Autopsy  4.14.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
InterestingHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2020 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
32 import java.util.Map;
33 import java.util.Observable;
34 import java.util.Observer;
35 import java.util.Set;
36 import java.util.logging.Level;
37 import org.openide.nodes.ChildFactory;
38 import org.openide.nodes.Children;
39 import org.openide.nodes.Node;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.Lookups;
48 import org.sleuthkit.datamodel.BlackboardArtifact;
49 import org.sleuthkit.datamodel.BlackboardAttribute;
50 import org.sleuthkit.datamodel.SleuthkitCase;
51 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
52 import org.sleuthkit.datamodel.TskCoreException;
53 
54 public class InterestingHits implements AutopsyVisitableItem {
55 
56  private static final String INTERESTING_ITEMS = NbBundle
57  .getMessage(InterestingHits.class, "InterestingHits.interestingItems.text");
58  private static final String DISPLAY_NAME = NbBundle.getMessage(InterestingHits.class, "InterestingHits.displayName.text");
59  private static final Logger logger = Logger.getLogger(InterestingHits.class.getName());
62  private SleuthkitCase skCase;
64  private final long filteringDSObjId; // 0 if not filtering/grouping by data source
65 
72  public InterestingHits(SleuthkitCase skCase) {
73  this(skCase, 0);
74  }
75 
83  public InterestingHits(SleuthkitCase skCase, long objId) {
84  this.skCase = skCase;
85  this.filteringDSObjId = objId;
86  interestingResults.update();
87  }
88 
89  private class InterestingResults extends Observable {
90 
91  // NOTE: the map can be accessed by multiple worker threads and needs to be synchronized
92  private final Map<String, Map<String, Set<Long>>> interestingItemsMap = new LinkedHashMap<>();
93 
94  public List<String> getSetNames() {
95  List<String> setNames;
96  synchronized (interestingItemsMap) {
97  setNames = new ArrayList<>(interestingItemsMap.keySet());
98  }
99  Collections.sort(setNames);
100  return setNames;
101  }
102 
103  public Set<Long> getArtifactIds(String setName, String typeName) {
104  synchronized (interestingItemsMap) {
105  return interestingItemsMap.get(setName).get(typeName);
106  }
107  }
108 
109  public void update() {
110  synchronized (interestingItemsMap) {
111  interestingItemsMap.clear();
112  }
113  loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
114  loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
115  setChanged();
116  notifyObservers();
117  }
118 
119  /*
120  * Reads the artifacts of specified type, grouped by Set, and loads into
121  * the interestingItemsMap
122  */
123  @SuppressWarnings("deprecation")
124  private void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) {
125  if (skCase == null) {
126  return;
127  }
128 
129  int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
130  int artId = artType.getTypeID();
131  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
132  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
133  + "attribute_type_id=" + setNameId //NON-NLS
134  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
135  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
136  if (filteringDSObjId > 0) {
137  query += " AND blackboard_artifacts.data_source_obj_id = " + filteringDSObjId;
138  }
139 
140  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
141  synchronized (interestingItemsMap) {
142  ResultSet resultSet = dbQuery.getResultSet();
143  while (resultSet.next()) {
144  String value = resultSet.getString("value_text"); //NON-NLS
145  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
146  if (!interestingItemsMap.containsKey(value)) {
147  interestingItemsMap.put(value, new LinkedHashMap<>());
148  interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName(), new HashSet<>());
149  interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(), new HashSet<>());
150  }
151  interestingItemsMap.get(value).get(artType.getDisplayName()).add(artifactId);
152  }
153  }
154  } catch (TskCoreException | SQLException ex) {
155  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
156  }
157  }
158  }
159 
160  @Override
161  public <T> T accept(AutopsyItemVisitor<T> visitor) {
162  return visitor.visit(this);
163  }
164 
168  public class RootNode extends DisplayableItemNode {
169 
170  public RootNode() {
171  super(Children.create(new SetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
172  super.setName(INTERESTING_ITEMS);
173  super.setDisplayName(DISPLAY_NAME);
174  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
175  }
176 
177  @Override
178  public boolean isLeafTypeNode() {
179  return false;
180  }
181 
182  @Override
183  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
184  return visitor.visit(this);
185  }
186 
187  @Override
188  protected Sheet createSheet() {
189  Sheet sheet = super.createSheet();
190  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
191  if (sheetSet == null) {
192  sheetSet = Sheet.createPropertiesSet();
193  sheet.put(sheetSet);
194  }
195 
196  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
197  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.displayName"),
198  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
199  getName()));
200 
201  return sheet;
202  }
203 
204  @Override
205  public String getItemType() {
206  return getClass().getName();
207  }
208  }
209 
210  private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
211 
212  /*
213  * This should probably be in the top-level class, but the factory has
214  * nice methods for its startup and shutdown, so it seemed like a
215  * cleaner place to register the property change listener.
