Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Static Public Member Functions | Static Public Attributes | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.casemodule.Case Class Reference

Inherits ErrorObserver.

Classes

enum  CaseType
 
enum  Events
 

Public Member Functions

Image addImage (String imgPath, long imgId, String timeZone) throws CaseActionException
 
void addReport (String localPath, String srcModuleName, String reportName) throws TskCoreException
 
void closeCase () throws CaseActionException
 
void deleteReports (Collection<?extends Report > reports, boolean deleteFromDisk) throws TskCoreException
 
List< Report > getAllReports () throws TskCoreException
 
String getCacheDirectory ()
 
String getCaseDirectory ()
 
CaseType getCaseType ()
 
String getCreatedDate ()
 
List< Content > getDataSources () throws TskCoreException
 
String getExaminer ()
 
String getExportDirectory ()
 
String getLogDirectoryPath ()
 
String getModuleDirectory ()
 
String getModuleOutputDirectoryRelativePath ()
 
String getModulesOutputDirAbsPath ()
 
String getName ()
 
String getNumber ()
 
String getOutputDirectory ()
 
String getReportDirectory ()
 
Services getServices ()
 
SleuthkitCase getSleuthkitCase ()
 
String getTempDirectory ()
 
String getTextIndexName ()
 
Set< TimeZone > getTimeZone ()
 
boolean hasData ()
 
void notifyAddingDataSource (UUID dataSourceId)
 
void notifyBlackBoardArtifactTagAdded (BlackboardArtifactTag newTag)
 
void notifyBlackBoardArtifactTagDeleted (BlackboardArtifactTag deletedTag)
 
void notifyContentTagAdded (ContentTag newTag)
 
void notifyContentTagDeleted (ContentTag deletedTag)
 
void notifyDataSourceAdded (Content newDataSource, UUID dataSourceId)
 
void notifyFailedAddingDataSource (UUID dataSourceId)
 
void receiveError (String context, String errorMessage)
 

Static Public Member Functions

static void addEventSubscriber (Set< String > eventNames, PropertyChangeListener subscriber)
 
static void addEventSubscriber (String eventName, PropertyChangeListener subscriber)
 
static synchronized void addPropertyChangeListener (PropertyChangeListener listener)
 
static String convertTimeZone (String timezoneID)
 
static void create (String caseDir, String caseName, String caseNumber, String examiner) throws CaseActionException
 
static void create (String caseDir, String caseName, String caseNumber, String examiner, CaseType caseType) throws CaseActionException
 
static boolean existsCurrentCase ()
 
static String getAppName ()
 
static String getAutopsyVersion ()
 
static Case getCurrentCase ()
 
static String getModulesOutputDirRelPath ()
 
static PropertyChangeSupport getPropertyChangeSupport ()
 
static void invokeStartupDialog ()
 
static boolean isCaseOpen ()
 
static boolean isValidName (String caseName)
 
static void open (String caseMetadataFilePath) throws CaseActionException
 
static boolean pathExists (String imgPath)
 
static void removeEventSubscriber (String eventName, PropertyChangeListener subscriber)
 
static void removeEventSubscriber (Set< String > eventNames, PropertyChangeListener subscriber)
 
static synchronized void removePropertyChangeListener (PropertyChangeListener listener)
 

Static Public Attributes

static final String propStartup = "LBL_StartupDialog"
 

Private Member Functions

 Case (String name, String number, String examiner, String configFilePath, XMLCaseManagement xmlcm, SleuthkitCase db, CaseType type)
 
String getDirectory (String input)
 
String getHostDirectory ()
 
void setConfigFilePath (String givenPath)
 

Static Private Member Functions

static void changeCase (Case newCase)
 
static void checkSubFolders (Case openedCase)
 
static void clearTempFolder ()
 
static void doCaseChange (Case toChangeTo)
 
static void updateMainWindowTitle (String newCaseName)
 

Private Attributes

final CaseType caseType
 
CollaborationMonitor collaborationMonitor
 
String configFilePath
 
final SleuthkitCase db
 
String examiner
 
boolean hasData = false
 
String name
 
String number
 
final Services services
 
volatile IntervalErrorReportData tskErrorReporter = null
 
final XMLCaseManagement xmlcm
 

Static Private Attributes

static String appName = null
 
static final String autopsyVer = Version.getVersion()
 
static final String CACHE_FOLDER = "Cache"
 
static Case currentCase = null
 
static final String dev = "/dev/"
 
static final String EVENT_CHANNEL_NAME = "%s-Case-Events"
 
static final AutopsyEventPublisher eventPublisher = new AutopsyEventPublisher()
 
static final String EXPORT_FOLDER = "Export"
 
static final String LOG_FOLDER = "Log"
 
static final Logger logger = Logger.getLogger(Case.class.getName())
 
static final int MAX_SANITIZED_NAME_LENGTH = 47
 
static final int MIN_SECONDS_BETWEEN_ERROR_REPORTS = 60
 
static final String pdisk = "\\\\.\\physicaldrive"
 
static final String REPORTS_FOLDER = "Reports"
 
static final String TEMP_FOLDER = "Temp"
 

Detailed Description

Stores all information for a given case. Only a single case can currently be open at a time. Use getCurrentCase() to retrieve the object for the current case.

