19 package org.sleuthkit.datamodel;
21 import com.google.common.collect.ImmutableSet;
22 import com.google.common.eventbus.EventBus;
23 import com.mchange.v2.c3p0.ComboPooledDataSource;
24 import com.mchange.v2.c3p0.DataSources;
25 import com.mchange.v2.c3p0.PooledDataSource;
26 import com.zaxxer.sparsebits.SparseBitSet;
27 import java.beans.PropertyVetoException;
28 import java.io.BufferedInputStream;
29 import java.io.BufferedOutputStream;
31 import java.io.FileInputStream;
32 import java.io.FileOutputStream;
33 import java.io.IOException;
34 import java.io.InputStream;
35 import java.io.OutputStream;
36 import java.io.UnsupportedEncodingException;
37 import java.net.InetAddress;
38 import java.net.URLEncoder;
39 import java.nio.charset.StandardCharsets;
40 import java.nio.file.Paths;
41 import java.sql.Connection;
42 import java.sql.DriverManager;
43 import java.sql.PreparedStatement;
44 import java.sql.ResultSet;
45 import java.sql.SQLException;
46 import java.sql.Statement;
47 import java.text.SimpleDateFormat;
48 import java.util.ArrayList;
49 import java.util.Arrays;
50 import java.util.Collection;
51 import java.util.Collections;
52 import java.util.Date;
53 import java.util.EnumMap;
54 import java.util.HashMap;
55 import java.util.HashSet;
56 import java.util.LinkedHashMap;
57 import java.util.List;
59 import java.util.MissingResourceException;
60 import java.util.ResourceBundle;
62 import java.util.UUID;
63 import java.util.concurrent.ConcurrentHashMap;
64 import java.util.concurrent.locks.ReentrantReadWriteLock;
65 import java.util.logging.Level;
66 import java.util.logging.Logger;
67 import org.postgresql.util.PSQLState;
83 import org.sqlite.SQLiteConfig;
84 import org.sqlite.SQLiteDataSource;
85 import org.sqlite.SQLiteJDBCLoader;
93 private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
102 private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE;
103 private static final Logger logger = Logger.getLogger(
SleuthkitCase.class.getName());
104 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
105 private static final int IS_REACHABLE_TIMEOUT_MS = 1000;
106 private static final String SQL_ERROR_CONNECTION_GROUP =
"08";
107 private static final String SQL_ERROR_AUTHENTICATION_GROUP =
"28";
108 private static final String SQL_ERROR_PRIVILEGE_GROUP =
"42";
109 private static final String SQL_ERROR_RESOURCE_GROUP =
"53";
110 private static final String SQL_ERROR_LIMIT_GROUP =
"54";
111 private static final String SQL_ERROR_INTERNAL_GROUP =
"xx";
112 private static final int MIN_USER_DEFINED_TYPE_ID = 10000;
114 private static final Set<String> CORE_TABLE_NAMES = ImmutableSet.of(
116 "tsk_event_descriptions",
129 "tsk_files_derived_method",
132 "blackboard_artifact_tags",
133 "blackboard_artifacts",
134 "blackboard_attributes",
135 "blackboard_artifact_types",
136 "blackboard_attribute_types",
138 "file_encoding_types",
139 "ingest_module_types",
140 "ingest_job_status_types",
143 "ingest_job_modules",
146 "account_relationships",
150 private static final Set<String> CORE_INDEX_NAMES = ImmutableSet.of(
154 "artifact_artifact_objID",
159 "relationships_account1",
160 "relationships_account2",
161 "relationships_relationship_source_obj_id",
162 "relationships_date_time",
163 "relationships_relationship_type",
164 "relationships_data_source_obj_id",
167 "events_data_source_obj_id",
168 "events_file_obj_id",
169 "events_artifact_id");
171 private static final String TSK_VERSION_KEY =
"TSK_VER";
172 private static final String SCHEMA_MAJOR_VERSION_KEY =
"SCHEMA_MAJOR_VERSION";
173 private static final String SCHEMA_MINOR_VERSION_KEY =
"SCHEMA_MINOR_VERSION";
174 private static final String CREATION_SCHEMA_MAJOR_VERSION_KEY =
"CREATION_SCHEMA_MAJOR_VERSION";
175 private static final String CREATION_SCHEMA_MINOR_VERSION_KEY =
"CREATION_SCHEMA_MINOR_VERSION";
177 private final ConnectionPool connections;
178 private final Map<Long, VirtualDirectory> rootIdsToCarvedFileDirs =
new HashMap<>();
179 private final Map<Long, FileSystem> fileSystemIdMap =
new HashMap<>();
180 private final List<ErrorObserver> sleuthkitCaseErrorObservers =
new ArrayList<>();
181 private final String databaseName;
182 private final String dbPath;
183 private final DbType dbType;
184 private final String caseDirPath;
186 private String dbBackupPath;
197 private final Map<Long, SparseBitSet> hasChildrenBitSetMap =
new HashMap<>();
199 private long nextArtifactId;
204 private final ReentrantReadWriteLock rwLock =
new ReentrantReadWriteLock(
true);
212 private final Map<String, Set<Long>> deviceIdToDatasourceObjIdMap =
new HashMap<>();
214 private final EventBus eventBus =
new EventBus(
"SleuthkitCase-EventBus");
217 eventBus.register(listener);
221 eventBus.unregister(listener);
224 void fireTSKEvent(Object event) {
225 eventBus.post(event);
229 private final Map<Long, Content> frequentlyUsedContentMap =
new HashMap<>();
231 private Examiner cachedCurrentExaminer = null;
249 if (info.getHost() == null || info.getHost().isEmpty()) {
250 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
251 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
252 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
253 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
254 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
255 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
256 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
260 Class.forName(
"org.postgresql.Driver");
261 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
265 }
catch (SQLException ex) {
267 String sqlState = ex.getSQLState().toLowerCase();
268 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
270 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
272 result = bundle.getString(
"DatabaseConnectionCheck.Port");
274 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
276 }
catch (IOException | MissingResourceException any) {
278 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
280 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
281 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
282 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
283 result = bundle.getString(
"DatabaseConnectionCheck.Access");
284 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
285 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
286 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
287 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
288 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
289 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
291 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
294 }
catch (ClassNotFoundException ex) {
295 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
311 Class.forName(
"org.sqlite.JDBC");
312 this.dbPath = dbPath;
313 this.dbType = dbType;
315 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
316 this.databaseName = dbFile.
getName();
317 this.connections =
new SQLiteConnections(dbPath);
318 this.caseHandle = caseHandle;
320 logSQLiteJDBCDriverInfo();
340 private SleuthkitCase(String host,
int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType)
throws Exception {
342 this.databaseName = dbName;
343 this.dbType = dbType;
344 this.caseDirPath = caseDirPath;
345 this.connections =
new PostgreSQLConnections(host, port, dbName, userName, password);
346 this.caseHandle = caseHandle;
350 private void init() throws Exception {
351 typeIdToArtifactTypeMap =
new ConcurrentHashMap<>();
352 typeIdToAttributeTypeMap =
new ConcurrentHashMap<>();
353 typeNameToArtifactTypeMap =
new ConcurrentHashMap<>();
354 typeNameToAttributeTypeMap =
new ConcurrentHashMap<>();
360 initBlackboardArtifactTypes();
361 initBlackboardAttributeTypes();
362 initNextArtifactId();
363 updateDatabaseSchema(null);
365 try (CaseDbConnection connection = connections.getConnection()) {
366 initIngestModuleTypes(connection);
367 initIngestStatusTypes(connection);
368 initReviewStatuses(connection);
369 initEncodingTypes(connection);
370 populateHasChildrenMap(connection);
371 updateExaminers(connection);
372 initDBSchemaCreationVersion(connection);
375 blackboard =
new Blackboard(
this);
376 communicationsMgr =
new CommunicationsManager(
this);
377 timelineMgr =
new TimelineManager(
this);
378 dbAccessManager =
new CaseDbAccessManager(
this);
379 taggingMgr =
new TaggingManager(
this);
387 static Set<String> getCoreTableNames() {
388 return CORE_TABLE_NAMES;
396 static Set<String> getCoreIndexNames() {
397 return CORE_INDEX_NAMES;
408 boolean getHasChildren(Content content) {
409 long objId = content.getId();
410 long mapIndex = objId / Integer.MAX_VALUE;
411 int mapValue = (int) (objId % Integer.MAX_VALUE);
413 synchronized (hasChildrenBitSetMap) {
414 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
415 return hasChildrenBitSetMap.get(mapIndex).get(mapValue);
426 private void setHasChildren(Long objId) {
427 long mapIndex = objId / Integer.MAX_VALUE;
428 int mapValue = (int) (objId % Integer.MAX_VALUE);
430 synchronized (hasChildrenBitSetMap) {
431 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
432 hasChildrenBitSetMap.get(mapIndex).set(mapValue);
434 SparseBitSet bitSet =
new SparseBitSet();
435 bitSet.set(mapValue);
436 hasChildrenBitSetMap.put(mapIndex, bitSet);
449 return communicationsMgr;
480 return dbAccessManager;
498 private void initBlackboardArtifactTypes() throws SQLException,
TskCoreException {
499 CaseDbConnection connection = connections.getConnection();
500 Statement statement = null;
501 ResultSet resultSet = null;
504 statement = connection.createStatement();
507 statement.execute(
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES (" + type.getTypeID() +
" , '" + type.getLabel() +
"', '" + type.getDisplayName() +
"')");
508 }
catch (SQLException ex) {
509 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_artifact_types WHERE artifact_type_id = '" + type.getTypeID() +
"'");
511 if (resultSet.getLong(
"count") == 0) {
517 this.typeIdToArtifactTypeMap.put(type.getTypeID(),
new BlackboardArtifact.Type(type));
518 this.typeNameToArtifactTypeMap.put(type.getLabel(),
new BlackboardArtifact.Type(type));
521 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ARTIFACT_TYPE.values())).getTypeID() + 1;
522 statement.execute(
"ALTER SEQUENCE blackboard_artifact_types_artifact_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
525 closeResultSet(resultSet);
526 closeStatement(statement);
539 private void initBlackboardAttributeTypes() throws SQLException, TskCoreException {
540 CaseDbConnection connection = connections.getConnection();
541 Statement statement = null;
542 ResultSet resultSet = null;
545 statement = connection.createStatement();
546 for (ATTRIBUTE_TYPE type : ATTRIBUTE_TYPE.values()) {
548 statement.execute(
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES (" + type.getTypeID() +
", '" + type.getLabel() +
"', '" + type.getDisplayName() +
"', '" + type.getValueType().getType() +
"')");
549 }
catch (SQLException ex) {
550 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types WHERE attribute_type_id = '" + type.getTypeID() +
"'");
552 if (resultSet.getLong(
"count") == 0) {
558 this.typeIdToAttributeTypeMap.put(type.getTypeID(),
new BlackboardAttribute.Type(type));
559 this.typeNameToAttributeTypeMap.put(type.getLabel(),
new BlackboardAttribute.Type(type));
562 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ATTRIBUTE_TYPE.values())).getTypeID() + 1;
563 statement.execute(
"ALTER SEQUENCE blackboard_attribute_types_attribute_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
566 closeResultSet(resultSet);
567 closeStatement(statement);
582 private void initNextArtifactId() throws SQLException, TskCoreException {
583 CaseDbConnection connection = connections.getConnection();
584 Statement statement = null;
585 ResultSet resultSet = null;
588 statement = connection.createStatement();
589 resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
591 this.nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
592 if (this.nextArtifactId == 1) {
593 this.nextArtifactId = BASE_ARTIFACT_ID;
596 closeResultSet(resultSet);
597 closeStatement(statement);
610 private void initIngestModuleTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
611 Statement statement = null;
612 ResultSet resultSet = null;
615 statement = connection.createStatement();
616 for (IngestModuleType type : IngestModuleType.values()) {
618 statement.execute(
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
619 }
catch (SQLException ex) {
620 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
622 if (resultSet.getLong(
"count") == 0) {
630 closeResultSet(resultSet);
631 closeStatement(statement);
643 private void initIngestStatusTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
644 Statement statement = null;
645 ResultSet resultSet = null;
648 statement = connection.createStatement();
649 for (IngestJobStatusType type : IngestJobStatusType.values()) {
651 statement.execute(
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
652 }
catch (SQLException ex) {
653 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
655 if (resultSet.getLong(
"count") == 0) {
663 closeResultSet(resultSet);
664 closeStatement(statement);
675 private void initReviewStatuses(CaseDbConnection connection)
throws SQLException, TskCoreException {
676 Statement statement = null;
677 ResultSet resultSet = null;
680 statement = connection.createStatement();
681 for (BlackboardArtifact.ReviewStatus status : BlackboardArtifact.ReviewStatus.values()) {
683 statement.execute(
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
684 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')");
685 }
catch (SQLException ex) {
686 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
688 if (resultSet.getLong(
"count") == 0) {
696 closeResultSet(resultSet);
697 closeStatement(statement);
709 private void initEncodingTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
710 Statement statement = null;
711 ResultSet resultSet = null;
714 statement = connection.createStatement();
715 for (TskData.EncodingType type : TskData.EncodingType.values()) {
717 statement.execute(
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')");
718 }
catch (SQLException ex) {
719 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
721 if (resultSet.getLong(
"count") == 0) {
729 closeResultSet(resultSet);
730 closeStatement(statement);
743 private void updateExaminers(CaseDbConnection connection)
throws SQLException, TskCoreException {
745 String loginName = System.getProperty(
"user.name");
746 if (loginName.isEmpty()) {
747 logger.log(Level.SEVERE,
"Cannot determine logged in user name");
753 PreparedStatement statement;
756 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_POSTGRESQL);
759 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_SQLITE);
762 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
764 statement.clearParameters();
765 statement.setString(1, loginName);
766 connection.executeUpdate(statement);
767 }
catch (SQLException ex) {
768 throw new TskCoreException(
"Error inserting row in tsk_examiners. login name: " + loginName, ex);
781 private void populateHasChildrenMap(CaseDbConnection connection)
throws TskCoreException {
782 long timestamp = System.currentTimeMillis();
784 Statement statement = null;
785 ResultSet resultSet = null;
788 statement = connection.createStatement();
789 resultSet = statement.executeQuery(
"select distinct par_obj_id from tsk_objects");
791 synchronized (hasChildrenBitSetMap) {
792 while (resultSet.next()) {
793 setHasChildren(resultSet.getLong(
"par_obj_id"));
796 long delay = System.currentTimeMillis() - timestamp;
797 logger.log(Level.INFO,
"Time to initialize parent node cache: {0} ms", delay);
798 }
catch (SQLException ex) {
799 throw new TskCoreException(
"Error populating parent node cache", ex);
801 closeResultSet(resultSet);
802 closeStatement(statement);
813 void addDataSourceToHasChildrenMap() throws TskCoreException {
815 CaseDbConnection connection = connections.getConnection();
817 populateHasChildrenMap(connection);
819 if (connection != null) {
834 private void updateDatabaseSchema(String dbPath)
throws Exception {
835 CaseDbConnection connection = connections.getConnection();
836 ResultSet resultSet = null;
837 Statement statement = null;
840 connection.beginTransaction();
842 boolean hasMinorVersion =
false;
843 ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null,
"tsk_db_info",
"schema%");
844 while (columns.next()) {
845 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
846 hasMinorVersion =
true;
851 int dbSchemaMajorVersion;
852 int dbSchemaMinorVersion = 0;
854 statement = connection.createStatement();
855 resultSet = connection.executeQuery(statement,
"SELECT schema_ver"
856 + (hasMinorVersion ?
", schema_minor_ver" :
"")
857 +
" FROM tsk_db_info");
858 if (resultSet.next()) {
859 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver");
860 if (hasMinorVersion) {
862 dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver");
865 throw new TskCoreException();
867 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(dbSchemaMajorVersion, dbSchemaMinorVersion);
874 if (
false == CURRENT_DB_SCHEMA_VERSION.
isCompatible(dbSchemaVersion)) {
876 throw new TskUnsupportedSchemaVersionException(
877 "Unsupported DB schema version " + dbSchemaVersion +
", the highest supported schema version is " + CURRENT_DB_SCHEMA_VERSION.
getMajor() +
".X");
878 }
else if (dbSchemaVersion.compareTo(CURRENT_DB_SCHEMA_VERSION) < 0) {
881 if (null != dbPath) {
884 String backupFilePath = dbPath +
".schemaVer" + dbSchemaVersion.toString() +
".backup";
886 dbBackupPath = backupFilePath;
893 dbSchemaVersion = updateFromSchema2toSchema3(dbSchemaVersion, connection);
894 dbSchemaVersion = updateFromSchema3toSchema4(dbSchemaVersion, connection);
895 dbSchemaVersion = updateFromSchema4toSchema5(dbSchemaVersion, connection);
896 dbSchemaVersion = updateFromSchema5toSchema6(dbSchemaVersion, connection);
897 dbSchemaVersion = updateFromSchema6toSchema7(dbSchemaVersion, connection);
898 dbSchemaVersion = updateFromSchema7toSchema7dot1(dbSchemaVersion, connection);
899 dbSchemaVersion = updateFromSchema7dot1toSchema7dot2(dbSchemaVersion, connection);
900 dbSchemaVersion = updateFromSchema7dot2toSchema8dot0(dbSchemaVersion, connection);
901 dbSchemaVersion = updateFromSchema8dot0toSchema8dot1(dbSchemaVersion, connection);
902 dbSchemaVersion = updateFromSchema8dot1toSchema8dot2(dbSchemaVersion, connection);
903 dbSchemaVersion = updateFromSchema8dot2toSchema8dot3(dbSchemaVersion, connection);
904 dbSchemaVersion = updateFromSchema8dot3toSchema8dot4(dbSchemaVersion, connection);
905 dbSchemaVersion = updateFromSchema8dot4toSchema8dot5(dbSchemaVersion, connection);
906 statement = connection.createStatement();
907 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.getMajor() +
", schema_minor_ver = " + dbSchemaVersion.getMinor());
908 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMajor() +
" WHERE name = '" + SCHEMA_MAJOR_VERSION_KEY +
"'");
909 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMinor() +
" WHERE name = '" + SCHEMA_MINOR_VERSION_KEY +
"'");
914 connection.commitTransaction();
915 }
catch (Exception ex) {
916 connection.rollbackTransaction();
919 closeResultSet(resultSet);
920 closeStatement(statement);
933 private void initDBSchemaCreationVersion(CaseDbConnection connection)
throws SQLException {
935 Statement statement = null;
936 ResultSet resultSet = null;
937 String createdSchemaMajorVersion =
"0";
938 String createdSchemaMinorVersion =
"0";
941 statement = connection.createStatement();
942 resultSet = connection.executeQuery(statement,
"SELECT name, value FROM tsk_db_info_extended");
943 while (resultSet.next()) {
944 String name = resultSet.getString(
"name");
945 if (name.equals(CREATION_SCHEMA_MAJOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MAJOR_VERSION")) {
946 createdSchemaMajorVersion = resultSet.getString(
"value");
947 }
else if (name.equals(CREATION_SCHEMA_MINOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MINOR_VERSION")) {
948 createdSchemaMinorVersion = resultSet.getString(
"value");
953 closeResultSet(resultSet);
954 closeStatement(statement);
958 caseDBSchemaCreationVersion =
new CaseDbSchemaVersionNumber(Integer.parseInt(createdSchemaMajorVersion), Integer.parseInt(createdSchemaMinorVersion));
970 public void copyCaseDB(String newDBPath)
throws IOException {
971 if (dbPath.isEmpty()) {
972 throw new IOException(
"Copying case database files is not supported for this type of case database");
974 InputStream in = null;
975 OutputStream out = null;
978 InputStream inFile =
new FileInputStream(dbPath);
979 in =
new BufferedInputStream(inFile);
980 OutputStream outFile =
new FileOutputStream(newDBPath);
981 out =
new BufferedOutputStream(outFile);
982 int bytesRead = in.read();
983 while (bytesRead != -1) {
984 out.write(bytesRead);
985 bytesRead = in.read();
996 }
catch (IOException e) {
997 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
1006 private void logSQLiteJDBCDriverInfo() {
1008 SleuthkitCase.logger.info(String.format(
"sqlite-jdbc version %s loaded in %s mode",
1009 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
1010 ?
