Autopsy  4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | Static Public Member Functions | Static Public Attributes | Protected Member Functions | Protected Attributes | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb Class Reference

Inherits org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.

Public Member Functions

void addArtifact (CorrelationAttribute eamArtifact) throws EamDbException
 
void addReferenceInstance (EamGlobalFileInstance eamGlobalFileInstance, CorrelationAttribute.Type correlationType) throws EamDbException
 
void bulkInsertArtifacts () throws EamDbException
 
void bulkInsertCases (List< CorrelationCase > cases) throws EamDbException
 
void bulkInsertReferenceTypeEntries (Set< EamGlobalFileInstance > globalInstances, CorrelationAttribute.Type contentType) throws EamDbException
 
List< CorrelationAttributeInstancegetArtifactInstancesByPath (CorrelationAttribute.Type aType, String filePath) throws EamDbException
 
List< CorrelationAttributeInstancegetArtifactInstancesByTypeValue (CorrelationAttribute.Type aType, String value) throws EamDbException
 
List< CorrelationAttributeInstancegetArtifactInstancesKnownBad (CorrelationAttribute.Type aType, String value) throws EamDbException
 
List< String > getBadTags ()
 
CorrelationCase getCaseByUUID (String caseUUID) throws EamDbException
 
List< CorrelationCasegetCases () throws EamDbException
 
CorrelationAttribute.Type getCorrelationTypeById (int typeId) throws EamDbException
 
Long getCountArtifactInstancesByCaseDataSource (String caseUUID, String dataSourceID) throws EamDbException
 
Long getCountArtifactInstancesByTypeValue (CorrelationAttribute.Type aType, String value) throws EamDbException
 
Long getCountArtifactInstancesKnownBad (CorrelationAttribute.Type aType, String value) throws EamDbException
 
Long getCountUniqueCaseDataSourceTuplesHavingTypeValue (CorrelationAttribute.Type aType, String value) throws EamDbException
 
Long getCountUniqueDataSources () throws EamDbException
 
CorrelationDataSource getDataSourceDetails (String dataSourceDeviceId) throws EamDbException
 
List< CorrelationDataSourcegetDataSources () throws EamDbException
 
String getDbInfo (String name) throws EamDbException
 
List< CorrelationAttribute.Type > getDefinedCorrelationTypes () throws EamDbException
 
List< CorrelationAttribute.Type > getEnabledCorrelationTypes () throws EamDbException
 
int getFrequencyPercentage (CorrelationAttribute corAttr) throws EamDbException
 
List< String > getListCasesHavingArtifactInstancesKnownBad (CorrelationAttribute.Type aType, String value) throws EamDbException
 
EamOrganization getOrganizationByID (int orgID) throws EamDbException
 
List< EamOrganizationgetOrganizations () throws EamDbException
 
List< EamGlobalFileInstancegetReferenceInstancesByTypeValue (CorrelationAttribute.Type aType, String aValue) throws EamDbException
 
EamGlobalSet getReferenceSetByID (int referenceSetID) throws EamDbException
 
List< CorrelationAttribute.Type > getSupportedCorrelationTypes () throws EamDbException
 
boolean isArtifactlKnownBadByReference (CorrelationAttribute.Type aType, String value) throws EamDbException
 
CorrelationCase newCase (Case autopsyCase) throws EamDbException
 
void newCase (CorrelationCase eamCase) throws EamDbException
 
int newCorrelationType (CorrelationAttribute.Type newType) throws EamDbException
 
void newDataSource (CorrelationDataSource eamDataSource) throws EamDbException
 
void newDbInfo (String name, String value) throws EamDbException
 
void newOrganization (EamOrganization eamOrg) throws EamDbException
 
int newReferencelSet (EamGlobalSet eamGlobalSet) throws EamDbException
 
void prepareBulkArtifact (CorrelationAttribute eamArtifact) throws EamDbException
 
void reset () throws EamDbException
 
void saveSettings ()
 
void setArtifactInstanceKnownStatus (CorrelationAttribute eamArtifact, TskData.FileKnown knownStatus) throws EamDbException
 
void setBadTags (List< String > badTags)
 
void shutdownConnections () throws EamDbException
 
void updateCase (CorrelationCase eamCase) throws EamDbException
 
void updateCorrelationType (CorrelationAttribute.Type aType) throws EamDbException
 
void updateDbInfo (String name, String value) throws EamDbException
 
void updateSettings ()
 

