11425                                 + 
" WHERE artifact_tags.artifact_id = arts.artifact_id" 
11426                                 + 
" AND arts.data_source_obj_id =  ?" 
11428                 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?)"), 
 
11429                 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset, examiner_id) VALUES (?, ?, ?, ?, ?, ?)"), 
 
11430                 DELETE_CONTENT_TAG(
"DELETE FROM content_tags WHERE tag_id = ?"), 
 
11431                 COUNT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM content_tags WHERE tag_name_id = ?"), 
 
11432                 COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
 
11433                                 "SELECT COUNT(*) AS count FROM content_tags as content_tags, tsk_files as tsk_files WHERE content_tags.obj_id = tsk_files.obj_id" 
11434                                 + 
" AND content_tags.tag_name_id = ? " 
11435                                 + 
" AND tsk_files.data_source_obj_id = ? " 
11437                 SELECT_CONTENT_TAGS(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank " 
11438                                 + 
"FROM content_tags " 
11439                                 + 
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id " 
11440                                 + 
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id"), 
 
11441                 SELECT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tsk_examiners.login_name " 
11442                                 + 
"FROM content_tags " 
11443                                 + 
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id " 
11444                                 + 
"WHERE tag_name_id = ?"), 
 
11445                 SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id " 
11446                                 + 
"FROM content_tags as content_tags, tsk_files as tsk_files, tag_names as tag_names, tsk_examiners as tsk_examiners " 
11447                                 + 
"WHERE content_tags.examiner_id = tsk_examiners.examiner_id" 
11448                                 + 
" AND content_tags.obj_id = tsk_files.obj_id" 
11449                                 + 
" AND content_tags.tag_name_id = tag_names.tag_name_id" 
11450                                 + 
" AND content_tags.tag_name_id = ?" 
11451                                 + 
" AND tsk_files.data_source_obj_id = ? "),
 
11452                 SELECT_CONTENT_TAG_BY_ID(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank " 
11453                                 + 
"FROM content_tags " 
11454                                 + 
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id " 
11455                                 + 
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id " 
11456                                 + 
"WHERE tag_id = ?"), 
 
11457                 SELECT_CONTENT_TAGS_BY_CONTENT(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank " 
11458                                 + 
"FROM content_tags " 
11459                                 + 
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id " 
11460                                 + 
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id " 
11461                                 + 
"WHERE content_tags.obj_id = ?"), 
 
11462                 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment, examiner_id) " 
11463                                 + 
"VALUES (?, ?, ?, ?)"), 
 
11464                 DELETE_ARTIFACT_TAG(
"DELETE FROM blackboard_artifact_tags WHERE tag_id = ?"), 
 
11465                 SELECT_ARTIFACT_TAGS(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tag_names.tag_set_id, tsk_examiners.login_name, tag_names.rank " 
11466                                 + 
"FROM blackboard_artifact_tags " 
11467                                 + 
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id " 
11468                                 + 
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id"), 
 
11469                 COUNT_ARTIFACTS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags WHERE tag_name_id = ?"), 
 
11470                 COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts WHERE artifact_tags.artifact_id = arts.artifact_id" 
11471                                 + 
" AND artifact_tags.tag_name_id = ?" 
11472                                 + 
" AND arts.data_source_obj_id =  ? "),
 
11473                 SELECT_ARTIFACT_TAGS_BY_TAG_NAME(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tsk_examiners.login_name " 
11474                                 + 
"FROM blackboard_artifact_tags " 
11475                                 + 
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id " 
11476                                 + 
"WHERE tag_name_id = ?"), 
 
11477                 SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT artifact_tags.tag_id, artifact_tags.artifact_id, artifact_tags.tag_name_id, artifact_tags.comment, arts.obj_id, arts.artifact_obj_id, arts.data_source_obj_id, arts.artifact_type_id, arts.review_status_id, tsk_examiners.login_name " 
11478                                 + 
"FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts, tsk_examiners AS tsk_examiners " 
11479                                 + 
"WHERE artifact_tags.examiner_id = tsk_examiners.examiner_id" 
11480                                 + 
" AND artifact_tags.artifact_id = arts.artifact_id" 
11481                                 + 
" AND artifact_tags.tag_name_id = ? " 
11482                                 + 
" AND arts.data_source_obj_id =  ? "),
 
11483                 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank " 
11484                                 + 
"FROM blackboard_artifact_tags " 
11485                                 + 
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id  " 
11486                                 + 
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id " 
11487                                 + 
"WHERE blackboard_artifact_tags.tag_id = ?"), 
 
11488                 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank " 
11489                                 + 
"FROM blackboard_artifact_tags " 
11490                                 + 
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id " 
11491                                 + 
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id " 
11492                                 + 
"WHERE blackboard_artifact_tags.artifact_id = ?"), 
 
11493                 SELECT_REPORTS(
"SELECT * FROM reports"), 
 
11494                 SELECT_REPORT_BY_ID(
"SELECT * FROM reports WHERE obj_id = ?"), 
 
11495                 INSERT_REPORT(
"INSERT INTO reports (obj_id, path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?, ?)"), 
 