"native" :
"pure-java"));
1011 }
catch (Exception ex) {
1012 SleuthkitCase.logger.log(Level.SEVERE,
"Error querying case database mode", ex);
1029 @SuppressWarnings(
"deprecation")
1030 private CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
1031 if (schemaVersion.getMajor() != 2) {
1032 return schemaVersion;
1034 Statement statement = null;
1035 Statement updateStatement = null;
1036 ResultSet resultSet = null;
1039 statement = connection.createStatement();
1042 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
1043 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
1044 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
1047 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
1050 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
1051 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
1052 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
1055 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
1058 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
1063 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
1064 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
1065 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
1066 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
1067 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
1068 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
1069 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
1070 +
"arts.artifact_type_id AS artifact_type_id "
1071 +
"FROM blackboard_attributes AS attrs "
1072 +
"INNER JOIN blackboard_artifacts AS arts "
1073 +
"WHERE attrs.artifact_id = arts.artifact_id;");
1074 updateStatement = connection.createStatement();
1075 while (resultSet.next()) {
1076 long artifactId = resultSet.getLong(
"artifact_id");
1077 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
1078 updateStatement.executeUpdate(
1079 "UPDATE blackboard_attributes "
1080 +
"SET artifact_type_id = " + artifactTypeId
1081 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
1090 HashMap<String, TagName> tagNames =
new HashMap<String, TagName>();
1094 String comment =
"";
1096 for (BlackboardAttribute attribute : attributes) {
1097 if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
1098 name = attribute.getValueString();
1099 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
1100 comment = attribute.getValueString();
1103 if (!name.isEmpty()) {
1105 if (tagNames.containsKey(name)) {
1106 tagName = tagNames.get(name);
1108 tagName =
addTagName(name,
"", TagName.HTML_COLOR.NONE);
1109 tagNames.put(name, tagName);
1111 addContentTag(content, tagName, comment, 0, content.getSize() - 1);
1115 long taggedArtifactId = -1;
1117 String comment =
"";
1119 for (BlackboardAttribute attribute : attributes) {
1120 if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()) {
1121 name = attribute.getValueString();
1122 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID()) {
1123 comment = attribute.getValueString();
1124 }
else if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()) {
1125 taggedArtifactId = attribute.getValueLong();
1128 if (taggedArtifactId != -1 && !name.isEmpty()) {
1130 if (tagNames.containsKey(name)) {
1131 tagName = tagNames.get(name);
1133 tagName =
addTagName(name,
"", TagName.HTML_COLOR.NONE);
1134 tagNames.put(name, tagName);
1140 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
1141 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
1142 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1143 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
");");
1145 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
1146 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1147 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
";");
1149 return new CaseDbSchemaVersionNumber(3, 0);
1151 closeStatement(updateStatement);
1152 closeResultSet(resultSet);
1153 closeStatement(statement);
1172 private CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1173 if (schemaVersion.getMajor() != 3) {
1174 return schemaVersion;
1177 Statement statement = null;
1178 ResultSet resultSet = null;
1179 Statement queryStatement = null;
1180 ResultSet queryResultSet = null;
1181 Statement updateStatement = null;
1186 statement = connection.createStatement();
1187 updateStatement = connection.createStatement();
1188 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
1189 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
1190 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
1191 +
"WHERE files.obj_id = arts.obj_id AND "
1192 +
"arts.artifact_id = attrs.artifact_id AND "
1193 +
"arts.artifact_type_id = 1 AND "
1194 +
"attrs.attribute_type_id = 62");
1195 while (resultSet.next()) {
1196 updateStatement.executeUpdate(
1198 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
1199 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
1204 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
1205 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
1206 while (resultSet.next()) {
1207 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
1208 String attributeLabel = resultSet.getString(
"type_name");
1209 if (attributeTypeId < MIN_USER_DEFINED_TYPE_ID) {
1210 updateStatement.executeUpdate(
1211 "UPDATE blackboard_attribute_types "
1212 +
"SET value_type = " + ATTRIBUTE_TYPE.fromLabel(attributeLabel).getValueType().getType() +
" "
1213 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
1219 queryStatement = connection.createStatement();
1220 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
1221 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
1222 while (resultSet.next()) {
1223 long objectId = resultSet.getLong(
"obj_id");
1224 String timeZone =
"";
1225 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
1226 if (queryResultSet.next()) {
1227 timeZone = queryResultSet.getString(
"tzone");
1229 queryResultSet.close();
1230 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
1231 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
1245 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
1246 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
1247 while (resultSet.next()) {
1248 long fileId = resultSet.getLong(
"obj_id");
1249 long dataSourceId = getDataSourceObjectId(connection, fileId);
1250 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
1253 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1254 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1255 if (this.dbType.equals(DbType.SQLITE)) {
1256 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1257 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1259 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1260 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1263 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
1264 initIngestModuleTypes(connection);
1265 initIngestStatusTypes(connection);
1267 return new CaseDbSchemaVersionNumber(4, 0);
1270 closeResultSet(queryResultSet);
1271 closeStatement(queryStatement);
1272 closeStatement(updateStatement);
1273 closeResultSet(resultSet);
1274 closeStatement(statement);
1292 private CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1293 if (schemaVersion.getMajor() != 4) {
1294 return schemaVersion;
1297 Statement statement = null;
1301 statement = connection.createStatement();
1302 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1312 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1315 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
1316 initEncodingTypes(connection);
1323 initReviewStatuses(connection);
1328 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
1330 return new CaseDbSchemaVersionNumber(5, 0);
1333 closeStatement(statement);
1351 private CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1352 if (schemaVersion.getMajor() != 5) {
1353 return schemaVersion;
1360 Statement statement = null;
1361 ResultSet resultSet = null;
1367 statement = connection.createStatement();
1368 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1370 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
1372 if (resultSet.getLong(
"count") == 0) {
1381 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1384 return new CaseDbSchemaVersionNumber(6, 0);
1387 closeResultSet(resultSet);
1388 closeStatement(statement);
1406 private CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1407 if (schemaVersion.getMajor() != 6) {
1408 return schemaVersion;
1414 Statement statement = null;
1415 Statement updstatement = null;
1416 ResultSet resultSet = null;
1419 statement = connection.createStatement();
1420 updstatement = connection.createStatement();
1421 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
1423 resultSet = connection.executeQuery(statement,
"SELECT obj_id,name FROM tsk_files");
1424 while (resultSet.next()) {
1425 long objID = resultSet.getLong(
"obj_id");
1426 String name = resultSet.getString(
"name");
1427 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" +
escapeSingleQuotes(extractExtension(name)) +
"' "
1428 +
"WHERE obj_id = " + objID);
1431 statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
1434 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
1436 return new CaseDbSchemaVersionNumber(7, 0);
1439 closeResultSet(resultSet);
1440 closeStatement(statement);
1441 closeStatement(updstatement);
1459 private CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1460 if (schemaVersion.getMajor() != 7) {
1461 return schemaVersion;
1464 if (schemaVersion.getMinor() != 0) {
1465 return schemaVersion;
1471 Statement statement = null;
1472 ResultSet resultSet = null;
1475 statement = connection.createStatement();
1478 if (schemaVersion.getMinor() == 0) {
1480 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
1482 return new CaseDbSchemaVersionNumber(7, 1);
1485 closeResultSet(resultSet);
1486 closeStatement(statement);
1504 private CaseDbSchemaVersionNumber updateFromSchema7dot1toSchema7dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1505 if (schemaVersion.getMajor() != 7) {
1506 return schemaVersion;
1509 if (schemaVersion.getMinor() != 1) {
1510 return schemaVersion;
1513 Statement statement = null;
1514 Statement updstatement = null;
1515 ResultSet resultSet = null;
1519 statement = connection.createStatement();
1520 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1");
1523 updstatement = connection.createStatement();
1524 resultSet = connection.executeQuery(statement,
"SELECT artifact_id, obj_id FROM blackboard_artifacts");
1525 while (resultSet.next()) {
1526 long artifact_id = resultSet.getLong(
"artifact_id");
1527 long obj_id = resultSet.getLong(
"obj_id");
1528 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
1529 updstatement.executeUpdate(
"UPDATE blackboard_artifacts SET data_source_obj_id = " + data_source_obj_id +
" "
1530 +
"WHERE artifact_id = " + artifact_id);
1532 closeResultSet(resultSet);
1533 closeStatement(statement);
1534 closeStatement(updstatement);
1539 statement = connection.createStatement();
1540 statement.execute(
"ALTER TABLE tag_names ADD COLUMN knownStatus INTEGER NOT NULL DEFAULT " + TskData.FileKnown.UNKNOWN.getFileKnownValue());
1543 if (this.dbType.equals(DbType.SQLITE)) {
1544 statement.execute(
"CREATE TABLE account_types (account_type_id INTEGER PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1545 statement.execute(
"CREATE TABLE accounts (account_id INTEGER PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1546 statement.execute(
"CREATE TABLE account_relationships (relationship_id INTEGER PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time INTEGER, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1548 statement.execute(
"CREATE TABLE account_types (account_type_id BIGSERIAL PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1549 statement.execute(
"CREATE TABLE accounts (account_id BIGSERIAL PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1550 statement.execute(
"CREATE TABLE account_relationships (relationship_id BIGSERIAL PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time BIGINT, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1554 statement.execute(
"CREATE INDEX artifact_artifact_objID ON blackboard_artifacts(artifact_obj_id)");
1555 statement.execute(
"CREATE INDEX relationships_account1 ON account_relationships(account1_id)");
1556 statement.execute(
"CREATE INDEX relationships_account2 ON account_relationships(account2_id)");
1557 statement.execute(
"CREATE INDEX relationships_relationship_source_obj_id ON account_relationships(relationship_source_obj_id)");
1558 statement.execute(
"CREATE INDEX relationships_date_time ON account_relationships(date_time)");
1559 statement.execute(
"CREATE INDEX relationships_relationship_type ON account_relationships(relationship_type)");
1560 statement.execute(
"CREATE INDEX relationships_data_source_obj_id ON account_relationships(data_source_obj_id)");
1562 return new CaseDbSchemaVersionNumber(7, 2);
1564 closeResultSet(resultSet);
1565 closeStatement(statement);
1566 closeStatement(updstatement);
1584 private CaseDbSchemaVersionNumber updateFromSchema7dot2toSchema8dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1585 if (schemaVersion.getMajor() != 7) {
1586 return schemaVersion;
1589 if (schemaVersion.getMinor() != 2) {
1590 return schemaVersion;
1593 Statement updateSchemaStatement = connection.createStatement();
1594 Statement getExistingReportsStatement = connection.createStatement();
1595 ResultSet resultSet = null;
1596 ResultSet existingReports = null;
1604 updateSchemaStatement.execute(
"ALTER TABLE reports RENAME TO old_reports");
1607 updateSchemaStatement.execute(
"CREATE TABLE reports (obj_id BIGSERIAL PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id))");
1610 existingReports = getExistingReportsStatement.executeQuery(
"SELECT * FROM old_reports");
1611 while (existingReports.next()) {
1612 String path = existingReports.getString(2);
1613 long crtime = existingReports.getInt(3);
1614 String sourceModule = existingReports.getString(4);
1615 String reportName = existingReports.getString(5);
1617 PreparedStatement insertObjectStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
1618 insertObjectStatement.clearParameters();
1619 insertObjectStatement.setNull(1, java.sql.Types.BIGINT);
1620 insertObjectStatement.setLong(2, TskData.ObjectType.REPORT.getObjectType());
1621 connection.executeUpdate(insertObjectStatement);
1622 resultSet = insertObjectStatement.getGeneratedKeys();
1623 if (!resultSet.next()) {
1624 throw new TskCoreException(String.format(
"Failed to INSERT report %s (%s) in tsk_objects table", reportName, path));
1626 long objectId = resultSet.getLong(1);
1629 PreparedStatement insertReportStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
1630 insertReportStatement.clearParameters();
1631 insertReportStatement.setLong(1, objectId);
1632 insertReportStatement.setString(2, path);
1633 insertReportStatement.setLong(3, crtime);
1634 insertReportStatement.setString(4, sourceModule);
1635 insertReportStatement.setString(5, reportName);
1636 connection.executeUpdate(insertReportStatement);
1640 updateSchemaStatement.execute(
"DROP TABLE old_reports");
1642 return new CaseDbSchemaVersionNumber(8, 0);
1644 closeResultSet(resultSet);
1645 closeResultSet(existingReports);
1646 closeStatement(updateSchemaStatement);
1647 closeStatement(getExistingReportsStatement);
1665 private CaseDbSchemaVersionNumber updateFromSchema8dot0toSchema8dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1666 if (schemaVersion.getMajor() != 8) {
1667 return schemaVersion;
1670 if (schemaVersion.getMinor() != 0) {
1671 return schemaVersion;
1676 try (Statement statement = connection.createStatement();) {
1678 if (this.dbType.equals(DbType.SQLITE)) {
1679 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id INTEGER PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name) )");
1680 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1681 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1683 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id BIGSERIAL PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name))");
1684 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1685 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1688 return new CaseDbSchemaVersionNumber(8, 1);
1707 private CaseDbSchemaVersionNumber updateFromSchema8dot1toSchema8dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1708 if (schemaVersion.getMajor() != 8) {
1709 return schemaVersion;
1712 if (schemaVersion.getMinor() != 1) {
1713 return schemaVersion;
1718 try (Statement statement = connection.createStatement();) {
1719 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha1 TEXT DEFAULT NULL");
1720 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha256 TEXT DEFAULT NULL");
1722 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_details TEXT");
1730 statement.execute(
"CREATE TABLE tsk_db_info_extended (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
1731 ResultSet result = statement.executeQuery(
"SELECT tsk_ver FROM tsk_db_info");
1733 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + TSK_VERSION_KEY +
"', '" + result.getLong(
"tsk_ver") +
"')");
1734 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MAJOR_VERSION_KEY +
"', '8')");
1735 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MINOR_VERSION_KEY +
"', '2')");
1736 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MAJOR_VERSION_KEY +
"', '0')");
1737 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MINOR_VERSION_KEY +
"', '0')");
1739 String primaryKeyType;
1742 primaryKeyType =
"BIGSERIAL";
1745 primaryKeyType =
"INTEGER";
1748 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1752 statement.execute(
"CREATE TABLE tsk_event_types ("
1753 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1754 +
" display_name TEXT UNIQUE NOT NULL, "
1755 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1756 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1757 +
" values( 0, 'Event Types', null)");
1758 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1759 +
" values(1, 'File System', 0)");
1760 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1761 +
" values(2, 'Web Activity', 0)");
1762 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1763 +
" values(3, 'Misc Types', 0)");
1764 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1765 +
" values(4, 'Modified', 1)");
1766 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1767 +
" values(5, 'Accessed', 1)");
1768 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1769 +
" values(6, 'Created', 1)");
1770 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1771 +
" values(7, 'Changed', 1)");
1774 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1775 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1776 +
" full_description TEXT NOT NULL, "
1777 +
" med_description TEXT, "
1778 +
" short_description TEXT,"
1779 +
" data_source_obj_id BIGINT NOT NULL, "
1780 +
" file_obj_id BIGINT NOT NULL, "
1781 +
" artifact_id BIGINT, "
1782 +
" hash_hit INTEGER NOT NULL, "
1783 +
" tagged INTEGER NOT NULL, "
1784 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1785 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1786 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1789 statement.execute(
"CREATE TABLE tsk_events ( "
1790 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1791 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1792 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1793 +
" time INTEGER NOT NULL) "
1797 statement.execute(
"CREATE INDEX events_time ON tsk_events(time)");
1798 statement.execute(
"CREATE INDEX events_type ON tsk_events(event_type_id)");
1799 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1800 statement.execute(
"CREATE INDEX events_file_obj_id ON tsk_event_descriptions(file_obj_id) ");
1801 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1802 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1803 return new CaseDbSchemaVersionNumber(8, 2);
1823 private CaseDbSchemaVersionNumber updateFromSchema8dot2toSchema8dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1824 if (schemaVersion.getMajor() != 8) {
1825 return schemaVersion;
1828 if (schemaVersion.getMinor() != 2) {
1829 return schemaVersion;
1834 ResultSet resultSet = null;
1836 try (Statement statement = connection.createStatement();) {
1841 String primaryKeyType;
1844 primaryKeyType =
"BIGSERIAL";
1847 primaryKeyType =
"INTEGER";
1850 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1854 statement.execute(
"CREATE TABLE IF NOT EXISTS tsk_event_types ("
1855 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1856 +
" display_name TEXT UNIQUE NOT NULL, "
1857 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1859 resultSet = statement.executeQuery(
"SELECT * from tsk_event_types");
1863 if (!resultSet.next()) {
1865 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1866 +
" values( 0, 'Event Types', null)");
1867 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1868 +
" values(1, 'File System', 0)");
1869 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1870 +
" values(2, 'Web Activity', 0)");
1871 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1872 +
" values(3, 'Misc Types', 0)");
1873 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1874 +
" values(4, 'Modified', 1)");
1875 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1876 +
" values(5, 'Accessed', 1)");
1877 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1878 +
" values(6, 'Created', 1)");
1879 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1880 +
" values(7, 'Changed', 1)");
1885 statement.execute(
"DROP TABLE IF EXISTS tsk_events");
1889 statement.execute(
"DROP TABLE IF EXISTS tsk_event_descriptions");
1892 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1893 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1894 +
" full_description TEXT NOT NULL, "
1895 +
" med_description TEXT, "
1896 +
" short_description TEXT,"
1897 +
" data_source_obj_id BIGINT NOT NULL, "
1898 +
" file_obj_id BIGINT NOT NULL, "
1899 +
" artifact_id BIGINT, "
1900 +
" hash_hit INTEGER NOT NULL, "
1901 +
" tagged INTEGER NOT NULL, "
1902 +
" UNIQUE(full_description, file_obj_id, artifact_id), "
1903 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1904 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1905 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1909 statement.execute(
"CREATE TABLE tsk_events ( "
1910 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1911 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1912 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1913 +
" time INTEGER NOT NULL, "
1914 +
" UNIQUE (event_type_id, event_description_id, time))"
1918 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MAJOR_VERSION' WHERE name = 'CREATED_SCHEMA_MAJOR_VERSION'");
1919 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MINOR_VERSION' WHERE name = 'CREATED_SCHEMA_MINOR_VERSION'");
1921 return new CaseDbSchemaVersionNumber(8, 3);
1923 closeResultSet(resultSet);
1949 private CaseDbSchemaVersionNumber updateFromSchema8dot3toSchema8dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1950 if (schemaVersion.getMajor() != 8) {
1951 return schemaVersion;
1954 if (schemaVersion.getMinor() != 3) {
1955 return schemaVersion;
1958 Statement statement = connection.createStatement();
1959 ResultSet results = null;
1966 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1972 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
1973 +
"WHERE table_name='tsk_event_descriptions' and column_name='file_obj_id'");
1974 if (results.next()) {
1976 statement.execute(
"ALTER TABLE tsk_event_descriptions "
1977 +
"RENAME COLUMN file_obj_id TO content_obj_id");
1981 statement.execute(
"CREATE TABLE temp_tsk_events ( "
1982 +
" event_id BIGSERIAL PRIMARY KEY, "
1983 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1984 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id),"
1985 +
" time BIGINT NOT NULL, "
1986 +
" UNIQUE (event_type_id, event_description_id, time))"
1990 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
1991 +
"event_description_id, time) SELECT * FROM tsk_events");
1994 statement.execute(
"DROP TABLE tsk_events");
1997 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2000 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2001 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2002 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2003 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2004 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2008 boolean hasMisnamedColumn =
false;
2009 results = statement.executeQuery(
"pragma table_info('tsk_event_descriptions')");
2010 while (results.next()) {
2011 if (results.getString(
"name") != null && results.getString(
"name").equals(
"file_obj_id")) {
2012 hasMisnamedColumn =
true;
2017 if (hasMisnamedColumn) {
2019 statement.execute(
"CREATE TABLE temp_tsk_event_descriptions ("
2020 +
" event_description_id INTEGER PRIMARY KEY, "
2021 +
" full_description TEXT NOT NULL, "
2022 +
" med_description TEXT, "
2023 +
" short_description TEXT,"
2024 +
" data_source_obj_id BIGINT NOT NULL, "
2025 +
" content_obj_id BIGINT NOT NULL, "
2026 +
" artifact_id BIGINT, "
2027 +
" hash_hit INTEGER NOT NULL, "
2028 +
" tagged INTEGER NOT NULL, "
2029 +
" UNIQUE(full_description, content_obj_id, artifact_id), "
2030 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2031 +
" FOREIGN KEY(content_obj_id) REFERENCES tsk_files(obj_id), "
2032 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2035 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2036 +
" event_id INTEGER PRIMARY KEY, "
2037 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2038 +
" event_description_id BIGINT NOT NULL REFERENCES temp_tsk_event_descriptions(event_description_id),"
2039 +
" time INTEGER NOT NULL, "
2040 +
" UNIQUE (event_type_id, event_description_id, time))"
2044 statement.execute(
"INSERT INTO temp_tsk_event_descriptions(event_description_id, full_description, "
2045 +
"med_description, short_description, data_source_obj_id, content_obj_id, artifact_id, "
2046 +
"hash_hit, tagged) SELECT * FROM tsk_event_descriptions");
2048 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2049 +
"event_description_id, time) SELECT * FROM tsk_events");
2052 statement.execute(
"DROP TABLE tsk_events");
2053 statement.execute(
"DROP TABLE tsk_event_descriptions");
2056 statement.execute(
"ALTER TABLE temp_tsk_event_descriptions RENAME TO tsk_event_descriptions");
2057 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2060 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2061 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2062 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2063 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2064 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2068 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2072 if (this.dbType.equals(DbType.SQLITE)) {
2073 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id INTEGER PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2075 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id BIGSERIAL PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2079 insertAccountTypeIfNotExists(statement,
"IMO",
"IMO");
2080 insertAccountTypeIfNotExists(statement,
"LINE",
"LINE");
2081 insertAccountTypeIfNotExists(statement,
"SKYPE",
"Skype");
2082 insertAccountTypeIfNotExists(statement,
"TANGO",
"Tango");
2083 insertAccountTypeIfNotExists(statement,
"TEXTNOW",
"TextNow");
2084 insertAccountTypeIfNotExists(statement,
"THREEMA",
"ThreeMa");
2085 insertAccountTypeIfNotExists(statement,
"VIBER",
"Viber");
2086 insertAccountTypeIfNotExists(statement,
"XENDER",
"Xender");
2087 insertAccountTypeIfNotExists(statement,
"ZAPYA",
"Zapya");
2088 insertAccountTypeIfNotExists(statement,
"SHAREIT",
"ShareIt");
2090 return new CaseDbSchemaVersionNumber(8, 4);
2092 closeResultSet(results);
2093 closeStatement(statement);
2098 private CaseDbSchemaVersionNumber updateFromSchema8dot4toSchema8dot5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2099 if (schemaVersion.getMajor() != 8) {
2100 return schemaVersion;
2103 if (schemaVersion.getMinor() != 4) {
2104 return schemaVersion;
2107 Statement statement = connection.createStatement();
2112 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id BIGSERIAL PRIMARY KEY, name TEXT UNIQUE)");
2113 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id BIGINT REFERENCES tsk_tag_sets(tag_set_id)");
2116 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id INTEGER PRIMARY KEY, name TEXT UNIQUE)");
2117 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id INTEGER REFERENCES tsk_tag_sets(tag_set_id)");
2121 statement.execute(
"ALTER TABLE tag_names ADD COLUMN rank INTEGER");
2123 String insertStmt =
"INSERT INTO tsk_tag_sets (name) VALUES ('Project VIC')";
2125 statement.execute(insertStmt, Statement.RETURN_GENERATED_KEYS);
2127 statement.execute(insertStmt);
2129 try (ResultSet resultSet = statement.getGeneratedKeys()) {
2130 if (resultSet != null && resultSet.next()) {
2131 int tagSetId = resultSet.getInt(1);
2133 String updateQuery =
"UPDATE tag_names SET tag_set_id = %d, color = '%s', rank = %d, display_name = '%s' WHERE display_name = '%s'";
2134 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Red", 1,
"Child Exploitation (Illegal)",
"CAT-1: Child Exploitation (Illegal)"));
2135 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Lime", 2,
"Child Exploitation (Non-Illegal/Age Difficult)",
"CAT-2: Child Exploitation (Non-Illegal/Age Difficult)"));
2136 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Yellow", 3,
"CGI/Animation (Child Exploitive)",
"CAT-3: CGI/Animation (Child Exploitive)"));
2137 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Purple", 4,
"Exemplar/Comparison (Internal Use Only)",
"CAT-4: Exemplar/Comparison (Internal Use Only)"));
2138 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Fuchsia", 5,
"Non-pertinent",
"CAT-5: Non-pertinent"));
2140 String
deleteContentTag =
"DELETE FROM content_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2141 String deleteArtifactTag =
"DELETE FROM blackboard_artifact_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2142 String deleteCat0 =
"DELETE FROM tag_names WHERE display_name = 'CAT-0: Uncategorized'";
2143 statement.executeUpdate(deleteContentTag);
2144 statement.executeUpdate(deleteArtifactTag);
2145 statement.executeUpdate(deleteCat0);
2148 throw new TskCoreException(
"Failed to retrieve the default tag_set_id from DB");
2158 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
2161 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1;");
2164 Statement updateStatement = connection.createStatement();
2165 try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id FROM tsk_fs_info")) {
2166 while (resultSet.next()) {
2167 long fsId = resultSet.getLong(
"obj_id");
2168 long dataSourceId = getDataSourceObjectId(connection, fsId);
2169 updateStatement.executeUpdate(
"UPDATE tsk_fs_info SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fsId +
";");
2172 closeStatement(updateStatement);
2175 return new CaseDbSchemaVersionNumber(8, 5);
2178 closeStatement(statement);
2194 private void insertAccountTypeIfNotExists(Statement statement, String type_name, String display_name)
throws TskCoreException, SQLException {
2196 String insertSQL = String.format(
"INTO account_types(type_name, display_name) VALUES ('%s', '%s')", type_name, display_name);
2199 insertSQL =
"INSERT " + insertSQL +
" ON CONFLICT DO NOTHING";
2202 insertSQL =
"INSERT OR IGNORE " + insertSQL;
2205 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
2207 statement.execute(insertSQL);
2217 static String extractExtension(
final String fileName) {
2219 int i = fileName.lastIndexOf(
".");
2221 if ((i > 0) && ((i + 1) < fileName.length())) {
2222 ext = fileName.substring(i + 1);
2233 return ext.toLowerCase();
2257 return CURRENT_DB_SCHEMA_VERSION;
2267 return caseDBSchemaCreationVersion;
2286 return dbBackupPath;
2313 return databaseName;
2333 rwLock.writeLock().lock();
2344 rwLock.writeLock().unlock();
2355 rwLock.readLock().lock();
2366 rwLock.readLock().unlock();
2386 }
catch (Exception ex) {
2387 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
2417 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType());
2418 }
catch (PropertyVetoException exp) {
2420 throw new TskCoreException(exp.getMessage(), exp);
2424 }
catch (Exception exp) {
2426 throw new TskCoreException(exp.getMessage(), exp);
2441 CaseDatabaseFactory factory =
new CaseDatabaseFactory(dbPath);
2442 factory.createCaseDatabase();
2446 }
catch (Exception ex) {
2447 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
2467 String databaseName = createCaseDataBaseName(caseName);
2481 CaseDatabaseFactory factory =
new CaseDatabaseFactory(databaseName, info);
2482 factory.createCaseDatabase();
2485 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
2486 databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType());
2487 }
catch (PropertyVetoException exp) {
2489 throw new TskCoreException(exp.getMessage(), exp);
2490 }
catch (Exception exp) {
2492 throw new TskCoreException(exp.getMessage(), exp);
2505 private static String createCaseDataBaseName(String candidateDbName) {
2507 if (!candidateDbName.isEmpty()) {
2511 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
2516 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
2521 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
2526 dbName = dbName.toLowerCase();
2532 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
2533 dbName =
"_" + dbName;
2540 if (dbName.length() > MAX_DB_NAME_LEN_BEFORE_TIMESTAMP) {
2541 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
2553 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
2554 Date date =
new Date();
2555 dbName = dbName +
"_" + dateFormat.format(date);
2570 if (cachedCurrentExaminer != null) {
2571 return cachedCurrentExaminer;
2573 String loginName = System.getProperty(
"user.name");
2574 if (loginName == null || loginName.isEmpty()) {
2575 throw new TskCoreException(
"Failed to determine logged in user name.");
2578 CaseDbConnection connection = connections.getConnection();
2580 ResultSet resultSet = null;
2582 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME);
2583 statement.clearParameters();
2584 statement.setString(1, loginName);
2585 resultSet = connection.executeQuery(statement);
2586 if (resultSet.next()) {
2587 cachedCurrentExaminer =
new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"display_name"));
2588 return cachedCurrentExaminer;
2590 throw new TskCoreException(
"Error getting examaminer for name = " + loginName);
2593 }
catch (SQLException ex) {
2594 throw new TskCoreException(
"Error getting examaminer for name = " + loginName, ex);
2596 closeResultSet(resultSet);
2612 Examiner getExaminerById(
long id)
throws TskCoreException {
2614 CaseDbConnection connection = connections.getConnection();
2616 ResultSet resultSet = null;
2618 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_ID);
2619 statement.clearParameters();
2620 statement.setLong(1,
id);
2621 resultSet = connection.executeQuery(statement);
2622 if (resultSet.next()) {
2623 return new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"full_name"));
2625 throw new TskCoreException(
"Error getting examaminer for id = " +
id);
2627 }
catch (SQLException ex) {
2628 throw new TskCoreException(
"Error getting examaminer for id = " +
id, ex);
2630 closeResultSet(resultSet);
2654 return this.caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath,
this);
2666 CaseDbConnection connection = connections.getConnection();
2669 ResultSet rs = null;
2671 s = connection.createStatement();
2672 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
2673 +
"WHERE par_obj_id IS NULL");
2674 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
2676 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
2679 List<Content> rootObjs =
new ArrayList<Content>();
2680 for (ObjectInfo i : infos) {
2681 if (null != i.type) {
2692 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
2698 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
2703 }
catch (SQLException ex) {
2704 throw new TskCoreException(
"Error getting root objects", ex);
2724 List<Long> getDataSourceObjIds(String deviceId)
throws TskCoreException {
2727 synchronized (deviceIdToDatasourceObjIdMap) {
2728 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
2729 return new ArrayList<Long>(deviceIdToDatasourceObjIdMap.get(deviceId));
2732 CaseDbConnection connection = connections.getConnection();
2735 ResultSet rs = null;
2737 s = connection.createStatement();
2738 rs = connection.executeQuery(s,
"SELECT obj_id FROM data_source_info WHERE device_id = '" + deviceId +
"'");
2739 List<Long> dataSourceObjIds =
new ArrayList<Long>();
2741 dataSourceObjIds.add(rs.getLong(
"obj_id"));
2744 long ds_obj_id = rs.getLong(
"obj_id");
2745 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
2746 deviceIdToDatasourceObjIdMap.get(deviceId).add(ds_obj_id);
2748 deviceIdToDatasourceObjIdMap.put(deviceId,
new HashSet<Long>(Arrays.asList(ds_obj_id)));
2751 return dataSourceObjIds;
2752 }
catch (SQLException ex) {
2753 throw new TskCoreException(
"Error getting data sources", ex);
2780 CaseDbConnection connection = connections.getConnection();
2782 Statement statement = null;
2783 ResultSet resultSet = null;
2784 Statement statement2 = null;
2785 ResultSet resultSet2 = null;
2787 statement = connection.createStatement();
2788 statement2 = connection.createStatement();
2789 resultSet = connection.executeQuery(statement,
2790 "SELECT ds.obj_id, ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
2791 +
"FROM data_source_info AS ds "
2792 +
"LEFT JOIN tsk_image_info AS img "
2793 +
"ON ds.obj_id = img.obj_id");
2795 List<DataSource> dataSourceList =
new ArrayList<DataSource>();
2798 while (resultSet.next()) {
2800 Long objectId = resultSet.getLong(
"obj_id");
2801 String deviceId = resultSet.getString(
"device_id");
2802 String timezone = resultSet.getString(
"time_zone");
2803 String type = resultSet.getString(
"type");
2811 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
2812 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
2820 String parentPath =
"/";
2821 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null,
FileKnown.
UNKNOWN, parentPath);
2826 Long ssize = resultSet.getLong(
"ssize");
2827 Long size = resultSet.getLong(
"size");
2828 String md5 = resultSet.getString(
"md5");
2829 String sha1 = resultSet.getString(
"sha1");
2830 String sha256 = resultSet.getString(
"sha256");
2831 String name = resultSet.getString(
"display_name");
2833 List<String> imagePaths = imagePathsMap.get(objectId);
2835 if (imagePaths.size() > 0) {
2836 String path = imagePaths.get(0);
2837 name = (
new java.io.File(path)).getName();
2843 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
2844 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
2847 dataSourceList.add(dataSource);
2850 return dataSourceList;
2852 }
catch (SQLException ex) {
2853 throw new TskCoreException(
"Error getting data sources", ex);
2855 closeResultSet(resultSet);
2856 closeStatement(statement);
2857 closeResultSet(resultSet2);
2858 closeStatement(statement2);
2885 CaseDbConnection connection = connections.getConnection();
2887 Statement statement = null;
2888 ResultSet resultSet = null;
2889 Statement statement2 = null;
2890 ResultSet resultSet2 = null;
2892 statement = connection.createStatement();
2893 statement2 = connection.createStatement();
2894 resultSet = connection.executeQuery(statement,
2895 "SELECT ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
2896 +
"FROM data_source_info AS ds "
2897 +
"LEFT JOIN tsk_image_info AS img "
2898 +
"ON ds.obj_id = img.obj_id "
2899 +
"WHERE ds.obj_id = " + objectId);
2900 if (resultSet.next()) {
2901 String deviceId = resultSet.getString(
"device_id");
2902 String timezone = resultSet.getString(
"time_zone");
2903 String type = resultSet.getString(
"type");
2911 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
2912 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
2919 String parentPath =
"/";
2920 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null,
FileKnown.
