Autopsy  4.14.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
ImageNode.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2012-2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.List;
29 import java.util.Set;
30 import java.util.logging.Level;
31 import javax.swing.Action;
32 import org.apache.commons.lang3.tuple.Pair;
33 import org.openide.nodes.Sheet;
34 import org.openide.util.NbBundle;
35 import org.openide.util.NbBundle.Messages;
49 import org.sleuthkit.datamodel.Content;
50 import org.sleuthkit.datamodel.Image;
51 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
52 import org.sleuthkit.datamodel.TskCoreException;
53 import org.sleuthkit.datamodel.VirtualDirectory;
55 import org.sleuthkit.datamodel.Tag;
56 
61 public class ImageNode extends AbstractContentNode<Image> {
62 
63  private static final Logger logger = Logger.getLogger(ImageNode.class.getName());
65 
74  static String nameForImage(Image i) {
75  return i.getName();
76  }
77 
81  public ImageNode(Image img) {
82  super(img);
83 
84  // set name, display name, and icon
85  String imgName = nameForImage(img);
86  this.setDisplayName(imgName);
87  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hard-drive-icon.jpg"); //NON-NLS
88 
89  // Listen for ingest events so that we can detect new added files (e.g. carved)
91  // Listen for case events so that we can detect when case is closed
93  }
94 
95  private void removeListeners() {
98  }
99 
107  @Override
108  @Messages({"ImageNode.action.runIngestMods.text=Run Ingest Modules",
109  "ImageNode.getActions.openFileSearchByAttr.text=Open File Search by Attributes"})
110  public Action[] getActions(boolean context) {
111 
112  List<Action> actionsList = new ArrayList<>();
113  for (Action a : super.getActions(true)) {
114  actionsList.add(a);
115  }
116  actionsList.addAll(ExplorerNodeActionVisitor.getActions(content));
117  actionsList.add(new FileSearchAction(Bundle.ImageNode_getActions_openFileSearchByAttr_text()));
118  actionsList.add(new ViewSummaryInformationAction(content.getId()));
119  actionsList.add(new RunIngestModulesAction(Collections.<Content>singletonList(content)));
120  actionsList.add(new NewWindowViewAction(NbBundle.getMessage(this.getClass(), "ImageNode.getActions.viewInNewWin.text"), this));
121  actionsList.add(new DeleteDataSourceAction(content.getId()));
122  return actionsList.toArray(new Action[0]);
123  }
124 
125  @Override
126  @Messages({"ImageNode.createSheet.size.name=Size (Bytes)",
127  "ImageNode.createSheet.size.displayName=Size (Bytes)",
128  "ImageNode.createSheet.size.desc=Size of the data source in bytes.",
129  "ImageNode.createSheet.type.name=Type",
130  "ImageNode.createSheet.type.displayName=Type",
131  "ImageNode.createSheet.type.desc=Type of the image.",
132  "ImageNode.createSheet.type.text=Image",
133  "ImageNode.createSheet.sectorSize.name=Sector Size (Bytes)",
134  "ImageNode.createSheet.sectorSize.displayName=Sector Size (Bytes)",
135  "ImageNode.createSheet.sectorSize.desc=Sector size of the image in bytes.",
136  "ImageNode.createSheet.timezone.name=Timezone",
137  "ImageNode.createSheet.timezone.displayName=Timezone",
138  "ImageNode.createSheet.timezone.desc=Timezone of the image",
139  "ImageNode.createSheet.deviceId.name=Device ID",
140  "ImageNode.createSheet.deviceId.displayName=Device ID",
141  "ImageNode.createSheet.deviceId.desc=Device ID of the image"})
142  protected Sheet createSheet() {
143  Sheet sheet = super.createSheet();
144  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
145  if (sheetSet == null) {
146  sheetSet = Sheet.createPropertiesSet();
147  sheet.put(sheetSet);
148  }
149 
150  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ImageNode.createSheet.name.name"),
151  NbBundle.getMessage(this.getClass(), "ImageNode.createSheet.name.displayName"),
152  NbBundle.getMessage(this.getClass(), "ImageNode.createSheet.name.desc"),
153  getDisplayName()));
154 
155  sheetSet.put(new NodeProperty<>(Bundle.ImageNode_createSheet_type_name(),
156  Bundle.ImageNode_createSheet_type_displayName(),
157  Bundle.ImageNode_createSheet_type_desc(),
158  Bundle.ImageNode_createSheet_type_text()));
159 
160  sheetSet.put(new NodeProperty<>(Bundle.ImageNode_createSheet_size_name(),
161  Bundle.ImageNode_createSheet_size_displayName(),
162  Bundle.ImageNode_createSheet_size_desc(),
163  this.content.getSize()));
164  sheetSet.put(new NodeProperty<>(Bundle.ImageNode_createSheet_sectorSize_name(),
165  Bundle.ImageNode_createSheet_sectorSize_displayName(),
166  Bundle.ImageNode_createSheet_sectorSize_desc(),
167  this.content.getSsize()));
168 
169  sheetSet.put(new NodeProperty<>(Bundle.ImageNode_createSheet_timezone_name(),
170  Bundle.ImageNode_createSheet_timezone_displayName(),
171  Bundle.ImageNode_createSheet_timezone_desc(),