11496                 DELETE_REPORT(
"DELETE FROM reports WHERE reports.obj_id = ?"), 
 
11497                 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"), 
 
11498                 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"), 
 
11499                 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"), 
 
11500                 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"), 
 
11501                 UPDATE_IMAGE_PATH(
"UPDATE tsk_image_names SET name = ? WHERE obj_id = ?"), 
 
11502                 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "  
11503                                 + 
"FROM tsk_objects INNER JOIN blackboard_artifacts "  
11504                                 + 
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "  
11505                                 + 
"WHERE (tsk_objects.par_obj_id = ?)"),
 
11506                 INSERT_OR_UPDATE_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?) ON CONFLICT (display_name) DO UPDATE SET description = ?, color = ?, knownStatus = ?"),
 
11507                 SELECT_EXAMINER_BY_ID(
"SELECT * FROM tsk_examiners WHERE examiner_id = ?"),
 
11508                 SELECT_EXAMINER_BY_LOGIN_NAME(
"SELECT * FROM tsk_examiners WHERE login_name = ?"),
 
11509                 INSERT_EXAMINER_POSTGRESQL(
"INSERT INTO tsk_examiners (login_name) VALUES (?) ON CONFLICT DO NOTHING"),
 
11510                 INSERT_EXAMINER_SQLITE(
"INSERT OR IGNORE INTO tsk_examiners (login_name) VALUES (?)"),
 
11511                 UPDATE_FILE_NAME(
"UPDATE tsk_files SET name = ? WHERE obj_id = ?"),
 
11512                 UPDATE_IMAGE_NAME(
"UPDATE tsk_image_info SET display_name = ? WHERE obj_id = ?"),
 
11513                 DELETE_IMAGE_NAME(
"DELETE FROM tsk_image_names WHERE obj_id = ?"),
 
11514                 INSERT_IMAGE_NAME(
"INSERT INTO tsk_image_names (obj_id, name, sequence) VALUES (?, ?, ?)"),
 
11515                 INSERT_IMAGE_INFO(
"INSERT INTO tsk_image_info (obj_id, type, ssize, tzone, size, md5, sha1, sha256, display_name)" 
11516                                 + 
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"),
 
11517                 INSERT_DATA_SOURCE_INFO(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) VALUES (?, ?, ?)"),
 
11518                 INSERT_DATA_SOURCE_INFO_WITH_ACQ_DETAIL(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, acquisition_details) VALUES (?, ?, ?, ?)"),
 
11519                 INSERT_VS_INFO(
"INSERT INTO tsk_vs_info (obj_id, vs_type, img_offset, block_size) VALUES (?, ?, ?, ?)"),
 
11520                 INSERT_VS_PART_SQLITE(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, desc, flags) VALUES (?, ?, ?, ?, ?, ?)"),
 
11521                 INSERT_VS_PART_POSTGRESQL(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, descr, flags) VALUES (?, ?, ?, ?, ?, ?)"),
 
11522                 INSERT_POOL_INFO(
"INSERT INTO tsk_pool_info (obj_id, pool_type) VALUES (?, ?)"),
 
11523                 INSERT_FS_INFO(
"INSERT INTO tsk_fs_info (obj_id, data_source_obj_id, img_offset, fs_type, block_size, block_count, root_inum, first_inum, last_inum, display_name)" 
11524                                 + 
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
 
11525                 SELECT_TAG_NAME_BY_ID(
"SELECT * FROM tag_names where tag_name_id = ?");
 
11527                 private final String sql;
 
11529                 private PREPARED_STATEMENT(String sql) {
 
11543         abstract private class ConnectionPool {
 
11545                 private PooledDataSource pooledDataSource;
 
11547                 public ConnectionPool() {
 
11548                         pooledDataSource = null;
 
11551                 CaseDbConnection getConnection() throws TskCoreException {
 
11552                         if (pooledDataSource == null) {
 
11553                                 throw new TskCoreException(
"Error getting case database connection - case is closed");
 
11556                                 return getPooledConnection();
 
11557                         } 
catch (SQLException exp) {
 
11558                                 throw new TskCoreException(exp.getMessage());
 
11562                 void close() throws TskCoreException {
 
11563                         if (pooledDataSource != null) {
 
11565                                         pooledDataSource.close();
 
11566                                 } 
catch (SQLException exp) {
 
11567                                         throw new TskCoreException(exp.getMessage());
 
11569                                         pooledDataSource = null;
 
11574                 abstract CaseDbConnection getPooledConnection() throws SQLException;
 
11576                 public PooledDataSource getPooledDataSource() {
 
11577                         return pooledDataSource;
 
11580                 public void setPooledDataSource(PooledDataSource pooledDataSource) {
 
11581                         this.pooledDataSource = pooledDataSource;
 
11589         private final class SQLiteConnections 
extends ConnectionPool {
 
11591                 private final Map<String, String> configurationOverrides = 
new HashMap<String, String>();
 
11593                 SQLiteConnections(String dbPath) 
throws SQLException {
 
11594                         configurationOverrides.put(
"acquireIncrement", 
"2");
 
11595                         configurationOverrides.put(
"initialPoolSize", 
"5");
 
11596                         configurationOverrides.put(
"minPoolSize", 
"5");
 
11601                         configurationOverrides.put(
"maxPoolSize", 
"20");
 