Static Public Member Functions

static synchronized SqliteEamDb getInstance () throws EamDbException
 
static boolean isEnabled ()
 

Static Public Attributes

static final int SCHEMA_VERSION = 1
 

Protected Member Functions

Connection connect () throws EamDbException
 
String getConflictClause ()
 

Protected Attributes

int bulkArtifactsThreshold
 
final List< CorrelationAttribute.Type > DEFAULT_CORRELATION_TYPES
 

Private Member Functions

 SqliteEamDb () throws EamDbException
 
void acquireExclusiveLock ()
 
void acquireSharedLock ()
 
void releaseExclusiveLock ()
 
void releaseSharedLock ()
 
void setupConnectionPool () throws EamDbException
 

Private Attributes

BasicDataSource connectionPool = null
 
final SqliteEamDbSettings dbSettings
 
final ReentrantReadWriteLock rwLock = new ReentrantReadWriteLock(true)
 

Static Private Attributes

static SqliteEamDb instance
 
static final Logger LOGGER = Logger.getLogger(SqliteEamDb.class.getName())
 

Detailed Description

Sqlite implementation of the Central Repository database. All methods in AbstractSqlEamDb that read or write to the database should be overriden here and use appropriate locking.

Definition at line 39 of file SqliteEamDb.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.SqliteEamDb ( ) throws EamDbException
private

Member Function Documentation

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock ( )
private

Acquire the lock that provides exclusive access to the case database. Call this method in a try block with a call to the lock release method in an associated finally block.

Definition at line 928 of file SqliteEamDb.java.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.addArtifact(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.addReferenceInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertArtifacts(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertCases(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertReferenceTypeEntries(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newCase(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newCorrelationType(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newDbInfo(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newOrganization(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newReferencelSet(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.reset(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.setArtifactInstanceKnownStatus(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateCase(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateCorrelationType(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateDbInfo().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock ( )
private

Acquire the lock that provides shared access to the case database. Call this method in a try block with a call to the lock release method in an associated finally block.

Definition at line 946 of file SqliteEamDb.java.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesByPath(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesKnownBad(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCaseByUUID(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCases(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCorrelationTypeById(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesByCaseDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesKnownBad(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountUniqueCaseDataSourceTuplesHavingTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountUniqueDataSources(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDataSourceDetails(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDataSources(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDbInfo(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDefinedCorrelationTypes(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getEnabledCorrelationTypes(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getFrequencyPercentage(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getListCasesHavingArtifactInstancesKnownBad(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getOrganizationByID(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getOrganizations(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getReferenceInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getReferenceSetByID(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getSupportedCorrelationTypes(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.isArtifactlKnownBadByReference().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.addArtifact ( CorrelationAttribute  eamArtifact) throws EamDbException

Inserts new Artifact(s) into the database. Should add associated Case and Data Source first.

Parameters
eamArtifactThe artifact to add

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 416 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.addReferenceInstance ( EamGlobalFileInstance  eamGlobalFileInstance,
CorrelationAttribute.Type  correlationType 
) throws EamDbException

Add a new reference instance

Parameters
eamGlobalFileInstanceThe reference instance to add
correlationTypeCorrelation Type that this Reference Instance is
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 767 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertArtifacts ( ) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertCases ( List< CorrelationCase cases) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertReferenceTypeEntries ( Set< EamGlobalFileInstance globalInstances,
CorrelationAttribute.Type  contentType 
) throws EamDbException
Connection org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.connect ( ) throws EamDbException
protected

Lazily setup Singleton connection on first request.

Returns
A connection from the connection pool.
Exceptions
EamDbException

Definition at line 179 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isEnabled(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.setupConnectionPool().

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.reset().

