Autopsy  4.10.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
ExtractedContent.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.util.ArrayList;
24 import java.util.Collections;
25 import java.util.Comparator;
26 import java.util.EnumSet;
27 import java.util.HashMap;
28 import java.util.List;
29 import java.util.Objects;
30 import java.util.logging.Level;
31 import org.openide.nodes.ChildFactory;
32 import org.openide.nodes.Children;
33 import org.openide.nodes.Node;
34 import org.openide.nodes.Sheet;
35 import org.openide.util.NbBundle;
36 import org.openide.util.lookup.Lookups;
43 import org.sleuthkit.datamodel.Blackboard;
44 import org.sleuthkit.datamodel.BlackboardArtifact;
45 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT;
46 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE;
47 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG;
48 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO;
49 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT;
50 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT;
51 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT;
52 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT;
53 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DOWNLOAD_SOURCE;
54 import org.sleuthkit.datamodel.SleuthkitCase;
55 import org.sleuthkit.datamodel.TskCoreException;
56 import org.sleuthkit.datamodel.TskException;
57 
62 public class ExtractedContent implements AutopsyVisitableItem {
63 
64  private SleuthkitCase skCase; // set to null after case has been closed
65  private Blackboard blackboard;
66  public static final String NAME = NbBundle.getMessage(RootNode.class, "ExtractedContentNode.name.text");
67  private final long datasourceObjId;
68 
74  public ExtractedContent(SleuthkitCase skCase) {
75  this(skCase, 0);
76  }
77 
84  public ExtractedContent(SleuthkitCase skCase, long objId) {
85  this.skCase = skCase;
86  this.datasourceObjId = objId;
87  this.blackboard = skCase.getBlackboard();
88  }
89 
90  @Override
91  public <T> T accept(AutopsyItemVisitor<T> visitor) {
92  return visitor.visit(this);
93  }
94 
95  public SleuthkitCase getSleuthkitCase() {
96  return skCase;
97  }
98 
99  static String getIconFilePath(int typeID) {
100  String filePath = "org/sleuthkit/autopsy/images/"; //NON-NLS
101  if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) {
102  return filePath + "bookmarks.png"; //NON-NLS
103  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) {
104  return filePath + "cookies.png"; //NON-NLS
105  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) {
106  return filePath + "history.png"; //NON-NLS
107  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) {
108  return filePath + "downloads.png"; //NON-NLS
109  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) {
110  return filePath + "recent_docs.png"; //NON-NLS
111  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()) {
112  return filePath + "gps_trackpoint.png"; //NON-NLS
113  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) {
114  return filePath + "programs.png"; //NON-NLS
115  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
116  return filePath + "usb_devices.png"; //NON-NLS
117  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
118  return filePath + "mail-icon-16.png"; //NON-NLS
119  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXTRACTED_TEXT.getTypeID()) {
120  return filePath + "text-file.png"; //NON-NLS
121  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()) {
122  return filePath + "searchquery.png"; //NON-NLS
123  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()) {
124  return filePath + "camera-icon-16.png"; //NON-NLS
125  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
126  return filePath + "computer.png"; //NON-NLS
127  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()) {
128  return filePath + "account-icon-16.png"; //NON-NLS
129  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()) {
130  return filePath + "contact.png"; //NON-NLS
131  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()) {
132  return filePath + "message.png"; //NON-NLS
133  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()) {
134  return filePath + "calllog.png"; //NON-NLS
135  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()) {
136  return filePath + "calendar.png"; //NON-NLS
137  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()) {
138  return filePath + "speeddialentry.png"; //NON-NLS
139  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()) {
140  return filePath + "bluetooth.png"; //NON-NLS
141  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()) {
142  return filePath + "gpsfav.png"; //NON-NLS
143  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()) {
144  return filePath + "gps-lastlocation.png"; //NON-NLS
145  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()) {
146  return filePath + "gps-search.png"; //NON-NLS
