Autopsy  4.5.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
DataResultFilterNode.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.directorytree;
20 
21 import java.awt.event.ActionEvent;
22 import java.beans.PropertyVetoException;
23 import java.text.MessageFormat;
24 import java.util.ArrayList;
25 import java.util.Collection;
26 import java.util.HashSet;
27 import java.util.List;
28 import java.util.logging.Level;
29 import java.util.prefs.PreferenceChangeEvent;
30 import java.util.prefs.PreferenceChangeListener;
31 import javax.swing.AbstractAction;
32 import javax.swing.Action;
33 import org.openide.explorer.ExplorerManager;
34 import org.openide.nodes.AbstractNode;
35 import org.openide.nodes.FilterNode;
36 import org.openide.nodes.Node;
37 import org.openide.nodes.Sheet;
38 import org.openide.util.NbBundle;
39 import org.openide.util.Utilities;
63 import static org.sleuthkit.autopsy.directorytree.Bundle.*;
64 import org.sleuthkit.datamodel.AbstractFile;
65 import org.sleuthkit.datamodel.BlackboardArtifact;
66 import org.sleuthkit.datamodel.BlackboardAttribute;
67 import org.sleuthkit.datamodel.Content;
68 import org.sleuthkit.datamodel.DerivedFile;
69 import org.sleuthkit.datamodel.Directory;
70 import org.sleuthkit.datamodel.File;
71 import org.sleuthkit.datamodel.LayoutFile;
72 import org.sleuthkit.datamodel.LocalFile;
73 import org.sleuthkit.datamodel.LocalDirectory;
74 import org.sleuthkit.datamodel.SlackFile;
75 import org.sleuthkit.datamodel.TskData;
76 import org.sleuthkit.datamodel.TskException;
77 import org.sleuthkit.datamodel.VirtualDirectory;
78 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
79 import org.sleuthkit.datamodel.TskCoreException;
80 
86 public class DataResultFilterNode extends FilterNode {
87 
88  private static final Logger LOGGER = Logger.getLogger(DataResultFilterNode.class.getName());
89 
94 
95  static {
96  UserPreferences.addChangeListener(new PreferenceChangeListener() {
97  @Override
98  public void preferenceChange(PreferenceChangeEvent evt) {
99  switch (evt.getKey()) {
101  filterKnownFromDataSources = UserPreferences.hideKnownFilesInDataSourcesTree();
102  break;
104  filterKnownFromViews = UserPreferences.hideKnownFilesInViewsTree();
105  break;
107  filterSlackFromDataSources = UserPreferences.hideSlackFilesInDataSourcesTree();
108  break;
110  filterSlackFromViews = UserPreferences.hideSlackFilesInViewsTree();
111  break;
112  }
113  }
114  });
115  }
116 
119 
120  private final ExplorerManager sourceEm;
121 
131  public DataResultFilterNode(Node node, ExplorerManager em) {
132  super(node, new DataResultFilterChildren(node, em));
133  this.sourceEm = em;
134  }
135 
149  private DataResultFilterNode(Node node, ExplorerManager em, boolean filterKnown, boolean filterSlack) {
150  super(node, new DataResultFilterChildren(node, em, filterKnown, filterSlack));
151  this.sourceEm = em;
152  }
153 
162  @Override
163  public Action[] getActions(boolean popup) {
164 
165  List<Action> actions = new ArrayList<>();
166 
167  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
168  List<Action> accept = originalNode.accept(getActionsDIV);
169  if (accept != null) {
170  actions.addAll(accept);
171  }
172 
173  //actions.add(new IndexContentFilesAction(nodeContent, "Index"));
174  return actions.toArray(new Action[actions.size()]);
175  }
176 
183  @Override
184  public Action getPreferredAction() {
185  final Node original = this.getOriginal();
186  // Once had a org.openide.nodes.ChildFactory$WaitFilterNode passed in
187  if ((original instanceof DisplayableItemNode) == false) {
188  return null;
189  }
190 
191  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
192  return originalNode.accept(getPreferredActionsDIV);
193  }
194 
195  @Override
196  public Node.PropertySet[] getPropertySets() {
197  Node.PropertySet[] propertySets = super.getPropertySets();