List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesByPath ( CorrelationAttribute.Type  aType,
String  filePath 
) throws EamDbException

Retrieves eamArtifact instances from the database that are associated with the aType and filePath

Parameters
aTypeEamArtifact.Type to search for
filePathFile path to search for
Returns
List of 0 or more EamArtifactInstances
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 455 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesByTypeValue ( CorrelationAttribute.Type  aType,
String  value 
) throws EamDbException

Retrieves eamArtifact instances from the database that are associated with the eamArtifactType and eamArtifactValue of the given eamArtifact.

Parameters
eamArtifactThe type/value to look up (artifact with 0 instances)
Returns
List of artifact instances for a given type/value

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 434 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesKnownBad ( CorrelationAttribute.Type  aType,
String  value 
) throws EamDbException

Gets list of matching eamArtifact instances that have knownStatus = "Bad".

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
List with 0 or more matching eamArtifact instances.

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 599 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<String> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getBadTags ( )

Get the list of tags recognized as "Bad"

Returns
The list of bad tags

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 204 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDbSettings.getBadTags().

CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCaseByUUID ( String  caseUUID) throws EamDbException

Retrieves Case details based on Case UUID

Parameters
caseUUIDunique identifier for a case
Returns
The retrieved case

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 323 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<CorrelationCase> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCases ( ) throws EamDbException
String org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getConflictClause ( )
protected

Definition at line 198 of file SqliteEamDb.java.

CorrelationAttribute.Type org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCorrelationTypeById ( int  typeId) throws EamDbException

Get the EamArtifact.Type that has the given Type.Id.

Parameters
typeIdType.Id of Correlation Type to get
Returns
EamArtifact.Type or null if it doesn't exist.
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 914 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

Long org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesByCaseDataSource ( String  caseUUID,
String  dataSourceID 
) throws EamDbException

Retrieves number of eamArtifact instances in the database that are associated with the caseDisplayName and dataSource of the given eamArtifact instance.

Parameters
caseUUIDCase ID to search for
dataSourceIDData source ID to search for
Returns
Number of artifact instances having caseDisplayName and dataSource

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 537 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

Long org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesByTypeValue ( CorrelationAttribute.Type  aType,
String  value 
) throws EamDbException

Retrieves number of artifact instances in the database that are associated with the ArtifactType and artifactValue of the given artifact.

Parameters
eamArtifactArtifact with artifactType and artifactValue to search for
Returns
Number of artifact instances having ArtifactType and ArtifactValue.

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 475 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

Long org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesKnownBad ( CorrelationAttribute.Type  aType,
String  value 
) throws EamDbException

Count matching eamArtifacts instances that have knownStatus = "Bad".

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
Number of matching eamArtifacts

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 617 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

Long org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountUniqueCaseDataSourceTuplesHavingTypeValue ( CorrelationAttribute.Type  aType,
String  value 
) throws EamDbException

Retrieves number of unique caseDisplayName / dataSource tuples in the database that are associated with the artifactType and artifactValue of the given artifact.

Parameters
eamArtifactArtifact with artifactType and artifactValue to search for
Returns
Number of unique tuples

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 505 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

Long org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountUniqueDataSources ( ) throws EamDbException
CorrelationDataSource org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDataSourceDetails ( String  dataSourceDeviceId) throws EamDbException

Updates a Data Source in the database

Parameters
eamDataSourcethe data source to update Retrieves Data Source details based on data source device ID
dataSourceDeviceIdthe data source device ID number
Returns
The data source

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 385 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<CorrelationDataSource> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDataSources ( ) throws EamDbException
String org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDbInfo ( String  name) throws EamDbException

Get the value for the given name from the name/value db_info table.

Parameters
nameName to search for
Returns
value associated with name.
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 241 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<CorrelationAttribute.Type> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDefinedCorrelationTypes ( ) throws EamDbException

Get the list of EamArtifact.Type's that will be used to correlate artifacts.

Returns
List of EamArtifact.Type's. If none are defined in the database, the default list will be returned.
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 840 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<CorrelationAttribute.Type> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getEnabledCorrelationTypes ( ) throws EamDbException

Get the list of enabled EamArtifact.Type's that will be used to correlate artifacts.