147  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID()) {
148  return filePath + "installed.png"; //NON-NLS
149  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() ||
150  typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()) {
151  return filePath + "encrypted-file.png"; //NON-NLS
152  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID()) {
153  return filePath + "mismatch-16.png"; //NON-NLS
154  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID()) {
155  return filePath + "gps_trackpoint.png"; //NON-NLS
156  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID()) {
157  return filePath + "drive_network.png"; //NON-NLS
158  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_FACE_DETECTED.getTypeID()) {
159  return filePath + "face.png"; //NON-NLS
160  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WIFI_NETWORK.getTypeID()) {
161  return filePath + "network-wifi.png"; //NON-NLS
162  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WIFI_NETWORK_ADAPTER.getTypeID()) {
163  return filePath + "network-wifi.png"; //NON-NLS
164  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_SIM_ATTACHED.getTypeID()) {
165  return filePath + "sim_card.png"; //NON-NLS
166  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_ADAPTER.getTypeID()) {
167  return filePath + "Bluetooth.png"; //NON-NLS
168  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_INFO.getTypeID()) {
169  return filePath + "devices.png"; //NON-NLS
170  } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_VERIFICATION_FAILED.getTypeID()) {
171  return filePath + "validationFailed.png"; //NON-NLS
172  }
173  return filePath + "artifact-icon.png"; //NON-NLS
174  }
175 
176  public class RootNode extends DisplayableItemNode {
177 
178  public RootNode(SleuthkitCase skCase) {
179  super(Children.create(new TypeFactory(), true), Lookups.singleton(NAME));
180  super.setName(NAME);
181  super.setDisplayName(NAME);
182  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/extracted_content.png"); //NON-NLS
183  }
184 
185  @Override
186  public boolean isLeafTypeNode() {
187  return false;
188  }
189 
190  @Override
191  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
192  return visitor.visit(this);
193  }
194 
195  @Override
196  protected Sheet createSheet() {
197  Sheet sheet = super.createSheet();
198  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
199  if (sheetSet == null) {
200  sheetSet = Sheet.createPropertiesSet();
201  sheet.put(sheetSet);
202  }
203 
204  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.name"),
205  NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.displayName"),
206  NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.desc"),
207  NAME));
208  return sheet;
209  }
210 
211  @Override
212  public String getItemType() {
213  return getClass().getName();
214  }
215  }
216 
222  private class TypeFactory extends ChildFactory.Detachable<BlackboardArtifact.Type> {
223 
224  private final ArrayList<BlackboardArtifact.Type> doNotShow = new ArrayList<>();
225  // maps the artifact type to its child node
226  private final HashMap<BlackboardArtifact.Type, TypeNode> typeNodeList = new HashMap<>();
227 
228  public TypeFactory() {
229  super();
230 
231  // these are shown in other parts of the UI tree
232  doNotShow.add(new BlackboardArtifact.Type(TSK_GEN_INFO));
233  doNotShow.add(new BlackboardArtifact.Type(TSK_EMAIL_MSG));
234  doNotShow.add(new BlackboardArtifact.Type(TSK_HASHSET_HIT));
235  doNotShow.add(new BlackboardArtifact.Type(TSK_KEYWORD_HIT));
236  doNotShow.add(new BlackboardArtifact.Type(TSK_INTERESTING_FILE_HIT));
237  doNotShow.add(new BlackboardArtifact.Type(TSK_INTERESTING_ARTIFACT_HIT));
238  doNotShow.add(new BlackboardArtifact.Type(TSK_ACCOUNT));
239  doNotShow.add(new BlackboardArtifact.Type(TSK_DATA_SOURCE_USAGE));
240  doNotShow.add(new BlackboardArtifact.Type(TSK_DOWNLOAD_SOURCE) );
241  }
242 
243  private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
244  String eventType = evt.getPropertyName();
245  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
251  try {
258  final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
259  if (null != event && !(this.doNotShow.contains(event.getBlackboardArtifactType()))) {
260  refresh(true);
261  }
262  } catch (NoCurrentCaseException notUsed) {
266  }
267  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
268  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
274  try {
276  refresh(true);
277  } catch (NoCurrentCaseException notUsed) {
281  }
282  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
283  // case was closed. Remove listeners so that we don't get called with a stale case handle
284  if (evt.getNewValue() == null) {
285  removeNotify();
286  skCase = null;
287  }
288  }
289  };
290 
291  @Override
292  protected void addNotify() {
296  }
297 
298  @Override
299  protected void removeNotify() {
303  typeNodeList.clear();