Definition at line 93 of file Case.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.casemodule.Case.Case ( String  name,
String  number,
String  examiner,
String  configFilePath,
XMLCaseManagement  xmlcm,
SleuthkitCase  db,
CaseType  type 
)
private

Member Function Documentation

static void org.sleuthkit.autopsy.casemodule.Case.addEventSubscriber ( Set< String >  eventNames,
PropertyChangeListener  subscriber 
)
static

Adds a subscriber to events from this Autopsy node and other Autopsy nodes.

Parameters
eventNamesThe events the subscriber is interested in.
subscriberThe subscriber to add.

Definition at line 1318 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.addSubscriber().

Referenced by org.sleuthkit.autopsy.casemodule.Case.addPropertyChangeListener(), org.sleuthkit.autopsy.ingest.IngestManager.subscribeToCaseEvents(), and org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent.subscribeToChangeEvents().

static void org.sleuthkit.autopsy.casemodule.Case.addEventSubscriber ( String  eventName,
PropertyChangeListener  subscriber 
)
static

Adds a subscriber to events from this Autopsy node and other Autopsy nodes.

Parameters
eventNameThe event the subscriber is interested in.
subscriberThe subscriber to add.

Definition at line 1329 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.addSubscriber().

Image org.sleuthkit.autopsy.casemodule.Case.addImage ( String  imgPath,
long  imgId,
String  timeZone 
) throws CaseActionException

Adds an image to the current case after it has been added to the DB. Sends out event and reopens windows if needed.

Parameters
imgPathThe path of the image file.
imgIdThe ID of the image.
timeZoneThe time zone of the image.
Deprecated:
As of release 4.0

Definition at line 727 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.notifyDataSourceAdded().

static synchronized void org.sleuthkit.autopsy.casemodule.Case.addPropertyChangeListener ( PropertyChangeListener  listener)
static
void org.sleuthkit.autopsy.casemodule.Case.addReport ( String  localPath,
String  srcModuleName,
String  reportName 
) throws TskCoreException

Adds a report to the case.

Parameters
localPathThe path of the report file, must be in the case directory or one of its subdirectories.
srcModuleNameThe name of the module that created the report.
reportNameThe report name, may be empty.
Exceptions
TskCoreException

Definition at line 1687 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

Referenced by org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importReports(), and org.sleuthkit.autopsy.timeline.actions.SaveSnapshotAsReport.SaveSnapshotAsReport().

static void org.sleuthkit.autopsy.casemodule.Case.changeCase ( Case  newCase)
staticprivate

Updates the current case to the given case and fires off the appropriate property-change

Parameters
newCasethe new current case or null if case is being closed

Use the text index name as the remote event channel name prefix since it is unique, the same as the case database name for a multiuser case, and is readily available through the Case.getTextIndexName() API.

Definition at line 333 of file Case.java.

References org.sleuthkit.autopsy.ingest.IngestManager.cancelAllIngestJobs(), org.sleuthkit.autopsy.ingest.IngestJob.CancellationReason.CASE_CLOSED, org.sleuthkit.autopsy.events.AutopsyEventPublisher.closeRemoteEventChannel(), org.sleuthkit.autopsy.casemodule.Case.collaborationMonitor, org.sleuthkit.autopsy.casemodule.Case.configFilePath, org.sleuthkit.autopsy.casemodule.Case.Events.CURRENT_CASE, org.sleuthkit.autopsy.casemodule.Case.currentCase, org.sleuthkit.autopsy.casemodule.Case.doCaseChange(), org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Notify.error(), org.sleuthkit.autopsy.casemodule.Case.getCaseType(), org.sleuthkit.autopsy.ingest.IngestManager.getInstance(), org.sleuthkit.autopsy.coreutils.PlatformUtil.getLogDirectory(), org.sleuthkit.autopsy.casemodule.Case.getLogDirectoryPath(), org.sleuthkit.autopsy.casemodule.Case.getTextIndexName(), org.sleuthkit.autopsy.casemodule.Case.CaseType.MULTI_USER_CASE, org.sleuthkit.autopsy.casemodule.Case.name, org.sleuthkit.autopsy.events.AutopsyEventPublisher.openRemoteEventChannel(), org.sleuthkit.autopsy.events.AutopsyEventPublisher.publishLocally(), org.sleuthkit.autopsy.coreutils.Logger.setLogDirectory(), and org.sleuthkit.autopsy.casemodule.Case.tskErrorReporter.

Referenced by org.sleuthkit.autopsy.casemodule.Case.closeCase(), org.sleuthkit.autopsy.casemodule.Case.create(), and org.sleuthkit.autopsy.casemodule.Case.open().

static void org.sleuthkit.autopsy.casemodule.Case.checkSubFolders ( Case  openedCase)
staticprivate

Check for existence of certain case sub dirs and create them if needed.

Parameters
openedCase

Definition at line 1577 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getModuleDirectory().