198 
199  for (int i = 0; i < propertySets.length; i++) {
200  Node.PropertySet ps = propertySets[i];
201 
202  if (ps.getName().equals(Sheet.PROPERTIES)) {
203  Sheet.Set newPs = new Sheet.Set();
204  newPs.setName(ps.getName());
205  newPs.setDisplayName(ps.getDisplayName());
206  newPs.setShortDescription(ps.getShortDescription());
207 
208  newPs.put(ps.getProperties());
209  if (newPs.remove(AbstractFsContentNode.HIDE_PARENT) != null) {
210  newPs.remove(AbstractFilePropertyType.LOCATION.toString());
211  }
212  propertySets[i] = newPs;
213  }
214  }
215 
216  return propertySets;
217  }
218 
229  @Override
230  public String getDisplayName() {
231  final Node orig = getOriginal();
232  String name = orig.getDisplayName();
233  if ((orig instanceof BlackboardArtifactNode)) {
234  name = ((BlackboardArtifactNode) orig).getSourceName();
235  }
236  return name;
237  }
238 
245  public void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo) {
246  if (getOriginal() instanceof DisplayableItemNode) {
247  ((DisplayableItemNode) getOriginal()).setChildNodeSelectionInfo(selectedChildNodeInfo);
248  }
249  }
250 
259  if (getOriginal() instanceof DisplayableItemNode) {
260  return ((DisplayableItemNode) getOriginal()).getChildNodeSelectionInfo();
261  } else {
262  return null;
263  }
264  }
265 
271  private static class DataResultFilterChildren extends FilterNode.Children {
272 
273  private final ExplorerManager sourceEm;
274 
275  private boolean filterKnown;
276  private boolean filterSlack;
277  private boolean filterArtifacts; // display message artifacts in the DataSource subtree
278 
282  private DataResultFilterChildren(Node arg, ExplorerManager sourceEm) {
283  super(arg);
284 
285  this.filterArtifacts = false;
286  switch (SelectionContext.getSelectionContext(arg)) {
287  case DATA_SOURCES:
288  filterSlack = filterSlackFromDataSources;
289  filterKnown = filterKnownFromDataSources;
290  filterArtifacts = true;
291  break;
292  case VIEWS:
293  filterSlack = filterSlackFromViews;
294  filterKnown = filterKnownFromViews;
295  break;
296  default:
297  filterSlack = false;
298  filterKnown = false;
299  break;
300  }
301  this.sourceEm = sourceEm;
302  }
303 
304  private DataResultFilterChildren(Node arg, ExplorerManager sourceEm, boolean filterKnown, boolean filterSlack) {
305  super(arg);
306  this.filterKnown = filterKnown;
307  this.filterSlack = filterSlack;
308  this.sourceEm = sourceEm;
309  }
310 
311  @Override
312  protected Node[] createNodes(Node key) {
313  AbstractFile file = key.getLookup().lookup(AbstractFile.class);
314  if (file != null) {
315  if (filterKnown && (file.getKnown() == TskData.FileKnown.KNOWN)) {
316  // Filter out child nodes that represent known files
317  return new Node[]{};
318  }
319  if (filterSlack && file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
320  // Filter out child nodes that represent slack files
321  return new Node[]{};
322  }
323  }
324 
325  // filter out all non-message artifacts, if displaying the results from the Data Source tree
326  BlackboardArtifact art = key.getLookup().lookup(BlackboardArtifact.class);
327  if (art != null && filterArtifacts) {
328  if ( (art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) &&
329  (art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()) ) {
330  return new Node[]{};
331  }
332  }
333 
334  return new Node[]{new DataResultFilterNode(key, sourceEm, filterKnown, filterSlack)};
335  }
336  }
337 
338  @NbBundle.Messages("DataResultFilterNode.viewSourceArtifact.text=View Source Result")
343  private static class GetPopupActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<List<Action>> {
344 
345  @Override
346  public List<Action> visit(BlackboardArtifactNode ban) {
347  //set up actions for artifact node based on its Content object
348  //TODO all actions need to be consolidated in single place!