Returns
List of enabled EamArtifact.Type's. If none are defined in the database, the default list will be returned.
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 859 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

int org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getFrequencyPercentage ( CorrelationAttribute  corAttr) throws EamDbException

Calculate the percentage of data sources that have this attribute value.

Parameters
corAttrAttribute type and value to get data about
Returns
Int between 0 and 100

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 485 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

static synchronized SqliteEamDb org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getInstance ( ) throws EamDbException
static

Get the singleton instance of SqliteEamDb

Returns
the singleton instance of SqliteEamDb
Exceptions
EamDbExceptionif one or more default correlation type(s) have an invalid db table name.

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 60 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.instance, and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.SqliteEamDb().

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance().

List<String> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getListCasesHavingArtifactInstancesKnownBad ( CorrelationAttribute.Type  aType,
String  value 
) throws EamDbException

Gets list of distinct case display names, where each case has 1+ Artifact Instance matching eamArtifact with knownStatus = "Bad".

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
List of cases containing this artifact with instances marked as bad
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 639 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

EamOrganization org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getOrganizationByID ( int  orgID) throws EamDbException

Get an organization having the given ID

Parameters
orgIDThe id to look up
Returns
The organization with the given ID
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 710 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<EamOrganization> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getOrganizations ( ) throws EamDbException
List<EamGlobalFileInstance> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getReferenceInstancesByTypeValue ( CorrelationAttribute.Type  aType,
String  aValue 
) throws EamDbException

Get all reference entries having a given correlation type and value

Parameters
aTypeType to use for matching
aValueValue to use for matching
Returns
List of all global file instances with a type and value
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 802 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

EamGlobalSet org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getReferenceSetByID ( int  referenceSetID) throws EamDbException

Get a reference set by ID

Parameters
referenceSetIDThe ID to look up
Returns
The global set associated with the ID
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 748 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

List<CorrelationAttribute.Type> org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getSupportedCorrelationTypes ( ) throws EamDbException

Get the list of supported EamArtifact.Type's that can be used to correlate artifacts.

Returns
List of supported EamArtifact.Type's. If none are defined in the database, the default list will be returned.
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 878 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

boolean org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.isArtifactlKnownBadByReference ( CorrelationAttribute.Type  aType,
String  value 
) throws EamDbException

Is the artifact known as bad according to the reference entries?

Parameters
aTypeEamArtifact.Type to search for
valueValue to search for
Returns
Global known status of the artifact

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 657 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireSharedLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock().

static boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isEnabled ( )
staticinherited
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newCase ( Case  autopsyCase) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newCase ( CorrelationCase  eamCase) throws EamDbException

Creates new Case in the database

Expects the Organization for this case to already exist in the database.

Parameters
eamCaseThe case to add

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 291 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock().

int org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newCorrelationType ( CorrelationAttribute.Type  newType) throws EamDbException

Add a new EamArtifact.Type to the db.

Parameters
newTypeNew type to add.
Returns
ID of this new Correlation Type
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 821 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newDataSource ( CorrelationDataSource  eamDataSource) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newDbInfo ( String  name,
String  value 
) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newOrganization ( EamOrganization  eamOrg) throws EamDbException
int org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newReferencelSet ( EamGlobalSet  eamGlobalSet) throws EamDbException

Add a new Global Set

Parameters
eamGlobalSetThe global set to add
Returns
The ID of the new global set
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 729 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock().

void org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.prepareBulkArtifact ( CorrelationAttribute  eamArtifact) throws EamDbException
inherited

Adds an eamArtifact to an internal list to be later added to DB. Artifact can have 1 or more Artifact Instances. Insert will be triggered by a threshold or a call to bulkInsertArtifacts().

Parameters
eamArtifactThe artifact to add

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 878 of file AbstractSqlEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.bulkArtifacts, and org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.bulkInsertArtifacts().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock ( )
private

Release the lock that provides exclusive access to the database. This method should always be called in the finally block of a try block in which the lock was acquired.