11602                         configurationOverrides.put(
"maxStatements", 
"200");
 
11603                         configurationOverrides.put(
"maxStatementsPerConnection", 
"20");
 
11605                         SQLiteConfig config = 
new SQLiteConfig();
 
11606                         config.setSynchronous(SQLiteConfig.SynchronousMode.OFF); 
 
11607                         config.setReadUncommited(
true);
 
11608                         config.enforceForeignKeys(
true); 
 
11609                         SQLiteDataSource unpooled = 
new SQLiteDataSource(config);
 
11610                         unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
 
11611                         setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
 
11615                 public CaseDbConnection getPooledConnection() throws SQLException {
 
11616                         return new SQLiteConnection(getPooledDataSource().getConnection());
 
11624         private final class PostgreSQLConnections 
extends ConnectionPool {
 
11626                 PostgreSQLConnections(String host, 
int port, String dbName, String userName, String password) 
throws PropertyVetoException, UnsupportedEncodingException {
 
11627                         ComboPooledDataSource comboPooledDataSource = 
new ComboPooledDataSource();
 
11628                         comboPooledDataSource.setDriverClass(
"org.postgresql.Driver"); 
 
11629                         comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host + 
":" + port + 
"/" 
11630                                         + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
 
11631                         comboPooledDataSource.setUser(userName);
 
11632                         comboPooledDataSource.setPassword(password);
 
11633                         comboPooledDataSource.setAcquireIncrement(2);
 
11634                         comboPooledDataSource.setInitialPoolSize(5);
 
11635                         comboPooledDataSource.setMinPoolSize(5);
 
11640                         comboPooledDataSource.setMaxPoolSize(20);
 
11641                         comboPooledDataSource.setMaxStatements(200);
 
11642                         comboPooledDataSource.setMaxStatementsPerConnection(20);
 
11643                         setPooledDataSource(comboPooledDataSource);
 
11647                 public CaseDbConnection getPooledConnection() throws SQLException {
 
11648                         return new PostgreSQLConnection(getPooledDataSource().getConnection());
 
11655         abstract class CaseDbConnection 
implements AutoCloseable {
 
11657                 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
 
11658                 static final int MAX_RETRIES = 20; 
 
11660                 private class CreateStatement 
implements DbCommand {
 
11662                         private final Connection connection;
 
11663                         private Statement statement = null;
 
11665                         CreateStatement(Connection connection) {
 
11666                                 this.connection = connection;
 
11669                         Statement getStatement() {
 
11674                         public void execute() throws SQLException {
 
11675                                 statement = connection.createStatement();
 
11679                 private class SetAutoCommit 
implements DbCommand {
 
11681                         private final Connection connection;
 
11682                         private final boolean mode;
 
11684                         SetAutoCommit(Connection connection, 
boolean mode) {
 
11685                                 this.connection = connection;
 
11690                         public void execute() throws SQLException {
 
11691                                 connection.setAutoCommit(mode);
 
11695                 private class Commit 
implements DbCommand {
 
11697                         private final Connection connection;
 
11699                         Commit(Connection connection) {
 
11700                                 this.connection = connection;
 
11704                         public void execute() throws SQLException {
 
11705                                 connection.commit();
 
11709                 private class ExecuteQuery 
implements DbCommand {
 
11711                         private final Statement statement;
 
11712                         private final String query;
 
11713                         private ResultSet resultSet;
 
11715                         ExecuteQuery(Statement statement, String query) {
 
11716                                 this.statement = statement;
 
11717                                 this.query = query;
 
11720                         ResultSet getResultSet() {
 
11725                         public void execute() throws SQLException {
 
11726                                 resultSet = statement.executeQuery(query);
 
11730                 private class ExecutePreparedStatementQuery 
implements DbCommand {
 
11732                         private final PreparedStatement preparedStatement;
 
11733                         private ResultSet resultSet;
 
11735                         ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
 
11736                                 this.preparedStatement = preparedStatement;
 
11739                         ResultSet getResultSet() {
 
11744                         public void execute() throws SQLException {
 
11745                                 resultSet = preparedStatement.executeQuery();
 
11749                 private class ExecutePreparedStatementUpdate 
implements DbCommand {
 
11751                         private final PreparedStatement preparedStatement;
 
11753                         ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
 
11754                                 this.preparedStatement = preparedStatement;
 
11758                         public void execute() throws SQLException {
 
11759                                 preparedStatement.executeUpdate();
 
11763                 private class ExecuteStatementUpdate 
implements DbCommand {
 
11765                         private final Statement statement;
 
11766                         private final String updateCommand;
 
11768                         ExecuteStatementUpdate(Statement statement, String updateCommand) {
 
11769                                 this.statement = statement;
 
11770                                 this.updateCommand = updateCommand;
 
11774                         public void execute() throws SQLException {
 
11775                                 statement.executeUpdate(updateCommand);
 
11779                 private class ExecuteStatementUpdateGenerateKeys 
implements DbCommand {
 
11781                         private final Statement statement;
 
11782                         private final int generateKeys;
 
11783                         private final String updateCommand;
 
11785                         ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand, 
int generateKeys) {
 
11786                                 this.statement = statement;
 
11787                                 this.generateKeys = generateKeys;
 
11788                                 this.updateCommand = updateCommand;
 
