Autopsy  4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
ExtractedContent.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.util.ArrayList;
24 import java.util.Collections;
25 import java.util.Comparator;
26 import java.util.EnumSet;
27 import java.util.HashMap;
28 import java.util.List;
29 import java.util.logging.Level;
30 import org.openide.nodes.ChildFactory;
31 import org.openide.nodes.Children;
32 import org.openide.nodes.Node;
33 import org.openide.nodes.Sheet;
34 import org.openide.util.NbBundle;
35 import org.openide.util.lookup.Lookups;
40 import org.sleuthkit.datamodel.BlackboardArtifact;
41 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT;
42 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG;
43 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO;
44 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT;
45 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT;
46 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT;
47 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT;
48 import org.sleuthkit.datamodel.SleuthkitCase;
49 import org.sleuthkit.datamodel.TskCoreException;
50 import org.sleuthkit.datamodel.TskException;
51 
56 public class ExtractedContent implements AutopsyVisitableItem {
57 
58  private SleuthkitCase skCase; // set to null after case has been closed
59  public static final String NAME = NbBundle.getMessage(RootNode.class, "ExtractedContentNode.name.text");
60 
61  public ExtractedContent(SleuthkitCase skCase) {
62  this.skCase = skCase;
63  }
64 
65  @Override
66  public <T> T accept(AutopsyItemVisitor<T> v) {
67  return v.visit(this);
68  }
69 
70  public SleuthkitCase getSleuthkitCase() {
71  return skCase;
72  }
73 
74  static String getIconFilePath(int typeID) {
75  String filePath = "org/sleuthkit/autopsy/images/"; //NON-NLS
76  if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) {
77  return filePath + "bookmarks.png"; //NON-NLS
78  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) {
79  return filePath + "cookies.png"; //NON-NLS
80  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) {
81  return filePath + "history.png"; //NON-NLS
82  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) {
83  return filePath + "downloads.png"; //NON-NLS
84  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) {
85  return filePath + "recent_docs.png"; //NON-NLS
86  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()) {
87  return filePath + "gps_trackpoint.png"; //NON-NLS
88  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) {
89  return filePath + "programs.png"; //NON-NLS
90  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
91  return filePath + "usb_devices.png"; //NON-NLS
92  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
93  return filePath + "mail-icon-16.png"; //NON-NLS
94  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXTRACTED_TEXT.getTypeID()) {
95  return filePath + "text-file.png"; //NON-NLS
96  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()) {
97  return filePath + "searchquery.png"; //NON-NLS
98  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()) {
99  return filePath + "camera-icon-16.png"; //NON-NLS
100  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
101  return filePath + "computer.png"; //NON-NLS
102  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()) {
103  return filePath + "account-icon-16.png"; //NON-NLS
104  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()) {
105  return filePath + "contact.png"; //NON-NLS
106  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()) {
107  return filePath + "message.png"; //NON-NLS
108  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()) {
109  return filePath + "calllog.png"; //NON-NLS
110  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()) {
111  return filePath + "calendar.png"; //NON-NLS
112  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()) {
113  return filePath + "speeddialentry.png"; //NON-NLS
114  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()) {
115  return filePath + "bluetooth.png"; //NON-NLS
116  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()) {
117  return filePath + "gpsfav.png"; //NON-NLS
118  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()) {
119  return filePath + "gps-lastlocation.png"; //NON-NLS
120  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()) {
121  return filePath + "gps-search.png"; //NON-NLS
122  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID()) {
123  return filePath + "installed.png"; //NON-NLS
124  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()) {