Referenced by org.sleuthkit.autopsy.casemodule.Case.doCaseChange().

static void org.sleuthkit.autopsy.casemodule.Case.clearTempFolder ( )
staticprivate
void org.sleuthkit.autopsy.casemodule.Case.closeCase ( ) throws CaseActionException
static String org.sleuthkit.autopsy.casemodule.Case.convertTimeZone ( String  timezoneID)
static

Convert the Java timezone ID to the "formatted" string that can be accepted by the C/C++ code. Example: "America/New_York" converted to "EST5EDT", etc

Parameters
timezoneID
Returns

Definition at line 1420 of file Case.java.

static void org.sleuthkit.autopsy.casemodule.Case.create ( String  caseDir,
String  caseName,
String  caseNumber,
String  examiner 
) throws CaseActionException
static

Creates a single-user new case.

Parameters
caseDirThe full path of the case directory. It will be created if it doesn't already exist; if it exists, it should have been created using Case.createCaseDirectory() to ensure that the required sub-directories aere created.
caseNameThe name of case.
caseNumberThe case number, can be the empty string.
examinerThe examiner to associate with the case, can be the empty string.
Exceptions
CaseActionExceptionif there is a problem creating the case. The exception will have a user-friendly message and may be a wrapper for a lower-level exception. If so, CaseActionException.getCause will return a Throwable (null otherwise).

Definition at line 430 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.CaseType.SINGLE_USER_CASE.

static void org.sleuthkit.autopsy.casemodule.Case.create ( String  caseDir,
String  caseName,
String  caseNumber,
String  examiner,
CaseType  caseType 
) throws CaseActionException
static

Creates a new case.

Parameters
caseDirThe full path of the case directory. It will be created if it doesn't already exist; if it exists, it should have been created using Case.createCaseDirectory() to ensure that the required sub-directories aere created.
caseNameThe name of case.
caseNumberThe case number, can be the empty string.
examinerThe examiner to associate with the case, can be the empty string.
caseTypeThe type of case (single-user or multi-user). The exception will have a user-friendly message and may be a wrapper for a lower-level exception. If so, CaseActionException.getCause will return a Throwable (null otherwise).
Exceptions
CaseActionExceptionif there is a problem creating the case.

Definition at line 453 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.Case(), org.sleuthkit.autopsy.casemodule.Case.changeCase(), org.sleuthkit.autopsy.core.UserPreferences.getDatabaseConnectionInfo(), org.sleuthkit.autopsy.casemodule.Case.CaseType.MULTI_USER_CASE, and org.sleuthkit.autopsy.casemodule.Case.CaseType.SINGLE_USER_CASE.

void org.sleuthkit.autopsy.casemodule.Case.deleteReports ( Collection<?extends Report >  reports,
boolean  deleteFromDisk 
) throws TskCoreException

Deletes reports from the case - deletes it from the disk as well as the database.

Parameters
reportsCollection of Report to be deleted from the case.
deleteFromDiskSet true to perform reports file deletion from disk.
Exceptions
TskCoreException

Definition at line 1713 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish(), and org.sleuthkit.autopsy.casemodule.Case.Events.REPORT_DELETED.

Referenced by org.sleuthkit.autopsy.datamodel.Reports.ReportNode.DeleteReportAction.actionPerformed().

static void org.sleuthkit.autopsy.casemodule.Case.doCaseChange ( Case  toChangeTo)
staticprivate
static boolean org.sleuthkit.autopsy.casemodule.Case.existsCurrentCase ( )
static
List<Report> org.sleuthkit.autopsy.casemodule.Case.getAllReports ( ) throws TskCoreException
static String org.sleuthkit.autopsy.casemodule.Case.getAppName ( )
static
static String org.sleuthkit.autopsy.casemodule.Case.getAutopsyVersion ( )
static

Returns the current version of Autopsy

Returns
autopsyVer

Definition at line 993 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.autopsyVer.

String org.sleuthkit.autopsy.casemodule.Case.getCacheDirectory ( )

Gets the full path to the cache directory of this case. Will create it if it does not already exist.

Returns
cacheDirectoryPath

Definition at line 1074 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getDirectory().

Referenced by org.sleuthkit.autopsy.coreutils.ImageUtils.getCachedThumbnailLocation().

String org.sleuthkit.autopsy.casemodule.Case.getCaseDirectory ( )
CaseType org.sleuthkit.autopsy.casemodule.Case.getCaseType ( )
String org.sleuthkit.autopsy.casemodule.Case.getCreatedDate ( )

get the created date of this case

Returns
case creation date

Definition at line 1243 of file Case.java.

static Case org.sleuthkit.autopsy.casemodule.Case.getCurrentCase ( )
static

Gets the currently opened case, if there is one.

Returns
the current open case
Exceptions
IllegalStateExceptionif there is no case open.

Definition at line 309 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.currentCase.