UNKNOWN, parentPath);
2925 Long ssize = resultSet.getLong(
"ssize");
2926 Long size = resultSet.getLong(
"size");
2927 String md5 = resultSet.getString(
"md5");
2928 String sha1 = resultSet.getString(
"sha1");
2929 String sha256 = resultSet.getString(
"sha256");
2930 String name = resultSet.getString(
"display_name");
2932 List<String> imagePaths = getImagePathsById(objectId);
2934 if (imagePaths.size() > 0) {
2935 String path = imagePaths.get(0);
2936 name = (
new java.io.File(path)).getName();
2942 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
2943 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
2946 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
2948 }
catch (SQLException ex) {
2949 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
2951 closeResultSet(resultSet);
2952 closeStatement(statement);
2953 closeResultSet(resultSet2);
2954 closeStatement(statement2);
2973 return getArtifactsHelper(
"blackboard_artifacts.artifact_type_id = " + artifactTypeID);
2987 CaseDbConnection connection = connections.getConnection();
2989 ResultSet rs = null;
2992 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE);
2993 statement.clearParameters();
2994 statement.setLong(1, objId);
2995 rs = connection.executeQuery(statement);
2998 count = rs.getLong(
"count");
3001 }
catch (SQLException ex) {
3002 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
3021 CaseDbConnection connection = connections.getConnection();
3023 ResultSet rs = null;
3026 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE);
3027 statement.clearParameters();
3028 statement.setInt(1, artifactTypeID);
3029 rs = connection.executeQuery(statement);
3032 count = rs.getLong(
"count");
3035 }
catch (SQLException ex) {
3036 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
3056 CaseDbConnection connection = connections.getConnection();
3058 ResultSet rs = null;
3061 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE);
3062 statement.clearParameters();
3063 statement.setInt(2, artifactTypeID);
3064 statement.setLong(1, dataSourceID);
3065 rs = connection.executeQuery(statement);
3068 count = rs.getLong(
"count");
3071 }
catch (SQLException ex) {
3072 throw new TskCoreException(String.format(
"Error getting number of blackboard artifacts by type (%d) and data source (%d)", artifactTypeID, dataSourceID), ex);
3095 CaseDbConnection connection = connections.getConnection();
3098 ResultSet rs = null;
3100 s = connection.createStatement();
3101 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3102 +
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3103 +
"types.type_name AS type_name, types.display_name AS display_name, "
3104 +
" arts.review_status_id AS review_status_id "
3105 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3106 +
"WHERE arts.artifact_id = attrs.artifact_id "
3107 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3108 +
" AND attrs.value_text = '" + value +
"'"
3109 +
" AND types.artifact_type_id=arts.artifact_type_id"
3111 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3113 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3114 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3118 }
catch (SQLException ex) {
3119 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3146 String valSubStr =
"%" + subString;
3147 if (startsWith ==
false) {
3150 CaseDbConnection connection = connections.getConnection();
3153 ResultSet rs = null;
3155 s = connection.createStatement();
3156 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3157 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3158 +
" types.type_name AS type_name, types.display_name AS display_name, "
3159 +
" arts.review_status_id AS review_status_id "
3160 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3161 +
" WHERE arts.artifact_id = attrs.artifact_id "
3162 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3163 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
3164 +
" AND types.artifact_type_id=arts.artifact_type_id "
3166 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3168 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3169 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3173 }
catch (SQLException ex) {
3174 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3198 CaseDbConnection connection = connections.getConnection();
3201 ResultSet rs = null;
3203 s = connection.createStatement();
3204 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3205 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3206 +
" types.type_name AS type_name, types.display_name AS display_name, "
3207 +
" arts.review_status_id AS review_status_id "
3208 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3209 +
"WHERE arts.artifact_id = attrs.artifact_id "
3210 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3211 +
" AND attrs.value_int32 = " + value
3212 +
" AND types.artifact_type_id=arts.artifact_type_id "
3214 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3216 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3217 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3221 }
catch (SQLException ex) {
3222 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3246 CaseDbConnection connection = connections.getConnection();
3249 ResultSet rs = null;
3251 s = connection.createStatement();
3252 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3253 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3254 +
" types.type_name AS type_name, types.display_name AS display_name, "
3255 +
" arts.review_status_id AS review_status_id "
3256 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3257 +
" WHERE arts.artifact_id = attrs.artifact_id "
3258 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3259 +
" AND attrs.value_int64 = " + value
3260 +
" AND types.artifact_type_id=arts.artifact_type_id "
3262 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3264 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3265 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3269 }
catch (SQLException ex) {
3270 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3294 CaseDbConnection connection = connections.getConnection();
3297 ResultSet rs = null;
3299 s = connection.createStatement();
3300 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3301 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3302 +
" types.type_name AS type_name, types.display_name AS display_name, "
3303 +
" arts.review_status_id AS review_status_id "
3304 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3305 +
" WHERE arts.artifact_id = attrs.artifact_id "
3306 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3307 +
" AND attrs.value_double = " + value
3308 +
" AND types.artifact_type_id=arts.artifact_type_id "
3310 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3312 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3313 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3317 }
catch (SQLException ex) {
3318 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3342 CaseDbConnection connection = connections.getConnection();
3345 ResultSet rs = null;
3347 s = connection.createStatement();
3348 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3349 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3350 +
" types.type_name AS type_name, types.display_name AS display_name, "
3351 +
" arts.review_status_id AS review_status_id "
3352 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3353 +
" WHERE arts.artifact_id = attrs.artifact_id "
3354 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3355 +
" AND attrs.value_byte = " + value
3356 +
" AND types.artifact_type_id=arts.artifact_type_id "
3358 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3360 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3361 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3365 }
catch (SQLException ex) {
3366 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3383 CaseDbConnection connection = connections.getConnection();
3386 ResultSet rs = null;
3388 s = connection.createStatement();
3389 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types");
3393 rs.getString(
"type_name"), rs.getString(
"display_name")));
3395 return artifactTypes;
3396 }
catch (SQLException ex) {
3397 throw new TskCoreException(
"Error getting artifact types", ex);
3415 String typeIdList =
"";
3422 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
3423 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
3424 CaseDbConnection connection = connections.getConnection();
3427 ResultSet rs = null;
3429 s = connection.createStatement();
3430 rs = connection.executeQuery(s, query);
3436 }
catch (SQLException ex) {
3437 throw new TskCoreException(
"Error getting artifact types in use", ex);
3457 CaseDbConnection connection = connections.getConnection();
3460 ResultSet rs = null;
3462 s = connection.createStatement();
3463 rs = connection.executeQuery(s,
3464 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
3465 +
"types.type_name AS type_name, types.display_name AS display_name "
3466 +
"FROM blackboard_artifact_types AS types "
3467 +
"INNER JOIN blackboard_artifacts AS arts "
3468 +
"ON arts.artifact_type_id = types.artifact_type_id");
3472 rs.getString(
"type_name"), rs.getString(
"display_name")));
3474 return uniqueArtifactTypes;
3475 }
catch (SQLException ex) {
3476 throw new TskCoreException(
"Error getting attribute types", ex);
3493 CaseDbConnection connection = connections.getConnection();
3496 ResultSet rs = null;
3498 s = connection.createStatement();
3499 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
3505 return attribute_types;
3506 }
catch (SQLException ex) {
3507 throw new TskCoreException(
"Error getting attribute types", ex);
3528 CaseDbConnection connection = connections.getConnection();
3531 ResultSet rs = null;
3533 s = connection.createStatement();
3534 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
3537 count = rs.getInt(
"count");
3540 }
catch (SQLException ex) {
3541 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
3562 ArrayList<BlackboardArtifact> getArtifactsHelper(String whereClause)
throws TskCoreException {
3563 CaseDbConnection connection = connections.getConnection();
3565 ResultSet rs = null;
3567 Statement statement = connection.createStatement();
3568 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
3569 +
"blackboard_artifacts.obj_id AS obj_id, "
3570 +
"blackboard_artifacts.artifact_obj_id AS artifact_obj_id, "
3571 +
"blackboard_artifacts.data_source_obj_id AS data_source_obj_id, "
3572 +
"blackboard_artifact_types.artifact_type_id AS artifact_type_id, "
3573 +
"blackboard_artifact_types.type_name AS type_name, "
3574 +
"blackboard_artifact_types.display_name AS display_name, "
3575 +
"blackboard_artifacts.review_status_id AS review_status_id "
3576 +
"FROM blackboard_artifacts, blackboard_artifact_types "
3577 +
"WHERE blackboard_artifacts.artifact_type_id = blackboard_artifact_types.artifact_type_id "
3579 +
" AND " + whereClause;
3580 rs = connection.executeQuery(statement, query);
3581 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3583 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3584 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3588 }
catch (SQLException ex) {
3589 throw new TskCoreException(
"Error getting or creating a blackboard artifact", ex);
3609 private long getArtifactsCountHelper(
int artifactTypeID,
long obj_id)
throws TskCoreException {
3610 CaseDbConnection connection = connections.getConnection();
3612 ResultSet rs = null;
3615 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE);
3616 statement.clearParameters();
3617 statement.setLong(1, obj_id);
3618 statement.setInt(2, artifactTypeID);
3619 rs = connection.executeQuery(statement);
3622 count = rs.getLong(
"count");
3625 }
catch (SQLException ex) {
3626 throw new TskCoreException(
"Error getting blackboard artifact count", ex);
3647 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
3663 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID +
";");
3695 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
3696 if (artifactTypeID == -1) {
3699 return getArtifactsCountHelper(artifactTypeID, obj_id);
3715 return getArtifactsCountHelper(artifactTypeID, obj_id);
3731 return getArtifactsCountHelper(artifactType.getTypeID(), obj_id);
3746 return getArtifactsHelper(
"blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
3761 return getArtifactsHelper(
"blackboard_artifact_types.artifact_type_id = " + artifactType.getTypeID() +
";");
3778 CaseDbConnection connection = connections.getConnection();
3781 ResultSet rs = null;
3783 s = connection.createStatement();
3784 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3785 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3786 +
"types.type_name AS type_name, types.display_name AS display_name,"
3787 +
"arts.review_status_id AS review_status_id "
3788 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3789 +
"WHERE arts.artifact_id = attrs.artifact_id "
3790 +
"AND attrs.attribute_type_id = " + attrType.getTypeID()
3791 +
" AND arts.artifact_type_id = " + artifactType.getTypeID()
3792 +
" AND attrs.value_text = '" + value +
"'"
3793 +
" AND types.artifact_type_id=arts.artifact_type_id"
3795 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3797 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3798 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3802 }
catch (SQLException ex) {
3803 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
3823 CaseDbConnection connection = connections.getConnection();
3825 ResultSet rs = null;
3828 s = connection.createStatement();
3829 rs = connection.executeQuery(s,
"SELECT arts.artifact_id AS artifact_id, "
3830 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3831 +
"types.type_name AS type_name, types.display_name AS display_name,"
3832 +
"arts.review_status_id AS review_status_id "
3833 +
"FROM blackboard_artifacts AS arts, blackboard_artifact_types AS types "
3834 +
"WHERE arts.artifact_id = " + artifactID
3835 +
" AND arts.artifact_type_id = types.artifact_type_id");
3837 return new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
3838 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3846 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
3848 }
catch (SQLException ex) {
3849 throw new TskCoreException(
"Error getting a blackboard artifact. " + ex.getMessage(), ex);
3866 CaseDbConnection connection = connections.getConnection();
3869 addBlackBoardAttribute(attr, artifactTypeId, connection);
3870 }
catch (SQLException ex) {
3871 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
3888 CaseDbConnection connection = connections.getConnection();
3891 connection.beginTransaction();
3893 addBlackBoardAttribute(attr, artifactTypeId, connection);
3895 connection.commitTransaction();
3896 }
catch (SQLException ex) {
3897 connection.rollbackTransaction();
3898 throw new TskCoreException(
"Error adding blackboard attributes", ex);
3905 private void addBlackBoardAttribute(
BlackboardAttribute attr,
int artifactTypeId, CaseDbConnection connection)
throws SQLException, TskCoreException {
3906 PreparedStatement statement;
3907 switch (attr.getAttributeType().getValueType()) {
3910 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_STRING_ATTRIBUTE);
3911 statement.clearParameters();
3912 statement.setString(7, attr.getValueString());
3915 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_BYTE_ATTRIBUTE);
3916 statement.clearParameters();
3917 statement.setBytes(7, attr.getValueBytes());
3920 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INT_ATTRIBUTE);
3921 statement.clearParameters();
3922 statement.setInt(7, attr.getValueInt());
3925 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
3926 statement.clearParameters();
3927 statement.setLong(7, attr.getValueLong());
3930 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DOUBLE_ATTRIBUTE);
3931 statement.clearParameters();
3932 statement.setDouble(7, attr.getValueDouble());
3935 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
3936 statement.clearParameters();
3937 statement.setLong(7, attr.getValueLong());
3940 throw new TskCoreException(
"Unrecognized artifact attribute value type");
3942 statement.setLong(1, attr.getArtifactID());
3943 statement.setInt(2, artifactTypeId);
3944 statement.setString(3, attr.getSourcesCSV());
3945 statement.setString(4,
"");
3946 statement.setInt(5, attr.getAttributeType().getTypeID());
3947 statement.setLong(6, attr.getAttributeType().getValueType().getType());
3948 connection.executeUpdate(statement);
3961 String addSourceToArtifactAttribute(BlackboardAttribute attr, String source)
throws TskCoreException {
3969 if (null == source || source.isEmpty()) {
3970 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
3972 CaseDbConnection connection = connections.getConnection();
3974 Statement queryStmt = null;
3975 Statement updateStmt = null;
3976 ResultSet result = null;
3977 String newSources =
"";
3979 connection.beginTransaction();
3980 String valueClause =
"";
3981 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
3982 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
3983 switch (valueType) {
3989 valueClause =
" value_int32 = " + attr.getValueInt();
3993 valueClause =
" value_int64 = " + attr.getValueLong();
3996 valueClause =
" value_double = " + attr.getValueDouble();
3999 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
4001 String query =
"SELECT source FROM blackboard_attributes WHERE"
4002 +
" artifact_id = " + attr.getArtifactID()
4003 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4004 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4005 +
" AND " + valueClause +
";";
4006 queryStmt = connection.createStatement();
4007 updateStmt = connection.createStatement();
4008 result = connection.executeQuery(queryStmt, query);
4015 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
4016 statement.clearParameters();
4017 statement.setLong(1, attr.getArtifactID());
4018 statement.setLong(2, attr.getAttributeType().getTypeID());
4019 statement.setBytes(3, attr.getValueBytes());
4020 result = connection.executeQuery(statement);
4022 while (result.next()) {
4023 String oldSources = result.getString(
"source");
4024 if (null != oldSources && !oldSources.isEmpty()) {
4025 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
4026 if (!uniqueSources.contains(source)) {
4027 newSources = oldSources +
"," + source;
4029 newSources = oldSources;
4032 newSources = source;
4034 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
4035 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
4036 +
" artifact_id = " + attr.getArtifactID()
4037 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4038 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4039 +
" AND " + valueClause +
";";
4040 connection.executeUpdate(updateStmt, update);
4047 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
4048 statement.clearParameters();
4049 statement.setString(1, newSources);
4050 statement.setLong(2, attr.getArtifactID());
4051 statement.setLong(3, attr.getAttributeType().getTypeID());
4052 statement.setBytes(4, attr.getValueBytes());
4053 connection.executeUpdate(statement);
4056 connection.commitTransaction();
4058 }
catch (SQLException ex) {
4059 connection.rollbackTransaction();
4060 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
4062 closeResultSet(result);
4063 closeStatement(updateStmt);
4064 closeStatement(queryStmt);
4085 CaseDbConnection connection = connections.getConnection();
4088 ResultSet rs = null;
4090 connection.beginTransaction();
4091 s = connection.createStatement();
4092 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeString +
"'");
4095 rs = connection.executeQuery(s,
"SELECT MAX(attribute_type_id) AS highest_id FROM blackboard_attribute_types");
4098 maxID = rs.getInt(
"highest_id");
4099 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
4100 maxID = MIN_USER_DEFINED_TYPE_ID;
4105 connection.executeUpdate(s,
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES ('" + maxID +
"', '" + attrTypeString +
"', '" + displayName +
"', '" + valueType.getType() +
"')");
4107 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
4108 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
4109 connection.commitTransaction();
4112 throw new TskDataException(
"The attribute type that was added was already within the system.");
4115 }
catch (SQLException ex) {
4116 connection.rollbackTransaction();
4117 throw new TskCoreException(
"Error adding attribute type", ex);
4137 if (this.typeNameToAttributeTypeMap.containsKey(attrTypeName)) {
4138 return this.typeNameToAttributeTypeMap.get(attrTypeName);
4140 CaseDbConnection connection = connections.getConnection();
4143 ResultSet rs = null;
4145 s = connection.createStatement();
4146 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
4151 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
4152 this.typeNameToAttributeTypeMap.put(attrTypeName, type);
4155 }
catch (SQLException ex) {
4156 throw new TskCoreException(
"Error getting attribute type id", ex);
4176 if (this.typeIdToAttributeTypeMap.containsKey(typeID)) {
4177 return this.typeIdToAttributeTypeMap.get(typeID);
4179 CaseDbConnection connection = connections.getConnection();
4182 ResultSet rs = null;
4184 s = connection.createStatement();
4185 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE attribute_type_id = " + typeID +
"");
4186 BlackboardAttribute.Type type = null;
4188 type =
new BlackboardAttribute.Type(rs.getInt(
"attribute_type_id"), rs.getString(
"type_name"),
4189 rs.getString(
"display_name"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(rs.getLong(
"value_type")));
4190 this.typeIdToAttributeTypeMap.put(typeID, type);
4191 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
4194 }
catch (SQLException ex) {
4195 throw new TskCoreException(
"Error getting attribute type id", ex);
4215 if (this.typeNameToArtifactTypeMap.containsKey(artTypeName)) {
4216 return this.typeNameToArtifactTypeMap.get(artTypeName);
4218 CaseDbConnection connection = connections.getConnection();
4221 ResultSet rs = null;
4223 s = connection.createStatement();
4224 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE type_name = '" + artTypeName +
"'");
4228 rs.getString(
"type_name"), rs.getString(
"display_name"));
4229 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4230 this.typeNameToArtifactTypeMap.put(artTypeName, type);
4233 }
catch (SQLException ex) {
4234 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4254 if (this.typeIdToArtifactTypeMap.containsKey(artTypeId)) {
4255 return typeIdToArtifactTypeMap.get(artTypeId);
4257 CaseDbConnection connection = connections.getConnection();
4260 ResultSet rs = null;
4262 s = connection.createStatement();
4263 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name FROM blackboard_artifact_types WHERE artifact_type_id = " + artTypeId +
"");
4264 BlackboardArtifact.Type type = null;
4266 type =
new BlackboardArtifact.Type(rs.getInt(
"artifact_type_id"),
4267 rs.getString(
"type_name"), rs.getString(
"display_name"));
4268 this.typeIdToArtifactTypeMap.put(artTypeId, type);
4269 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4272 }
catch (SQLException ex) {
4273 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4295 CaseDbConnection connection = connections.getConnection();
4298 ResultSet rs = null;
4300 connection.beginTransaction();
4301 s = connection.createStatement();
4302 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
4305 rs = connection.executeQuery(s,
"SELECT MAX(artifact_type_id) AS highest_id FROM blackboard_artifact_types");
4308 maxID = rs.getInt(
"highest_id");
4309 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
4310 maxID = MIN_USER_DEFINED_TYPE_ID;
4315 connection.executeUpdate(s,
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name) VALUES ('" + maxID +
"', '" + artifactTypeName +
"', '" + displayName +
"')");
4317 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4318 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4319 connection.commitTransaction();
4322 throw new TskDataException(
"The attribute type that was added was already within the system.");
4324 }
catch (SQLException ex) {
4325 connection.rollbackTransaction();
4326 throw new TskCoreException(
"Error adding artifact type", ex);
4336 CaseDbConnection connection = connections.getConnection();
4338 ResultSet rs = null;
4340 Statement statement = connection.createStatement();
4341 rs = connection.executeQuery(statement,
"SELECT attrs.artifact_id AS artifact_id, "
4342 +
"attrs.source AS source, attrs.context AS context, attrs.attribute_type_id AS attribute_type_id, "
4343 +
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, "
4344 +
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, "
4345 +
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, "
4346 +
"types.type_name AS type_name, types.display_name AS display_name "
4347 +
"FROM blackboard_attributes AS attrs, blackboard_attribute_types AS types WHERE attrs.artifact_id = " + artifact.getArtifactID()
4348 +
" AND attrs.attribute_type_id = types.attribute_type_id");
4349 ArrayList<BlackboardAttribute> attributes =
new ArrayList<BlackboardAttribute>();
4351 int attributeTypeId = rs.getInt(
"attribute_type_id");
4352 String attributeTypeName = rs.getString(
"type_name");
4354 if (this.typeIdToAttributeTypeMap.containsKey(attributeTypeId)) {
4355 attributeType = this.typeIdToAttributeTypeMap.get(attributeTypeId);
4358 rs.getString(
"display_name"),
4360 this.typeIdToAttributeTypeMap.put(attributeTypeId, attributeType);
4361 this.typeNameToAttributeTypeMap.put(attributeTypeName, attributeType);
4365 rs.getLong(
"artifact_id"),
4367 rs.getString(
"source"),
4368 rs.getString(
"context"),
4369 rs.getInt(
"value_int32"),
4370 rs.getLong(
"value_int64"),
4371 rs.getDouble(
"value_double"),
4372 rs.getString(
"value_text"),
4373 rs.getBytes(
"value_byte"), this
4375 attributes.add(attr);
4378 }
catch (SQLException ex) {
4379 throw new TskCoreException(
"Error getting attributes for artifact, artifact id = " + artifact.getArtifactID(), ex);
4400 CaseDbConnection connection = connections.getConnection();
4403 ResultSet rs = null;
4405 s = connection.createStatement();
4406 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
4407 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
4408 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
4409 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
4410 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
4411 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
4412 +
"FROM blackboard_attributes " + whereClause);
4413 ArrayList<BlackboardAttribute> matches =
new ArrayList<BlackboardAttribute>();
4419 rs.getLong(
"artifact_id"),
4421 rs.getString(
"source"),
4422 rs.getString(
"context"),
4423 rs.getInt(
"value_int32"),
4424 rs.getLong(
"value_int64"),
4425 rs.getDouble(
"value_double"),
4426 rs.getString(
"value_text"),
4427 rs.getBytes(
"value_byte"), this
4432 }
catch (SQLException ex) {
4433 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4454 CaseDbConnection connection = connections.getConnection();
4456 ResultSet rs = null;
4459 s = connection.createStatement();
4460 rs = connection.executeQuery(s,
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
4461 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.data_source_obj_id AS data_source_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
4462 +
"blackboard_artifacts.review_status_id AS review_status_id "
4463 +
"FROM blackboard_artifacts " + whereClause);
4464 ArrayList<BlackboardArtifact> matches =
new ArrayList<BlackboardArtifact>();
4470 type.getTypeID(), type.getTypeName(), type.getDisplayName(),
4472 matches.add(artifact);
4475 }
catch (SQLException ex) {
4476 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4515 return newBlackboardArtifact(artifactType.getTypeID(), obj_id, artifactType.getLabel(), artifactType.getDisplayName());
4519 CaseDbConnection connection = connections.getConnection();
4521 ResultSet resultSet = null;
4524 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
4526 PreparedStatement statement = null;
4528 statement = connection.getPreparedStatement(PREPARED_STATEMENT.POSTGRESQL_INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
4529 statement.clearParameters();
4530 statement.setLong(1, obj_id);
4531 statement.setLong(2, artifact_obj_id);
4532 statement.setLong(3, data_source_obj_id);
4533 statement.setInt(4, artifact_type_id);
4536 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
4537 statement.clearParameters();
4538 this.nextArtifactId++;
4539 statement.setLong(1, this.nextArtifactId);
4540 statement.setLong(2, obj_id);
4541 statement.setLong(3, artifact_obj_id);
4542 statement.setLong(4, data_source_obj_id);
4543 statement.setInt(5, artifact_type_id);
4546 connection.executeUpdate(statement);
4547 resultSet = statement.getGeneratedKeys();
4549 return new BlackboardArtifact(
this, resultSet.getLong(1),
4550 obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, artifactTypeName, artifactDisplayName, BlackboardArtifact.ReviewStatus.UNDECIDED,
true);
4551 }
catch (SQLException ex) {
4552 throw new TskCoreException(
"Error creating a blackboard artifact", ex);
4554 closeResultSet(resultSet);
4572 boolean getContentHasChildren(Content content)
throws TskCoreException {
4573 CaseDbConnection connection = connections.getConnection();
4575 ResultSet rs = null;
4578 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
4579 statement.clearParameters();
4580 statement.setLong(1, content.getId());
4581 rs = connection.executeQuery(statement);
4582 boolean hasChildren =
false;
4584 hasChildren = rs.getInt(
"count") > 0;
4587 }
catch (SQLException e) {
4588 throw new TskCoreException(
"Error checking for children of parent " + content, e);
4608 int getContentChildrenCount(Content content)
throws TskCoreException {
4610 if (!this.getHasChildren(content)) {
4614 CaseDbConnection connection = connections.getConnection();
4616 ResultSet rs = null;
4619 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
4620 statement.clearParameters();
4621 statement.setLong(1, content.getId());
4622 rs = connection.executeQuery(statement);
4623 int countChildren = -1;
4625 countChildren = rs.getInt(