172  this.content.getTimeZone()));
173 
174  try (CaseDbQuery query = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery("SELECT device_id FROM data_source_info WHERE obj_id = " + this.content.getId());) {
175  ResultSet deviceIdSet = query.getResultSet();
176  if (deviceIdSet.next()) {
177  sheetSet.put(new NodeProperty<>(Bundle.ImageNode_createSheet_deviceId_name(),
178  Bundle.ImageNode_createSheet_deviceId_displayName(),
179  Bundle.ImageNode_createSheet_deviceId_desc(),
180  deviceIdSet.getString("device_id")));
181  }
182  } catch (SQLException | TskCoreException | NoCurrentCaseException ex) {
183  logger.log(Level.SEVERE, "Failed to get device id for the following image: " + this.content.getId(), ex);
184  }
185 
186  return sheet;
187  }
188 
189  @Override
190  public <T> T accept(ContentNodeVisitor<T> visitor) {
191  return visitor.visit(this);
192  }
193 
194  @Override
195  public boolean isLeafTypeNode() {
196  return false;
197  }
198 
199  @Override
200  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
201  return visitor.visit(this);
202  }
203 
204  @Override
205  public String getItemType() {
206  return getClass().getName();
207  }
208 
209  /*
210  * This property change listener refreshes the tree when a new file is
211  * carved out of this image (i.e, the image is being treated as raw bytes
212  * and was ingested by the RawDSProcessor).
213  */
214  private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
215  String eventType = evt.getPropertyName();
216 
217  // See if the new file is a child of ours
218  if (eventType.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) {
219  if ((evt.getOldValue() instanceof ModuleContentEvent) == false) {
220  return;
221  }
222  ModuleContentEvent moduleContentEvent = (ModuleContentEvent) evt.getOldValue();
223  if ((moduleContentEvent.getSource() instanceof Content) == false) {
224  return;
225  }
226  Content newContent = (Content) moduleContentEvent.getSource();
227 
228  try {
229  Content parent = newContent.getParent();
230  if (parent != null) {
231  // Is this a new carved file?
232  if (parent.getName().equals(VirtualDirectory.NAME_CARVED)) {
233  // Is this new carved file for this data source?
234  if (newContent.getDataSource().getId() == getContent().getDataSource().getId()) {
235  // Find the image (if any) associated with the new content and
236  // trigger a refresh if it matches the image wrapped by this node.
237  while ((parent = parent.getParent()) != null) {
238  if (parent.getId() == getContent().getId()) {
240  break;
241  }
242  }
243  }
244  }
245  }
246  } catch (TskCoreException ex) {
247  // Do nothing.
248  } catch (NoSuchEventBusException ex) {
249  logger.log(Level.WARNING, "Failed to post key refresh event.", ex); // NON-NLS
250  }
251  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
252  if (evt.getNewValue() == null) {
253  // case was closed. Remove listeners so that we don't get called with a stale case handle
254  removeListeners();
255  }
256  }
257  };
258 
266  @Override
267  protected List<Tag> getAllTagsFromDatabase() {
268  return new ArrayList<>();
269  }
270 
280  @Override
282  return null;
283  }
284 
294  @Override
295  protected Pair<DataResultViewerTable.Score, String> getScorePropertyAndDescription(List<Tag> tags) {
296  return Pair.of(DataResultViewerTable.Score.NO_SCORE, NO_DESCR);
297  }
298 
309  @Override
312  }
313 
326  @Override
327  protected Pair<Long, String> getCountPropertyAndDescription(CorrelationAttributeInstance.Type attributeType, String attributeValue, String defaultDescription) {
328  return Pair.of(-1L, NO_DESCR);
329  }
330 }
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
CorrelationAttributeInstance getCorrelationAttributeInstance()
Definition: ImageNode.java:281
Action[] getActions(boolean context)
Definition: ImageNode.java:110
Pair< Long, String > getCountPropertyAndDescription(CorrelationAttributeInstance.Type attributeType, String attributeValue, String defaultDescription)
Definition: ImageNode.java:327
Pair< DataResultViewerTable.Score, String > getScorePropertyAndDescription(List< Tag > tags)
Definition: ImageNode.java:295
final PropertyChangeListener pcl
Definition: ImageNode.java:214
static void post(String nodeName, Object event)
DataResultViewerTable.HasCommentStatus getCommentProperty(List< Tag > tags, CorrelationAttributeInstance attribute)
Definition: ImageNode.java:310
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:486
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:531
static final Set< IngestManager.IngestModuleEvent > INGEST_MODULE_EVENTS_OF_INTEREST
Definition: ImageNode.java:64

Copyright © 2012-2020 Basis Technology. Generated on: Wed Apr 8 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.