349  //they should be set in individual Node subclass and using a utility to get Actions per Content sub-type
350  // TODO UPDATE: There is now a DataModelActionsFactory utility;
351 
352  List<Action> actionsList = new ArrayList<>();
353 
354  //merge predefined specific node actions if bban subclasses have their own
355  for (Action a : ban.getActions(true)) {
356  actionsList.add(a);
357  }
358  BlackboardArtifact ba = ban.getLookup().lookup(BlackboardArtifact.class);
359  final int artifactTypeID = ba.getArtifactTypeID();
360 
361  if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
362  || artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
363  actionsList.add(new ViewContextAction(
364  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), ban));
365  } else if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
366  //action to go to the source artifact
367  actionsList.add(new ViewSourceArtifactAction(DataResultFilterNode_viewSourceArtifact_text(), ba));
368  // action to go to the source file of the artifact
369  actionsList.add(new ViewContextAction(
370  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
371  } else {
372  // if the artifact links to another file, add an action to go to
373  // that file
374  Content c = findLinked(ban);
375  if (c != null) {
376  actionsList.add(new ViewContextAction(
377  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), c));
378  }
379  // action to go to the source file of the artifact
380  actionsList.add(new ViewContextAction(
381  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
382  }
383  Content c = ban.getLookup().lookup(File.class);
384  Node n = null;
385  boolean md5Action = false;
386  if (c != null) {
387  n = new FileNode((AbstractFile) c);
388  md5Action = true;
389  } else if ((c = ban.getLookup().lookup(Directory.class)) != null) {
390  n = new DirectoryNode((Directory) c);
391  } else if ((c = ban.getLookup().lookup(VirtualDirectory.class)) != null) {
392  n = new VirtualDirectoryNode((VirtualDirectory) c);
393  } else if ((c = ban.getLookup().lookup(LocalDirectory.class)) != null) {
394  n = new LocalDirectoryNode((LocalDirectory) c);
395  } else if ((c = ban.getLookup().lookup(LayoutFile.class)) != null) {
396  n = new LayoutFileNode((LayoutFile) c);
397  } else if ((c = ban.getLookup().lookup(LocalFile.class)) != null
398  || (c = ban.getLookup().lookup(DerivedFile.class)) != null) {
399  n = new LocalFileNode((AbstractFile) c);
400  } else if ((c = ban.getLookup().lookup(SlackFile.class)) != null) {
401  n = new SlackFileNode((SlackFile) c);
402  }
403  if (n != null) {
404  actionsList.add(null); // creates a menu separator
405  actionsList.add(new NewWindowViewAction(
406  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInNewWin.text"), n));
407  actionsList.add(new ExternalViewerAction(
408  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.openInExtViewer.text"), n));
409  actionsList.add(null); // creates a menu separator
410  actionsList.add(ExtractAction.getInstance());
411  if (md5Action) {
412  actionsList.add(new HashSearchAction(
413  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.searchFilesSameMd5.text"), n));
414  }
415  actionsList.add(null); // creates a menu separator
416  actionsList.add(AddContentTagAction.getInstance());
417  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
418 
419  final Collection<AbstractFile> selectedFilesList
420  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(AbstractFile.class));
421  if (selectedFilesList.size() == 1) {
422  actionsList.add(DeleteFileContentTagAction.getInstance());
423  }
424  } else {
425  // There's no specific file associated with the artifact, but
426  // we can still tag the artifact itself
427  actionsList.add(null);
428  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
429  }
430 
431  final Collection<BlackboardArtifact> selectedArtifactsList
432  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class));
433  if (selectedArtifactsList.size() == 1) {
435  }
436 
437  if (n != null) {
438  actionsList.addAll(ContextMenuExtensionPoint.getActions());
439  }
440 
441  return actionsList;
442  }
443 
444  @Override
445  public List<Action> visit(Reports.ReportsListNode ditem) {
446  // The base class Action is "Collapse All", inappropriate.
447  return null;
448  }
449 
450  @Override
451  public List<Action> visit(FileTypesNode fileTypes) {
452  return defaultVisit(fileTypes);
453  }
454 
455  @Override
456  protected List<Action> defaultVisit(DisplayableItemNode ditem) {
457  //preserve the default node's actions
458  List<Action> actions = new ArrayList<>();
459 
460  for (Action action : ditem.getActions(true)) {
461  actions.add(action);
462  }
463 
464  return actions;
465  }
466 
467  private Content findLinked(BlackboardArtifactNode ba) {
468  BlackboardArtifact art = ba.getLookup().lookup(BlackboardArtifact.class);
469  Content c = null;
470  try {
471  for (BlackboardAttribute attr : art.getAttributes()) {
472  if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) {
473  switch (attr.getAttributeType().getValueType()) {
474  case INTEGER:
475  int i = attr.getValueInt();
476  if (i != -1) {
477  c = art.getSleuthkitCase().getContentById(i);
478  }
479  break;
480  case LONG:
481  long l = attr.getValueLong();
482  if (l != -1) {
483  c = art.getSleuthkitCase().getContentById(l);
484  }
485  break;
486  }
487  }
488  }
489  } catch (TskException ex) {
490  Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error getting linked file", ex); //NON-NLS
491  }
492  return c;
493  }
494 
495  }
496 
497  /*
498  * Action for double-click / preferred action on nodes.