11792                         public void execute() throws SQLException {
 
11793                                 statement.executeUpdate(updateCommand, generateKeys);
 
11797                 private class PrepareStatement 
implements DbCommand {
 
11799                         private final Connection connection;
 
11800                         private final String input;
 
11801                         private PreparedStatement preparedStatement = null;
 
11803                         PrepareStatement(Connection connection, String input) {
 
11804                                 this.connection = connection;
 
11805                                 this.input = input;
 
11808                         PreparedStatement getPreparedStatement() {
 
11809                                 return preparedStatement;
 
11813                         public void execute() throws SQLException {
 
11814                                 preparedStatement = connection.prepareStatement(input);
 
11818                 private class PrepareStatementGenerateKeys 
implements DbCommand {
 
11820                         private final Connection connection;
 
11821                         private final String input;
 
11822                         private final int generateKeys;
 
11823                         private PreparedStatement preparedStatement = null;
 
11825                         PrepareStatementGenerateKeys(Connection connection, String input, 
int generateKeysInput) {
 
11826                                 this.connection = connection;
 
11827                                 this.input = input;
 
11828                                 this.generateKeys = generateKeysInput;
 
11831                         PreparedStatement getPreparedStatement() {
 
11832                                 return preparedStatement;
 
11836                         public void execute() throws SQLException {
 
11837                                 preparedStatement = connection.prepareStatement(input, generateKeys);
 
11841                 abstract void executeCommand(DbCommand command) 
throws SQLException;
 
11843                 private final Connection connection;
 
11844                 private final Map<PREPARED_STATEMENT, PreparedStatement> preparedStatements;
 
11846                 CaseDbConnection(Connection connection) {
 
11847                         this.connection = connection;
 
11848                         preparedStatements = 
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(PREPARED_STATEMENT.class);
 
11852                         return this.connection != null;
 
11855                 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey) 
throws SQLException {
 
11856                         return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
 
11859                 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey, 
int generateKeys) 
throws SQLException {
 
11861                         PreparedStatement statement;
 
11862                         if (this.preparedStatements.containsKey(statementKey)) {
 
11863                                 statement = this.preparedStatements.get(statementKey);
 
11865                                 statement = prepareStatement(statementKey.getSQL(), generateKeys);
 
11866                                 this.preparedStatements.put(statementKey, statement);
 
11871                 PreparedStatement prepareStatement(String sqlStatement, 
int generateKeys) 
throws SQLException {
 
11872                         PrepareStatement prepareStatement = 
new PrepareStatement(this.getConnection(), sqlStatement);
 
11873                         executeCommand(prepareStatement);
 
11874                         return prepareStatement.getPreparedStatement();
 
11877                 Statement createStatement() throws SQLException {
 
11878                         CreateStatement createStatement = 
new CreateStatement(this.connection);
 
11879                         executeCommand(createStatement);
 
11880                         return createStatement.getStatement();
 
11884                         SetAutoCommit setAutoCommit = 
new SetAutoCommit(connection, 
false);
 
11885                         executeCommand(setAutoCommit);
 
11888                 void commitTransaction() throws SQLException {
 
11889                         Commit commit = 
new Commit(connection);
 
11890                         executeCommand(commit);
 
11892                         SetAutoCommit setAutoCommit = 
new SetAutoCommit(connection, 
true);
 
11893                         executeCommand(setAutoCommit);
 
11901                 void rollbackTransaction() {
 
11903                                 connection.rollback();
 
11904                         } 
catch (SQLException e) {
 
11905                                 logger.log(Level.SEVERE, 
"Error rolling back transaction", e);
 
11908                                 connection.setAutoCommit(
true);
 
11909                         } 
catch (SQLException e) {
 
11910                                 logger.log(Level.SEVERE, 
"Error restoring auto-commit", e);
 
11921                 void rollbackTransactionWithThrow() throws SQLException {
 
11923                                 connection.rollback();
 
11925                                 connection.setAutoCommit(
true);
 
11929                 ResultSet 
executeQuery(Statement statement, String query) 
throws SQLException {
 
11930                         ExecuteQuery queryCommand = 
new ExecuteQuery(statement, query);
 
11931                         executeCommand(queryCommand);
 
11932                         return queryCommand.getResultSet();
 
11944                 ResultSet 
executeQuery(PreparedStatement statement) 
throws SQLException {
 
11945                         ExecutePreparedStatementQuery executePreparedStatementQuery = 
new ExecutePreparedStatementQuery(statement);
 
11946                         executeCommand(executePreparedStatementQuery);
 
11947                         return executePreparedStatementQuery.getResultSet();
 
11950                 void executeUpdate(Statement statement, String update) 
throws SQLException {
 
11951                         executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
 
11954                 void executeUpdate(Statement statement, String update, 
int generateKeys) 
throws SQLException {
 
11955                         ExecuteStatementUpdate executeStatementUpdate = 
new ExecuteStatementUpdate(statement, update);
 
11956                         executeCommand(executeStatementUpdate);
 
11959                 void executeUpdate(PreparedStatement statement) 
throws SQLException {
 
11960                         ExecutePreparedStatementUpdate executePreparedStatementUpdate = 
new ExecutePreparedStatementUpdate(statement);
 