"count");
4627 return countChildren;
4628 }
catch (SQLException e) {
4629 throw new TskCoreException(
"Error checking for children of parent " + content, e);
4648 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
4649 CaseDbConnection connection = connections.getConnection();
4651 ResultSet rs = null;
4653 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
4654 statement.clearParameters();
4655 long parentId = parent.getId();
4656 statement.setLong(1, parentId);
4657 statement.setShort(2, type.getFileType());
4658 rs = connection.executeQuery(statement);
4659 return fileChildren(rs, connection, parentId);
4660 }
catch (SQLException ex) {
4661 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4678 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
4679 CaseDbConnection connection = connections.getConnection();
4681 ResultSet rs = null;
4683 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
4684 statement.clearParameters();
4685 long parentId = parent.getId();
4686 statement.setLong(1, parentId);
4687 rs = connection.executeQuery(statement);
4688 return fileChildren(rs, connection, parentId);
4689 }
catch (SQLException ex) {
4690 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4709 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
4710 CaseDbConnection connection = connections.getConnection();
4712 ResultSet rs = null;
4714 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
4715 statement.clearParameters();
4716 statement.setLong(1, parent.getId());
4717 statement.setShort(2, type.getFileType());
4718 rs = connection.executeQuery(statement);
4719 List<Long> children =
new ArrayList<Long>();
4721 children.add(rs.getLong(
"obj_id"));
4724 }
catch (SQLException ex) {
4725 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4742 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
4743 CaseDbConnection connection = connections.getConnection();
4745 ResultSet rs = null;
4747 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
4748 statement.clearParameters();
4749 statement.setLong(1, parent.getId());
4750 rs = connection.executeQuery(statement);
4751 List<Long> children =
new ArrayList<Long>();
4753 children.add(rs.getLong(
"obj_id"));
4756 }
catch (SQLException ex) {
4757 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
4775 List<Long> getBlackboardArtifactChildrenIds(Content parent)
throws TskCoreException {
4776 CaseDbConnection connection = connections.getConnection();
4778 ResultSet rs = null;
4780 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
4781 statement.clearParameters();
4782 statement.setLong(1, parent.getId());
4783 rs = connection.executeQuery(statement);
4784 List<Long> children =
new ArrayList<Long>();
4786 children.add(rs.getLong(
"obj_id"));
4789 }
catch (SQLException ex) {
4790 throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
4807 List<Content> getBlackboardArtifactChildren(Content parent)
throws TskCoreException {
4809 long parentId = parent.getId();
4810 ArrayList<BlackboardArtifact> artsArray = getArtifactsHelper(
"blackboard_artifacts.obj_id = " + parentId +
";");
4812 List<Content> lc =
new ArrayList<Content>();
4813 lc.addAll(artsArray);
4825 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
4826 CaseDbConnection connection = connections.getConnection();
4829 ResultSet rs = null;
4831 s = connection.createStatement();
4832 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
4833 +
"FROM tsk_objects LEFT JOIN tsk_files "
4834 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
4835 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
4836 +
" ORDER BY tsk_objects.obj_id");
4837 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
4839 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
4842 }
catch (SQLException ex) {
4843 throw new TskCoreException(
"Error getting Children Info for Content", ex);
4862 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
4863 return getParentInfo(c.getId());
4876 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
4877 CaseDbConnection connection = connections.getConnection();
4880 ResultSet rs = null;
4882 s = connection.createStatement();
4883 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
4884 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
4885 +
"ON child.par_obj_id = parent.obj_id "
4886 +
"WHERE child.obj_id = " + contentId);
4888 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
4892 }
catch (SQLException ex) {
4893 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
4912 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
4917 ObjectInfo parentInfo = getParentInfo(fsc);
4918 if (parentInfo == null) {
4921 Directory parent = null;
4922 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
4923 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
4925 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
4944 Content content = frequentlyUsedContentMap.get(
id);
4945 if (null != content) {
4949 CaseDbConnection connection = connections.getConnection();
4952 ResultSet rs = null;
4957 s = connection.createStatement();
4958 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
4962 parentId = rs.getLong(
"par_obj_id");
4964 }
catch (SQLException ex) {
4965 throw new TskCoreException(
"Error getting Content by ID.", ex);
4977 frequentlyUsedContentMap.put(
id, content);
4980 content = getVolumeSystemById(
id, parentId);
4983 content = getVolumeById(
id, parentId);
4984 frequentlyUsedContentMap.put(
id, content);
4987 content = getPoolById(
id, parentId);
4990 content = getFileSystemById(
id, parentId);
4991 frequentlyUsedContentMap.put(
id, content);
5002 frequentlyUsedContentMap.put(
id, content);
5012 throw new TskCoreException(
"Could not obtain Content object with ID: " +
id);
5025 String getFilePath(
long id) {
5026 CaseDbConnection connection;
5028 connection = connections.getConnection();
5029 }
catch (TskCoreException ex) {
5030 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
5033 String filePath = null;
5035 ResultSet rs = null;
5037 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
5038 statement.clearParameters();
5039 statement.setLong(1,
id);
5040 rs = connection.executeQuery(statement);
5042 filePath = rs.getString(
"path");
5044 }
catch (SQLException ex) {
5045 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
5061 TskData.EncodingType getEncodingType(
long id) {
5062 CaseDbConnection connection;
5064 connection = connections.getConnection();
5065 }
catch (TskCoreException ex) {
5066 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
5069 TskData.EncodingType type = TskData.EncodingType.NONE;
5071 ResultSet rs = null;
5073 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
5074 statement.clearParameters();
5075 statement.setLong(1,
id);
5076 rs = connection.executeQuery(statement);
5078 type = TskData.EncodingType.valueOf(rs.getInt(1));
5080 }
catch (SQLException ex) {
5081 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
5098 String getFileParentPath(
long objectId, CaseDbConnection connection) {
5099 String parentPath = null;
5101 ResultSet rs = null;
5103 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
5104 statement.clearParameters();
5105 statement.setLong(1, objectId);
5106 rs = connection.executeQuery(statement);
5108 parentPath = rs.getString(
"parent_path");
5110 }
catch (SQLException ex) {
5111 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5127 String getFileName(
long objectId, CaseDbConnection connection) {
5128 String fileName = null;
5130 ResultSet rs = null;
5132 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
5133 statement.clearParameters();
5134 statement.setLong(1, objectId);
5135 rs = connection.executeQuery(statement);
5137 fileName = rs.getString(
"name");
5139 }
catch (SQLException ex) {
5140 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5158 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
5159 CaseDbConnection connection = connections.getConnection();
5160 DerivedFile.DerivedMethod method = null;
5162 ResultSet rs1 = null;
5163 ResultSet rs2 = null;
5165 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
5166 statement.clearParameters();
5167 statement.setLong(1,
id);
5168 rs1 = connection.executeQuery(statement);
5170 int method_id = rs1.getInt(
"derived_id");
5171 String rederive = rs1.getString(
"rederive");
5172 method =
new DerivedFile.DerivedMethod(method_id, rederive);
5173 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
5174 statement.clearParameters();
5175 statement.setInt(1, method_id);
5176 rs2 = connection.executeQuery(statement);
5178 method.setToolName(rs2.getString(
"tool_name"));
5179 method.setToolVersion(rs2.getString(
"tool_version"));
5180 method.setOther(rs2.getString(
"other"));
5183 }
catch (SQLException e) {
5184 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
5186 closeResultSet(rs2);
5187 closeResultSet(rs1);
5205 CaseDbConnection connection = connections.getConnection();
5227 ResultSet rs = null;
5229 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_BY_ID);
5230 statement.clearParameters();
5231 statement.setLong(1, objectId);
5232 rs = connection.executeQuery(statement);
5233 List<AbstractFile> files = resultSetToAbstractFiles(rs, connection);
5234 if (files.size() > 0) {
5235 return files.get(0);
5239 }
catch (SQLException ex) {
5240 throw new TskCoreException(
"Error getting file by id, id = " + objectId, ex);
5258 CaseDbConnection connection = connections.getConnection();
5260 ResultSet rs = null;
5262 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID);
5263 statement.clearParameters();
5264 statement.setLong(1,
id);
5265 rs = connection.executeQuery(statement);
5266 List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
5267 if (artifacts.size() > 0) {
5268 return artifacts.get(0);
5272 }
catch (SQLException ex) {
5273 throw new TskCoreException(
"Error getting artifacts by artifact_obj_id, artifact_obj_id = " +
id, ex);
5292 CaseDbConnection connection = connections.getConnection();
5294 ResultSet rs = null;
5296 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_ID);
5297 statement.clearParameters();
5298 statement.setLong(1,
id);
5299 rs = connection.executeQuery(statement);
5300 List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
5301 if (artifacts.size() > 0) {
5302 return artifacts.get(0);
5306 }
catch (SQLException ex) {
5307 throw new TskCoreException(
"Error getting artifacts by artifact id, artifact id = " +
id, ex);
5327 private long getFileSystemId(
long fileId, CaseDbConnection connection) {
5329 ResultSet rs = null;
5332 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_SYSTEM_BY_OBJECT);
5333 statement.clearParameters();
5334 statement.setLong(1, fileId);
5335 rs = connection.executeQuery(statement);
5337 ret = rs.getLong(
"fs_obj_id");
5342 }
catch (SQLException e) {
5343 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
5363 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
5364 CaseDbConnection connection = connections.getConnection();
5366 Statement statement = null;
5367 ResultSet resultSet = null;
5369 statement = connection.createStatement();
5370 resultSet = connection.executeQuery(statement, query);
5372 return (resultSet.getLong(
"count") > 0L);
5373 }
catch (SQLException ex) {
5374 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
5376 closeResultSet(resultSet);
5377 closeStatement(statement);
5394 public List<AbstractFile>
findFiles(
Content dataSource, String fileName)
throws TskCoreException {
5395 List<AbstractFile> files =
new ArrayList<AbstractFile>();
5396 CaseDbConnection connection = connections.getConnection();
5398 ResultSet resultSet = null;
5400 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME);
5401 statement.clearParameters();
5402 statement.setString(1, fileName.toLowerCase());
5403 statement.setLong(2, dataSource.getId());
5404 resultSet = connection.executeQuery(statement);
5405 files.addAll(resultSetToAbstractFiles(resultSet, connection));
5406 }
catch (SQLException e) {
5407 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
5409 closeResultSet(resultSet);
5429 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, String dirSubString)
throws TskCoreException {
5430 List<AbstractFile> files =
new ArrayList<AbstractFile>();
5431 CaseDbConnection connection = connections.getConnection();
5433 ResultSet resultSet = null;
5435 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
5436 statement.clearParameters();
5437 statement.setString(1, fileName.toLowerCase());
5438 statement.setString(2,
"%" + dirSubString.toLowerCase() +
"%");
5439 statement.setLong(3, dataSource.getId());
5440 resultSet = connection.executeQuery(statement);
5441 files.addAll(resultSetToAbstractFiles(resultSet, connection));
5442 }
catch (SQLException e) {
5443 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
5445 closeResultSet(resultSet);
5471 if (null != localTrans) {
5474 }
catch (TskCoreException ex2) {
5475 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
5493 private long addObject(
long parentId,
int objectType, CaseDbConnection connection)
throws SQLException {
5494 ResultSet resultSet = null;
5498 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
5499 statement.clearParameters();
5500 if (parentId != 0) {
5501 statement.setLong(1, parentId);
5503 statement.setNull(1, java.sql.Types.BIGINT);
5505 statement.setInt(2, objectType);
5506 connection.executeUpdate(statement);
5507 resultSet = statement.getGeneratedKeys();
5509 if (resultSet.next()) {
5510 if (parentId != 0) {
5511 setHasChildren(parentId);
5513 return resultSet.getLong(1);
5515 throw new SQLException(
"Error inserting object with parent " + parentId +
" into tsk_objects");
5518 closeResultSet(resultSet);
5541 if (transaction == null) {
5542 throw new TskCoreException(
"Passed null CaseDbTransaction");
5545 ResultSet resultSet = null;
5548 CaseDbConnection connection = transaction.getConnection();
5553 if (isRootDirectory((AbstractFile) parent, transaction)) {
5556 parentPath = ((AbstractFile) parent).getParentPath() + parent.
getName() +
"/";
5570 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5571 statement.clearParameters();
5572 statement.setLong(1, newObjId);
5575 if (0 != parentId) {
5576 long parentFs = this.getFileSystemId(parentId, connection);
5577 if (parentFs != -1) {
5578 statement.setLong(2, parentFs);
5580 statement.setNull(2, java.sql.Types.BIGINT);
5583 statement.setNull(2, java.sql.Types.BIGINT);
5587 statement.setString(3, directoryName);
5591 statement.setShort(5, (
short) 1);
5595 statement.setShort(6, dirType.
getValue());
5597 statement.setShort(7, metaType.
getValue());
5601 statement.setShort(8, dirFlag.
getValue());
5604 statement.setShort(9, metaFlags);
5607 statement.setLong(10, 0);
5610 statement.setNull(11, java.sql.Types.BIGINT);
5611 statement.setNull(12, java.sql.Types.BIGINT);
5612 statement.setNull(13, java.sql.Types.BIGINT);
5613 statement.setNull(14, java.sql.Types.BIGINT);
5615 statement.setNull(15, java.sql.Types.VARCHAR);
5617 statement.setNull(17, java.sql.Types.VARCHAR);
5620 statement.setString(18, parentPath);
5623 long dataSourceObjectId;
5624 if (0 == parentId) {
5625 dataSourceObjectId = newObjId;
5627 dataSourceObjectId = getDataSourceObjectId(connection, parentId);
5629 statement.setLong(19, dataSourceObjectId);
5632 statement.setString(20, null);
5633 connection.executeUpdate(statement);
5635 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
5638 }
catch (SQLException e) {
5639 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
5641 closeResultSet(resultSet);
5663 }
catch (TskCoreException ex) {
5666 }
catch (TskCoreException ex2) {
5667 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
5691 if (transaction == null) {
5692 throw new TskCoreException(
"Passed null CaseDbTransaction");
5695 ResultSet resultSet = null;
5698 CaseDbConnection connection = transaction.getConnection();
5701 if ((parent == null) || isRootDirectory(parent, transaction)) {
5714 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5715 statement.clearParameters();
5716 statement.setLong(1, newObjId);
5719 statement.setNull(2, java.sql.Types.BIGINT);
5722 statement.setString(3, directoryName);
5726 statement.setShort(5, (
short) 1);
5730 statement.setShort(6, dirType.
getValue());
5732 statement.setShort(7, metaType.
getValue());
5736 statement.setShort(8, dirFlag.
getValue());
5739 statement.setShort(9, metaFlags);
5742 statement.setLong(10, 0);
5745 statement.setNull(11, java.sql.Types.BIGINT);
5746 statement.setNull(12, java.sql.Types.BIGINT);
5747 statement.setNull(13, java.sql.Types.BIGINT);
5748 statement.setNull(14, java.sql.Types.BIGINT);
5750 statement.setNull(15, java.sql.Types.VARCHAR);
5752 statement.setNull(17, java.sql.Types.VARCHAR);
5755 statement.setString(18, parentPath);
5758 long dataSourceObjectId = getDataSourceObjectId(connection, parentId);
5759 statement.setLong(19, dataSourceObjectId);
5762 statement.setString(20, null);
5764 connection.executeUpdate(statement);
5766 return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
5769 }
catch (SQLException e) {
5770 throw new TskCoreException(
"Error creating local directory '" + directoryName +
"'", e);
5772 closeResultSet(resultSet);
5797 Statement statement = null;
5801 CaseDbConnection connection = transaction.getConnection();
5806 statement = connection.createStatement();
5807 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
5808 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"');");
5817 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
5818 preparedStatement.clearParameters();
5819 preparedStatement.setLong(1, newObjId);
5820 preparedStatement.setNull(2, java.sql.Types.BIGINT);
5821 preparedStatement.setString(3, rootDirectoryName);
5823 preparedStatement.setShort(5, (
short) 1);
5827 preparedStatement.setShort(7, metaType.
getValue());
5829 preparedStatement.setShort(8, dirFlag.
getValue());
5832 preparedStatement.setShort(9, metaFlags);
5833 preparedStatement.setLong(10, 0);
5834 preparedStatement.setNull(11, java.sql.Types.BIGINT);
5835 preparedStatement.setNull(12, java.sql.Types.BIGINT);
5836 preparedStatement.setNull(13, java.sql.Types.BIGINT);
5837 preparedStatement.setNull(14, java.sql.Types.BIGINT);
5838 preparedStatement.setNull(15, java.sql.Types.VARCHAR);
5840 preparedStatement.setNull(17, java.sql.Types.VARCHAR);
5841 String parentPath =
"/";
5842 preparedStatement.setString(18, parentPath);
5843 preparedStatement.setLong(19, newObjId);
5844 preparedStatement.setString(20, null);
5845 connection.executeUpdate(preparedStatement);
5847 return new LocalFilesDataSource(
this, newObjId, newObjId, deviceId, rootDirectoryName, dirType, metaType, dirFlag, metaFlags, timeZone, null,
FileKnown.
UNKNOWN, parentPath);
5849 }
catch (SQLException ex) {
5850 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
5852 closeStatement(statement);
5877 String timezone, String md5, String sha1, String sha256,
5881 Statement statement = null;
5884 CaseDbConnection connection = transaction.getConnection();
5889 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
5890 preparedStatement.clearParameters();
5891 preparedStatement.setLong(1, newObjId);
5892 preparedStatement.setShort(2, (
short) type.getValue());
5893 preparedStatement.setLong(3, sectorSize);
5894 preparedStatement.setString(4, timezone);
5896 long savedSize = size < 0 ? 0 : size;
5897 preparedStatement.setLong(5, savedSize);
5898 preparedStatement.setString(6, md5);
5899 preparedStatement.setString(7, sha1);
5900 preparedStatement.setString(8, sha256);
5901 preparedStatement.setString(9, displayName);
5902 connection.executeUpdate(preparedStatement);
5905 for (
int i = 0; i < imagePaths.size(); i++) {
5906 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
5907 preparedStatement.clearParameters();
5908 preparedStatement.setLong(1, newObjId);
5909 preparedStatement.setString(2, imagePaths.get(i));
5910 preparedStatement.setLong(3, i);
5911 connection.executeUpdate(preparedStatement);
5915 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO);
5916 statement = connection.createStatement();
5917 preparedStatement.setLong(1, newObjId);
5918 preparedStatement.setString(2, deviceId);
5919 preparedStatement.setString(3, timezone);
5920 connection.executeUpdate(preparedStatement);
5923 String name = displayName;
5924 if (name == null || name.isEmpty()) {
5925 if (imagePaths.size() > 0) {
5926 String path = imagePaths.get(0);
5927 name = (
new java.io.File(path)).getName();
5932 return new Image(
this, newObjId, type.getValue(), deviceId, sectorSize, name,
5933 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, savedSize);
5934 }
catch (SQLException ex) {
5935 if (!imagePaths.isEmpty()) {
5936 throw new TskCoreException(String.format(
"Error adding image with path %s to database", imagePaths.get(0)), ex);
5938 throw new TskCoreException(String.format(
"Error adding image with display name %s to database", displayName), ex);
5941 closeStatement(statement);
5964 CaseDbConnection connection = transaction.getConnection();
5965 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
VS.getObjectType(), connection);
5969 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_INFO);
5970 preparedStatement.clearParameters();
5971 preparedStatement.setLong(1, newObjId);
5972 preparedStatement.setShort(2, (
short) type.getVsType());
5973 preparedStatement.setLong(3, imgOffset);
5974 preparedStatement.setLong(4, blockSize);
5975 connection.executeUpdate(preparedStatement);
5978 return new VolumeSystem(
this, newObjId,
"", type.getVsType(), imgOffset, blockSize);
5979 }
catch (SQLException ex) {
5980 throw new TskCoreException(String.format(
"Error creating volume system with parent ID %d and image offset %d",
5981 parentObjId, imgOffset), ex);
6002 public Volume addVolume(
long parentObjId,
long addr,
long start,
long length, String desc,
6005 Statement statement = null;
6008 CaseDbConnection connection = transaction.getConnection();
6013 PreparedStatement preparedStatement;
6015 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL);
6017 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_SQLITE);
6019 preparedStatement.clearParameters();
6020 preparedStatement.setLong(1, newObjId);
6021 preparedStatement.setLong(2, addr);
6022 preparedStatement.setLong(3, start);
6023 preparedStatement.setLong(4, length);
6024 preparedStatement.setString(5, desc);
6025 preparedStatement.setShort(6, (
short) flags);
6026 connection.executeUpdate(preparedStatement);
6029 return new Volume(
this, newObjId, addr, start, length, flags, desc);
6030 }
catch (SQLException ex) {
6031 throw new TskCoreException(String.format(
"Error creating volume with address %d and parent ID %d", addr, parentObjId), ex);
6033 closeStatement(statement);
6051 Statement statement = null;
6054 CaseDbConnection connection = transaction.getConnection();
6059 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_POOL_INFO);
6060 preparedStatement.clearParameters();
6061 preparedStatement.setLong(1, newObjId);
6062 preparedStatement.setShort(2, type.getValue());
6063 connection.executeUpdate(preparedStatement);
6066 return new Pool(
this, newObjId, type.getName(), type.getValue());
6067 }
catch (SQLException ex) {
6068 throw new TskCoreException(String.format(
"Error creating pool with type %d and parent ID %d", type.getValue(), parentObjId), ex);
6070 closeStatement(statement);
6094 long rootInum,
long firstInum,
long lastInum, String displayName,
6097 Statement statement = null;
6100 CaseDbConnection connection = transaction.getConnection();
6101 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
FS.getObjectType(), connection);
6104 long dataSourceId = getDataSourceObjectId(connection, newObjId);
6108 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FS_INFO);
6109 preparedStatement.clearParameters();
6110 preparedStatement.setLong(1, newObjId);
6111 preparedStatement.setLong(2, dataSourceId);
6112 preparedStatement.setLong(3, imgOffset);
6113 preparedStatement.setInt(4, type.getValue());
6114 preparedStatement.setLong(5, blockSize);
6115 preparedStatement.setLong(6, blockCount);
6116 preparedStatement.setLong(7, rootInum);
6117 preparedStatement.setLong(8, firstInum);
6118 preparedStatement.setLong(9, lastInum);
6119 preparedStatement.setString(10, displayName);
6120 connection.executeUpdate(preparedStatement);
6123 return new FileSystem(
this, newObjId, displayName, imgOffset, type, blockSize, blockCount, rootInum,
6124 firstInum, lastInum);
6125 }
catch (SQLException ex) {
6126 throw new TskCoreException(String.format(
"Error creating file system with image offset %d and parent ID %d",
6127 imgOffset, parentObjId), ex);
6129 closeStatement(statement);
6161 long metaAddr,
int metaSeq,
6164 long ctime,
long crtime,
long atime,
long mtime,
6165 boolean isFile,
Content parent)
throws TskCoreException {
6170 Statement queryStatement = null;
6172 CaseDbConnection connection = transaction.getConnection();
6181 AbstractFile parentFile = (AbstractFile) parent;
6182 if (isRootDirectory(parentFile, transaction)) {
6185 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
6191 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE);
6192 statement.clearParameters();
6193 statement.setLong(1, objectId);
6194 statement.setLong(2, fsObjId);
6195 statement.setLong(3, dataSourceObjId);
6196 statement.setShort(4, (
short) attrType.getValue());
6197 statement.setInt(5, attrId);
6198 statement.setString(6, fileName);
6199 statement.setLong(7, metaAddr);
6200 statement.setInt(8, metaSeq);
6202 statement.setShort(10, (
short) 1);
6204 statement.setShort(11, dirType.
getValue());
6206 statement.setShort(12, metaType.
getValue());
6207 statement.setShort(13, dirFlag.getValue());
6208 statement.setShort(14, metaFlags);
6209 statement.setLong(15, size < 0 ? 0 : size);
6210 statement.setLong(16, ctime);
6211 statement.setLong(17, crtime);
6212 statement.setLong(18, atime);
6213 statement.setLong(19, mtime);
6214 statement.setString(20, parentPath);
6215 final String extension = extractExtension(fileName);
6216 statement.setString(21, extension);
6218 connection.executeUpdate(statement);
6220 DerivedFile derivedFile =
new DerivedFile(
this, objectId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
6221 size, ctime, crtime, atime, mtime, null, null, parentPath, null, parent.getId(), null, null, extension);
6223 timelineManager.addEventsForNewFile(derivedFile, connection);
6229 attrType, attrId, fileName, metaAddr, metaSeq,
6230 dirType, metaType, dirFlag, metaFlags,
6231 size, ctime, crtime, atime, mtime,
6232 (
short) 0, 0, 0, null, null, parentPath, null,
6235 }
catch (SQLException ex) {
6236 logger.log(Level.WARNING,
"Failed to add file system file", ex);
6238 closeStatement(queryStatement);
6239 if (null != transaction) {
6242 }
catch (TskCoreException ex2) {
6243 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6259 CaseDbConnection connection = connections.getConnection();
6262 ResultSet rs = null;
6264 s = connection.createStatement();
6265 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
6267 +
" AND obj_id = data_source_obj_id"
6268 +
" ORDER BY dir_type, LOWER(name)");
6269 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
6271 virtDirRootIds.add(virtualDirectory(rs, connection));
6273 return virtDirRootIds;
6274 }
catch (SQLException ex) {
6275 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
6297 assert (null != fileRanges);
6298 if (null == fileRanges) {
6299 throw new TskCoreException(
"TskFileRange object is null");
6302 assert (null != parent);
6303 if (null == parent) {
6304 throw new TskCoreException(
"Conent is null");
6308 Statement statement = null;
6309 ResultSet resultSet = null;
6313 CaseDbConnection connection = transaction.getConnection();
6315 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<LayoutFile>();
6323 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
6332 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6333 prepStmt.clearParameters();
6334 prepStmt.setLong(1, fileRangeId);
6335 prepStmt.setNull(2, java.sql.Types.BIGINT);
6336 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
6338 prepStmt.setNull(5, java.sql.Types.BIGINT);
6343 prepStmt.setLong(10, fileRange.getByteLen());
6344 prepStmt.setNull(11, java.sql.Types.BIGINT);
6345 prepStmt.setNull(12, java.sql.Types.BIGINT);
6346 prepStmt.setNull(13, java.sql.Types.BIGINT);
6347 prepStmt.setNull(14, java.sql.Types.BIGINT);
6348 prepStmt.setNull(15, java.sql.Types.VARCHAR);
6350 prepStmt.setNull(17, java.sql.Types.VARCHAR);
6351 prepStmt.setNull(18, java.sql.Types.VARCHAR);
6352 prepStmt.setLong(19, parent.getId());
6355 prepStmt.setString(20, null);
6356 connection.executeUpdate(prepStmt);
6363 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
6364 prepStmt.clearParameters();
6365 prepStmt.setLong(1, fileRangeId);
6366 prepStmt.setLong(2, fileRange.getByteStart());
6367 prepStmt.setLong(3, fileRange.getByteLen());
6368 prepStmt.setLong(4, fileRange.getSequence());
6369 connection.executeUpdate(prepStmt);
6374 fileRangeLayoutFiles.add(
new LayoutFile(
this,
6377 Long.toString(fileRange.getSequence()),
6383 fileRange.getByteLen(),
6387 parent.getUniquePath(),
6393 return fileRangeLayoutFiles;
6395 }
catch (SQLException ex) {
6396 throw new TskCoreException(
"Failed to add layout files to case database", ex);
6398 closeResultSet(resultSet);
6399 closeStatement(statement);
6401 if (null != transaction) {
6404 }
catch (TskCoreException ex2) {
6405 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6423 assert (null != carvingResult);
6424 if (null == carvingResult) {
6425 throw new TskCoreException(
"Carving is null");
6427 assert (null != carvingResult.getParent());
6428 if (null == carvingResult.getParent()) {
6429 throw new TskCoreException(
"Carving result has null parent");
6431 assert (null != carvingResult.getCarvedFiles());
6432 if (null == carvingResult.getCarvedFiles()) {
6433 throw new TskCoreException(
"Carving result has null carved files");
6436 Statement statement = null;
6437 ResultSet resultSet = null;
6438 long newCacheKey = 0;
6441 CaseDbConnection connection = transaction.getConnection();
6450 while (null != root) {
6465 if (null == carvedFilesDir) {
6466 List<Content> rootChildren;
6468 rootChildren = ((FileSystem) root).getRootDirectory().