499  */
500  private class GetPreferredActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<AbstractAction> {
501 
502  @Override
503  public AbstractAction visit(BlackboardArtifactNode ban) {
504  BlackboardArtifact artifact = ban.getArtifact();
505  try {
506  if ( (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) ||
507  (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()) ) {
508  if (artifact.hasChildren()) {
509  return openChild(ban);
510  }
511  }
512  }
513  catch (TskCoreException ex) {
514  LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting children from blackboard artifact{0}.", artifact.getArtifactID()), ex); //NON-NLS
515  }
516  return new ViewContextAction(
517  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInDir.text"), ban);
518  }
519 
520  @Override
521  public AbstractAction visit(DirectoryNode dn) {
522  if (dn.getDisplayName().equals(DirectoryNode.DOTDOTDIR)) {
523  return openParent(dn);
524  } else if (dn.getDisplayName().equals(DirectoryNode.DOTDIR) == false) {
525  return openChild(dn);
526  } else {
527  return null;
528  }
529  }
530 
531  @Override
532  public AbstractAction visit(FileNode fn) {
533  if (fn.hasContentChildren()) {
534  return openChild(fn);
535  } else {
536  return null;
537  }
538  }
539 
540  @Override
541  public AbstractAction visit(LocalFileNode dfn) {
542  if (dfn.hasContentChildren()) {
543  return openChild(dfn);
544  } else {
545  return null;
546  }
547  }
548 
549  @Override
550  public AbstractAction visit(Reports.ReportNode reportNode) {
551  return reportNode.getPreferredAction();
552  }
553 
554  @Override
555  protected AbstractAction defaultVisit(DisplayableItemNode c) {
556  return openChild(c);
557  }
558 
559  @Override
560  public AbstractAction visit(FileTypesNode fileTypes) {
561  return openChild(fileTypes);
562  }
563 
572  private AbstractAction openChild(final AbstractNode dataModelNode) {
573  // get the current selection from the directory tree explorer manager,
574  // which is a DirectoryTreeFilterNode. One of that node's children
575  // is a DirectoryTreeFilterNode that wraps the dataModelNode. We need
576  // to set that wrapped node as the selection and root context of the
577  // directory tree explorer manager (sourceEm)
578  final Node currentSelectionInDirectoryTree = sourceEm.getSelectedNodes()[0];
579 
580  return new AbstractAction() {
581  @Override
582  public void actionPerformed(ActionEvent e) {
583  if (currentSelectionInDirectoryTree != null) {
584  // Find the filter version of the passed in dataModelNode.
585  final org.openide.nodes.Children children = currentSelectionInDirectoryTree.getChildren();
586  // This call could break if the DirectoryTree is re-implemented with lazy ChildFactory objects.
587  Node newSelection = children.findChild(dataModelNode.getName());
588 
589  /*
590  * We got null here when we were viewing a ZIP file in
591  * the Views -> Archives area and double clicking on it
592  * got to this code. It tried to find the child in the
593  * tree and didn't find it. An exception was then thrown
594  * from setting the selected node to be null.
595  */
596  if (newSelection != null) {
597  try {
598  sourceEm.setExploredContextAndSelection(newSelection, new Node[]{newSelection});
599  } catch (PropertyVetoException ex) {
600  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
601  logger.log(Level.WARNING, "Error: can't open the selected directory.", ex); //NON-NLS
602  }
603  }
604  }
605  }
606  };
607  }
608 
617  private AbstractAction openParent(AbstractNode node) {
618  // @@@ Why do we ignore node?
619  Node[] selectedFilterNodes = sourceEm.getSelectedNodes();
620  Node selectedFilterNode = selectedFilterNodes[0];
621  final Node parentNode = selectedFilterNode.getParentNode();
622 
623  return new AbstractAction() {
624  @Override
625  public void actionPerformed(ActionEvent e) {
626  try {
627  sourceEm.setSelectedNodes(new Node[]{parentNode});
628  } catch (PropertyVetoException ex) {
629  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
630  logger.log(Level.WARNING, "Error: can't open the parent directory.", ex); //NON-NLS
631  }
632  }
633  };
634  }
635  }
636 }
abstract< T > T accept(DisplayableItemNodeVisitor< T > visitor)
static final DisplayableItemNodeVisitor< List< Action > > getActionsDIV
static synchronized AddBlackboardArtifactTagAction getInstance()
static synchronized DeleteFileBlackboardArtifactTagAction getInstance()
DataResultFilterChildren(Node arg, ExplorerManager sourceEm, boolean filterKnown, boolean filterSlack)
static synchronized ExtractAction getInstance()
void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo)
static synchronized DeleteFileContentTagAction getInstance()
final DisplayableItemNodeVisitor< AbstractAction > getPreferredActionsDIV
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addChangeListener(PreferenceChangeListener listener)
static synchronized AddContentTagAction getInstance()
DataResultFilterNode(Node node, ExplorerManager em, boolean filterKnown, boolean filterSlack)

Copyright © 2012-2016 Basis Technology. Generated on: Tue Feb 20 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.