11961                         executeCommand(executePreparedStatementUpdate);
 
11968                 public void close() {
 
11970                                 connection.close();
 
11971                         } 
catch (SQLException ex) {
 
11972                                 logger.log(Level.SEVERE, 
"Unable to close connection to case database", ex);
 
11976                 Connection getConnection() {
 
11977                         return this.connection;
 
11984         private final class SQLiteConnection 
extends CaseDbConnection {
 
11986                 private static final int DATABASE_LOCKED_ERROR = 0; 
 
11987                 private static final int SQLITE_BUSY_ERROR = 5;
 
11989                 SQLiteConnection(Connection conn) {
 
11994                 void executeCommand(DbCommand command) 
throws SQLException {
 
11995                         int retryCounter = 0;
 
12000                                 } 
catch (SQLException ex) {
 
12001                                         if ((ex.getErrorCode() == SQLITE_BUSY_ERROR || ex.getErrorCode() == DATABASE_LOCKED_ERROR) && retryCounter < MAX_RETRIES) {
 
12008                                                         Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
 
12009                                                 } 
catch (InterruptedException exp) {
 
12010                                                         Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING, 
"Unexpectedly unable to wait for database.", exp);
 
12023         private final class PostgreSQLConnection 
extends CaseDbConnection {
 
12025                 private final String COMMUNICATION_ERROR = PSQLState.COMMUNICATION_ERROR.getState();
 
12026                 private final String SYSTEM_ERROR = PSQLState.SYSTEM_ERROR.getState();
 
12027                 private final String UNKNOWN_STATE = PSQLState.UNKNOWN_STATE.getState();
 
12028                 private static final int MAX_RETRIES = 3;
 
12030                 PostgreSQLConnection(Connection conn) {
 
12035                 void executeUpdate(Statement statement, String update, 
int generateKeys) 
throws SQLException {
 
12036                         CaseDbConnection.ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys = 
new CaseDbConnection.ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
 
12037                         executeCommand(executeStatementUpdateGenerateKeys);
 
12041                 PreparedStatement prepareStatement(String sqlStatement, 
int generateKeys) 
throws SQLException {
 
12042                         CaseDbConnection.PrepareStatementGenerateKeys prepareStatementGenerateKeys = 
new CaseDbConnection.PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
 
12043                         executeCommand(prepareStatementGenerateKeys);
 
12044                         return prepareStatementGenerateKeys.getPreparedStatement();
 
12048                 void executeCommand(DbCommand command) 
throws SQLException {
 
12049                         SQLException lastException = null;
 
12050                         for (
int retries = 0; retries < MAX_RETRIES; retries++) {
 
12053                                         lastException = null; 
 
12055                                 } 
catch (SQLException ex) {
 
12056                                         lastException = ex;
 
12057                                         String sqlState = ex.getSQLState();
 
12058                                         if (sqlState == null || sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
 
12060                                                         Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
 
12061                                                 } 
catch (InterruptedException exp) {
 
12062                                                         Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING, 
"Unexpectedly unable to wait for database.", exp);
 
12071                         if (lastException != null) {
 
12072                                 throw lastException;
 
12093                 private final CaseDbConnection connection;
 
12097                         this.connection = connection;
 
12098                         this.sleuthkitCase = sleuthkitCase;
 
12100                                 this.connection.beginTransaction();
 
12101                         } 
catch (SQLException ex) {
 
12102                                 throw new TskCoreException(
"Failed to create transaction on case database", ex);
 
12114                 CaseDbConnection getConnection() {
 
12115                         return this.connection;
 
12126                                 this.connection.commitTransaction();
 
12127                         } 
catch (SQLException ex) {
 
12128                                 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
 
12142                                 this.connection.rollbackTransactionWithThrow();
 
12143                         } 
catch (SQLException ex) {
 
12144                                 throw new TskCoreException(
"Case database transaction rollback failed", ex);
 
12155                         this.connection.close();
 
12171                 private ResultSet resultSet;
 
12172                 private CaseDbConnection connection;
 
12174                 private CaseDbQuery(String query) 
throws TskCoreException {
 
12175                         this(query, 
false);
 
12178                 private CaseDbQuery(String query, 
boolean allowWriteQuery) 
throws TskCoreException {
 
12179                         if (!allowWriteQuery) {
 
12180                                 if (!query.regionMatches(
true, 0, 
"SELECT", 0, 
"SELECT".length())) {
 
12181                                         throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
 
12185                                 connection = connections.getConnection();
 
12186                         } 
catch (TskCoreException ex) {
 
12187                                 throw new TskCoreException(
"Error getting connection for query: ", ex);
 
12192                                 resultSet = connection.executeQuery(connection.createStatement(), query);
 
12193                         } 
catch (SQLException ex) {
 
12195                                 throw new TskCoreException(
"Error executing query: ", ex);
 
12209                 public void close() throws TskCoreException {
 
12211                                 if (resultSet != null) {
 
12212                                         final Statement statement = resultSet.getStatement();
 
12213                                         if (statement != null) {
 
12218                                 connection.close();
 
12219                         } 
catch (SQLException ex) {
 
12220                                 throw new TskCoreException(
"Error closing query: ", ex);
 
12236                 sleuthkitCaseErrorObservers.add(observer);
 