getChildren();
6472 for (
Content child : rootChildren) {
6478 if (null == carvedFilesDir) {
6479 long parId = root.
getId();
6481 if (root instanceof FileSystem) {
6482 Content rootDir = ((FileSystem) root).getRootDirectory();
6483 parId = rootDir.
getId();
6487 newCacheKey = root.
getId();
6488 rootIdsToCarvedFileDirs.put(newCacheKey, carvedFilesDir);
6495 String parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
6496 List<LayoutFile> carvedFiles =
new ArrayList<LayoutFile>();
6512 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6513 prepStmt.clearParameters();
6514 prepStmt.setLong(1, carvedFileId);
6516 prepStmt.setLong(2, root.
getId());
6518 prepStmt.setNull(2, java.sql.Types.BIGINT);
6520 prepStmt.setString(3, carvedFile.getName());
6522 prepStmt.setShort(5, (
short) 1);
6527 prepStmt.setLong(10, carvedFile.getSizeInBytes());
6528 prepStmt.setNull(11, java.sql.Types.BIGINT);
6529 prepStmt.setNull(12, java.sql.Types.BIGINT);
6530 prepStmt.setNull(13, java.sql.Types.BIGINT);
6531 prepStmt.setNull(14, java.sql.Types.BIGINT);
6532 prepStmt.setNull(15, java.sql.Types.VARCHAR);
6534 prepStmt.setNull(17, java.sql.Types.VARCHAR);
6535 prepStmt.setString(18, parentPath);
6537 prepStmt.setString(20, extractExtension(carvedFile.getName()));
6538 connection.executeUpdate(prepStmt);
6545 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
6546 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
6547 prepStmt.clearParameters();
6548 prepStmt.setLong(1, carvedFileId);
6549 prepStmt.setLong(2, tskFileRange.getByteStart());
6550 prepStmt.setLong(3, tskFileRange.getByteLen());
6551 prepStmt.setLong(4, tskFileRange.getSequence());
6552 connection.executeUpdate(prepStmt);
6561 carvedFile.getName(),
6567 carvedFile.getSizeInBytes(),
6579 }
catch (SQLException ex) {
6580 throw new TskCoreException(
"Failed to add carved files to case database", ex);
6582 closeResultSet(resultSet);
6583 closeStatement(statement);
6585 if (null != transaction) {
6588 }
catch (TskCoreException ex2) {
6589 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6591 if (0 != newCacheKey) {
6592 rootIdsToCarvedFileDirs.remove(newCacheKey);
6629 long size,
long ctime,
long crtime,
long atime,
long mtime,
6630 boolean isFile,
Content parentObj,
6631 String rederiveDetails, String toolName, String toolVersion,
6634 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
6639 CaseDbConnection connection = transaction.getConnection();
6641 final long parentId = parentObj.
getId();
6642 String parentPath =
"";
6646 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() +
'/';
6658 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6659 statement.clearParameters();
6660 statement.setLong(1, newObjId);
6663 long fsObjId = this.getFileSystemId(parentId, connection);
6664 if (fsObjId != -1) {
6665 statement.setLong(2, fsObjId);
6667 statement.setNull(2, java.sql.Types.BIGINT);
6669 statement.setString(3, fileName);
6673 statement.setShort(5, (
short) 1);
6677 statement.setShort(6, dirType.
getValue());
6679 statement.setShort(7, metaType.
getValue());
6683 statement.setShort(8, dirFlag.
getValue());
6686 statement.setShort(9, metaFlags);
6690 long savedSize = size < 0 ? 0 : size;
6691 statement.setLong(10, savedSize);
6695 statement.setLong(11, ctime);
6696 statement.setLong(12, crtime);
6697 statement.setLong(13, atime);
6698 statement.setLong(14, mtime);
6700 statement.setNull(15, java.sql.Types.VARCHAR);
6702 statement.setNull(17, java.sql.Types.VARCHAR);
6705 statement.setString(18, parentPath);
6708 long dataSourceObjId = getDataSourceObjectId(connection, parentId);
6709 statement.setLong(19, dataSourceObjId);
6710 final String extension = extractExtension(fileName);
6712 statement.setString(20, extension);
6714 connection.executeUpdate(statement);
6717 addFilePath(connection, newObjId, localPath, encodingType);
6719 DerivedFile derivedFile =
new DerivedFile(
this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
6720 savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
6722 timelineManager.addEventsForNewFile(derivedFile, connection);
6726 }
catch (SQLException ex) {
6727 connection.rollbackTransaction();
6728 throw new TskCoreException(
"Failed to add derived file to case database", ex);
6765 long size,
long ctime,
long crtime,
long atime,
long mtime,
6766 boolean isFile, String mimeType,
6767 String rederiveDetails, String toolName, String toolVersion,
6771 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
6773 CaseDbConnection connection = connections.getConnection();
6775 ResultSet rs = null;
6778 connection.beginTransaction();
6779 final long parentId = parentObj.
getId();
6780 String parentPath =
"";
6784 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.
getName() +
'/';
6788 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_DERIVED_FILE);
6789 statement.clearParameters();
6796 statement.setShort(2, dirType.
getValue());
6798 statement.setShort(3, metaType.
getValue());
6802 statement.setShort(4, dirFlag.
getValue());
6805 statement.setShort(5, metaFlags);
6809 long savedSize = size < 0 ? 0 : size;
6810 statement.setLong(6, savedSize);
6814 statement.setLong(7, ctime);
6815 statement.setLong(8, crtime);
6816 statement.setLong(9, atime);
6817 statement.setLong(10, mtime);
6818 statement.setString(11, mimeType);
6819 statement.setString(12, String.valueOf(derivedFile.
getId()));
6820 connection.executeUpdate(statement);
6823 updateFilePath(connection, derivedFile.
getId(), localPath, encodingType);
6825 connection.commitTransaction();
6827 long dataSourceObjId = getDataSourceObjectId(connection, parentId);
6828 final String extension = extractExtension(derivedFile.
getName());
6829 return new DerivedFile(
this, derivedFile.
getId(), dataSourceObjId, derivedFile.
getName(), dirType, metaType, dirFlag, metaFlags,
6830 savedSize, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension);
6831 }
catch (SQLException ex) {
6832 connection.rollbackTransaction();
6833 throw new TskCoreException(
"Failed to add derived file to case database", ex);
6861 long size,
long ctime,
long crtime,
long atime,
long mtime,
6867 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
6872 if (null != localTrans) {
6875 }
catch (TskCoreException ex2) {
6876 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6907 long size,
long ctime,
long crtime,
long atime,
long mtime,
6912 size, ctime, crtime, atime, mtime,
6914 isFile, encodingType,
6915 parent, transaction);
6946 long size,
long ctime,
long crtime,
long atime,
long mtime,
6947 String md5,
FileKnown known, String mimeType,
6950 CaseDbConnection connection = transaction.getConnection();
6951 Statement queryStatement = null;
6963 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6964 statement.clearParameters();
6965 statement.setLong(1, objectId);
6966 statement.setNull(2, java.sql.Types.BIGINT);
6967 statement.setString(3, fileName);
6969 statement.setShort(5, (
short) 1);
6971 statement.setShort(6, dirType.
getValue());
6973 statement.setShort(7, metaType.
getValue());
6975 statement.setShort(8, dirFlag.
getValue());
6977 statement.setShort(9, metaFlags);
6979 long savedSize = size < 0 ? 0 : size;
6980 statement.setLong(10, savedSize);
6981 statement.setLong(11, ctime);
6982 statement.setLong(12, crtime);
6983 statement.setLong(13, atime);
6984 statement.setLong(14, mtime);
6985 statement.setString(15, md5);
6986 if (known != null) {
6987 statement.setByte(16, known.getFileKnownValue());
6991 statement.setString(17, mimeType);
6993 long dataSourceObjId;
6996 AbstractFile parentFile = (AbstractFile) parent;
6997 if (isRootDirectory(parentFile, transaction)) {
7000 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
7005 dataSourceObjId = getDataSourceObjectId(connection, parent.getId());
7007 statement.setString(18, parentPath);
7008 statement.setLong(19, dataSourceObjId);
7009 final String extension = extractExtension(fileName);
7010 statement.setString(20, extension);
7012 connection.executeUpdate(statement);
7013 addFilePath(connection, objectId, localPath, encodingType);
7023 ctime, crtime, atime, mtime,
7024 mimeType, md5, known,
7025 parent.getId(), parentPath,
7028 encodingType, extension);
7032 }
catch (SQLException ex) {
7033 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
7035 closeStatement(queryStatement);
7052 CaseDbConnection connection = transaction.getConnection();
7053 Statement statement = null;
7054 ResultSet resultSet = null;
7057 String query = String.format(
"SELECT ParentRow.type AS parent_type, ParentRow.obj_id AS parent_object_id "
7058 +
"FROM tsk_objects ParentRow JOIN tsk_objects ChildRow ON ChildRow.par_obj_id = ParentRow.obj_id "
7059 +
"WHERE ChildRow.obj_id = %s;", file.
getId());
7061 statement = connection.createStatement();
7062 resultSet = statement.executeQuery(query);
7063 if (resultSet.next()) {
7064 long parentId = resultSet.getLong(
"parent_object_id");
7065 if (parentId == 0) {
7068 int type = resultSet.getInt(
"parent_type");
7069 return (type == TskData.ObjectType.IMG.getObjectType()
7070 || type == TskData.ObjectType.VS.getObjectType()
7071 || type == TskData.ObjectType.VOL.getObjectType()
7072 || type == TskData.ObjectType.FS.getObjectType());
7077 }
catch (SQLException ex) {
7078 throw new TskCoreException(String.format(
"Failed to lookup parent of file (%s) with id %d", file.
getName(), file.
getId()), ex);
7080 closeResultSet(resultSet);
7081 closeStatement(statement);
7107 long ctime,
long crtime,
long atime,
long mtime,
7108 List<TskFileRange> fileRanges,
7109 Content parent)
throws TskCoreException {
7111 if (null == parent) {
7112 throw new TskCoreException(
"Parent can not be null");
7117 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
7123 Statement statement = null;
7124 ResultSet resultSet = null;
7127 CaseDbConnection connection = transaction.getConnection();
7143 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7144 prepStmt.clearParameters();
7145 prepStmt.setLong(1, newFileId);
7148 if (0 != parent.getId()) {
7149 long parentFs = this.getFileSystemId(parent.getId(), connection);
7150 if (parentFs != -1) {
7151 prepStmt.setLong(2, parentFs);
7153 prepStmt.setNull(2, java.sql.Types.BIGINT);
7156 prepStmt.setNull(2, java.sql.Types.BIGINT);
7158 prepStmt.setString(3, fileName);
7160 prepStmt.setShort(5, (
short) 0);
7163 prepStmt.setShort(8, dirFlag.getValue());
7164 prepStmt.setShort(9, metaFlag.getValue());
7166 long savedSize = size < 0 ? 0 : size;
7167 prepStmt.setLong(10, savedSize);
7168 prepStmt.setLong(11, ctime);
7169 prepStmt.setLong(12, crtime);
7170 prepStmt.setLong(13, atime);
7171 prepStmt.setLong(14, mtime);
7172 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7174 prepStmt.setNull(17, java.sql.Types.VARCHAR);
7175 prepStmt.setString(18, parentPath);
7176 prepStmt.setLong(19, parent.getDataSource().getId());
7178 prepStmt.setString(20, extractExtension(fileName));
7179 connection.executeUpdate(prepStmt);
7186 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7188 prepStmt.clearParameters();
7189 prepStmt.setLong(1, newFileId);
7190 prepStmt.setLong(2, tskFileRange.getByteStart());
7191 prepStmt.setLong(3, tskFileRange.getByteLen());
7192 prepStmt.setLong(4, tskFileRange.getSequence());
7193 connection.executeUpdate(prepStmt);
7201 parent.getDataSource().getId(),
7207 metaFlag.getValue(),
7209 ctime, crtime, atime, mtime,
7219 }
catch (SQLException ex) {
7220 throw new TskCoreException(
"Failed to add layout file " + fileName +
" to case database", ex);
7222 closeResultSet(resultSet);
7223 closeStatement(statement);
7225 if (null != transaction) {
7228 }
catch (TskCoreException ex2) {
7229 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7247 private long getDataSourceObjectId(CaseDbConnection connection,
long objectId)
throws TskCoreException {
7249 Statement statement = null;
7250 ResultSet resultSet = null;
7252 statement = connection.createStatement();
7253 long dataSourceObjId;
7254 long ancestorId = objectId;
7256 dataSourceObjId = ancestorId;
7257 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
7258 resultSet = statement.executeQuery(query);
7259 if (resultSet.next()) {
7260 ancestorId = resultSet.getLong(
"par_obj_id");
7262 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
7266 }
while (0 != ancestorId);
7267 return dataSourceObjId;
7268 }
catch (SQLException ex) {
7269 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
7271 closeResultSet(resultSet);
7272 closeStatement(statement);
7288 private void addFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
7289 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LOCAL_PATH);
7290 statement.clearParameters();
7291 statement.setLong(1, objId);
7292 statement.setString(2, path);
7293 statement.setInt(3, type.getType());
7294 connection.executeUpdate(statement);
7308 private void updateFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
7309 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_LOCAL_PATH);
7310 statement.clearParameters();
7311 statement.setString(1, path);
7312 statement.setInt(2, type.getType());
7313 statement.setLong(3, objId);
7314 connection.executeUpdate(statement);
7333 return findFiles(dataSource, fileName, parentFile.getName());
7348 CaseDbConnection connection = connections.getConnection();
7351 ResultSet rs = null;
7353 s = connection.createStatement();
7354 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
7356 return rs.getLong(
"count");
7357 }
catch (SQLException e) {
7358 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
7385 CaseDbConnection connection = connections.getConnection();
7388 ResultSet rs = null;
7390 s = connection.createStatement();
7391 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
7392 return resultSetToAbstractFiles(rs, connection);
7393 }
catch (SQLException e) {
7394 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
7416 CaseDbConnection connection = connections.getConnection();
7419 ResultSet rs = null;
7421 s = connection.createStatement();
7422 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
7423 List<Long> ret =
new ArrayList<Long>();
7425 ret.add(rs.getLong(
"obj_id"));
7428 }
catch (SQLException e) {
7429 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
7449 public List<AbstractFile>
openFiles(
Content dataSource, String filePath)
throws TskCoreException {
7456 int lastSlash = path.lastIndexOf(
'/');
7459 if (lastSlash == path.length()) {
7460 path = path.substring(0, lastSlash - 1);
7461 lastSlash = path.lastIndexOf(
'/');
7464 String parentPath = path.substring(0, lastSlash);
7465 String fileName = path.substring(lastSlash);
7467 return findFiles(dataSource, fileName, parentPath);
7481 CaseDbConnection connection = connections.getConnection();
7484 ResultSet rs = null;
7486 s = connection.createStatement();
7487 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
7488 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
7491 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
7495 }
catch (SQLException ex) {
7496 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
7516 CaseDbConnection connection = connections.getConnection();
7518 Statement s1 = null;
7519 ResultSet rs1 = null;
7520 Statement s2 = null;
7521 ResultSet rs2 = null;
7523 s1 = connection.createStatement();
7524 rs1 = connection.executeQuery(s1,
"SELECT tsk_image_info.type, tsk_image_info.ssize, tsk_image_info.tzone, tsk_image_info.size, tsk_image_info.md5, tsk_image_info.sha1, tsk_image_info.sha256, tsk_image_info.display_name, data_source_info.device_id "
7525 +
"FROM tsk_image_info "
7526 +
"INNER JOIN data_source_info ON tsk_image_info.obj_id = data_source_info.obj_id "
7527 +
"WHERE tsk_image_info.obj_id = " +
id);
7529 s2 = connection.createStatement();
7530 rs2 = connection.executeQuery(s2,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " +
id);
7531 List<String> imagePaths =
new ArrayList<String>();
7532 while (rs2.next()) {
7533 imagePaths.add(rs2.getString(
"name"));
7535 long type = rs1.getLong(
"type");
7536 long ssize = rs1.getLong(
"ssize");
7537 String tzone = rs1.getString(
"tzone");
7538 long size = rs1.getLong(
"size");
7539 String md5 = rs1.getString(
"md5");
7540 String sha1 = rs1.getString(
"sha1");
7541 String sha256 = rs1.getString(
"sha256");
7542 String name = rs1.getString(
"display_name");
7544 if (imagePaths.size() > 0) {
7545 String path = imagePaths.get(0);
7546 name = (
new java.io.File(path)).getName();
7551 String device_id = rs1.getString(
"device_id");
7553 return new Image(
this,
id, type, device_id, ssize, name,
7554 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, sha1, sha256, size);
7556 throw new TskCoreException(
"No image found for id: " +
id);
7558 }
catch (SQLException ex) {
7559 throw new TskCoreException(
"Error getting Image by id, id = " +
id, ex);
7561 closeResultSet(rs2);
7563 closeResultSet(rs1);
7582 CaseDbConnection connection = connections.getConnection();
7585 ResultSet rs = null;
7587 s = connection.createStatement();
7588 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
7589 +
"where obj_id = " +
id);
7591 long type = rs.getLong(
"vs_type");
7592 long imgOffset = rs.getLong(
"img_offset");
7593 long blockSize = rs.getLong(
"block_size");
7595 vs.setParent(parent);
7598 throw new TskCoreException(
"No volume system found for id:" +
id);
7600 }
catch (SQLException ex) {
7601 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
7618 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
7619 VolumeSystem vs = getVolumeSystemById(
id, null);
7620 vs.setParentId(parentId);
7635 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
7636 return getFileSystemByIdHelper(
id, parent);
7647 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
7649 FileSystem fs = getFileSystemById(
id, vol);
7650 fs.setParentId(parentId);
7665 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
7666 return getFileSystemByIdHelper(
id, parent);
7680 Pool getPoolById(
long id, Content parent)
throws TskCoreException {
7681 return getPoolByIdHelper(
id, parent);
7692 Pool getPoolById(
long id,
long parentId)
throws TskCoreException {
7693 Pool pool = getPoolById(
id, null);
7694 pool.setParentId(parentId);
7709 private Pool getPoolByIdHelper(
long id, Content parent)
throws TskCoreException {
7712 try (CaseDbConnection connection = connections.getConnection();
7713 Statement s = connection.createStatement();
7714 ResultSet rs = connection.executeQuery(s,
"SELECT * FROM tsk_pool_info "
7715 +
"where obj_id = " +
id);) {
7717 Pool pool =
new Pool(
this, rs.getLong(
"obj_id"), TskData.TSK_POOL_TYPE_ENUM.valueOf(rs.getLong(
"pool_type")).getName(), rs.getLong(
"pool_type"));
7718 pool.setParent(parent);
7722 throw new TskCoreException(
"No pool found for ID:" +
id);
7724 }
catch (SQLException ex) {
7725 throw new TskCoreException(
"Error getting Pool by ID", ex);
7742 private FileSystem getFileSystemByIdHelper(
long id, Content parent)
throws TskCoreException {
7746 synchronized (fileSystemIdMap) {
7747 if (fileSystemIdMap.containsKey(
id)) {
7748 return fileSystemIdMap.get(
id);
7751 CaseDbConnection connection = connections.getConnection();
7754 ResultSet rs = null;
7756 s = connection.createStatement();
7757 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
7758 +
"where obj_id = " +
id);
7760 TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt(
"fs_type"));
7761 FileSystem fs =
new FileSystem(
this, rs.getLong(
"obj_id"),
"", rs.getLong(
"img_offset"),
7762 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
7763 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
7764 fs.setParent(parent);
7766 synchronized (fileSystemIdMap) {
7767 fileSystemIdMap.put(
id, fs);
7771 throw new TskCoreException(
"No file system found for id:" +
id);
7773 }
catch (SQLException ex) {
7774 throw new TskCoreException(
"Error getting File System by ID", ex);
7794 Volume getVolumeById(
long id, VolumeSystem parent)
throws TskCoreException {
7795 CaseDbConnection connection = connections.getConnection();
7798 ResultSet rs = null;
7800 s = connection.createStatement();
7801 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
7802 +
"where obj_id = " +
id);
7813 description = rs.getString(
"desc");
7814 }
catch (Exception ex) {
7815 description = rs.getString(
"descr");
7817 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
7818 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
7820 vol.setParent(parent);
7823 throw new TskCoreException(
"No volume found for id:" +
id);
7825 }
catch (SQLException ex) {
7826 throw new TskCoreException(
"Error getting Volume by ID", ex);
7843 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
7844 Volume vol = getVolumeById(
id, null);
7845 vol.setParentId(parentId);
7860 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
7861 CaseDbConnection connection = connections.getConnection();
7864 ResultSet rs = null;
7866 s = connection.createStatement();
7867 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
7868 +
"WHERE obj_id = " +
id);
7869 Directory temp = null;
7871 final short type = rs.getShort(
"type");
7872 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
7873 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
7874 || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
7875 temp = directory(rs, parentFs);
7877 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
7878 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
7881 throw new TskCoreException(
"No Directory found for id:" +
id);
7884 }
catch (SQLException ex) {
7885 throw new TskCoreException(
"Error getting Directory by ID", ex);
7904 List<FileSystem> fileSystems =
new ArrayList<>();
7905 CaseDbConnection connection = connections.getConnection();
7909 ResultSet rs = null;
7910 String queryStr =
"SELECT * FROM tsk_fs_info WHERE data_source_obj_id = " + image.getId();
7912 s = connection.createStatement();
7913 rs = connection.executeQuery(s, queryStr);
7917 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
7918 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
7920 fileSystems.add(fs);
7922 }
catch (SQLException ex) {
7923 throw new TskCoreException(
"Error looking up files systems. Query: " + queryStr, ex);
7943 List<Content> getImageChildren(
Image img)
throws TskCoreException {
7944 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
7945 List<Content> children =
new ArrayList<Content>();
7946 for (ObjectInfo info : childInfos) {
7947 if (null != info.type) {
7948 switch (info.type) {
7950 children.add(getVolumeSystemById(info.id, img));
7953 children.add(getPoolById(info.id, img));
7956 children.add(getFileSystemById(info.id, img));
7974 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
7991 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
7992 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
7993 List<Long> children =
new ArrayList<Long>();
7994 for (ObjectInfo info : childInfos) {
7995 if (info.type == ObjectType.VS
7996 || info.type == ObjectType.POOL
7997 || info.type == ObjectType.FS
7998 || info.type == ObjectType.ABSTRACTFILE
7999 || info.type == ObjectType.ARTIFACT) {
8000 children.add(info.id);
8001 }
else if (info.type == ObjectType.REPORT) {
8004 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
8020 List<Content> getPoolChildren(Pool pool)
throws TskCoreException {
8021 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
8022 List<Content> children =
new ArrayList<Content>();
8023 for (ObjectInfo info : childInfos) {
8024 if (null != info.type) {
8025 switch (info.type) {
8027 children.add(getVolumeSystemById(info.id, pool));
8042 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
8059 List<Long> getPoolChildrenIds(Pool pool)
throws TskCoreException {
8060 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
8061 List<Long> children =
new ArrayList<Long>();
8062 for (ObjectInfo info : childInfos) {
8063 if (info.type == ObjectType.VS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8064 children.add(info.id);
8066 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
8082 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
8083 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
8084 List<Content> children =
new ArrayList<Content>();
8085 for (ObjectInfo info : childInfos) {
8086 if (null != info.type) {
8087 switch (info.type) {
8089 children.add(getVolumeById(info.id, vs));
8104 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
8121 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
8122 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
8123 List<Long> children =
new ArrayList<Long>();
8124 for (ObjectInfo info : childInfos) {
8125 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8126 children.add(info.id);
8128 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
8144 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
8145 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
8146 List<Content> children =
new ArrayList<Content>();
8147 for (ObjectInfo info : childInfos) {
8148 if (null != info.type) {
8149 switch (info.type) {
8151 children.add(getPoolById(info.id, vol));
8154 children.add(getFileSystemById(info.id, vol));
8169 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
8186 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
8187 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
8188 final List<Long> children =
new ArrayList<Long>();
8189 for (ObjectInfo info : childInfos) {
8190 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
8191 children.add(info.id);
8193 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
8212 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone)
throws TskCoreException {
8213 long imageId = this.caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone,
this);
8227 CaseDbConnection connection = connections.getConnection();
8229 Statement s1 = null;
8230 Statement s2 = null;
8231 ResultSet rs1 = null;
8232 ResultSet rs2 = null;
8234 s1 = connection.createStatement();
8235 rs1 = connection.executeQuery(s1,
"SELECT obj_id FROM tsk_image_info");
8236 s2 = connection.createStatement();
8237 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
8238 while (rs1.next()) {
8239 long obj_id = rs1.getLong(
"obj_id");
8240 rs2 = connection.executeQuery(s2,
"SELECT * FROM tsk_image_names WHERE obj_id = " + obj_id);
8241 List<String> paths =
new ArrayList<String>();
8242 while (rs2.next()) {
8243 paths.add(rs2.getString(
"name"));
8247 imgPaths.put(obj_id, paths);
8250 }
catch (SQLException ex) {
8251 throw new TskCoreException(
"Error getting image paths.", ex);
8253 closeResultSet(rs2);
8255 closeResultSet(rs1);
8272 private List<String> getImagePathsById(
long objectId)
throws TskCoreException {
8273 List<String> imagePaths =
new ArrayList<String>();
8274 CaseDbConnection connection = connections.getConnection();
8276 Statement statement = null;
8277 ResultSet resultSet = null;
8279 statement = connection.createStatement();
8280 resultSet = connection.executeQuery(statement,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + objectId);
8281 while (resultSet.next()) {
8282 imagePaths.add(resultSet.getString(
"name"));
8284 }
catch (SQLException ex) {
8285 throw new TskCoreException(String.format(
"Error getting image names with obj_id = %d", objectId), ex);
8287 closeResultSet(resultSet);
8288 closeStatement(statement);
8303 CaseDbConnection connection = connections.getConnection();
8306 ResultSet rs = null;
8308 s = connection.createStatement();
8309 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
8310 Collection<Long> imageIDs =
new ArrayList<Long>();
8312 imageIDs.add(rs.getLong(
"obj_id"));
8314 List<Image> images =
new ArrayList<Image>();
8315 for (
long id : imageIDs) {
8319 }
catch (SQLException ex) {
8320 throw new TskCoreException(
"Error retrieving images.", ex);
8339 public void setImagePaths(
long obj_id, List<String> paths)
throws TskCoreException {
8340 CaseDbConnection connection = connections.getConnection();
8342 PreparedStatement statement = null;
8344 connection.beginTransaction();
8345 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_IMAGE_NAME);
8346 statement.clearParameters();
8347 statement.setLong(1, obj_id);
8348 connection.executeUpdate(statement);
8349 for (
int i = 0; i < paths.size(); i++) {
8350 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
8351 statement.clearParameters();
8352 statement.setLong(1, obj_id);
8353 statement.setString(2, paths.get(i));
8354 statement.setLong(3, i);
8355 connection.executeUpdate(statement);
8357 connection.commitTransaction();
8358 }
catch (SQLException ex) {
8359 connection.rollbackTransaction();
8360 throw new TskCoreException(
"Error updating image paths.", ex);
8378 void deleteDataSource(
long dataSourceObjectId)
throws TskCoreException {
8379 CaseDbConnection connection = connections.getConnection();
8380 Statement statement = null;
8383 statement = connection.createStatement();
8384 connection.beginTransaction();
8387 statement.execute(
"DELETE FROM tsk_objects WHERE obj_id = " + dataSourceObjectId);
8390 String accountSql =
"DELETE FROM accounts WHERE account_id in (SELECT account_id FROM accounts "
8391 +
"WHERE account_id NOT IN (SELECT account1_id FROM account_relationships) "
8392 +
"AND account_id NOT IN (SELECT account2_id FROM account_relationships))";
8393 statement.execute(accountSql);
8394 connection.commitTransaction();
8395 }
catch (SQLException ex) {
8396 connection.rollbackTransaction();
8397 throw new TskCoreException(
"Error deleting data source.", ex);
8429 private List<AbstractFile> resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
throws SQLException {
8430 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
8433 final short type = rs.getShort(
"type");
8434 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()
8435 && (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
8437 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
8438 result = directory(rs, null);
8440 result = file(rs, null);
8442 results.add(result);
8443 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()