Referenced by org.sleuthkit.autopsy.actions.OpenLogFolderAction.actionPerformed(), org.sleuthkit.autopsy.actions.OpenOutputFolderAction.actionPerformed(), org.sleuthkit.autopsy.actions.DeleteContentTagAction.actionPerformed(), org.sleuthkit.autopsy.actions.DeleteBlackboardArtifactTagAction.actionPerformed(), org.sleuthkit.autopsy.casemodule.CaseCloseAction.actionPerformed(), org.sleuthkit.autopsy.directorytree.ExternalViewerAction.actionPerformed(), org.sleuthkit.autopsy.casemodule.CaseOpenAction.actionPerformed(), org.sleuthkit.autopsy.datamodel.Reports.ReportNode.DeleteReportAction.actionPerformed(), org.sleuthkit.autopsy.casemodule.services.Blackboard.addArtifactType(), org.sleuthkit.autopsy.casemodule.services.Blackboard.addAttributeType(), org.sleuthkit.autopsy.casemodule.services.TagsManager.addBlackboardArtifactTag(), org.sleuthkit.autopsy.casemodule.services.TagsManager.addContentTag(), org.sleuthkit.autopsy.actions.AddContentTagAction.addTag(), org.sleuthkit.autopsy.actions.AddBlackboardArtifactTagAction.addTag(), org.sleuthkit.autopsy.corecomponents.DataContentTopComponent.canClose(), org.sleuthkit.autopsy.corecomponents.DataResultTopComponent.canClose(), org.sleuthkit.autopsy.corecomponents.DataResultPanel.canClose(), org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent.canClose(), org.sleuthkit.autopsy.report.ReportGenerator.TableReportsWorker.checkIfTagHasImage(), org.sleuthkit.autopsy.corecomponents.Installer.close(), org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent.componentOpened(), org.sleuthkit.autopsy.datamodel.Reports.ReportNodeFactory.createKeys(), org.sleuthkit.autopsy.datamodel.Tags.TagNameNodeFactory.createKeys(), org.sleuthkit.autopsy.datamodel.Tags.ContentTagNodeFactory.createKeys(), org.sleuthkit.autopsy.datamodel.Tags.BlackboardArtifactTagNodeFactory.createKeys(), org.sleuthkit.autopsy.timeline.explorernodes.EventRootNode.EventNodeChildFactory.createNodeForKey(), org.sleuthkit.autopsy.casemodule.services.TagsManager.deleteBlackboardArtifactTag(), org.sleuthkit.autopsy.casemodule.services.TagsManager.deleteContentTag(), org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector.detect(), org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector.detectUserDefinedType(), org.sleuthkit.autopsy.directorytree.ExtractAction.extractFile(), org.sleuthkit.autopsy.directorytree.ExtractAction.extractFiles(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.findFileInCaseDatabase(), org.sleuthkit.autopsy.ingest.IngestMonitor.MonitorTimerAction.findRootDirectoryForCurrentCase(), org.sleuthkit.autopsy.coreutils.ImageUtils.getCachedThumbnailLocation(), org.sleuthkit.autopsy.ingest.IngestServices.getCurrentCase(), org.sleuthkit.autopsy.ingest.IngestServices.getCurrentSleuthkitCaseDb(), org.sleuthkit.autopsy.ingest.events.DataSourceAnalysisEvent.getDataSource(), org.sleuthkit.autopsy.report.ReportGenerator.FileReportsWorker.getFiles(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.getModuleOutputPath(), org.sleuthkit.autopsy.casemodule.events.ReportAddedEvent.getNewValue(), org.sleuthkit.autopsy.ingest.events.FileAnalyzedEvent.getNewValue(), org.sleuthkit.autopsy.casemodule.events.DataSourceAddedEvent.getNewValue(), org.sleuthkit.autopsy.ingest.events.ContentChangedEvent.getOldValue(), org.sleuthkit.autopsy.ingest.events.BlackboardPostEvent.getOldValue(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.getPathRelativeToCaseFolder(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.getRelModuleOutputPath(), org.sleuthkit.autopsy.actions.GetTagNameAndCommentDialog.GetTagNameAndCommentDialog(), org.sleuthkit.autopsy.actions.GetTagNameDialog.GetTagNameDialog(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.getTempPath(), org.sleuthkit.autopsy.coreutils.VideoUtils.getTempVideoFile(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importArtifacts(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importDerivedFiles(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importReports(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importResults(), org.sleuthkit.autopsy.keywordsearch.SolrSearchService.indexArtifact(), org.sleuthkit.autopsy.report.ReportGenerator.TableReportsWorker.makeBlackboardArtifactTagsTables(), org.sleuthkit.autopsy.report.ReportGenerator.TableReportsWorker.makeContentTagsTables(), org.sleuthkit.autopsy.actions.GetTagNameDialog.okButtonActionPerformed(), org.sleuthkit.autopsy.timeline.OpenTimelineAction.performAction(), org.sleuthkit.autopsy.report.ArtifactSelectionDialog.populateList(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.process(), org.sleuthkit.autopsy.modules.exif.ExifParserFileIngestModule.process(), org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchIngestModule.process(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbIngestModule.process(), org.sleuthkit.autopsy.filesearch.DateSearchFilter.CasePropertyChangeListener.propertyChange(), org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent.propertyChange(), org.sleuthkit.autopsy.timeline.TimeLineController.AutopsyIngestModuleListener.propertyChange(), org.sleuthkit.autopsy.datamodel.DataSourcesNode.DataSourcesNodeChildren.reloadKeys(), org.sleuthkit.autopsy.timeline.actions.SaveSnapshotAsReport.SaveSnapshotAsReport(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.setDisplayName(), org.sleuthkit.autopsy.ingest.IngestManager.startIngestJob(), org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorIngestModule.startUp(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.startUp(), org.sleuthkit.autopsy.examples.SampleExecutableDataSourceIngestModule.startUp(), org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.startUp(), org.sleuthkit.autopsy.ingest.IngestManager.subscribeToServiceMonitorEvents(), org.sleuthkit.autopsy.datamodel.Tags.TagNameNode.updateDisplayName(), org.sleuthkit.autopsy.datamodel.Tags.ContentTagTypeNode.updateDisplayName(), org.sleuthkit.autopsy.datamodel.Tags.BlackboardArtifactTagTypeNode.updateDisplayName(), org.sleuthkit.autopsy.casemodule.ImageFilePanel.warnIfPathIsInvalid(), and org.sleuthkit.autopsy.timeline.actions.SaveSnapshotAsReport.writeHTMLFile().