12248                 int i = sleuthkitCaseErrorObservers.indexOf(observer);
 
12250                         sleuthkitCaseErrorObservers.remove(i);
 
12264                 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
 
12265                         if (observer != null) {
 
12267                                         observer.receiveError(context, errorMessage);
 
12268                                 } 
catch (Exception ex) {
 
12269                                         logger.log(Level.SEVERE, 
"Observer client unable to receive message: {0}, {1}", 
new Object[]{context, errorMessage, ex});
 
12301                         private final String contextString;
 
12303                         private Context(String context) {
 
12304                                 this.contextString = context;
 
12308                                 return contextString;
 
12312                 void receiveError(String context, String errorMessage);
 
12326         long getDataSourceObjectId(
long objectId) {
 
12328                         CaseDbConnection connection = connections.getConnection();
 
12330                                 return getDataSourceObjectId(connection, objectId);
 
12332                                 connection.close();
 
12334                 } 
catch (TskCoreException ex) {
 
12335                         logger.log(Level.SEVERE, 
"Error getting data source object id for a file", ex);
 
12351                 CaseDbConnection connection = connections.getConnection();
 
12353                 ResultSet rs = null;
 
12356                         PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID);
 
12357                         rs = connection.executeQuery(statement);
 
12360                                 id = rs.getLong(
"max_obj_id");
 
12363                 } 
catch (SQLException e) {
 
12364                         throw new TskCoreException(
"Error getting last object id", e);
 
12366                         closeResultSet(rs);
 
12367                         connection.close();
 
12387                 CaseDbConnection connection = connections.getConnection();
 
12389                 Statement s = null;
 
12390                 ResultSet rs = null;
 
12392                         s = connection.createStatement();
 
12393                         rs = connection.executeQuery(s, 
"SELECT * FROM tsk_files WHERE " + sqlWhereClause); 
 
12394                         List<FsContent> results = 
new ArrayList<FsContent>();
 
12395                         List<AbstractFile> temp = resultSetToAbstractFiles(rs, connection);
 
12403                 } 
catch (SQLException e) {
 
12404                         throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
 
12406                         closeResultSet(rs);
 
12408                         connection.close();
 
12426                 CaseDbConnection connection = connections.getConnection();
 
12428                 Statement s = null;
 
12429                 ResultSet rs = null;
 
12431                         s = connection.createStatement();
 
12432                         rs = connection.executeQuery(s, 
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName + 
"'"); 
 
12435                                 typeId = rs.getInt(
"artifact_type_id");
 
12438                 } 
catch (SQLException ex) {
 
12439                         throw new TskCoreException(
"Error getting artifact type id", ex);
 
12441                         closeResultSet(rs);
 
12443                         connection.close();
 
12476         public int addArtifactType(String artifactTypeName, String displayName) 
throws TskCoreException {
 
12479                 } 
catch (TskDataException ex) {
 
12480                         throw new TskCoreException(
"Failed to add artifact type.", ex);
 
12498         public int addAttrType(String attrTypeString, String displayName) 
throws TskCoreException {
 
12501                 } 
catch (TskDataException ex) {
 
12502                         throw new TskCoreException(
"Couldn't add new attribute type");
 
12518                 CaseDbConnection connection = connections.getConnection();
 
12520                 Statement s = null;
 
12521                 ResultSet rs = null;
 
12523                         s = connection.createStatement();
 
12524                         rs = connection.executeQuery(s, 
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName + 
"'"); 
 
12527                                 typeId = rs.getInt(
"attribute_type_id");
 
12530                 } 
catch (SQLException ex) {
 
12531                         throw new TskCoreException(
"Error getting attribute type id", ex);
 
12533                         closeResultSet(rs);
 
12535                         connection.close();
 
12554                 CaseDbConnection connection = connections.getConnection();
 
12556                 Statement s = null;
 
12557                 ResultSet rs = null;
 
12559                         s = connection.createStatement();
 
12560                         rs = connection.executeQuery(s, 
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID); 
 
12562                                 return rs.getString(
"type_name");
 
12564                                 throw new TskCoreException(
"No type with that id");
 
12566                 } 
catch (SQLException ex) {
 
12567                         throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
 
12569                         closeResultSet(rs);
 
12571                         connection.close();
 
12590                 CaseDbConnection connection = connections.getConnection();
 
12592                 Statement s = null;
 
12593                 ResultSet rs = null;
 
12595                         s = connection.createStatement();
 
12596                         rs = connection.executeQuery(s, 
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID); 
 
12598                                 return rs.getString(
"display_name");
 
12600                                 throw new TskCoreException(
"No type with that id");
 
12602                 } 
catch (SQLException ex) {
 
12603                         throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
 
12605                         closeResultSet(rs);
 
12607                         connection.close();
 
12642         public ResultSet 
runQuery(String query) 
throws SQLException {
 
12643                 CaseDbConnection connection;
 
12645                         connection = connections.getConnection();
 
12646                 } 
catch (TskCoreException ex) {
 
12647                         throw new SQLException(
"Error getting connection for ad hoc query", ex);
 
12651                         return connection.executeQuery(connection.createStatement(), query);
 
12655                         connection.close();
 
12671                 final Statement statement = resultSet.getStatement();
 