8444 || (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
8445 final VirtualDirectory virtDir = virtualDirectory(rs, connection);
8446 results.add(virtDir);
8447 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR.getFileType()) {
8448 final LocalDirectory localDir = localDirectory(rs);
8449 results.add(localDir);
8450 }
else if (type == TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType()
8451 || type == TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.getFileType()
8452 || type == TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType()
8453 || type == TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType()) {
8454 TSK_DB_FILES_TYPE_ENUM atype = TSK_DB_FILES_TYPE_ENUM.valueOf(type);
8455 String parentPath = rs.getString(
"parent_path");
8456 if (parentPath == null) {
8459 LayoutFile lf =
new LayoutFile(
this,
8460 rs.getLong(
"obj_id"),
8461 rs.getLong(
"data_source_obj_id"),
8462 rs.getString(
"name"),
8464 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8465 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8467 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8468 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
8470 }
else if (type == TSK_DB_FILES_TYPE_ENUM.DERIVED.getFileType()) {
8471 final DerivedFile df;
8472 df = derivedFile(rs, connection, AbstractContent.UNKNOWN_ID);
8474 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL.getFileType()) {
8476 lf = localFile(rs, connection, AbstractContent.UNKNOWN_ID);
8478 }
else if (type == TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType()) {
8479 final SlackFile sf = slackFile(rs, null);
8483 }
catch (SQLException e) {
8484 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
8504 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8505 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8506 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8507 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8508 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8509 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8510 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8511 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8512 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8513 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8514 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
8515 f.setFileSystem(fs);
8530 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
8531 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8532 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8533 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8534 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8535 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8536 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8537 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8538 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8539 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8540 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8541 rs.getString(
"parent_path"));
8542 dir.setFileSystem(fs);
8556 VirtualDirectory virtualDirectory(ResultSet rs, CaseDbConnection connection)
throws SQLException {
8557 String parentPath = rs.getString(
"parent_path");
8558 if (parentPath == null) {
8562 long objId = rs.getLong(
"obj_id");
8563 long dsObjId = rs.getLong(
"data_source_obj_id");
8564 if (objId == dsObjId) {
8566 String deviceId =
"";
8567 String timeZone =
"";
8569 ResultSet rsDataSourceInfo = null;
8573 s = connection.createStatement();
8574 rsDataSourceInfo = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objId);
8575 if (rsDataSourceInfo.next()) {
8576 deviceId = rsDataSourceInfo.getString(
"device_id");
8577 timeZone = rsDataSourceInfo.getString(
"time_zone");
8579 }
catch (SQLException ex) {
8580 logger.log(Level.SEVERE,
"Error data source info for datasource id " + objId, ex);
8582 closeResultSet(rsDataSourceInfo);
8587 return new LocalFilesDataSource(
this,
8590 rs.getString(
"name"),
8591 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8592 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8593 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8594 rs.getShort(
"meta_flags"),
8596 rs.getString(
"md5"),
8597 FileKnown.valueOf(rs.getByte(
"known")),
8600 final VirtualDirectory vd =
new VirtualDirectory(
this,
8602 rs.getString(
"name"),
8603 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8604 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8605 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8606 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
8607 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
8621 LocalDirectory localDirectory(ResultSet rs)
throws SQLException {
8622 String parentPath = rs.getString(
"parent_path");
8623 if (parentPath == null) {
8626 final LocalDirectory ld =
new LocalDirectory(
this, rs.getLong(
"obj_id"),
8627 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
8628 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8629 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8630 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8631 rs.getShort(
"meta_flags"), rs.getString(
"md5"),
8632 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
8649 private DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8650 boolean hasLocalPath = rs.getBoolean(
"has_path");
8651 long objId = rs.getLong(
"obj_id");
8652 String localPath = null;
8653 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
8655 ResultSet rsFilePath = null;
8658 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
8659 statement.clearParameters();
8660 statement.setLong(1, objId);
8661 rsFilePath = connection.executeQuery(statement);
8662 if (rsFilePath.next()) {
8663 localPath = rsFilePath.getString(
"path");
8664 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
8666 }
catch (SQLException ex) {
8667 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
8669 closeResultSet(rsFilePath);
8673 String parentPath = rs.getString(
"parent_path");
8674 if (parentPath == null) {
8677 final DerivedFile df =
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
8678 rs.getString(
"name"),
8679 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8680 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8681 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8683 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8684 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8685 parentPath, localPath, parentId, rs.getString(
"mime_type"),
8686 encodingType, rs.getString(
"extension"));
8703 private LocalFile localFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8704 long objId = rs.getLong(
"obj_id");
8705 String localPath = null;
8706 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
8707 if (rs.getBoolean(
"has_path")) {
8708 ResultSet rsFilePath = null;
8711 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
8712 statement.clearParameters();
8713 statement.setLong(1, objId);
8714 rsFilePath = connection.executeQuery(statement);
8715 if (rsFilePath.next()) {
8716 localPath = rsFilePath.getString(
"path");
8717 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
8719 }
catch (SQLException ex) {
8720 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
8722 closeResultSet(rsFilePath);
8726 String parentPath = rs.getString(
"parent_path");
8727 if (null == parentPath) {
8730 LocalFile file =
new LocalFile(
this, objId, rs.getString(
"name"),
8731 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")),
8732 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8733 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8734 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8736 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8737 rs.getString(
"mime_type"), rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8738 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
8739 localPath, encodingType, rs.getString(
"extension"));
8756 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
8757 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
8758 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
8759 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8760 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8761 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
8762 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
8763 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8764 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
8765 rs.getString(
"md5"), FileKnown.valueOf(rs.getByte(
"known")),
8766 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"));
8767 f.setFileSystem(fs);
8782 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
8783 List<Content> children =
new ArrayList<Content>();
8786 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
8791 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
8793 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
8794 result = directory(rs, null);
8796 result = file(rs, null);
8798 children.add(result);
8800 VirtualDirectory virtDir = virtualDirectory(rs, connection);
8801 children.add(virtDir);
8805 VirtualDirectory virtDir = virtualDirectory(rs, connection);
8806 children.add(virtDir);
8809 LocalDirectory localDir = localDirectory(rs);
8810 children.add(localDir);
8812 case UNALLOC_BLOCKS:
8816 String parentPath = rs.getString(
"parent_path");
8817 if (parentPath == null) {
8820 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
8821 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), type,
8822 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
8823 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
8824 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
8826 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
8827 rs.getString(
"md5"),
8828 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"));
8833 final DerivedFile df = derivedFile(rs, connection, parentId);
8837 final LocalFile lf = localFile(rs, connection, parentId);
8842 final SlackFile sf = slackFile(rs, null);
8869 private List<BlackboardArtifact> resultSetToArtifacts(ResultSet rs)
throws SQLException, TskCoreException {
8870 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
8873 BlackboardArtifact.Type artifactType =
getArtifactType(rs.getInt(
"artifact_type_id"));
8874 if (artifactType != null) {
8875 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
8876 rs.getInt(
"artifact_type_id"), artifactType.getTypeName(), artifactType.getDisplayName(),
8877 BlackboardArtifact.ReviewStatus.withID(rs.getInt(
"review_status_id"))));
8879 throw new TskCoreException(
"Error looking up artifact type ID " + rs.getInt(
"artifact_type_id") +
" from artifact " + rs.getLong(
"artifact_id"));
8882 }
catch (SQLException e) {
8883 logger.log(Level.SEVERE,
"Error getting artifacts from result set", e);
8946 CaseDbConnection getConnection() throws TskCoreException {
8947 return connections.getConnection();
8950 synchronized String getUniqueCaseIdentifier() throws TskCoreException {
8951 if (caseHandle != null) {
8952 return caseHandle.getCaseDbIdentifier();
8954 throw new TskCoreException(
"Case has been closed");
8973 connections.close();
8974 }
catch (TskCoreException ex) {
8975 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
8978 fileSystemIdMap.clear();
8981 if (this.caseHandle != null) {
8982 this.caseHandle.free();
8983 this.caseHandle = null;
8985 }
catch (TskCoreException ex) {
8986 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
9005 long id = file.getId();
9006 FileKnown currentKnown = file.getKnown();
9007 if (currentKnown.compareTo(fileKnown) > 0) {
9010 CaseDbConnection connection = connections.getConnection();
9012 Statement statement = null;
9014 statement = connection.createStatement();
9015 connection.executeUpdate(statement,
"UPDATE tsk_files "
9016 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
9017 +
"WHERE obj_id=" + id);
9019 file.setKnown(fileKnown);
9020 }
catch (SQLException ex) {
9021 throw new TskCoreException(
"Error setting Known status.", ex);
9023 closeStatement(statement);
9038 void setFileName(String name,
long objId)
throws TskCoreException {
9040 CaseDbConnection connection = connections.getConnection();
9044 preparedStatement.clearParameters();
9045 preparedStatement.setString(1, name);
9046 preparedStatement.setLong(2, objId);
9047 connection.executeUpdate(preparedStatement);
9048 }
catch (SQLException ex) {
9049 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
9064 void setImageName(String name,
long objId)
throws TskCoreException {
9066 CaseDbConnection connection = connections.getConnection();
9069 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_NAME);
9070 preparedStatement.clearParameters();
9071 preparedStatement.setString(1, name);
9072 preparedStatement.setLong(2, objId);
9073 connection.executeUpdate(preparedStatement);
9074 }
catch (SQLException ex) {
9075 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
9092 CaseDbConnection connection = connections.getConnection();
9093 Statement statement = null;
9094 ResultSet rs = null;
9097 statement = connection.createStatement();
9098 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
9099 file.setMIMEType(mimeType);
9100 }
catch (SQLException ex) {
9101 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
9104 closeStatement(statement);
9119 void setMd5Hash(
AbstractFile file, String md5Hash)
throws TskCoreException {
9120 if (md5Hash == null) {
9123 long id = file.getId();
9124 CaseDbConnection connection = connections.getConnection();
9127 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
9128 statement.clearParameters();
9129 statement.setString(1, md5Hash.toLowerCase());
9130 statement.setLong(2,
id);
9131 connection.executeUpdate(statement);
9132 file.setMd5Hash(md5Hash.toLowerCase());
9133 }
catch (SQLException ex) {
9134 throw new TskCoreException(
"Error setting MD5 hash", ex);
9150 void setMd5ImageHash(Image img, String md5Hash)
throws TskCoreException {
9151 if (md5Hash == null) {
9154 long id = img.getId();
9155 CaseDbConnection connection = connections.getConnection();
9158 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_MD5);
9159 statement.clearParameters();
9160 statement.setString(1, md5Hash.toLowerCase());
9161 statement.setLong(2,
id);
9162 connection.executeUpdate(statement);
9163 }
catch (SQLException ex) {
9164 throw new TskCoreException(
"Error setting MD5 hash", ex);
9181 String getMd5ImageHash(Image img)
throws TskCoreException {
9182 long id = img.getId();
9183 CaseDbConnection connection = connections.getConnection();
9185 ResultSet rs = null;
9188 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_MD5);
9189 statement.clearParameters();
9190 statement.setLong(1,
id);
9191 rs = connection.executeQuery(statement);
9193 hash = rs.getString(
"md5");
9196 }
catch (SQLException ex) {
9197 throw new TskCoreException(
"Error getting MD5 hash", ex);
9214 void setSha1ImageHash(Image img, String sha1Hash)
throws TskCoreException {
9215 if (sha1Hash == null) {
9218 long id = img.getId();
9219 CaseDbConnection connection = connections.getConnection();
9222 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA1);
9223 statement.clearParameters();
9224 statement.setString(1, sha1Hash.toLowerCase());
9225 statement.setLong(2,
id);
9226 connection.executeUpdate(statement);
9227 }
catch (SQLException ex) {
9228 throw new TskCoreException(
"Error setting SHA1 hash", ex);
9245 String getSha1ImageHash(Image img)
throws TskCoreException {
9246 long id = img.getId();
9247 CaseDbConnection connection = connections.getConnection();
9249 ResultSet rs = null;
9252 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA1);
9253 statement.clearParameters();
9254 statement.setLong(1,
id);
9255 rs = connection.executeQuery(statement);
9257 hash = rs.getString(
"sha1");
9260 }
catch (SQLException ex) {
9261 throw new TskCoreException(
"Error getting SHA1 hash", ex);
9278 void setSha256ImageHash(Image img, String sha256Hash)
throws TskCoreException {
9279 if (sha256Hash == null) {
9282 long id = img.getId();
9283 CaseDbConnection connection = connections.getConnection();
9286 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA256);
9287 statement.clearParameters();
9288 statement.setString(1, sha256Hash.toLowerCase());
9289 statement.setLong(2,
id);
9290 connection.executeUpdate(statement);
9291 }
catch (SQLException ex) {
9292 throw new TskCoreException(
"Error setting SHA256 hash", ex);
9309 String getSha256ImageHash(Image img)
throws TskCoreException {
9310 long id = img.getId();
9311 CaseDbConnection connection = connections.getConnection();
9313 ResultSet rs = null;
9316 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA256);
9317 statement.clearParameters();
9318 statement.setLong(1,
id);
9319 rs = connection.executeQuery(statement);
9321 hash = rs.getString(
"sha256");
9324 }
catch (SQLException ex) {
9325 throw new TskCoreException(
"Error setting SHA256 hash", ex);
9341 void setAcquisitionDetails(DataSource datasource, String details)
throws TskCoreException {
9343 long id = datasource.getId();
9344 CaseDbConnection connection = connections.getConnection();
9347 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
9348 statement.clearParameters();
9349 statement.setString(1, details);
9350 statement.setLong(2,
id);
9351 connection.executeUpdate(statement);
9352 }
catch (SQLException ex) {
9353 throw new TskCoreException(
"Error setting acquisition details", ex);
9369 void setAcquisitionDetails(
long dataSourceId, String details, CaseDbTransaction trans)
throws TskCoreException {
9372 CaseDbConnection connection = trans.getConnection();
9373 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
9374 statement.clearParameters();
9375 statement.setString(1, details);
9376 statement.setLong(2, dataSourceId);
9377 connection.executeUpdate(statement);
9378 }
catch (SQLException ex) {
9379 throw new TskCoreException(
"Error setting acquisition details", ex);
9394 String getAcquisitionDetails(DataSource datasource)
throws TskCoreException {
9395 long id = datasource.getId();
9396 CaseDbConnection connection = connections.getConnection();
9398 ResultSet rs = null;
9401 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_DETAILS);
9402 statement.clearParameters();
9403 statement.setLong(1,
id);
9404 rs = connection.executeQuery(statement);
9406 hash = rs.getString(
"acquisition_details");
9409 }
catch (SQLException ex) {
9410 throw new TskCoreException(
"Error setting acquisition details", ex);
9429 if (newStatus == null) {
9432 CaseDbConnection connection = connections.getConnection();
9434 Statement statement = null;
9436 statement = connection.createStatement();
9437 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
9438 +
" SET review_status_id=" + newStatus.getID()
9439 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
9440 }
catch (SQLException ex) {
9441 throw new TskCoreException(
"Error setting review status", ex);
9443 closeStatement(statement);
9460 CaseDbConnection connection = connections.getConnection();
9463 ResultSet rs = null;
9465 s = connection.createStatement();
9466 Short contentShort = contentType.getValue();
9467 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
9470 count = rs.getInt(
"count");
9473 }
catch (SQLException ex) {
9474 throw new TskCoreException(
"Error getting number of objects.", ex);
9492 String escapedText = null;
9494 escapedText = text.replaceAll(
"'",
"''");
9507 if (md5Hash == null) {
9510 CaseDbConnection connection;
9512 connection = connections.getConnection();
9513 }
catch (TskCoreException ex) {
9514 logger.log(Level.SEVERE,
"Error finding files by md5 hash " + md5Hash, ex);
9519 ResultSet rs = null;
9521 s = connection.createStatement();
9522 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
9523 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
9525 return resultSetToAbstractFiles(rs, connection);
9526 }
catch (SQLException ex) {
9527 logger.log(Level.WARNING,
"Error querying database.", ex);
9544 CaseDbConnection connection;
9546 connection = connections.getConnection();
9547 }
catch (TskCoreException ex) {
9548 logger.log(Level.SEVERE,
"Error checking md5 hashing status", ex);
9551 boolean allFilesAreHashed =
false;
9554 ResultSet rs = null;
9556 s = connection.createStatement();
9557 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
9559 +
"AND md5 IS NULL "
9560 +
"AND size > '0'");
9561 if (rs.next() && rs.getInt(
"count") == 0) {
9562 allFilesAreHashed =
true;
9564 }
catch (SQLException ex) {
9565 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
9572 return allFilesAreHashed;
9581 CaseDbConnection connection;
9583 connection = connections.getConnection();
9584 }
catch (TskCoreException ex) {
9585 logger.log(Level.SEVERE,
"Error getting database connection for hashed files count", ex);
9591 ResultSet rs = null;
9593 s = connection.createStatement();
9594 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
9595 +
"WHERE md5 IS NOT NULL "
9596 +
"AND size > '0'");
9598 count = rs.getInt(
"count");
9600 }
catch (SQLException ex) {
9601 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
9621 CaseDbConnection connection = connections.getConnection();
9623 ResultSet resultSet = null;
9626 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES);
9627 resultSet = connection.executeQuery(statement);
9628 ArrayList<TagName> tagNames =
new ArrayList<>();
9629 while (resultSet.next()) {
9630 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9632 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
9635 }
catch (SQLException ex) {
9636 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
9638 closeResultSet(resultSet);
9655 CaseDbConnection connection = connections.getConnection();
9657 ResultSet resultSet = null;
9660 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE);
9661 resultSet = connection.executeQuery(statement);
9662 ArrayList<TagName> tagNames =
new ArrayList<>();
9663 while (resultSet.next()) {
9664 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9666 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
9669 }
catch (SQLException ex) {
9670 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
9672 closeResultSet(resultSet);
9692 ArrayList<TagName> tagNames =
new ArrayList<TagName>();
9698 CaseDbConnection connection = connections.getConnection();
9700 ResultSet resultSet = null;
9703 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE);
9704 statement.setLong(1, dsObjId);
9705 statement.setLong(2, dsObjId);
9706 resultSet = connection.executeQuery(statement);
9707 while (resultSet.next()) {
9708 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9710 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
9713 }
catch (SQLException ex) {
9714 throw new TskCoreException(
"Failed to get tag names in use for data source objID : " + dsObjId, ex);
9716 closeResultSet(resultSet);
9755 CaseDbConnection connection = connections.getConnection();
9757 ResultSet resultSet = null;
9759 PreparedStatement statement;
9761 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OR_UPDATE_TAG_NAME, Statement.RETURN_GENERATED_KEYS);
9762 statement.clearParameters();
9763 statement.setString(5, description);
9764 statement.setString(6, color.getName());
9765 statement.setByte(7, knownStatus.getFileKnownValue());
9766 statement.setString(1, displayName);
9767 statement.setString(2, description);
9768 statement.setString(3, color.getName());
9769 statement.setByte(4, knownStatus.getFileKnownValue());
9770 connection.executeUpdate(statement);
9771 resultSet = statement.getGeneratedKeys();
9774 long tagId = resultSet.getLong(1);
9777 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAME_BY_ID);
9778 statement.clearParameters();
9779 statement.setLong(1, tagId);
9780 resultSet = connection.executeQuery(statement);
9783 return new TagName(tagId, displayName, description, color, knownStatus, resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
9785 }
catch (SQLException ex) {
9786 throw new TskCoreException(
"Error adding row for " + displayName +
" tag name to tag_names table", ex);
9788 closeResultSet(resultSet);
9819 CaseDbConnection connection = connections.getConnection();
9823 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_CONTENT_TAG);
9824 statement.clearParameters();
9825 statement.setLong(1, tag.getId());
9826 connection.executeUpdate(statement);
9827 }
catch (SQLException ex) {
9828 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
9844 CaseDbConnection connection = connections.getConnection();
9846 ResultSet resultSet = null;
9852 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS);
9853 resultSet = connection.executeQuery(statement);
9854 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
9855 while (resultSet.next()) {
9856 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9858 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
9860 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
9861 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name")));
9864 }
catch (SQLException ex) {
9865 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
9867 closeResultSet(resultSet);
9884 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9885 throw new TskCoreException(
"TagName object is invalid, id not set");
9887 CaseDbConnection connection = connections.getConnection();
9889 ResultSet resultSet = null;
9892 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME);
9893 statement.clearParameters();
9894 statement.setLong(1, tagName.getId());
9895 resultSet = connection.executeQuery(statement);
9896 if (resultSet.next()) {
9897 return resultSet.getLong(
"count");
9899 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
9901 }
catch (SQLException ex) {
9902 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
9904 closeResultSet(resultSet);
9927 if (tagName.getId() ==
Tag.ID_NOT_SET) {
9928 throw new TskCoreException(
"TagName object is invalid, id not set");
9931 CaseDbConnection connection = connections.getConnection();
9933 ResultSet resultSet = null;
9938 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
9939 statement.clearParameters();
9940 statement.setLong(1, tagName.getId());
9941 statement.setLong(2, dsObjId);
9943 resultSet = connection.executeQuery(statement);
9944 if (resultSet.next()) {
9945 return resultSet.getLong(
"count");
9947 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
9949 }
catch (SQLException ex) {
9950 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
9952 closeResultSet(resultSet);
9970 CaseDbConnection connection = connections.getConnection();
9972 ResultSet resultSet = null;
9980 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID);
9981 statement.clearParameters();
9982 statement.setLong(1, contentTagID);
9983 resultSet = connection.executeQuery(statement);
9985 while (resultSet.next()) {
9986 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
9988 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
9990 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
9994 }
catch (SQLException ex) {
9995 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
9997 closeResultSet(resultSet);
10016 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10017 throw new TskCoreException(
"TagName object is invalid, id not set");
10019 CaseDbConnection connection = connections.getConnection();
10021 ResultSet resultSet = null;
10027 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME);
10028 statement.clearParameters();
10029 statement.setLong(1, tagName.getId());
10030 resultSet = connection.executeQuery(statement);
10031 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
10032 while (resultSet.next()) {
10034 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
10039 }
catch (SQLException ex) {
10040 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
10042 closeResultSet(resultSet);
10043 connection.close();
10062 CaseDbConnection connection = connections.getConnection();
10064 ResultSet resultSet = null;
10073 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
10074 statement.clearParameters();
10075 statement.setLong(1, tagName.getId());
10076 statement.setLong(2, dsObjId);
10077 resultSet = connection.executeQuery(statement);
10078 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
10079 while (resultSet.next()) {
10081 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
10086 }
catch (SQLException ex) {
10087 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
" data source objID : " + dsObjId, ex);
10089 closeResultSet(resultSet);
10090 connection.close();
10107 CaseDbConnection connection = connections.getConnection();
10109 ResultSet resultSet = null;
10116 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT);
10117 statement.clearParameters();
10118 statement.setLong(1, content.getId());
10119 resultSet = connection.executeQuery(statement);
10120 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
10121 while (resultSet.next()) {
10122 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10124 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
10126 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
10130 }
catch (SQLException ex) {
10131 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
10133 closeResultSet(resultSet);
10134 connection.close();
10164 CaseDbConnection connection = connections.getConnection();
10168 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_ARTIFACT_TAG);
10169 statement.clearParameters();
10170 statement.setLong(1, tag.getId());
10171 connection.executeUpdate(statement);
10172 }
catch (SQLException ex) {
10173 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
10175 connection.close();
10190 CaseDbConnection connection = connections.getConnection();
10192 ResultSet resultSet = null;
10198 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS);
10199 resultSet = connection.executeQuery(statement);
10200 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
10201 while (resultSet.next()) {
10202 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10204 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
