19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.HashSet;
28 import java.util.LinkedHashMap;
29 import java.util.List;
31 import java.util.Observable;
32 import java.util.Observer;
34 import java.util.logging.Level;
35 import org.openide.nodes.ChildFactory;
36 import org.openide.nodes.Children;
37 import org.openide.nodes.Node;
38 import org.openide.nodes.Sheet;
39 import org.openide.util.NbBundle;
40 import org.openide.util.lookup.Lookups;
49 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
61 public static final String
NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getLabel();
63 .getMessage(
KeywordHits.class,
"KeywordHits.simpleLiteralSearch.text");
65 .getMessage(
KeywordHits.class,
"KeywordHits.singleRegexSearch.text");
77 private final Map<String, Map<String, Set<Long>>>
topLevelMap =
new LinkedHashMap<>();
83 List<String> getListNames() {
85 List<String> names =
new ArrayList<>(topLevelMap.keySet());
93 List<String> getKeywords(String listName) {
94 List<String> keywords;
96 keywords =
new ArrayList<>(topLevelMap.get(listName).keySet());
98 Collections.sort(keywords);
102 Set<Long> getArtifactIds(String listName, String keyword) {
104 return topLevelMap.get(listName).get(keyword);
109 void populateMaps(Map<Long, Map<Long, String>> artifactIds) {
114 Map<String, Map<String, Set<Long>>> listsMap =
new LinkedHashMap<>();
117 Map<String, Set<Long>> literalMap =
new LinkedHashMap<>();
120 Map<String, Set<Long>> regexMap =
new LinkedHashMap<>();
123 topLevelMap.put(SIMPLE_LITERAL_SEARCH, literalMap);
124 topLevelMap.put(SIMPLE_REGEX_SEARCH, regexMap);
126 for (Map.Entry<Long, Map<Long, String>> art : artifactIds.entrySet()) {
127 long id = art.getKey();
128 Map<Long, String> attributes = art.getValue();
131 String listName = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()));
132 String word = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()));
133 String reg = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID()));
136 if (listName != null) {
137 if (listsMap.containsKey(listName) ==
false) {
138 listsMap.put(listName,
new LinkedHashMap<String, Set<Long>>());
141 Map<String, Set<Long>> listMap = listsMap.get(listName);
142 if (listMap.containsKey(word) ==
false) {
143 listMap.put(word,
new HashSet<Long>());
146 listMap.get(word).add(
id);
148 else if (reg != null) {
149 if (regexMap.containsKey(reg) ==
false) {
150 regexMap.put(reg,
new HashSet<Long>());
152 regexMap.get(reg).add(
id);
155 if (literalMap.containsKey(word) ==
false) {
156 literalMap.put(word,
new HashSet<Long>());
158 literalMap.get(word).add(
id);
160 topLevelMap.putAll(listsMap);
168 @SuppressWarnings(
"deprecation")
170 Map<Long, Map<Long, String>> artifactIds =
new LinkedHashMap<>();
172 if (skCase == null) {
176 int setId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
177 int wordId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID();
178 int regexId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID();
179 int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID();
180 String query =
"SELECT blackboard_attributes.value_text,blackboard_attributes.artifact_id,"
181 +
"blackboard_attributes.attribute_type_id FROM blackboard_attributes,blackboard_artifacts WHERE "
182 +
"(blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id AND "
183 +
"blackboard_artifacts.artifact_type_id=" + artId
184 +
") AND (attribute_type_id=" + setId +
" OR "
185 +
"attribute_type_id=" + wordId +
" OR "
186 +
"attribute_type_id=" + regexId +
")";
188 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
189 ResultSet resultSet = dbQuery.getResultSet();
190 while (resultSet.next()) {
191 String value = resultSet.getString(
"value_text");
192 long artifactId = resultSet.getLong(
"artifact_id");
193 long typeId = resultSet.getLong(
"attribute_type_id");
194 if (!artifactIds.containsKey(artifactId)) {
195 artifactIds.put(artifactId,
new LinkedHashMap<Long, String>());
197 if (!value.equals(
"")) {
198 artifactIds.get(artifactId).put(typeId, value);
201 }
catch (TskCoreException | SQLException ex) {
202 logger.log(Level.WARNING,
"SQL Exception occurred: ", ex);
205 populateMaps(artifactIds);
211 return v.
visit(
this);
218 super(Children.create(
new ListFactory(),
true), Lookups.singleton(KEYWORD_HITS));
220 super.setDisplayName(KEYWORD_HITS);
221 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/keyword_hits.png");
231 return v.