12673                 if (statement != null) {
 
12695         public LayoutFile addCarvedFile(String carvedFileName, 
long carvedFileSize, 
long containerId, List<TskFileRange> data) 
throws TskCoreException {
 
12698                 files.add(carvedFile);
 
12702                                 || parent instanceof 
Volume 
12703                                 || parent instanceof 
Image) {
 
12706                         throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
 
12725         public List<LayoutFile> 
addCarvedFiles(List<CarvedFileContainer> filesToAdd) 
throws TskCoreException {
 
12729                         carvedFiles.add(carvedFile);
 
12734                                 || parent instanceof 
Volume 
12735                                 || parent instanceof 
Image) {
 
12738                         throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
 
12774                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
12776                         String rederiveDetails, String toolName, String toolVersion, String otherDetails) 
throws TskCoreException {
 
12777                 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
 
12778                                 isFile, parentFile, rederiveDetails, toolName, toolVersion,
 
12808                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
12811                 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
 
12836                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime,
 
12839                 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
 
12861                 return this.caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans, 
"", 
this);
 
12878                 } 
catch (TskCoreException ex) {
 
12879                         logger.log(Level.SEVERE, 
"Error loading all file systems for image with ID {0}", image.
getId());
 
12880                         return new ArrayList<>();
 
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
 
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
 
static ARTIFACT_TYPE fromID(int id)
 
FS
File that can be found in file system tree. 
 
static FileKnown valueOf(byte known)
 
BlackboardArtifact getArtifactByArtifactId(long id)
 
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
 
BlackboardArtifact getArtifactById(long id)
 
List< Report > getAllReports()
 
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
 
long getBlackboardArtifactsCount(long objId)
 
int getArtifactTypeID(String artifactTypeName)
 
synchronized Content getParent()
 
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
 
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
 
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
 
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
 
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
 
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
 
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
 
CommunicationsManager getCommunicationsManager()
 
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
 
CaseDbTransaction beginTransaction()
 
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
 
List< Content > getChildren()
 
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
 
ALLOC
Metadata structure is currently in an allocated state. 
 
int countFilesMd5Hashed()
 
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
 
CaseDbSchemaVersionNumber getDBSchemaCreationVersion()
 
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
 
void addErrorObserver(ErrorObserver observer)
 
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
 
Blackboard getBlackboard()
 
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
 
TSK_FS_META_TYPE_DIR
Directory file NON-NLS. 
 
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
 
synchronized void close()
 
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
 
void setFileMIMEType(AbstractFile file, String mimeType)
 
UNALLOC
Metadata structure is currently in an unallocated state. 
 
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
 
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
 
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
 
int addArtifactType(String artifactTypeName, String displayName)
 
List< DataSource > getDataSources()
 
BlackboardArtifactTagChange addArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
 
synchronized CaseDbAccessManager getCaseDbAccessManager()
 
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
 
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
 
List< AbstractFile > openFiles(Content dataSource, String filePath)
 
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
 
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
 
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
 
Content getContentById(long id)
 
BlackboardArtifactTag getAddedTag()
 
VersionNumber getDBSchemaVersion()
 
static IngestJobStatusType fromID(int typeId)
 
List< TagName > getTagNamesInUse()
 
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
 
LAYOUT_FILE
Set of blocks from an image that have been designated as a file. 
 
static final String NAME_CARVED
 
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
 
static IngestModuleType fromID(int typeId)
 
List< ContentTag > getAllContentTags()
 
long getDataSourceObjectId()
 
List< VirtualDirectory > getVirtualDirectoryRoots()
 
LayoutFile addLayoutFile(String fileName, long size, TSK_FS_NAME_FLAG_ENUM dirFlag, TSK_FS_META_FLAG_ENUM metaFlag, long ctime, long crtime, long atime, long mtime, List< TskFileRange > fileRanges, Content parent)
 
long getBlackboardArtifactTagsCountByTagName(TagName tagName, long dsObjId)
 
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
 
ContentTag getContentTagByID(long contentTagID)
 
LOCAL
Local file that was added (not from a disk image) 
 
Map< Long, List< String > > getImagePaths()
 
List< Long > findAllFileIdsWhere(String sqlWhereClause)
 
synchronized TaggingManager getTaggingManager()
 
BlackboardArtifact getBlackboardArtifact(long artifactID)
 
List< BlackboardArtifact.Type > getArtifactTypesInUse()
 
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
 
AbstractFile getAbstractFileById(long id)
 
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
 
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
 
long countFilesWhere(String sqlWhereClause)
 
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
 
FS
File System - see tsk_fs_info for more details. 
 