10208 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10212 }
catch (SQLException ex) {
10213 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
10215 closeResultSet(resultSet);
10216 connection.close();
10232 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10233 throw new TskCoreException(
"TagName object is invalid, id not set");
10235 CaseDbConnection connection = connections.getConnection();
10237 ResultSet resultSet = null;
10240 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME);
10241 statement.clearParameters();
10242 statement.setLong(1, tagName.getId());
10243 resultSet = connection.executeQuery(statement);
10244 if (resultSet.next()) {
10245 return resultSet.getLong(
"count");
10247 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
10249 }
catch (SQLException ex) {
10250 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
10252 closeResultSet(resultSet);
10253 connection.close();
10274 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10275 throw new TskCoreException(
"TagName object is invalid, id not set");
10278 CaseDbConnection connection = connections.getConnection();
10280 ResultSet resultSet = null;
10285 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE);
10286 statement.clearParameters();
10287 statement.setLong(1, tagName.getId());
10288 statement.setLong(2, dsObjId);
10289 resultSet = connection.executeQuery(statement);
10290 if (resultSet.next()) {
10291 return resultSet.getLong(
"count");
10293 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
10295 }
catch (SQLException ex) {
10296 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
10298 closeResultSet(resultSet);
10299 connection.close();
10316 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10317 throw new TskCoreException(
"TagName object is invalid, id not set");
10319 CaseDbConnection connection = connections.getConnection();
10321 ResultSet resultSet = null;
10327 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME);
10328 statement.clearParameters();
10329 statement.setLong(1, tagName.getId());
10330 resultSet = connection.executeQuery(statement);
10331 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10332 while (resultSet.next()) {
10336 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10340 }
catch (SQLException ex) {
10341 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
10343 closeResultSet(resultSet);
10344 connection.close();
10365 if (tagName.getId() ==
Tag.ID_NOT_SET) {
10366 throw new TskCoreException(
"TagName object is invalid, id not set");
10369 CaseDbConnection connection = connections.getConnection();
10371 ResultSet resultSet = null;
10379 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
10380 statement.clearParameters();
10381 statement.setLong(1, tagName.getId());
10382 statement.setLong(2, dsObjId);
10383 resultSet = connection.executeQuery(statement);
10384 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
10385 while (resultSet.next()) {
10389 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10393 }
catch (SQLException ex) {
10394 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
10396 closeResultSet(resultSet);
10397 connection.close();
10416 CaseDbConnection connection = connections.getConnection();
10418 ResultSet resultSet = null;
10426 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID);
10427 statement.clearParameters();
10428 statement.setLong(1, artifactTagID);
10429 resultSet = connection.executeQuery(statement);
10431 while (resultSet.next()) {
10432 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10434 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
10438 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10442 }
catch (SQLException ex) {
10443 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
10445 closeResultSet(resultSet);
10446 connection.close();
10465 CaseDbConnection connection = connections.getConnection();
10467 ResultSet resultSet = null;
10474 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT);
10475 statement.clearParameters();
10476 statement.setLong(1, artifact.getArtifactID());
10477 resultSet = connection.executeQuery(statement);
10478 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
10479 while (resultSet.next()) {
10480 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
10482 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
10485 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
10489 }
catch (SQLException ex) {
10490 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
10492 closeResultSet(resultSet);
10493 connection.close();
10507 CaseDbConnection connection = connections.getConnection();
10511 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_PATH);
10512 statement.clearParameters();
10513 statement.setString(1, newPath);
10514 statement.setLong(2, objectId);
10515 connection.executeUpdate(statement);
10516 }
catch (SQLException ex) {
10517 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
10519 connection.close();
10537 public Report addReport(String localPath, String sourceModuleName, String reportName)
throws TskCoreException {
10538 return addReport(localPath, sourceModuleName, reportName, null);
10559 String relativePath =
"";
10560 long createTime = 0;
10561 String localPathLower = localPath.toLowerCase();
10563 if (localPathLower.startsWith(
"http")) {
10564 relativePath = localPathLower;
10565 createTime = System.currentTimeMillis() / 1000;
10576 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
10577 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
10578 }
catch (IllegalArgumentException ex) {
10579 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
10580 throw new TskCoreException(errorMessage, ex);
10584 java.io.File tempFile =
new java.io.File(localPath);
10586 createTime = tempFile.lastModified() / 1000;
10587 }
catch (Exception ex) {
10588 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
10593 CaseDbConnection connection = connections.getConnection();
10595 ResultSet resultSet = null;
10599 long parentObjId = 0;
10600 if (parent != null) {
10601 parentObjId = parent.getId();
10606 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
10607 statement.clearParameters();
10608 statement.setLong(1, objectId);
10609 statement.setString(2, relativePath);
10610 statement.setLong(3, createTime);
10611 statement.setString(4, sourceModuleName);
10612 statement.setString(5, reportName);
10613 connection.executeUpdate(statement);
10614 return new Report(
this, objectId, localPath, createTime, sourceModuleName, reportName, parent);
10615 }
catch (SQLException ex) {
10616 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
10618 closeResultSet(resultSet);
10619 connection.close();
10633 CaseDbConnection connection = connections.getConnection();
10635 ResultSet resultSet = null;
10636 ResultSet parentResultSet = null;
10637 PreparedStatement statement = null;
10638 Statement parentStatement = null;
10641 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORTS);
10642 parentStatement = connection.createStatement();
10643 resultSet = connection.executeQuery(statement);
10644 ArrayList<Report> reports =
new ArrayList<Report>();
10645 while (resultSet.next()) {
10646 String localpath = resultSet.getString(
"path");
10647 if (localpath.toLowerCase().startsWith(
"http") ==
false) {
10649 localpath = Paths.get(
getDbDirPath(), localpath).normalize().toString();
10654 long reportId = resultSet.getLong(
"obj_id");
10655 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", reportId);
10656 parentResultSet = parentStatement.executeQuery(parentQuery);
10657 if (parentResultSet.next()) {
10658 long parentId = parentResultSet.getLong(
"par_obj_id");
10661 parentResultSet.close();
10663 reports.add(
new Report(
this,
10666 resultSet.getLong(
"crtime"),
10667 resultSet.getString(
"src_module_name"),
10668 resultSet.getString(
"report_name"),
10672 }
catch (SQLException ex) {
10673 throw new TskCoreException(
"Error querying reports table", ex);
10675 closeResultSet(resultSet);
10676 closeResultSet(parentResultSet);
10677 closeStatement(statement);
10678 closeStatement(parentStatement);
10680 connection.close();
10695 CaseDbConnection connection = connections.getConnection();
10697 PreparedStatement statement = null;
10698 Statement parentStatement = null;
10699 ResultSet resultSet = null;
10700 ResultSet parentResultSet = null;
10704 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORT_BY_ID);
10705 parentStatement = connection.createStatement();
10706 statement.clearParameters();
10707 statement.setLong(1,
id);
10708 resultSet = connection.executeQuery(statement);
10710 if (resultSet.next()) {
10713 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;",
id);
10714 parentResultSet = parentStatement.executeQuery(parentQuery);
10715 if (parentResultSet.next()) {
10716 long parentId = parentResultSet.getLong(
"par_obj_id");
10720 report =
new Report(
this, resultSet.getLong(
"obj_id"),
10721 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
10722 resultSet.getLong(
"crtime"),
10723 resultSet.getString(
"src_module_name"),
10724 resultSet.getString(
"report_name"),
10727 throw new TskCoreException(
"No report found for id: " +
id);
10729 }
catch (SQLException ex) {
10730 throw new TskCoreException(
"Error querying reports table for id: " +
id, ex);
10732 closeResultSet(resultSet);
10733 closeResultSet(parentResultSet);
10734 closeStatement(statement);
10735 closeStatement(parentStatement);
10736 connection.close();
10751 CaseDbConnection connection = connections.getConnection();
10755 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT);
10756 statement.setLong(1, report.getId());
10757 connection.executeUpdate(statement);
10758 }
catch (SQLException ex) {
10759 throw new TskCoreException(
"Error querying reports table", ex);
10761 connection.close();
10766 static void closeResultSet(ResultSet resultSet) {
10767 if (resultSet != null) {
10770 }
catch (SQLException ex) {
10771 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
10776 static void closeStatement(Statement statement) {
10777 if (statement != null) {
10780 }
catch (SQLException ex) {
10781 logger.log(Level.SEVERE,
"Error closing Statement", ex);
10795 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
10796 CaseDbConnection connection = connections.getConnection();
10799 Statement statement = connection.createStatement();
10800 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
10801 }
catch (SQLException ex) {
10802 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
10804 connection.close();
10809 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
10810 CaseDbConnection connection = connections.getConnection();
10813 Statement statement = connection.createStatement();
10814 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
10815 }
catch (SQLException ex) {
10816 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
10818 connection.close();
10840 CaseDbConnection connection = connections.getConnection();
10842 ResultSet resultSet = null;
10843 Statement statement;
10845 connection.beginTransaction();
10846 statement = connection.createStatement();
10847 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_JOB, Statement.RETURN_GENERATED_KEYS);
10848 insertStatement.setLong(1, dataSource.getId());
10849 insertStatement.setString(2, hostName);
10850 insertStatement.setLong(3, jobStart.getTime());
10851 insertStatement.setLong(4, jobEnd.getTime());
10852 insertStatement.setInt(5, status.ordinal());
10853 insertStatement.setString(6, settingsDir);
10854 connection.executeUpdate(insertStatement);
10855 resultSet = insertStatement.getGeneratedKeys();
10857 long id = resultSet.getLong(1);
10858 for (
int i = 0; i < ingestModules.size(); i++) {
10860 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
10861 +
"VALUES (" +
id +
", " + ingestModule.
getIngestModuleId() +
", " + i +
");");
10865 connection.commitTransaction();
10866 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
10867 }
catch (SQLException ex) {
10868 connection.rollbackTransaction();
10869 throw new TskCoreException(
"Error adding the ingest job.", ex);
10871 closeResultSet(resultSet);
10872 connection.close();
10891 CaseDbConnection connection = connections.getConnection();
10892 ResultSet resultSet = null;
10893 Statement statement = null;
10894 String uniqueName = factoryClassName +
"-" + displayName +
"-" + type.toString() +
"-" + version;
10897 statement = connection.createStatement();
10898 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
10899 if (!resultSet.next()) {
10902 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_MODULE, Statement.RETURN_GENERATED_KEYS);
10903 insertStatement.setString(1, displayName);
10904 insertStatement.setString(2, uniqueName);
10905 insertStatement.setInt(3, type.ordinal());
10906 insertStatement.setString(4, version);
10907 connection.executeUpdate(insertStatement);
10908 resultSet = statement.getGeneratedKeys();
10910 long id = resultSet.getLong(1);
10915 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10916 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
10918 }
catch (SQLException ex) {
10920 closeStatement(statement);
10921 statement = connection.createStatement();
10922 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
10923 if (resultSet.next()) {
10924 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
10927 throw new TskCoreException(
"Couldn't add new module to database.", ex);
10929 }
catch (SQLException ex1) {
10930 throw new TskCoreException(
"Couldn't add new module to database.", ex1);
10933 closeResultSet(resultSet);
10934 closeStatement(statement);
10935 connection.close();
10948 CaseDbConnection connection = connections.getConnection();
10949 ResultSet resultSet = null;
10950 Statement statement = null;
10951 List<IngestJobInfo> ingestJobs =
new ArrayList<IngestJobInfo>();
10954 statement = connection.createStatement();
10955 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
10956 while (resultSet.next()) {
10957 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
10958 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
10960 resultSet.getString(
"settings_dir"), this.getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
10963 }
catch (SQLException ex) {
10964 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
10966 closeResultSet(resultSet);
10967 closeStatement(statement);
10968 connection.close();
10983 private List<IngestModuleInfo> getIngestModules(
int ingestJobId, CaseDbConnection connection)
throws SQLException {
10984 ResultSet resultSet = null;
10985 Statement statement = null;
10986 List<IngestModuleInfo> ingestModules =
new ArrayList<IngestModuleInfo>();
10989 statement = connection.createStatement();
10990 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
10991 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
10992 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
10993 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
10994 +
"FROM ingest_job_modules, ingest_modules "
10995 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
10996 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
10997 +
"ORDER BY (ingest_job_modules.pipeline_position);");
10998 while (resultSet.next()) {
10999 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
11000 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
11002 return ingestModules;
11004 closeResultSet(resultSet);
11005 closeStatement(statement);
11030 long addImageJNI(TskData.TSK_IMG_TYPE_ENUM type,
long sectorSize,
long size,
11031 String timezone, String md5, String sha1, String sha256,
11032 String deviceId, String collectionDetails,
11033 CaseDbTransaction transaction)
throws TskCoreException {
11037 CaseDbConnection connection = transaction.getConnection();
11038 long newObjId = addObject(0, TskData.ObjectType.IMG.getObjectType(), connection);
11042 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
11043 preparedStatement.clearParameters();
11044 preparedStatement.setLong(1, newObjId);
11045 preparedStatement.setShort(2, (
short) type.getValue());
11046 preparedStatement.setLong(3, sectorSize);
11047 preparedStatement.setString(4, timezone);
11049 long savedSize = size < 0 ? 0 : size;
11050 preparedStatement.setLong(5, savedSize);
11051 preparedStatement.setString(6, md5);
11052 preparedStatement.setString(7, sha1);
11053 preparedStatement.setString(8, sha256);
11054 preparedStatement.setString(9, null);
11055 connection.executeUpdate(preparedStatement);
11058 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO_WITH_ACQ_DETAIL);
11059 preparedStatement.setLong(1, newObjId);
11060 preparedStatement.setString(2, deviceId);
11061 preparedStatement.setString(3, timezone);
11062 preparedStatement.setString(4, collectionDetails);
11063 connection.executeUpdate(preparedStatement);
11066 }
catch (SQLException ex) {
11067 throw new TskCoreException(String.format(
"Error adding image to database"), ex);
11084 void addImageNameJNI(
long objId, String name,
long sequence,
11085 CaseDbTransaction transaction)
throws TskCoreException {
11088 CaseDbConnection connection = transaction.getConnection();
11089 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
11090 preparedStatement.clearParameters();
11091 preparedStatement.setLong(1, objId);
11092 preparedStatement.setString(2, name);
11093 preparedStatement.setLong(3, sequence);
11094 connection.executeUpdate(preparedStatement);
11095 }
catch (SQLException ex) {
11096 throw new TskCoreException(String.format(
"Error adding image name %s to image with object ID %d", name, objId), ex);
11144 long addFileJNI(
long parentObjId,
11145 Long fsObjId,
long dataSourceObjId,
11147 Integer attrType, Integer attrId, String name,
11148 Long metaAddr, Long metaSeq,
11149 int dirType,
int metaType,
int dirFlags,
int metaFlags,
11151 Long crtime, Long ctime, Long atime, Long mtime,
11152 Integer meta_mode, Integer gid, Integer uid,
11153 String md5, TskData.FileKnown known,
11154 String escaped_path, String extension,
11155 boolean hasLayout, CaseDbTransaction transaction)
throws TskCoreException {
11157 Statement queryStatement = null;
11160 CaseDbConnection connection = transaction.getConnection();
11164 long objectId = addObject(parentObjId, TskData.ObjectType.ABSTRACTFILE.getObjectType(), connection);
11169 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE_All_FIELDS);
11170 statement.clearParameters();
11171 if (fsObjId != null) {
11172 statement.setLong(1, fsObjId);
11174 statement.setNull(1, java.sql.Types.BIGINT);
11176 statement.setLong(2, objectId);
11177 statement.setLong(3, dataSourceObjId);
11178 statement.setShort(4, (
short) fsType);
11179 if (attrType != null) {
11180 statement.setShort(5, attrType.shortValue());
11182 statement.setNull(5, java.sql.Types.SMALLINT);
11184 if (attrId != null) {
11185 statement.setInt(6, attrId);
11187 statement.setNull(6, java.sql.Types.INTEGER);
11189 statement.setString(7, name);
11190 if (metaAddr != null) {
11191 statement.setLong(8, metaAddr);
11193 statement.setNull(8, java.sql.Types.BIGINT);
11195 if (metaSeq != null) {
11196 statement.setInt(9, metaSeq.intValue());
11198 statement.setNull(9, java.sql.Types.INTEGER);
11200 statement.setShort(10, (
short) dirType);
11201 statement.setShort(11, (
short) metaType);
11202 statement.setShort(12, (
short) dirFlags);
11203 statement.setShort(13, (
short) metaFlags);
11204 statement.setLong(14, size < 0 ? 0 : size);
11205 if (crtime != null) {
11206 statement.setLong(15, crtime);
11208 statement.setNull(15, java.sql.Types.BIGINT);
11210 if (ctime != null) {
11211 statement.setLong(16, ctime);
11213 statement.setNull(16, java.sql.Types.BIGINT);
11215 if (atime != null) {
11216 statement.setLong(17, atime);
11218 statement.setNull(17, java.sql.Types.BIGINT);
11220 if (mtime != null) {
11221 statement.setLong(18, mtime);
11223 statement.setNull(18, java.sql.Types.BIGINT);
11225 if (meta_mode != null) {
11226 statement.setLong(19, meta_mode);
11228 statement.setNull(19, java.sql.Types.BIGINT);
11231 statement.setLong(20, gid);
11233 statement.setNull(20, java.sql.Types.BIGINT);
11236 statement.setLong(21, uid);
11238 statement.setNull(21, java.sql.Types.BIGINT);
11240 statement.setString(22, md5);
11241 statement.setInt(23, known.getFileKnownValue());
11242 statement.setString(24, escaped_path);
11243 statement.setString(25, extension);
11245 statement.setInt(26, 1);
11247 statement.setNull(26, java.sql.Types.INTEGER);
11249 connection.executeUpdate(statement);
11253 && TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType() != fsType
11254 && (!name.equals(
".")) && (!name.equals(
".."))) {
11256 DerivedFile derivedFile =
new DerivedFile(
this, objectId, dataSourceObjId, name,
11257 TSK_FS_NAME_TYPE_ENUM.valueOf((
short) dirType),
11258 TSK_FS_META_TYPE_ENUM.valueOf((
short) metaType),
11259 TSK_FS_NAME_FLAG_ENUM.valueOf(dirFlags),
11261 size, ctime, crtime, atime, mtime, null, null, escaped_path, null, parentObjId, null, null, extension);
11263 timelineManager.addEventsForNewFileQuiet(derivedFile, connection);
11267 }
catch (SQLException ex) {
11268 throw new TskCoreException(
"Failed to add file system file", ex);
11270 closeStatement(queryStatement);
11287 void addLayoutFileRangeJNI(
long objId,
long byteStart,
long byteLen,
11288 long seq, CaseDbTransaction transaction)
throws TskCoreException {
11291 CaseDbConnection connection = transaction.getConnection();
11293 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
11294 prepStmt.clearParameters();
11295 prepStmt.setLong(1, objId);
11296 prepStmt.setLong(2, byteStart);
11297 prepStmt.setLong(3, byteLen);
11298 prepStmt.setLong(4, seq);
11299 connection.executeUpdate(prepStmt);
11300 }
catch (SQLException ex) {
11301 throw new TskCoreException(
"Error adding layout range to file with obj ID " + objId, ex);
11310 static class ObjectInfo {
11313 private TskData.ObjectType type;
11315 ObjectInfo(
long id, ObjectType type) {
11324 TskData.ObjectType getType() {
11329 private interface DbCommand {
11331 void execute() throws SQLException;
11334 private enum PREPARED_STATEMENT {
11336 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
11337 +
"WHERE artifact_type_id = ?"),
11338 COUNT_ARTIFACTS_OF_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
11339 COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE data_source_obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
11340 COUNT_ARTIFACTS_FROM_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
11341 COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
11342 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
11343 +
"FROM tsk_objects INNER JOIN tsk_files "
11344 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11345 +
"WHERE (tsk_objects.par_obj_id = ? ) "
11346 +
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"),
11347 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
11348 +
"FROM tsk_objects INNER JOIN tsk_files "
11349 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11350 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
11351 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
11352 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
11353 +
"FROM tsk_objects INNER JOIN tsk_files "
11354 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11355 +
"WHERE (tsk_objects.par_obj_id = ?)"),
11356 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
11357 +
"FROM tsk_objects INNER JOIN tsk_files "
11358 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
11359 +
"WHERE (tsk_objects.par_obj_id = ? "
11360 +
"AND tsk_files.type = ? )"),
11361 SELECT_FILE_BY_ID(
"SELECT * FROM tsk_files WHERE obj_id = ? LIMIT 1"),
11362 SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
11363 SELECT_ARTIFACT_BY_ARTIFACT_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_id = ? LIMIT 1"),
11364 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
11365 +
"VALUES (?, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
11366 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
11367 +
"VALUES (DEFAULT, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
11368 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
11369 +
"VALUES (?,?,?,?,?,?,?)"),
11370 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
11371 +
"VALUES (?,?,?,?,?,?,?)"),
11372 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
11373 +
"VALUES (?,?,?,?,?,?,?)"),
11374 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
11375 +
"VALUES (?,?,?,?,?,?,?)"),
11376 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
11377 +
"VALUES (?,?,?,?,?,?,?)"),
11378 SELECT_FILES_BY_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
11379 SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
11380 UPDATE_FILE_MD5(
"UPDATE tsk_files SET md5 = ? WHERE obj_id = ?"),
11381 UPDATE_IMAGE_MD5(
"UPDATE tsk_image_info SET md5 = ? WHERE obj_id = ?"),
11382 UPDATE_IMAGE_SHA1(
"UPDATE tsk_image_info SET sha1 = ? WHERE obj_id = ?"),
11383 UPDATE_IMAGE_SHA256(
"UPDATE tsk_image_info SET sha256 = ? WHERE obj_id = ?"),
11384 SELECT_IMAGE_MD5(
"SELECT md5 FROM tsk_image_info WHERE obj_id = ?"),
11385 SELECT_IMAGE_SHA1(
"SELECT sha1 FROM tsk_image_info WHERE obj_id = ?"),
11386 SELECT_IMAGE_SHA256(
"SELECT sha256 FROM tsk_image_info WHERE obj_id = ?"),
11387 UPDATE_ACQUISITION_DETAILS(
"UPDATE data_source_info SET acquisition_details = ? WHERE obj_id = ?"),
11388 SELECT_ACQUISITION_DETAILS(
"SELECT acquisition_details FROM data_source_info WHERE obj_id = ?"),
11389 SELECT_LOCAL_PATH_FOR_FILE(
"SELECT path FROM tsk_files_path WHERE obj_id = ?"),
11390 SELECT_ENCODING_FOR_FILE(
"SELECT encoding_type FROM tsk_files_path WHERE obj_id = ?"),
11391 SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE(
"SELECT path, encoding_type FROM tsk_files_path WHERE obj_id = ?"),
11392 SELECT_PATH_FOR_FILE(
"SELECT parent_path FROM tsk_files WHERE obj_id = ?"),
11393 SELECT_FILE_NAME(
"SELECT name FROM tsk_files WHERE obj_id = ?"),
11394 SELECT_DERIVED_FILE(
"SELECT derived_id, rederive FROM tsk_files_derived WHERE obj_id = ?"),
11395 SELECT_FILE_DERIVATION_METHOD(
"SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"),
11396 SELECT_MAX_OBJECT_ID(
"SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"),
11397 INSERT_OBJECT(
"INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"),
11398 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, known, mime_type, parent_path, data_source_obj_id,extension) "
11399 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11400 INSERT_FILE_SYSTEM_FILE(
"INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, parent_path, extension)"
11401 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11402 INSERT_FILE_SYSTEM_FILE_All_FIELDS(
"INSERT INTO tsk_files (fs_obj_id, obj_id, data_source_obj_id, type, attr_type, attr_id, name, meta_addr, meta_seq, dir_type, meta_type, dir_flags, meta_flags, size, crtime, ctime, atime, mtime, mode, gid, uid, md5, known, parent_path, extension, has_layout)"
11403 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11404 UPDATE_DERIVED_FILE(
"UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?, meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ? "
11405 +
"WHERE obj_id = ?"),
11406 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
11407 +
"VALUES (?, ?, ?, ?)"),
11408 INSERT_LOCAL_PATH(
"INSERT INTO tsk_files_path (obj_id, path, encoding_type) VALUES (?, ?, ?)"),
11409 UPDATE_LOCAL_PATH(
"UPDATE tsk_files_path SET path = ?, encoding_type = ? WHERE obj_id = ?"),
11410 COUNT_CHILD_OBJECTS_BY_PARENT(
"SELECT COUNT(obj_id) AS count FROM tsk_objects WHERE par_obj_id = ?"),
11411 SELECT_FILE_SYSTEM_BY_OBJECT(
"SELECT fs_obj_id from tsk_files WHERE obj_id=?"),
11412 SELECT_TAG_NAMES(
"SELECT * FROM tag_names"),
11413 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
11414 +
"WHERE tag_name_id IN "
11415 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
11416 SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE(
"SELECT * FROM tag_names "
11417 +
"WHERE tag_name_id IN "
11418 +
"( SELECT content_tags.tag_name_id as tag_name_id "
11419 +
"FROM content_tags as content_tags, tsk_files as tsk_files"
11420 +
" WHERE content_tags.obj_id = tsk_files.obj_id"
11421 +
" AND tsk_files.data_source_obj_id = ?"
11423 +
"SELECT artifact_tags.tag_name_id as tag_name_id "
11424 +
" FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts "
11425 +
" WHERE artifact_tags.artifact_id = arts.artifact_id"
11426 +
" AND arts.data_source_obj_id = ?"
11428 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?)"),
11429 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset, examiner_id) VALUES (?, ?, ?, ?, ?, ?)"),
11430 DELETE_CONTENT_TAG(
"DELETE FROM content_tags WHERE tag_id = ?"),
11431 COUNT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM content_tags WHERE tag_name_id = ?"),
11432 COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
11433 "SELECT COUNT(*) AS count FROM content_tags as content_tags, tsk_files as tsk_files WHERE content_tags.obj_id = tsk_files.obj_id"
11434 +
" AND content_tags.tag_name_id = ? "
11435 +
" AND tsk_files.data_source_obj_id = ? "
11437 SELECT_CONTENT_TAGS(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
11438 +
"FROM content_tags "
11439 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11440 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id"),
11441 SELECT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tsk_examiners.login_name "
11442 +
"FROM content_tags "
11443 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11444 +
"WHERE tag_name_id = ?"),
11445 SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id "
11446 +
"FROM content_tags as content_tags, tsk_files as tsk_files, tag_names as tag_names, tsk_examiners as tsk_examiners "
11447 +
"WHERE content_tags.examiner_id = tsk_examiners.examiner_id"
11448 +
" AND content_tags.obj_id = tsk_files.obj_id"
11449 +
" AND content_tags.tag_name_id = tag_names.tag_name_id"
11450 +
" AND content_tags.tag_name_id = ?"