List<Content> org.sleuthkit.autopsy.casemodule.Case.getDataSources ( ) throws TskCoreException

Get the data model Content objects in the root of this case's hierarchy.

Returns
a list of the root objects
Exceptions
org.sleuthkit.datamodel.TskCoreException

Definition at line 1232 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.getTimeZone(), org.sleuthkit.autopsy.casemodule.Case.hasData(), org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent.propertyChange(), and org.sleuthkit.autopsy.datamodel.DataSourcesNode.DataSourcesNodeChildren.reloadKeys().

String org.sleuthkit.autopsy.casemodule.Case.getDirectory ( String  input)
private
String org.sleuthkit.autopsy.casemodule.Case.getExaminer ( )

Gets the Examiner name

Returns
examiner

Definition at line 1032 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.examiner.

String org.sleuthkit.autopsy.casemodule.Case.getExportDirectory ( )

Gets the full path to the export directory of this case. Will create it if it does not already exist.

Returns
exportDirectoryPath

Definition at line 1084 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getDirectory().

Referenced by org.sleuthkit.autopsy.directorytree.ExtractAction.extractFile(), and org.sleuthkit.autopsy.directorytree.ExtractAction.extractFiles().

String org.sleuthkit.autopsy.casemodule.Case.getHostDirectory ( )
private

Get the host output directory path where modules should save their permanent data. If single-user case, the directory is a subdirectory of the case directory. If multi-user case, the directory is a subdirectory of the hostName, which is a subdirectory of the case directory.

Returns
the path to the host output directory

Definition at line 1170 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getCaseDirectory(), org.sleuthkit.autopsy.coreutils.NetworkUtils.getLocalHostName(), and org.sleuthkit.autopsy.casemodule.Case.CaseType.MULTI_USER_CASE.

Referenced by org.sleuthkit.autopsy.casemodule.Case.getDirectory(), and org.sleuthkit.autopsy.casemodule.Case.getOutputDirectory().

String org.sleuthkit.autopsy.casemodule.Case.getLogDirectoryPath ( )

Gets the full path to the log directory of this case. Will create it if it does not already exist.

Returns
logDirectoryPath

Definition at line 1094 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getDirectory().

Referenced by org.sleuthkit.autopsy.actions.OpenLogFolderAction.actionPerformed(), and org.sleuthkit.autopsy.casemodule.Case.changeCase().

String org.sleuthkit.autopsy.casemodule.Case.getModuleDirectory ( )
String org.sleuthkit.autopsy.casemodule.Case.getModuleOutputDirectoryRelativePath ( )

Get relative (with respect to case dir) module output directory path where modules should save their permanent data. The directory is a subdirectory of this case dir.

Returns
relative path to the module output dir

Definition at line 1150 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getCaseType(), org.sleuthkit.autopsy.coreutils.NetworkUtils.getLocalHostName(), and org.sleuthkit.autopsy.casemodule.Case.CaseType.MULTI_USER_CASE.

Referenced by org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.getRelModuleOutputPath(), and org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorIngestModule.startUp().

String org.sleuthkit.autopsy.casemodule.Case.getModulesOutputDirAbsPath ( )

Get module output directory path where modules should save their permanent data.

Returns
absolute path to the module output directory
Deprecated:
Use getModuleDirectory() instead.

Definition at line 1193 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getModuleDirectory().

static String org.sleuthkit.autopsy.casemodule.Case.getModulesOutputDirRelPath ( )
static

Get relative (with respect to case dir) module output directory path where modules should save their permanent data. The directory is a subdirectory of this case dir.

Returns
relative path to the module output dir
Deprecated:
Use getModuleOutputDirectoryRelativePath() instead

Definition at line 1207 of file Case.java.

String org.sleuthkit.autopsy.casemodule.Case.getName ( )
String org.sleuthkit.autopsy.casemodule.Case.getNumber ( )

Gets the case number

Returns
number

Definition at line 1023 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.number.

String org.sleuthkit.autopsy.casemodule.Case.getOutputDirectory ( )

Get the output directory path where modules should save their permanent data. If single-user case, the directory is a subdirectory of the case directory. If multi-user case, the directory is a subdirectory of HostName, which is a subdirectory of the case directory.