Pool addPool(long parentObjId, TskData.TSK_POOL_TYPE_ENUM type, CaseDbTransaction transaction)
 
boolean isFileFromSource(Content dataSource, long fileId)
 
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
 
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
 
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
 
void deleteReport(Report report)
 
List< Image > getImages()
 
int getAttrTypeID(String attrTypeName)
 
Image getImageById(long id)
 
Report addReport(String localPath, String sourceModuleName, String reportName, Content parent)
 
List< Content > getChildren()
 
USED
Metadata structure has been allocated at least once. 
 
void unregisterForEvents(Object listener)
 
LOCAL_DIR
Local directory that was added (not from a disk image) 
 
TimelineManager getTimelineManager()
 
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
 
void releaseSingleUserCaseReadLock()
 
VOL
Volume - see tsk_vs_parts for more details. 
 
void closeRunQuery(ResultSet resultSet)
 
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
 
int addAttrType(String attrTypeString, String displayName)
 
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
 
long getContentTagsCountByTagName(TagName tagName, long dsObjId)
 
List< ContentTag > getContentTagsByTagName(TagName tagName)
 
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
 
static String escapeSingleQuotes(String text)
 
String getAttrTypeDisplayName(int attrTypeID)
 
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
 
List< AbstractFile > findFiles(Content dataSource, String fileName)
 
List< TagName > getAllTagNames()
 
Report getReportById(long id)
 
BlackboardAttribute.Type getAttributeType(String attrTypeName)
 
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
 
static HTML_COLOR getColorByName(String colorName)
 
void acquireSingleUserCaseWriteLock()
 
REPORT
Artifact - see blackboard_artifacts for more details. 
 
List< AbstractFile > findFilesByMd5(String md5Hash)
 
long getBlackboardArtifactsTypeCount(int artifactTypeID, long dataSourceID)
 
BlackboardArtifact.Type getArtifactType(String artTypeName)
 
BlackboardArtifact newBlackboardArtifact(ARTIFACT_TYPE artifactType, long obj_id)
 
void releaseSingleUserCaseWriteLock()
 
DERIVED
File derived from a parent file (i.e. from ZIP) 
 
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
 
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
 
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
 
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
 
Report addReport(String localPath, String sourceModuleName, String reportName)
 
void releaseExclusiveLock()
 
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
 
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
 
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, CaseDbTransaction transaction)
 
void removeErrorObserver(ErrorObserver observer)
 
String getContextString()
 
List< Content > getRootObjects()
 
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirSubString)
 
ContentTagChange addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
 
FileSystem addFileSystem(long parentObjId, long imgOffset, TskData.TSK_FS_TYPE_ENUM type, long blockSize, long blockCount, long rootInum, long firstInum, long lastInum, String displayName, CaseDbTransaction transaction)
 
void acquireExclusiveLock()
 
boolean allFilesMd5Hashed()
 
String getAttrTypeString(int attrTypeID)
 
int getBlackboardAttributeTypesCount()
 
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
 
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
 
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
 
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
 
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
 
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
 
long getBlackboardArtifactsTypeCount(int artifactTypeID)
 
List< ContentTag > getContentTagsByTagName(TagName tagName, long dsObjId)
 
void deleteContentTag(ContentTag tag)
 
static ObjectType valueOf(short objectType)
 
long getContentTagsCountByTagName(TagName tagName)
 
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parent)
 
Collection< FileSystem > getImageFileSystems(Image image)
 
void updateImagePath(String newPath, long objectId)
 
VolumeSystem addVolumeSystem(long parentObjId, TskData.TSK_VS_TYPE_ENUM type, long imgOffset, long blockSize, CaseDbTransaction transaction)
 
Examiner getCurrentExaminer()
 
UNKNOWN
File marked as unknown by hash db. 
 
List< TagName > getTagNamesInUse(long dsObjId)
 
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
 
boolean setKnown(AbstractFile file, FileKnown fileKnown)
 
static void tryConnect(CaseDbConnectionInfo info)
 
static SleuthkitCase openCase(String dbPath)
 
CaseDbQuery executeInsertOrUpdate(String query)
 
static String createNonUniquePath(String uniquePath)
 
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName, long dsObjId)
 
Volume addVolume(long parentObjId, long addr, long start, long length, String desc, long flags, CaseDbTransaction transaction)
 
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
 
void submitError(String context, String errorMessage)
 
final List< IngestJobInfo > getIngestJobs()
 
ALLOC
Name is in an allocated state. 
 
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
 
static SleuthkitCase newCase(String dbPath)
 
String getBackupDatabasePath()
 
void acquireSingleUserCaseReadLock()
 
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
 
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
 
List< ContentTag > getContentTagsByContent(Content content)
 
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
 
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
 
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
 
ABSTRACTFILE
File - see tsk_files for more details. 
 
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
 
DataSource getDataSource(long objectId)
 
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
 
TSK_FS_META_TYPE_REG
Regular file NON-NLS. 
 
Iterable< BlackboardArtifact.Type > getArtifactTypes()
 
List< BlackboardAttribute.Type > getAttributeTypes()
 
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
 
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
 
List< FsContent > findFilesWhere(String sqlWhereClause)
 
static ReviewStatus withID(int id)
 
void copyCaseDB(String newDBPath)
 
ResultSet runQuery(String query)
 
List< TskFileRange > getFileRanges(long id)
 
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
 
void registerForEvents(Object listener)
 
CaseDbQuery executeQuery(String query)
 
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
 
void setImagePaths(long obj_id, List< String > paths)
 
VS
Volume System - see tsk_vs_info for more details. 
 
IMG
Disk Image - see tsk_image_info for more details. 
 
UNALLOC
Name is in an unallocated state. 
 
Collection< FileSystem > getFileSystems(Image image)
 
LocalDirectory addLocalDirectory(long parentId, String directoryName)