visit(
this);
236 Sheet s = super.createSheet();
237 Sheet.Set ss = s.get(Sheet.PROPERTIES);
239 ss = Sheet.createPropertiesSet();
243 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.name.name"),
244 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.name.displayName"),
245 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.name.desc"),
253 return getClass().getName();
257 private class ListFactory extends ChildFactory.Detachable<String> implements Observer {
259 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
261 public void propertyChange(PropertyChangeEvent evt) {
262 String eventType = evt.getPropertyName();
279 if (null != eventData && eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
282 }
catch (IllegalStateException notUsed) {
298 }
catch (IllegalStateException notUsed) {
305 if (evt.getNewValue() == null) {
319 keywordResults.addObserver(
this);
327 keywordResults.deleteObserver(
this);
332 list.addAll(keywordResults.getListNames());
342 public void update(Observable o, Object arg) {
352 super(Children.create(
new TermFactory(listName),
true), Lookups.singleton(listName));
353 super.setName(listName);
354 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/keyword_hits.png");
357 keywordResults.addObserver(
this);
361 int totalDescendants = 0;
362 for (String word : keywordResults.getKeywords(listName)) {
363 Set<Long> ids = keywordResults.getArtifactIds(listName, word);
364 totalDescendants += ids.size();
366 super.setDisplayName(listName +
" (" + totalDescendants +
")");
371 Sheet s = super.createSheet();
372 Sheet.Set ss = s.get(Sheet.PROPERTIES);
374 ss = Sheet.createPropertiesSet();
378 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.listName.name"),
379 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.listName.displayName"),
380 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.listName.desc"),
383 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.numChildren.name"),
384 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.numChildren.displayName"),
385 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.numChildren.desc"),
386 keywordResults.getKeywords(listName).size()));
398 return v.
visit(
this);
402 public void update(Observable o, Object arg) {
408 return getClass().getName();
412 private class TermFactory extends ChildFactory.Detachable<String> implements Observer {
423 keywordResults.addObserver(
this);
428 keywordResults.deleteObserver(
this);
433 list.addAll(keywordResults.getKeywords(setName));
443 public void update(Observable o, Object arg) {
454 super(Children.create(
new HitsFactory(setName, keyword),
true), Lookups.singleton(keyword));
455 super.setName(keyword);
458 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/keyword_hits.png");
460 keywordResults.addObserver(
this);
464 super.setDisplayName(keyword +
" (" + keywordResults.getArtifactIds(setName, keyword).size() +
")");
468 public void update(Observable o, Object arg) {
479 return v.
visit(
this);
484 Sheet s = super.createSheet();
485 Sheet.Set ss = s.get(Sheet.PROPERTIES);
487 ss = Sheet.createPropertiesSet();
491 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.listName.name"),
492 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.listName.displayName"),
493 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.listName.desc"),
496 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.filesWithHits.name"),
497 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.filesWithHits.displayName"),
498 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createSheet.filesWithHits.desc"),
499 keywordResults.getArtifactIds(setName, keyword).size()));
506 return getClass().getName();
510 public class HitsFactory extends ChildFactory.Detachable<Long> implements Observer {
523 keywordResults.addObserver(
this);
528 keywordResults.deleteObserver(
this);
533 list.addAll(keywordResults.getArtifactIds(setName, keyword));
539 if (skCase == null) {
544 BlackboardArtifact art = skCase.getBlackboardArtifact(artifactId);
548 file = skCase.getAbstractFileById(art.getObjectID());
549 }
catch (TskCoreException ex) {
550 logger.log(Level.SEVERE,
"TskCoreException while constructing BlackboardArtifact Node from KeywordHitsKeywordChildren");
562 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createNodeForKey.modTime.name"),
563 NbBundle.getMessage(
this.getClass(),
564 "KeywordHits.createNodeForKey.modTime.displayName"),
565 NbBundle.getMessage(
this.getClass(),
566 "KeywordHits.createNodeForKey.modTime.desc"),
569 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createNodeForKey.accessTime.name"),
570 NbBundle.getMessage(
this.getClass(),
571 "KeywordHits.createNodeForKey.accessTime.displayName"),
572 NbBundle.getMessage(
this.getClass(),
573 "KeywordHits.createNodeForKey.accessTime.desc"),
576 NbBundle.getMessage(
this.getClass(),
"KeywordHits.createNodeForKey.chgTime.name"),
577 NbBundle.getMessage(
this.getClass(),
578 "KeywordHits.createNodeForKey.chgTime.displayName"),
579 NbBundle.getMessage(
this.getClass(),
580 "KeywordHits.createNodeForKey.chgTime.desc"),
583 }
catch (TskException ex) {
584 logger.log(Level.WARNING,
"TSK Exception occurred", ex);
590 public void update(Observable o, Object arg) {
final PropertyChangeListener pcl
KeywordHits(SleuthkitCase skCase)
static final String KEYWORD_HITS
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
void update(Observable o, Object arg)
static String getStringTime(long epochSeconds, TimeZone tzone)
Node createNodeForKey(String key)
static synchronized IngestManager getInstance()
void update(Observable o, Object arg)
final KeywordResults keywordResults
void update(Observable o, Object arg)
static void removePropertyChangeListener(PropertyChangeListener listener)
static final String SIMPLE_REGEX_SEARCH
TermFactory(String setName)
T visit(DataSourcesNode in)
final Map< String, Map< String, Set< Long > > > topLevelMap
boolean createKeys(List< String > list)
void removeIngestJobEventListener(final PropertyChangeListener listener)
TermNode(String setName, String keyword)
boolean createKeys(List< String > list)
void update(Observable o, Object arg)
void addIngestJobEventListener(final PropertyChangeListener listener)
Node createNodeForKey(Long artifactId)
Node createNodeForKey(String key)
ListNode(String listName)
boolean createKeys(List< Long > list)
static void addPropertyChangeListener(PropertyChangeListener listener)
static final Logger logger
void addIngestModuleEventListener(final PropertyChangeListener listener)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
void addNodeProperty(NodeProperty<?> np)
static final String SIMPLE_LITERAL_SEARCH
void update(Observable o, Object arg)
HitsFactory(String setName, String keyword)