125  return filePath + "encrypted-file.png"; //NON-NLS
126  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID()) {
127  return filePath + "mismatch-16.png"; //NON-NLS
128  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID()) {
129  return filePath + "gps_trackpoint.png"; //NON-NLS
130  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID()) {
131  return filePath + "drive_network.png"; //NON-NLS
132  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_FACE_DETECTED.getTypeID()) {
133  return filePath + "face.png"; //NON-NLS
134  }
135  return filePath + "artifact-icon.png"; //NON-NLS
136  }
137 
138  public class RootNode extends DisplayableItemNode {
139 
140  public RootNode(SleuthkitCase skCase) {
141  super(Children.create(new TypeFactory(), true), Lookups.singleton(NAME));
142  super.setName(NAME);
143  super.setDisplayName(NAME);
144  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/extracted_content.png"); //NON-NLS
145  }
146 
147  @Override
148  public boolean isLeafTypeNode() {
149  return false;
150  }
151 
152  @Override
153  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
154  return v.visit(this);
155  }
156 
157  @Override
158  protected Sheet createSheet() {
159  Sheet s = super.createSheet();
160  Sheet.Set ss = s.get(Sheet.PROPERTIES);
161  if (ss == null) {
162  ss = Sheet.createPropertiesSet();
163  s.put(ss);
164  }
165 
166  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.name"),
167  NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.displayName"),
168  NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.desc"),
169  NAME));
170  return s;
171  }
172 
173  @Override
174  public String getItemType() {
175  return getClass().getName();
176  }
177  }
178 
184  private class TypeFactory extends ChildFactory.Detachable<BlackboardArtifact.Type> {
185 
186  private final ArrayList<BlackboardArtifact.Type> doNotShow = new ArrayList<>();
187  // maps the artifact type to its child node
188  private final HashMap<BlackboardArtifact.Type, TypeNode> typeNodeList = new HashMap<>();
189 
190  public TypeFactory() {
191  super();
192 
193  // these are shown in other parts of the UI tree
194  doNotShow.add(new BlackboardArtifact.Type(TSK_GEN_INFO));
195  doNotShow.add(new BlackboardArtifact.Type(TSK_EMAIL_MSG));
196  doNotShow.add(new BlackboardArtifact.Type(TSK_HASHSET_HIT));
197  doNotShow.add(new BlackboardArtifact.Type(TSK_KEYWORD_HIT));
198  doNotShow.add(new BlackboardArtifact.Type(TSK_INTERESTING_FILE_HIT));
199  doNotShow.add(new BlackboardArtifact.Type(TSK_INTERESTING_ARTIFACT_HIT));
200  doNotShow.add(new BlackboardArtifact.Type(TSK_ACCOUNT));
201  }
202 
203  private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
204  String eventType = evt.getPropertyName();
205  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
211  try {
218  final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
219  if (null != event && !(this.doNotShow.contains(event.getBlackboardArtifactType()))) {
220  refresh(true);
221  }
222  } catch (IllegalStateException notUsed) {
226  }
227  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
228  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
234  try {
236  refresh(true);
237  } catch (IllegalStateException notUsed) {
241  }
242  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
243  // case was closed. Remove listeners so that we don't get called with a stale case handle
244  if (evt.getNewValue() == null) {
245  removeNotify();
246  skCase = null;
247  }
248  }
249  };
250 
251  @Override
252  protected void addNotify() {
256  }
257 
258  @Override
259  protected void removeNotify() {
263  typeNodeList.clear();
264  }
265 
266  @Override
267  protected boolean createKeys(List<BlackboardArtifact.Type> list) {
268  //TEST COMMENT
269  if (skCase != null) {
270  try {
271  List<BlackboardArtifact.Type> types = skCase.getArtifactTypesInUse();
272  types.removeAll(doNotShow);
273  Collections.sort(types,
274  new Comparator<BlackboardArtifact.Type>() {
275  @Override
276  public int compare(BlackboardArtifact.Type a, BlackboardArtifact.Type b) {
277  return a.getDisplayName().compareTo(b.getDisplayName());
278  }
279  });
280  list.addAll(types);
281 
282  // the create node method will get called only for new types
283  // refresh the counts if we already created them from a previous update
284  for (BlackboardArtifact.Type art : types) {
285  TypeNode node = typeNodeList.get(art);
286  if (node != null) {
287  node.updateDisplayName();
288  }
289  }
290  } catch (TskCoreException ex) {