Returns
the path to the host output directory

Definition at line 1126 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getHostDirectory().

Referenced by org.sleuthkit.autopsy.actions.OpenOutputFolderAction.actionPerformed().

static PropertyChangeSupport org.sleuthkit.autopsy.casemodule.Case.getPropertyChangeSupport ( )
static

Gets a PropertyChangeSupport object. The PropertyChangeSupport object returned is not used by instances of this class and does not have any PropertyChangeListeners.

Returns
A new PropertyChangeSupport object.
Deprecated:
Do not use.

Definition at line 1221 of file Case.java.

String org.sleuthkit.autopsy.casemodule.Case.getReportDirectory ( )

Get the reports directory path where modules should save their reports. Will create it if it does not already exist.

Returns
absolute path to the report output directory

Definition at line 1104 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getDirectory().

Referenced by org.sleuthkit.autopsy.timeline.actions.SaveSnapshotAsReport.SaveSnapshotAsReport().

Services org.sleuthkit.autopsy.casemodule.Case.getServices ( )
Returns
The Services object for this case.

Definition at line 841 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.services.

Referenced by org.sleuthkit.autopsy.actions.DeleteContentTagAction.actionPerformed(), org.sleuthkit.autopsy.actions.DeleteBlackboardArtifactTagAction.actionPerformed(), org.sleuthkit.autopsy.actions.AddContentTagAction.addTag(), org.sleuthkit.autopsy.actions.AddBlackboardArtifactTagAction.addTag(), org.sleuthkit.autopsy.datamodel.Tags.TagNameNodeFactory.createKeys(), org.sleuthkit.autopsy.datamodel.Tags.ContentTagNodeFactory.createKeys(), org.sleuthkit.autopsy.datamodel.Tags.BlackboardArtifactTagNodeFactory.createKeys(), org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector.detectUserDefinedType(), org.sleuthkit.autopsy.actions.GetTagNameAndCommentDialog.GetTagNameAndCommentDialog(), org.sleuthkit.autopsy.actions.GetTagNameDialog.GetTagNameDialog(), org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.handleArtifactTagDeleted(), org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.handleContentTagDeleted(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importDerivedFiles(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importResults(), org.sleuthkit.autopsy.report.ReportGenerator.TableReportsWorker.makeBlackboardArtifactTagsTables(), org.sleuthkit.autopsy.report.ReportGenerator.TableReportsWorker.makeContentTagsTables(), org.sleuthkit.autopsy.actions.GetTagNameDialog.okButtonActionPerformed(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.process(), org.sleuthkit.autopsy.modules.exif.ExifParserFileIngestModule.process(), org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchIngestModule.process(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbIngestModule.process(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.startUp(), org.sleuthkit.autopsy.timeline.filters.TagNameFilter.TagNameFilter(), org.sleuthkit.autopsy.datamodel.Tags.TagNameNode.updateDisplayName(), org.sleuthkit.autopsy.datamodel.Tags.ContentTagTypeNode.updateDisplayName(), and org.sleuthkit.autopsy.datamodel.Tags.BlackboardArtifactTagTypeNode.updateDisplayName().

SleuthkitCase org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase ( )

Get the underlying SleuthkitCase instance from the Sleuth Kit bindings library.

Returns

Definition at line 851 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.db.

Referenced by org.sleuthkit.autopsy.casemodule.services.Blackboard.addArtifactType(), org.sleuthkit.autopsy.casemodule.services.Blackboard.addAttributeType(), org.sleuthkit.autopsy.report.ReportGenerator.TableReportsWorker.checkIfTagHasImage(), org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent.componentOpened(), org.sleuthkit.autopsy.timeline.explorernodes.EventRootNode.EventNodeChildFactory.createNodeForKey(), org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector.detect(), org.sleuthkit.autopsy.timeline.ui.detailview.EventBundleNodeBase< EventCluster, EventStripe, EventStripeNode >.EventBundleNodeBase(), org.sleuthkit.autopsy.timeline.db.EventsRepository.EventsRepository(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.findFileInCaseDatabase(), org.sleuthkit.autopsy.ingest.IngestServices.getCurrentSleuthkitCaseDb(), org.sleuthkit.autopsy.ingest.events.DataSourceAnalysisEvent.getDataSource(), org.sleuthkit.autopsy.report.ReportGenerator.FileReportsWorker.getFiles(), org.sleuthkit.autopsy.casemodule.events.ReportAddedEvent.getNewValue(), org.sleuthkit.autopsy.ingest.events.FileAnalyzedEvent.getNewValue(), org.sleuthkit.autopsy.casemodule.events.DataSourceAddedEvent.getNewValue(), org.sleuthkit.autopsy.ingest.events.ContentChangedEvent.getOldValue(), org.sleuthkit.autopsy.ingest.events.BlackboardPostEvent.getOldValue(), org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.handleArtifactTagDeleted(), org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.handleContentTagDeleted(), org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importArtifacts(), org.sleuthkit.autopsy.keywordsearch.SolrSearchService.indexArtifact(), org.sleuthkit.autopsy.timeline.db.EventsRepository.invalidateCaches(), org.sleuthkit.autopsy.report.ArtifactSelectionDialog.populateList(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.setDisplayName(), and org.sleuthkit.autopsy.timeline.filters.TagNameFilter.TagNameFilter().