216  */
217  private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
218  String eventType = evt.getPropertyName();
219  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
226  try {
234  ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
235  if (null != eventData && (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()
236  || eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID())) {
237  interestingResults.update();
238  }
239  } catch (NoCurrentCaseException notUsed) {
243  }
244  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
245  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
252  try {
254  interestingResults.update();
255  } catch (NoCurrentCaseException notUsed) {
259  }
260  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
261  // case was closed. Remove listeners so that we don't get called with a stale case handle
262  if (evt.getNewValue() == null) {
263  removeNotify();
264  skCase = null;
265  }
266  }
267  };
268 
269  @Override
270  protected void addNotify() {
274  interestingResults.update();
275  interestingResults.addObserver(this);
276  }
277 
278  @Override
279  protected void removeNotify() {
283  interestingResults.deleteObserver(this);
284  }
285 
286  @Override
287  protected boolean createKeys(List<String> list) {
288  list.addAll(interestingResults.getSetNames());
289  return true;
290  }
291 
292  @Override
293  protected Node createNodeForKey(String key) {
294  return new SetNameNode(key);
295  }
296 
297  @Override
298  public void update(Observable o, Object arg) {
299  refresh(true);
300  }
301  }
302 
303  public class SetNameNode extends DisplayableItemNode implements Observer {
304 
305  private final String setName;
306 
307  public SetNameNode(String setName) {//, Set<Long> children) {
308  super(Children.create(new HitTypeFactory(setName), true), Lookups.singleton(setName));
309  this.setName = setName;
310  super.setName(setName);
312  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
313  interestingResults.addObserver(this);
314  }
315 
316  private void updateDisplayName() {
317  int sizeOfSet = interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size()
318  + interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName()).size();
319  super.setDisplayName(setName + " (" + sizeOfSet + ")");
320  }
321 
322  @Override
323  public boolean isLeafTypeNode() {
324  return false;
325  }
326 
327  @Override
328  protected Sheet createSheet() {
329  Sheet sheet = super.createSheet();
330  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
331  if (sheetSet == null) {
332  sheetSet = Sheet.createPropertiesSet();
333  sheet.put(sheetSet);
334  }
335 
336  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
337  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
338  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
339  getName()));
340 
341  return sheet;
342  }
343 
344  @Override
345  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
346  return visitor.visit(this);
347  }
348 
349  @Override
350  public void update(Observable o, Object arg) {
352  }
353 
354  @Override
355  public String getItemType() {
360  return getClass().getName();
361  }
362  }
363 
364  private class HitTypeFactory extends ChildFactory<String> implements Observer {
365 
366  private final String setName;
367  private final Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
368 
369  private HitTypeFactory(String setName) {
370  super();
371  this.setName = setName;
372  interestingResults.addObserver(this);
373  }
374 
375  @Override
376  protected boolean createKeys(List<String> list) {
377  list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName());
378  list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName());
379  return true;
380  }
381 
382  @Override
383  protected Node createNodeForKey(String key) {
384  return new InterestingItemTypeNode(setName, key);
385  }
386 
387  @Override
388  public void update(Observable o, Object arg) {
389  refresh(true);
390  }
391  }
392 
393  public class InterestingItemTypeNode extends DisplayableItemNode implements Observer {
394 
395  private final String typeName;
396  private final String setName;
397 
398  private InterestingItemTypeNode(String setName, String typeName) {
399  super(Children.create(new HitFactory(setName, typeName), true), Lookups.singleton(setName));
400  this.typeName = typeName;
401  this.setName = setName;
407  super.setName(setName + "_" + typeName);
409  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
410  interestingResults.addObserver(this);
411  }
412 
413  private void updateDisplayName() {
414  super.setDisplayName(typeName + " (" + interestingResults.getArtifactIds(setName, typeName).size() + ")");
415  }
416 
417  @Override
418  public boolean isLeafTypeNode() {
419  return true;
420  }
421 
422  @Override
423  protected Sheet createSheet() {
424  Sheet sheet = super.createSheet();
425  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
426  if (sheetSet == null) {
427  sheetSet = Sheet.createPropertiesSet();
428  sheet.put(sheetSet);
429  }
430  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
431  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
432  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
433  getName()));
434  return sheet;
435  }
436 
437  @Override
438  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
439  return visitor.visit(this);
440  }
441 
442  @Override
443  public void update(Observable o, Object arg) {
445  }
446 
447  @Override
448  public String getItemType() {
453  return getClass().getName();
454  }
455  }
456 
457  private class HitFactory extends BaseChildFactory<BlackboardArtifact> implements Observer {
458 
459  private final String setName;
460  private final String typeName;
461  private final Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
462 
463  private HitFactory(String setName, String typeName) {
469  super(setName + "_" + typeName);
470  this.setName = setName;
471  this.typeName = typeName;
472  interestingResults.addObserver(this);
473  }
474 
475  @Override
476  protected List<BlackboardArtifact> makeKeys() {
477 
478  if (skCase != null) {
479  interestingResults.getArtifactIds(setName, typeName).forEach((id) -> {
480  try {
481  if (!artifactHits.containsKey(id)) {
482  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
483  //Cache attributes while we are off the EDT.
484  //See JIRA-5969
485  art.getAttributes();
486  artifactHits.put(id, art);
487  }
488  } catch (TskCoreException ex) {
489  logger.log(Level.SEVERE, "TSK Exception occurred", ex); //NON-NLS
490  }
491  });
492 
493  return new ArrayList<>(artifactHits.values());
494  }
495  return Collections.emptyList();
496  }
497 
498  @Override
499  protected Node createNodeForKey(BlackboardArtifact art) {
500  return new BlackboardArtifactNode(art);
501  }
502 
503  @Override
504  public void update(Observable o, Object arg) {
505  refresh(true);
506  }
507 
508  @Override
509  protected void onAdd() {
510  // No-op
511  }
512 
513  @Override
514  protected void onRemove() {
515  // No-op
516  }
517  }
518 }
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static final Set< IngestManager.IngestModuleEvent > INGEST_MODULE_EVENTS_OF_INTEREST
static synchronized IngestManager getInstance()
void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType)
InterestingHits(SleuthkitCase skCase, long objId)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static final Set< IngestManager.IngestJobEvent > INGEST_JOB_EVENTS_OF_INTEREST
Set< Long > getArtifactIds(String setName, String typeName)
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:486
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:531
final Map< String, Map< String, Set< Long > > > interestingItemsMap

Copyright © 2012-2020 Basis Technology. Generated on: Wed Apr 8 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.