11451 +
" AND tsk_files.data_source_obj_id = ? "),
11452 SELECT_CONTENT_TAG_BY_ID(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
11453 +
"FROM content_tags "
11454 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11455 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11456 +
"WHERE tag_id = ?"),
11457 SELECT_CONTENT_TAGS_BY_CONTENT(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
11458 +
"FROM content_tags "
11459 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
11460 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
11461 +
"WHERE content_tags.obj_id = ?"),
11462 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment, examiner_id) "
11463 +
"VALUES (?, ?, ?, ?)"),
11464 DELETE_ARTIFACT_TAG(
"DELETE FROM blackboard_artifact_tags WHERE tag_id = ?"),
11465 SELECT_ARTIFACT_TAGS(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tag_names.tag_set_id, tsk_examiners.login_name, tag_names.rank "
11466 +
"FROM blackboard_artifact_tags "
11467 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11468 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id"),
11469 COUNT_ARTIFACTS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags WHERE tag_name_id = ?"),
11470 COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts WHERE artifact_tags.artifact_id = arts.artifact_id"
11471 +
" AND artifact_tags.tag_name_id = ?"
11472 +
" AND arts.data_source_obj_id = ? "),
11473 SELECT_ARTIFACT_TAGS_BY_TAG_NAME(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tsk_examiners.login_name "
11474 +
"FROM blackboard_artifact_tags "
11475 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11476 +
"WHERE tag_name_id = ?"),
11477 SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT artifact_tags.tag_id, artifact_tags.artifact_id, artifact_tags.tag_name_id, artifact_tags.comment, arts.obj_id, arts.artifact_obj_id, arts.data_source_obj_id, arts.artifact_type_id, arts.review_status_id, tsk_examiners.login_name "
11478 +
"FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts, tsk_examiners AS tsk_examiners "
11479 +
"WHERE artifact_tags.examiner_id = tsk_examiners.examiner_id"
11480 +
" AND artifact_tags.artifact_id = arts.artifact_id"
11481 +
" AND artifact_tags.tag_name_id = ? "
11482 +
" AND arts.data_source_obj_id = ? "),
11483 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
11484 +
"FROM blackboard_artifact_tags "
11485 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11486 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11487 +
"WHERE blackboard_artifact_tags.tag_id = ?"),
11488 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
11489 +
"FROM blackboard_artifact_tags "
11490 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
11491 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
11492 +
"WHERE blackboard_artifact_tags.artifact_id = ?"),
11493 SELECT_REPORTS(
"SELECT * FROM reports"),
11494 SELECT_REPORT_BY_ID(
"SELECT * FROM reports WHERE obj_id = ?"),
11495 INSERT_REPORT(
"INSERT INTO reports (obj_id, path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?, ?)"),
11496 DELETE_REPORT(
"DELETE FROM reports WHERE reports.obj_id = ?"),
11497 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
11498 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
11499 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
11500 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
11501 UPDATE_IMAGE_PATH(
"UPDATE tsk_image_names SET name = ? WHERE obj_id = ?"),
11502 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "
11503 +
"FROM tsk_objects INNER JOIN blackboard_artifacts "
11504 +
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "
11505 +
"WHERE (tsk_objects.par_obj_id = ?)"),
11506 INSERT_OR_UPDATE_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?) ON CONFLICT (display_name) DO UPDATE SET description = ?, color = ?, knownStatus = ?"),
11507 SELECT_EXAMINER_BY_ID(
"SELECT * FROM tsk_examiners WHERE examiner_id = ?"),
11508 SELECT_EXAMINER_BY_LOGIN_NAME(
"SELECT * FROM tsk_examiners WHERE login_name = ?"),
11509 INSERT_EXAMINER_POSTGRESQL(
"INSERT INTO tsk_examiners (login_name) VALUES (?) ON CONFLICT DO NOTHING"),
11510 INSERT_EXAMINER_SQLITE(
"INSERT OR IGNORE INTO tsk_examiners (login_name) VALUES (?)"),
11511 UPDATE_FILE_NAME(
"UPDATE tsk_files SET name = ? WHERE obj_id = ?"),
11512 UPDATE_IMAGE_NAME(
"UPDATE tsk_image_info SET display_name = ? WHERE obj_id = ?"),
11513 DELETE_IMAGE_NAME(
"DELETE FROM tsk_image_names WHERE obj_id = ?"),
11514 INSERT_IMAGE_NAME(
"INSERT INTO tsk_image_names (obj_id, name, sequence) VALUES (?, ?, ?)"),
11515 INSERT_IMAGE_INFO(
"INSERT INTO tsk_image_info (obj_id, type, ssize, tzone, size, md5, sha1, sha256, display_name)"
11516 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11517 INSERT_DATA_SOURCE_INFO(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) VALUES (?, ?, ?)"),
11518 INSERT_DATA_SOURCE_INFO_WITH_ACQ_DETAIL(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, acquisition_details) VALUES (?, ?, ?, ?)"),
11519 INSERT_VS_INFO(
"INSERT INTO tsk_vs_info (obj_id, vs_type, img_offset, block_size) VALUES (?, ?, ?, ?)"),
11520 INSERT_VS_PART_SQLITE(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, desc, flags) VALUES (?, ?, ?, ?, ?, ?)"),
11521 INSERT_VS_PART_POSTGRESQL(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, descr, flags) VALUES (?, ?, ?, ?, ?, ?)"),
11522 INSERT_POOL_INFO(
"INSERT INTO tsk_pool_info (obj_id, pool_type) VALUES (?, ?)"),
11523 INSERT_FS_INFO(
"INSERT INTO tsk_fs_info (obj_id, data_source_obj_id, img_offset, fs_type, block_size, block_count, root_inum, first_inum, last_inum, display_name)"
11524 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
11525 SELECT_TAG_NAME_BY_ID(
"SELECT * FROM tag_names where tag_name_id = ?");
11527 private final String sql;
11529 private PREPARED_STATEMENT(String sql) {
11543 abstract private class ConnectionPool {
11545 private PooledDataSource pooledDataSource;
11547 public ConnectionPool() {
11548 pooledDataSource = null;
11551 CaseDbConnection getConnection() throws TskCoreException {
11552 if (pooledDataSource == null) {
11553 throw new TskCoreException(
"Error getting case database connection - case is closed");
11556 return getPooledConnection();
11557 }
catch (SQLException exp) {
11558 throw new TskCoreException(exp.getMessage());
11562 void close() throws TskCoreException {
11563 if (pooledDataSource != null) {
11565 pooledDataSource.close();
11566 }
catch (SQLException exp) {
11567 throw new TskCoreException(exp.getMessage());
11569 pooledDataSource = null;
11574 abstract CaseDbConnection getPooledConnection() throws SQLException;
11576 public PooledDataSource getPooledDataSource() {
11577 return pooledDataSource;
11580 public void setPooledDataSource(PooledDataSource pooledDataSource) {
11581 this.pooledDataSource = pooledDataSource;
11589 private final class SQLiteConnections
extends ConnectionPool {
11591 private final Map<String, String> configurationOverrides =
new HashMap<String, String>();
11593 SQLiteConnections(String dbPath)
throws SQLException {
11594 configurationOverrides.put(
"acquireIncrement",
"2");
11595 configurationOverrides.put(
"initialPoolSize",
"5");
11596 configurationOverrides.put(
"minPoolSize",
"5");
11601 configurationOverrides.put(
"maxPoolSize",
"20");
11602 configurationOverrides.put(
"maxStatements",
"200");
11603 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
11605 SQLiteConfig config =
new SQLiteConfig();
11606 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
11607 config.setReadUncommited(
true);
11608 config.enforceForeignKeys(
true);
11609 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
11610 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
11611 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
11615 public CaseDbConnection getPooledConnection() throws SQLException {
11616 return new SQLiteConnection(getPooledDataSource().getConnection());
11624 private final class PostgreSQLConnections
extends ConnectionPool {
11626 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
11627 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
11628 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
11629 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
11630 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
11631 comboPooledDataSource.setUser(userName);
11632 comboPooledDataSource.setPassword(password);
11633 comboPooledDataSource.setAcquireIncrement(2);
11634 comboPooledDataSource.setInitialPoolSize(5);
11635 comboPooledDataSource.setMinPoolSize(5);
11640 comboPooledDataSource.setMaxPoolSize(20);
11641 comboPooledDataSource.setMaxStatements(200);
11642 comboPooledDataSource.setMaxStatementsPerConnection(20);
11643 setPooledDataSource(comboPooledDataSource);
11647 public CaseDbConnection getPooledConnection() throws SQLException {
11648 return new PostgreSQLConnection(getPooledDataSource().getConnection());
11655 abstract class CaseDbConnection
implements AutoCloseable {
11657 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
11658 static final int MAX_RETRIES = 20;
11660 private class CreateStatement
implements DbCommand {
11662 private final Connection connection;
11663 private Statement statement = null;
11665 CreateStatement(Connection connection) {
11666 this.connection = connection;
11669 Statement getStatement() {
11674 public void execute() throws SQLException {
11675 statement = connection.createStatement();
11679 private class SetAutoCommit
implements DbCommand {
11681 private final Connection connection;
11682 private final boolean mode;
11684 SetAutoCommit(Connection connection,
boolean mode) {
11685 this.connection = connection;
11690 public void execute() throws SQLException {
11691 connection.setAutoCommit(mode);
11695 private class Commit
implements DbCommand {
11697 private final Connection connection;
11699 Commit(Connection connection) {
11700 this.connection = connection;
11704 public void execute() throws SQLException {
11705 connection.commit();
11709 private class ExecuteQuery
implements DbCommand {
11711 private final Statement statement;
11712 private final String query;
11713 private ResultSet resultSet;
11715 ExecuteQuery(Statement statement, String query) {
11716 this.statement = statement;
11717 this.query = query;
11720 ResultSet getResultSet() {
11725 public void execute() throws SQLException {
11726 resultSet = statement.executeQuery(query);
11730 private class ExecutePreparedStatementQuery
implements DbCommand {
11732 private final PreparedStatement preparedStatement;
11733 private ResultSet resultSet;
11735 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
11736 this.preparedStatement = preparedStatement;
11739 ResultSet getResultSet() {
11744 public void execute() throws SQLException {
11745 resultSet = preparedStatement.executeQuery();
11749 private class ExecutePreparedStatementUpdate
implements DbCommand {
11751 private final PreparedStatement preparedStatement;
11753 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
11754 this.preparedStatement = preparedStatement;
11758 public void execute() throws SQLException {
11759 preparedStatement.executeUpdate();
11763 private class ExecuteStatementUpdate
implements DbCommand {
11765 private final Statement statement;
11766 private final String updateCommand;
11768 ExecuteStatementUpdate(Statement statement, String updateCommand) {
11769 this.statement = statement;
11770 this.updateCommand = updateCommand;
11774 public void execute() throws SQLException {
11775 statement.executeUpdate(updateCommand);
11779 private class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
11781 private final Statement statement;
11782 private final int generateKeys;
11783 private final String updateCommand;
11785 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
11786 this.statement = statement;
11787 this.generateKeys = generateKeys;
11788 this.updateCommand = updateCommand;
11792 public void execute() throws SQLException {
11793 statement.executeUpdate(updateCommand, generateKeys);
11797 private class PrepareStatement
implements DbCommand {
11799 private final Connection connection;
11800 private final String input;
11801 private PreparedStatement preparedStatement = null;
11803 PrepareStatement(Connection connection, String input) {
11804 this.connection = connection;
11805 this.input = input;
11808 PreparedStatement getPreparedStatement() {
11809 return preparedStatement;
11813 public void execute() throws SQLException {
11814 preparedStatement = connection.prepareStatement(input);
11818 private class PrepareStatementGenerateKeys
implements DbCommand {
11820 private final Connection connection;
11821 private final String input;
11822 private final int generateKeys;
11823 private PreparedStatement preparedStatement = null;
11825 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
11826 this.connection = connection;
11827 this.input = input;
11828 this.generateKeys = generateKeysInput;
11831 PreparedStatement getPreparedStatement() {
11832 return preparedStatement;
11836 public void execute() throws SQLException {
11837 preparedStatement = connection.prepareStatement(input, generateKeys);
11841 abstract void executeCommand(DbCommand command)
throws SQLException;
11843 private final Connection connection;
11844 private final Map<PREPARED_STATEMENT, PreparedStatement> preparedStatements;
11846 CaseDbConnection(Connection connection) {
11847 this.connection = connection;
11848 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(PREPARED_STATEMENT.class);
11852 return this.connection != null;
11855 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
11856 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
11859 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
11861 PreparedStatement statement;
11862 if (this.preparedStatements.containsKey(statementKey)) {
11863 statement = this.preparedStatements.get(statementKey);
11865 statement = prepareStatement(statementKey.getSQL(), generateKeys);
11866 this.preparedStatements.put(statementKey, statement);
11871 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
11872 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
11873 executeCommand(prepareStatement);
11874 return prepareStatement.getPreparedStatement();
11877 Statement createStatement() throws SQLException {
11878 CreateStatement createStatement =
new CreateStatement(this.connection);
11879 executeCommand(createStatement);
11880 return createStatement.getStatement();
11884 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
11885 executeCommand(setAutoCommit);
11888 void commitTransaction() throws SQLException {
11889 Commit commit =
new Commit(connection);
11890 executeCommand(commit);
11892 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
11893 executeCommand(setAutoCommit);
11901 void rollbackTransaction() {
11903 connection.rollback();
11904 }
catch (SQLException e) {
11905 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
11908 connection.setAutoCommit(
true);
11909 }
catch (SQLException e) {
11910 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
11921 void rollbackTransactionWithThrow() throws SQLException {
11923 connection.rollback();
11925 connection.setAutoCommit(
true);
11929 ResultSet
executeQuery(Statement statement, String query)
throws SQLException {
11930 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
11931 executeCommand(queryCommand);
11932 return queryCommand.getResultSet();
11944 ResultSet
executeQuery(PreparedStatement statement)
throws SQLException {
11945 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
11946 executeCommand(executePreparedStatementQuery);
11947 return executePreparedStatementQuery.getResultSet();
11950 void executeUpdate(Statement statement, String update)
throws SQLException {
11951 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
11954 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
11955 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
11956 executeCommand(executeStatementUpdate);
11959 void executeUpdate(PreparedStatement statement)
throws SQLException {
11960 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
11961 executeCommand(executePreparedStatementUpdate);
11968 public void close() {
11970 connection.close();
11971 }
catch (SQLException ex) {
11972 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
11976 Connection getConnection() {
11977 return this.connection;
11984 private final class SQLiteConnection
extends CaseDbConnection {
11986 private static final int DATABASE_LOCKED_ERROR = 0;
11987 private static final int SQLITE_BUSY_ERROR = 5;
11989 SQLiteConnection(Connection conn) {
11994 void executeCommand(DbCommand command)
throws SQLException {
11995 int retryCounter = 0;
12000 }
catch (SQLException ex) {
12001 if ((ex.getErrorCode() == SQLITE_BUSY_ERROR || ex.getErrorCode() == DATABASE_LOCKED_ERROR) && retryCounter < MAX_RETRIES) {
12008 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
12009 }
catch (InterruptedException exp) {
12010 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
12023 private final class PostgreSQLConnection
extends CaseDbConnection {
12025 private final String COMMUNICATION_ERROR = PSQLState.COMMUNICATION_ERROR.getState();
12026 private final String SYSTEM_ERROR = PSQLState.SYSTEM_ERROR.getState();
12027 private final String UNKNOWN_STATE = PSQLState.UNKNOWN_STATE.getState();
12028 private static final int MAX_RETRIES = 3;
12030 PostgreSQLConnection(Connection conn) {
12035 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
12036 CaseDbConnection.ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new CaseDbConnection.ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
12037 executeCommand(executeStatementUpdateGenerateKeys);
12041 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
12042 CaseDbConnection.PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new CaseDbConnection.PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
12043 executeCommand(prepareStatementGenerateKeys);
12044 return prepareStatementGenerateKeys.getPreparedStatement();
12048 void executeCommand(DbCommand command)
throws SQLException {
12049 SQLException lastException = null;
12050 for (
int retries = 0; retries < MAX_RETRIES; retries++) {
12053 lastException = null;
12055 }
catch (SQLException ex) {
12056 lastException = ex;
12057 String sqlState = ex.getSQLState();
12058 if (sqlState == null || sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
12060 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
12061 }
catch (InterruptedException exp) {
12062 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
12071 if (lastException != null) {
12072 throw lastException;
12093 private final CaseDbConnection connection;
12097 this.connection = connection;
12098 this.sleuthkitCase = sleuthkitCase;
12100 this.connection.beginTransaction();
12101 }
catch (SQLException ex) {
12102 throw new TskCoreException(
"Failed to create transaction on case database", ex);
12114 CaseDbConnection getConnection() {
12115 return this.connection;
12126 this.connection.commitTransaction();
12127 }
catch (SQLException ex) {
12128 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
12142 this.connection.rollbackTransactionWithThrow();
12143 }
catch (SQLException ex) {
12144 throw new TskCoreException(
"Case database transaction rollback failed", ex);
12155 this.connection.close();
12171 private ResultSet resultSet;
12172 private CaseDbConnection connection;
12174 private CaseDbQuery(String query)
throws TskCoreException {
12175 this(query,
false);
12178 private CaseDbQuery(String query,
boolean allowWriteQuery)
throws TskCoreException {
12179 if (!allowWriteQuery) {
12180 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
12181 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
12185 connection = connections.getConnection();
12186 }
catch (TskCoreException ex) {
12187 throw new TskCoreException(
"Error getting connection for query: ", ex);
12192 resultSet = connection.executeQuery(connection.createStatement(), query);
12193 }
catch (SQLException ex) {
12195 throw new TskCoreException(
"Error executing query: ", ex);
12209 public void close() throws TskCoreException {
12211 if (resultSet != null) {
12212 final Statement statement = resultSet.getStatement();
12213 if (statement != null) {
12218 connection.close();
12219 }
catch (SQLException ex) {
12220 throw new TskCoreException(
"Error closing query: ", ex);
12236 sleuthkitCaseErrorObservers.add(observer);
12248 int i = sleuthkitCaseErrorObservers.indexOf(observer);
12250 sleuthkitCaseErrorObservers.remove(i);
12264 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
12265 if (observer != null) {
12267 observer.receiveError(context, errorMessage);
12268 }
catch (Exception ex) {
12269 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
12301 private final String contextString;
12303 private Context(String context) {
12304 this.contextString = context;
12308 return contextString;
12312 void receiveError(String context, String errorMessage);
12326 long getDataSourceObjectId(
long objectId) {
12328 CaseDbConnection connection = connections.getConnection();
12330 return getDataSourceObjectId(connection, objectId);
12332 connection.close();
12334 }
catch (TskCoreException ex) {
12335 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
12351 CaseDbConnection connection = connections.getConnection();
12353 ResultSet rs = null;
12356 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID);
12357 rs = connection.executeQuery(statement);
12360 id = rs.getLong(
"max_obj_id");
12363 }
catch (SQLException e) {
12364 throw new TskCoreException(
"Error getting last object id", e);
12366 closeResultSet(rs);
12367 connection.close();
12387 CaseDbConnection connection = connections.getConnection();
12389 Statement s = null;
12390 ResultSet rs = null;
12392 s = connection.createStatement();
12393 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
12394 List<FsContent> results =
new ArrayList<FsContent>();
12395 List<AbstractFile> temp = resultSetToAbstractFiles(rs, connection);
12403 }
catch (SQLException e) {
12404 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
12406 closeResultSet(rs);
12408 connection.close();
12426 CaseDbConnection connection = connections.getConnection();
12428 Statement s = null;
12429 ResultSet rs = null;
12431 s = connection.createStatement();
12432 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
12435 typeId = rs.getInt(
"artifact_type_id");
12438 }
catch (SQLException ex) {
12439 throw new TskCoreException(
"Error getting artifact type id", ex);
12441 closeResultSet(rs);
12443 connection.close();
12476 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
12479 }
catch (TskDataException ex) {
12480 throw new TskCoreException(
"Failed to add artifact type.", ex);
12498 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
12501 }
catch (TskDataException ex) {
12502 throw new TskCoreException(
"Couldn't add new attribute type");
12518 CaseDbConnection connection = connections.getConnection();
12520 Statement s = null;
12521 ResultSet rs = null;
12523 s = connection.createStatement();
12524 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
12527 typeId = rs.getInt(
"attribute_type_id");
12530 }
catch (SQLException ex) {
12531 throw new TskCoreException(
"Error getting attribute type id", ex);
12533 closeResultSet(rs);
12535 connection.close();
12554 CaseDbConnection connection = connections.getConnection();
12556 Statement s = null;
12557 ResultSet rs = null;
12559 s = connection.createStatement();
12560 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
12562 return rs.getString(
"type_name");
12564 throw new TskCoreException(
"No type with that id");
12566 }
catch (SQLException ex) {
12567 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
12569 closeResultSet(rs);
12571 connection.close();
12590 CaseDbConnection connection = connections.getConnection();
12592 Statement s = null;
12593 ResultSet rs = null;
12595 s = connection.createStatement();
12596 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
12598 return rs.getString(
"display_name");
12600 throw new TskCoreException(
"No type with that id");
12602 }
catch (SQLException ex) {
12603 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
12605 closeResultSet(rs);
12607 connection.close();
12642 public ResultSet
runQuery(String query)
throws SQLException {
12643 CaseDbConnection connection;
12645 connection = connections.getConnection();
12646 }
catch (TskCoreException ex) {
12647 throw new SQLException(
"Error getting connection for ad hoc query", ex);
12651 return connection.executeQuery(connection.createStatement(), query);
12655 connection.close();
12671 final Statement statement = resultSet.getStatement();
12673 if (statement != null) {
12695 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
12698 files.add(carvedFile);
12702 || parent instanceof
Volume
12703 || parent instanceof
Image) {
12706 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
12725 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
12729 carvedFiles.add(carvedFile);
12734 || parent instanceof
Volume
12735 || parent instanceof
Image) {
12738 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
12774 long size,
long ctime,
long crtime,
long atime,
long mtime,
12776 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
12777 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
12778 isFile, parentFile, rederiveDetails, toolName, toolVersion,
12808 long size,
long ctime,
long crtime,
long atime,
long mtime,
12811 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
12836 long size,
long ctime,
long crtime,
long atime,
long mtime,
12839 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
12861 return this.caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"",
this);
12878 }
catch (TskCoreException ex) {
12879 logger.log(Level.SEVERE,
"Error loading all file systems for image with ID {0}", image.
getId());
12880 return new ArrayList<>();
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
static ARTIFACT_TYPE fromID(int id)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
BlackboardArtifact getArtifactByArtifactId(long id)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
BlackboardArtifact getArtifactById(long id)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
synchronized Content getParent()
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
CommunicationsManager getCommunicationsManager()
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
List< Content > getChildren()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbSchemaVersionNumber getDBSchemaCreationVersion()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
void addErrorObserver(ErrorObserver observer)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
Blackboard getBlackboard()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
synchronized void close()
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
void setFileMIMEType(AbstractFile file, String mimeType)
UNALLOC
Metadata structure is currently in an unallocated state.
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
BlackboardArtifactTagChange addArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
synchronized CaseDbAccessManager getCaseDbAccessManager()
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
List< AbstractFile > openFiles(Content dataSource, String filePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
BlackboardArtifactTag getAddedTag()
VersionNumber getDBSchemaVersion()
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
static final String NAME_CARVED
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
long getDataSourceObjectId()
List< VirtualDirectory > getVirtualDirectoryRoots()
LayoutFile addLayoutFile(String fileName, long size, TSK_FS_NAME_FLAG_ENUM dirFlag, TSK_FS_META_FLAG_ENUM metaFlag, long ctime, long crtime, long atime, long mtime, List< TskFileRange > fileRanges, Content parent)
long getBlackboardArtifactTagsCountByTagName(TagName tagName, long dsObjId)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
synchronized TaggingManager getTaggingManager()
BlackboardArtifact getBlackboardArtifact(long artifactID)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
long countFilesWhere(String sqlWhereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
FS
File System - see tsk_fs_info for more details.
Pool addPool(long parentObjId, TskData.TSK_POOL_TYPE_ENUM type, CaseDbTransaction transaction)
boolean isFileFromSource(Content dataSource, long fileId)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Image > getImages()
int getAttrTypeID(String attrTypeName)
Image getImageById(long id)
Report addReport(String localPath, String sourceModuleName, String reportName, Content parent)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
void unregisterForEvents(Object listener)
LOCAL_DIR
Local directory that was added (not from a disk image)
TimelineManager getTimelineManager()
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void releaseSingleUserCaseReadLock()
VOL
Volume - see tsk_vs_parts for more details.
void closeRunQuery(ResultSet resultSet)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
long getContentTagsCountByTagName(TagName tagName, long dsObjId)
List< ContentTag > getContentTagsByTagName(TagName tagName)
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static String escapeSingleQuotes(String text)
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< TagName > getAllTagNames()
Report getReportById(long id)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
static HTML_COLOR getColorByName(String colorName)
void acquireSingleUserCaseWriteLock()
REPORT
Artifact - see blackboard_artifacts for more details.
List< AbstractFile > findFilesByMd5(String md5Hash)
long getBlackboardArtifactsTypeCount(int artifactTypeID, long dataSourceID)
BlackboardArtifact.Type getArtifactType(String artTypeName)
BlackboardArtifact newBlackboardArtifact(ARTIFACT_TYPE artifactType, long obj_id)
void releaseSingleUserCaseWriteLock()
DERIVED
File derived from a parent file (i.e. from ZIP)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, CaseDbTransaction transaction)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
List< Content > getRootObjects()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirSubString)
ContentTagChange addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
FileSystem addFileSystem(long parentObjId, long imgOffset, TskData.TSK_FS_TYPE_ENUM type, long blockSize, long blockCount, long rootInum, long firstInum, long lastInum, String displayName, CaseDbTransaction transaction)
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
List< ContentTag > getContentTagsByTagName(TagName tagName, long dsObjId)
void deleteContentTag(ContentTag tag)
static ObjectType valueOf(short objectType)
long getContentTagsCountByTagName(TagName tagName)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parent)
Collection< FileSystem > getImageFileSystems(Image image)
void updateImagePath(String newPath, long objectId)
VolumeSystem addVolumeSystem(long parentObjId, TskData.TSK_VS_TYPE_ENUM type, long imgOffset, long blockSize, CaseDbTransaction transaction)
Examiner getCurrentExaminer()
UNKNOWN
File marked as unknown by hash db.
List< TagName > getTagNamesInUse(long dsObjId)
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
static void tryConnect(CaseDbConnectionInfo info)
static SleuthkitCase openCase(String dbPath)
CaseDbQuery executeInsertOrUpdate(String query)
static String createNonUniquePath(String uniquePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName, long dsObjId)
Volume addVolume(long parentObjId, long addr, long start, long length, String desc, long flags, CaseDbTransaction transaction)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
void acquireSingleUserCaseReadLock()
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
List< FsContent > findFilesWhere(String sqlWhereClause)
static ReviewStatus withID(int id)
void copyCaseDB(String newDBPath)
ResultSet runQuery(String query)
List< TskFileRange > getFileRanges(long id)
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
void registerForEvents(Object listener)
CaseDbQuery executeQuery(String query)
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
LocalDirectory addLocalDirectory(long parentId, String directoryName)