String org.sleuthkit.autopsy.casemodule.Case.getTempDirectory ( )
String org.sleuthkit.autopsy.casemodule.Case.getTextIndexName ( )

Get the name of the index where extracted text is stored for the case.

Returns
Index name.

Definition at line 1256 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.changeCase().

Set<TimeZone> org.sleuthkit.autopsy.casemodule.Case.getTimeZone ( )

Gets the time zone(s) of the image(s) in this case.

Returns
time zones the set of time zones

Definition at line 1269 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getDataSources().

boolean org.sleuthkit.autopsy.casemodule.Case.hasData ( )

Returns if the case has data in it yet.

Returns

Definition at line 1746 of file Case.java.

References org.sleuthkit.autopsy.casemodule.Case.getDataSources().

static void org.sleuthkit.autopsy.casemodule.Case.invokeStartupDialog ( )
static
static boolean org.sleuthkit.autopsy.casemodule.Case.isCaseOpen ( )
static
static boolean org.sleuthkit.autopsy.casemodule.Case.isValidName ( String  caseName)
static

Checks if a String is a valid case name

Parameters
caseNamethe candidate String
Returns
true if the candidate String is a valid case name

Definition at line 1550 of file Case.java.

void org.sleuthkit.autopsy.casemodule.Case.notifyAddingDataSource ( UUID  dataSourceId)

Notifies case event subscribers (property change listeners) that a data source is being added to the case database.

This should not be called from the event dispatch thread (EDT)

Parameters
dataSourceIdA unique identifier for the data source. This UUID should be used to call notifyNewDataSource() after the data source is added.

Definition at line 762 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

void org.sleuthkit.autopsy.casemodule.Case.notifyBlackBoardArtifactTagAdded ( BlackboardArtifactTag  newTag)

Notifies the UI that a new BlackboardArtifactTag has been added.

This should not be called from the event dispatch thread (EDT)

Parameters
newTagnew BlackboardArtifactTag added

Definition at line 823 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.addBlackboardArtifactTag().

void org.sleuthkit.autopsy.casemodule.Case.notifyBlackBoardArtifactTagDeleted ( BlackboardArtifactTag  deletedTag)

Notifies the UI that a BlackboardArtifactTag has been deleted.

This should not be called from the event dispatch thread (EDT)

Parameters
deletedTagBlackboardArtifactTag deleted

Definition at line 834 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.deleteBlackboardArtifactTag().

void org.sleuthkit.autopsy.casemodule.Case.notifyContentTagAdded ( ContentTag  newTag)

Notifies the UI that a new ContentTag has been added.

This should not be called from the event dispatch thread (EDT)

Parameters
newTagnew ContentTag added

Definition at line 801 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.addContentTag().

void org.sleuthkit.autopsy.casemodule.Case.notifyContentTagDeleted ( ContentTag  deletedTag)

Notifies the UI that a ContentTag has been deleted.

This should not be called from the event dispatch thread (EDT)

Parameters
deletedTagContentTag deleted

Definition at line 812 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.deleteContentTag().

void org.sleuthkit.autopsy.casemodule.Case.notifyDataSourceAdded ( Content  newDataSource,
UUID  dataSourceId 
)

Notifies case event subscribers (property change listeners) that a data source is being added to the case database.

This should not be called from the event dispatch thread (EDT)

Parameters
newDataSourceNew data source added.
dataSourceIdA unique identifier for the data source. Should be the same UUID used to call notifyAddingNewDataSource() when the process of adding the data source began.

Definition at line 790 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

Referenced by org.sleuthkit.autopsy.casemodule.Case.addImage().

void org.sleuthkit.autopsy.casemodule.Case.notifyFailedAddingDataSource ( UUID  dataSourceId)

Notifies case event subscribers (property change listeners) that a data source failed to be added to the case database.

This should not be called from the event dispatch thread (EDT)

Parameters
dataSourceIdA unique identifier for the data source.

Definition at line 774 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.publish().

static void org.sleuthkit.autopsy.casemodule.Case.open ( String  caseMetadataFilePath) throws CaseActionException
static
static boolean org.sleuthkit.autopsy.casemodule.Case.pathExists ( String  imgPath)
static

Check if image from the given image path exists.

Parameters
imgPaththe image path
Returns
isExist whether the path exists

Definition at line 1362 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.open(), and org.sleuthkit.autopsy.casemodule.ImageFilePanel.validatePanel().

void org.sleuthkit.autopsy.casemodule.Case.receiveError ( String  context,
String  errorMessage 
)

Definition at line 396 of file Case.java.

static void org.sleuthkit.autopsy.casemodule.Case.removeEventSubscriber ( String  eventName,
PropertyChangeListener  subscriber 
)
static

Adds a subscriber to events from this Autopsy node and other Autopsy nodes.

Parameters
eventNameThe event the subscriber is no longer interested in.
subscriberThe subscriber to add.

