19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.EnumSet;
27 import java.util.HashMap;
28 import java.util.LinkedHashMap;
29 import java.util.List;
31 import java.util.Observable;
32 import java.util.Observer;
34 import java.util.logging.Level;
35 import org.openide.nodes.ChildFactory;
36 import org.openide.nodes.Children;
37 import org.openide.nodes.Node;
38 import org.openide.nodes.Sheet;
39 import org.openide.util.NbBundle;
40 import org.openide.util.lookup.Lookups;
48 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
59 private static final String
LABEL_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getLabel();
60 private static final String
DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getDisplayName();
74 public static final Map<String, String>
parsePath(String path) {
75 Map<String, String> parsed =
new HashMap<>();
76 String[] split = path.split(MAIL_PATH_SEPARATOR);
77 if (split.length < 4) {
78 parsed.put(MAIL_ACCOUNT, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultAcct.text"));
79 parsed.put(MAIL_FOLDER, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultFolder.text"));
82 parsed.put(MAIL_ACCOUNT, split[2]);
83 parsed.put(MAIL_FOLDER, split[3]);
103 private final Map<String, Map<String, List<Long>>>
accounts =
new LinkedHashMap<>();
111 return accounts.keySet();
117 return accounts.get(account).keySet();
123 return accounts.get(account).get(folder);
127 @SuppressWarnings(
"deprecation")
132 if (skCase == null) {
136 int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID();
137 int pathAttrId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID();
138 String query =
"SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id "
139 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
140 +
"attribute_type_id=" + pathAttrId
141 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
142 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
144 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
145 ResultSet resultSet = dbQuery.getResultSet();
147 while (resultSet.next()) {
148 final String path = resultSet.getString(
"value_text");
149 final long artifactId = resultSet.getLong(
"artifact_id");
150 final Map<String, String> parsedPath =
parsePath(path);
151 final String account = parsedPath.get(MAIL_ACCOUNT);
152 final String folder = parsedPath.get(MAIL_FOLDER);
154 Map<String, List<Long>> folders = accounts.get(account);
155 if (folders == null) {
156 folders =
new LinkedHashMap<>();
157 accounts.put(account, folders);
159 List<Long> messages = folders.get(folder);
160 if (messages == null) {
161 messages =
new ArrayList<>();
162 folders.put(folder, messages);
164 messages.add(artifactId);
167 }
catch (TskCoreException | SQLException ex) {
168 logger.log(Level.WARNING,
"Cannot initialize email extraction: ", ex);
182 super(Children.create(
new AccountFactory(),
true), Lookups.singleton(DISPLAY_NAME));
183 super.setName(LABEL_NAME);
184 super.setDisplayName(DISPLAY_NAME);
185 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/mail-icon-16.png");
196 return v.
visit(
this);
201 Sheet s = super.createSheet();
202 Sheet.Set ss = s.get(Sheet.PROPERTIES);
204 ss = Sheet.createPropertiesSet();
208 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
209 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
210 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
218 return getClass().getName();
225 private class AccountFactory extends ChildFactory.Detachable<String> implements Observer {
231 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
233 public void propertyChange(PropertyChangeEvent evt) {
234 String eventType = evt.getPropertyName();
251 if (null != eventData && eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
254 }
catch (IllegalStateException notUsed) {
270 }
catch (IllegalStateException notUsed) {
277 if (evt.getNewValue() == null) {
291 emailResults.addObserver(
this);
299 emailResults.deleteObserver(
this);
314 public void update(Observable o, Object arg) {
327 super(Children.create(
new FolderFactory(accountName),
true), Lookups.singleton(accountName));
328 super.setName(accountName);
330 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/account-icon-16.png");
332 emailResults.addObserver(
this);
336 super.setDisplayName(accountName +
" (" + emailResults.
getFolders(accountName) +
")");
341 Sheet s = super.createSheet();
342 Sheet.Set ss = s.get(Sheet.PROPERTIES);
344 ss = Sheet.createPropertiesSet();
348 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
349 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
350 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
363 return v.
visit(
this);
367 public void update(Observable o, Object arg) {
373 return getClass().getName();
380 private class FolderFactory extends ChildFactory<String> implements Observer {
387 emailResults.addObserver(
this);
392 list.addAll(emailResults.
getFolders(accountName));
398 return new FolderNode(accountName, folderName);
402 public void update(Observable o, Object arg) {
416 super(Children.create(
new MessageFactory(accountName, folderName),
true), Lookups.singleton(accountName));
417 super.setName(folderName);
418 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/folder-icon-16.png");
422 emailResults.addObserver(
this);
426 super.setDisplayName(folderName +
" (" + emailResults.
getArtifactIds(accountName, folderName).size() +
")");
437 Sheet s = super.createSheet();
438 Sheet.Set ss = s.get(Sheet.PROPERTIES);
440 ss = Sheet.createPropertiesSet();
444 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
445 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
446 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
454 return v.
visit(
this);
458 public void update(Observable o, Object arg) {
464 return getClass().getName();
480 emailResults.addObserver(
this);
485 list.addAll(emailResults.
getArtifactIds(accountName, folderName));
491 if (skCase == null) {
495 BlackboardArtifact artifact = skCase.getBlackboardArtifact(artifactId);
497 }
catch (TskCoreException ex) {
498 logger.log(Level.WARNING,
"Error creating mail messages nodes", ex);
504 public void update(Observable o, Object arg) {
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
void addIngestModuleEventListener(final PropertyChangeListener listener)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)