Definition at line 937 of file SqliteEamDb.java.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.addArtifact(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.addReferenceInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertArtifacts(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertCases(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.bulkInsertReferenceTypeEntries(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newCase(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newCorrelationType(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newDbInfo(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newOrganization(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.newReferencelSet(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.reset(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.setArtifactInstanceKnownStatus(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateCase(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateCorrelationType(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateDbInfo().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseSharedLock ( )
private

Release the lock that provides shared access to the database. This method should always be called in the finally block of a try block in which the lock was acquired.

Definition at line 955 of file SqliteEamDb.java.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesByPath(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getArtifactInstancesKnownBad(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCaseByUUID(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCases(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCorrelationTypeById(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesByCaseDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountArtifactInstancesKnownBad(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountUniqueCaseDataSourceTuplesHavingTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getCountUniqueDataSources(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDataSourceDetails(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDataSources(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDbInfo(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getDefinedCorrelationTypes(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getEnabledCorrelationTypes(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getFrequencyPercentage(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getListCasesHavingArtifactInstancesKnownBad(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getOrganizationByID(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getOrganizations(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getReferenceInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getReferenceSetByID(), org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.getSupportedCorrelationTypes(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.isArtifactlKnownBadByReference().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.reset ( ) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.saveSettings ( )
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.setArtifactInstanceKnownStatus ( CorrelationAttribute  eamArtifact,
TskData.FileKnown  knownStatus 
) throws EamDbException

Sets an eamArtifact instance as knownStatus = "Bad". If eamArtifact exists, it is updated. If eamArtifact does not exist nothing happens

Parameters
eamArtifactArtifact containing exactly one (1) ArtifactInstance.

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 580 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.setBadTags ( List< String >  tags)

Set the tags recognized as "Bad"

Parameters
tagsThe tags to consider bad

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 209 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDbSettings.setBadTags().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.setupConnectionPool ( ) throws EamDbException
private
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.shutdownConnections ( ) throws EamDbException

Shutdown the connection pool.

This closes the connection pool including all idle database connections. It will not close active/in-use connections. Thus, it is vital that there are no in-use connections when you call this method.

Exceptions
EamDbExceptionif there is a problem closing the connection pool.

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 79 of file SqliteEamDb.java.

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateCase ( CorrelationCase  eamCase) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateCorrelationType ( CorrelationAttribute.Type  aType) throws EamDbException
void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateDbInfo ( String  name,
String  value 
) throws EamDbException

Update the value for a name in the name/value db_info table.

Parameters
nameName to find
valueValue to assign to name.
Exceptions
EamDbException

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 259 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.acquireExclusiveLock(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.releaseExclusiveLock().

void org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.updateSettings ( )

Update settings

When using updateSettings, if any database settings have changed, you should call shutdownConnections() before using any API methods. That will ensure that any old connections are closed and all new connections will be made using the new settings.

Implements org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.

Definition at line 93 of file SqliteEamDb.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.bulkArtifactsThreshold, org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDbSettings.getBulkThreshold(), and org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDbSettings.loadSettings().

Member Data Documentation

int org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.bulkArtifactsThreshold
protectedinherited
BasicDataSource org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.connectionPool = null
private

Definition at line 45 of file SqliteEamDb.java.

final SqliteEamDbSettings org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.dbSettings
private

Definition at line 47 of file SqliteEamDb.java.

final List<CorrelationAttribute.Type> org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.DEFAULT_CORRELATION_TYPES
protectedinherited
SqliteEamDb org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.instance
staticprivate
final Logger org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.LOGGER = Logger.getLogger(SqliteEamDb.class.getName())
staticprivate

Definition at line 41 of file SqliteEamDb.java.

final ReentrantReadWriteLock org.sleuthkit.autopsy.centralrepository.datamodel.SqliteEamDb.rwLock = new ReentrantReadWriteLock(true)
private

Definition at line 51 of file SqliteEamDb.java.

final int org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.SCHEMA_VERSION = 1
staticinherited

Definition at line 31 of file EamDb.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.