Definition at line 1340 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.removeSubscriber().

Referenced by org.sleuthkit.autopsy.casemodule.Case.removePropertyChangeListener().

static void org.sleuthkit.autopsy.casemodule.Case.removeEventSubscriber ( Set< String >  eventNames,
PropertyChangeListener  subscriber 
)
static

Removes a subscriber to events from this Autopsy node and other Autopsy nodes.

Parameters
eventNamesThe event the subscriber is no longer interested in.
subscriberThe subscriber to add.

Definition at line 1351 of file Case.java.

References org.sleuthkit.autopsy.events.AutopsyEventPublisher.removeSubscriber().

static synchronized void org.sleuthkit.autopsy.casemodule.Case.removePropertyChangeListener ( PropertyChangeListener  listener)
static
void org.sleuthkit.autopsy.casemodule.Case.setConfigFilePath ( String  givenPath)
private

Uses the given path to store it as the configuration file path

Parameters
givenPaththe given config file path

Definition at line 975 of file Case.java.

static void org.sleuthkit.autopsy.casemodule.Case.updateMainWindowTitle ( String  newCaseName)
staticprivate

Member Data Documentation

String org.sleuthkit.autopsy.casemodule.Case.appName = null
staticprivate

Definition at line 97 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.getAppName().

final String org.sleuthkit.autopsy.casemodule.Case.autopsyVer = Version.getVersion()
staticprivate

Definition at line 95 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.getAutopsyVersion().

final String org.sleuthkit.autopsy.casemodule.Case.CACHE_FOLDER = "Cache"
staticprivate

Definition at line 276 of file Case.java.

final CaseType org.sleuthkit.autopsy.casemodule.Case.caseType
private
CollaborationMonitor org.sleuthkit.autopsy.casemodule.Case.collaborationMonitor
private

Definition at line 286 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.changeCase().

String org.sleuthkit.autopsy.casemodule.Case.configFilePath
private
Case org.sleuthkit.autopsy.casemodule.Case.currentCase = null
staticprivate
final SleuthkitCase org.sleuthkit.autopsy.casemodule.Case.db
private
final String org.sleuthkit.autopsy.casemodule.Case.dev = "/dev/"
staticprivate

Definition at line 1369 of file Case.java.

final String org.sleuthkit.autopsy.casemodule.Case.EVENT_CHANNEL_NAME = "%s-Case-Events"
staticprivate

Definition at line 96 of file Case.java.

final AutopsyEventPublisher org.sleuthkit.autopsy.casemodule.Case.eventPublisher = new AutopsyEventPublisher()
staticprivate

The event publisher is static so that subscribers only have to subscribe once to receive events for all cases.

Definition at line 112 of file Case.java.

String org.sleuthkit.autopsy.casemodule.Case.examiner
private
final String org.sleuthkit.autopsy.casemodule.Case.EXPORT_FOLDER = "Export"
staticprivate

Definition at line 277 of file Case.java.

boolean org.sleuthkit.autopsy.casemodule.Case.hasData = false
private
final String org.sleuthkit.autopsy.casemodule.Case.LOG_FOLDER = "Log"
staticprivate

Definition at line 278 of file Case.java.

final Logger org.sleuthkit.autopsy.casemodule.Case.logger = Logger.getLogger(Case.class.getName())
staticprivate

Definition at line 273 of file Case.java.

final int org.sleuthkit.autopsy.casemodule.Case.MAX_SANITIZED_NAME_LENGTH = 47
staticprivate

Definition at line 100 of file Case.java.

final int org.sleuthkit.autopsy.casemodule.Case.MIN_SECONDS_BETWEEN_ERROR_REPORTS = 60
staticprivate

Definition at line 99 of file Case.java.

String org.sleuthkit.autopsy.casemodule.Case.name
private
String org.sleuthkit.autopsy.casemodule.Case.number
private
final String org.sleuthkit.autopsy.casemodule.Case.pdisk = "\\\\.\\physicaldrive"
staticprivate

Does the given string refer to a physical drive?

Definition at line 1368 of file Case.java.

final String org.sleuthkit.autopsy.casemodule.Case.propStartup = "LBL_StartupDialog"
static

Name for the property that determines whether to show the dialog at startup

Definition at line 106 of file Case.java.

final String org.sleuthkit.autopsy.casemodule.Case.REPORTS_FOLDER = "Reports"
staticprivate

Definition at line 280 of file Case.java.

final Services org.sleuthkit.autopsy.casemodule.Case.services
private

Definition at line 272 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.getServices().

final String org.sleuthkit.autopsy.casemodule.Case.TEMP_FOLDER = "Temp"
staticprivate

Definition at line 281 of file Case.java.

volatile IntervalErrorReportData org.sleuthkit.autopsy.casemodule.Case.tskErrorReporter = null
private

Definition at line 98 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.changeCase().

final XMLCaseManagement org.sleuthkit.autopsy.casemodule.Case.xmlcm
private

Definition at line 267 of file Case.java.

Referenced by org.sleuthkit.autopsy.casemodule.Case.Case().


The documentation for this class was generated from the following file:

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.