291  Logger.getLogger(TypeFactory.class.getName()).log(Level.SEVERE, "Error getting list of artifacts in use: " + ex.getLocalizedMessage()); //NON-NLS
292  }
293  }
294  return true;
295  }
296 
297  @Override
298  protected Node createNodeForKey(BlackboardArtifact.Type key) {
299  TypeNode node = new TypeNode(key);
300  typeNodeList.put(key, node);
301  return node;
302  }
303  }
304 
311  public class TypeNode extends DisplayableItemNode {
312 
313  private final BlackboardArtifact.Type type;
314  private long childCount = 0;
315 
316  TypeNode(BlackboardArtifact.Type type) {
317  super(Children.create(new ArtifactFactory(type), true), Lookups.singleton(type.getDisplayName()));
318  super.setName(type.getTypeName());
319  this.type = type;
320  this.setIconBaseWithExtension(ExtractedContent.getIconFilePath(type.getTypeID())); //NON-NLS
321  updateDisplayName();
322  }
323 
324  final void updateDisplayName() {
325  if (skCase == null) {
326  return;
327  }
328 
329  // NOTE: This completely destroys our lazy-loading ideal
330  // a performance increase might be had by adding a
331  // "getBlackboardArtifactCount()" method to skCase
332  try {
333  this.childCount = skCase.getBlackboardArtifactsTypeCount(type.getTypeID());
334  } catch (TskException ex) {
335  Logger.getLogger(TypeNode.class.getName())
336  .log(Level.WARNING, "Error getting child count", ex); //NON-NLS
337  }
338  super.setDisplayName(type.getDisplayName() + " \u200E(\u200E" + childCount + ")\u200E");
339  }
340 
341  @Override
342  protected Sheet createSheet() {
343  Sheet s = super.createSheet();
344  Sheet.Set ss = s.get(Sheet.PROPERTIES);
345  if (ss == null) {
346  ss = Sheet.createPropertiesSet();
347  s.put(ss);
348  }
349 
350  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.name"),
351  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.displayName"),
352  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.desc"),
353  type.getDisplayName()));
354 
355  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.name"),
356  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.displayName"),
357  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.desc"),
358  childCount));
359 
360  return s;
361  }
362 
363  @Override
364  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
365  return v.visit(this);
366  }
367 
368  @Override
369  public boolean isLeafTypeNode() {
370  return true;
371  }
372 
373  @Override
374  public String getItemType() {
375  return getClass().getName() + type.getDisplayName();
376  }
377  }
378 
382  private class ArtifactFactory extends ChildFactory.Detachable<BlackboardArtifact> {
383 
384  private BlackboardArtifact.Type type;
385 
386  public ArtifactFactory(BlackboardArtifact.Type type) {
387  super();
388  this.type = type;
389  }
390 
391  private final PropertyChangeListener pcl = new PropertyChangeListener() {
392  @Override
393  public void propertyChange(PropertyChangeEvent evt) {
394  String eventType = evt.getPropertyName();
395  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
402  try {
410  final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
411  if (null != event && event.getBlackboardArtifactType().equals(type)) {
412  refresh(true);
413  }
414  } catch (IllegalStateException notUsed) {
418  }
419  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
420  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
427  try {
429  refresh(true);
430  } catch (IllegalStateException notUsed) {
434  }
435  }
436  }
437  };
438 
439  @Override
440  protected void addNotify() {
443  }
444 
445  @Override
446  protected void removeNotify() {
449  }
450 
451  @Override
452  protected boolean createKeys(List<BlackboardArtifact> list) {
453  if (skCase != null) {
454  try {
455  List<BlackboardArtifact> arts = skCase.getBlackboardArtifacts(type.getTypeID());
456  list.addAll(arts);
457  } catch (TskException ex) {
458  Logger.getLogger(ArtifactFactory.class.getName()).log(Level.SEVERE, "Couldn't get blackboard artifacts from database", ex); //NON-NLS
459  }
460  }
461  return true;
462  }
463 
464  @Override
465  protected Node createNodeForKey(BlackboardArtifact key) {
466  return new BlackboardArtifactNode(key);
467  }
468  }
469 }
boolean createKeys(List< BlackboardArtifact.Type > list)
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
final ArrayList< BlackboardArtifact.Type > doNotShow
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:395
final HashMap< BlackboardArtifact.Type, TypeNode > typeNodeList
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:440

Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.