304  }
305 
306  @Override
307  protected boolean createKeys(List<BlackboardArtifact.Type> list) {
308  if (skCase != null) {
309  try {
310  List<BlackboardArtifact.Type> types = Objects.equals(CasePreferences.getGroupItemsInTreeByDataSource(), true) ?
311  blackboard.getArtifactTypesInUse(datasourceObjId) :
312  skCase.getArtifactTypesInUse() ;
313 
314  types.removeAll(doNotShow);
315  Collections.sort(types,
316  new Comparator<BlackboardArtifact.Type>() {
317  @Override
318  public int compare(BlackboardArtifact.Type a, BlackboardArtifact.Type b) {
319  return a.getDisplayName().compareTo(b.getDisplayName());
320  }
321  });
322  list.addAll(types);
323 
324  // the create node method will get called only for new types
325  // refresh the counts if we already created them from a previous update
326  for (BlackboardArtifact.Type art : types) {
327  TypeNode node = typeNodeList.get(art);
328  if (node != null) {
329  node.updateDisplayName();
330  }
331  }
332  } catch (TskCoreException ex) {
333  Logger.getLogger(TypeFactory.class.getName()).log(Level.SEVERE, "Error getting list of artifacts in use: " + ex.getLocalizedMessage()); //NON-NLS
334  }
335  }
336  return true;
337  }
338 
339  @Override
340  protected Node createNodeForKey(BlackboardArtifact.Type key) {
341  TypeNode node = new TypeNode(key);
342  typeNodeList.put(key, node);
343  return node;
344  }
345  }
346 
353  public class TypeNode extends DisplayableItemNode {
354 
355  private final BlackboardArtifact.Type type;
356  private long childCount = 0;
357 
358  TypeNode(BlackboardArtifact.Type type) {
359  super(Children.create(new ArtifactFactory(type), true), Lookups.singleton(type.getDisplayName()));
360  super.setName(type.getTypeName());
361  this.type = type;
362  this.setIconBaseWithExtension(ExtractedContent.getIconFilePath(type.getTypeID())); //NON-NLS
363  updateDisplayName();
364  }
365 
366  final void updateDisplayName() {
367  if (skCase == null) {
368  return;
369  }
370 
371  // NOTE: This completely destroys our lazy-loading ideal
372  // a performance increase might be had by adding a
373  // "getBlackboardArtifactCount()" method to skCase
374  try {
375  this.childCount = Objects.equals(CasePreferences.getGroupItemsInTreeByDataSource(), true) ?
376  blackboard.getArtifactsCount(type.getTypeID(), datasourceObjId) :
377  skCase.getBlackboardArtifactsTypeCount(type.getTypeID());
378  } catch (TskException ex) {
379  Logger.getLogger(TypeNode.class.getName())
380  .log(Level.WARNING, "Error getting child count", ex); //NON-NLS
381  }
382  super.setDisplayName(type.getDisplayName() + " \u200E(\u200E" + childCount + ")\u200E");
383  }
384 
385  @Override
386  protected Sheet createSheet() {
387  Sheet sheet = super.createSheet();
388  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
389  if (sheetSet == null) {
390  sheetSet = Sheet.createPropertiesSet();
391  sheet.put(sheetSet);
392  }
393 
394  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.name"),
395  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.displayName"),
396  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.desc"),
397  type.getDisplayName()));
398 
399  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.name"),
400  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.displayName"),
401  NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.desc"),
402  childCount));
403 
404  return sheet;
405  }
406 
407  @Override
408  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
409  return visitor.visit(this);
410  }
411 
412  @Override
413  public boolean isLeafTypeNode() {
414  return true;
415  }
416 
417  @Override
418  public String getItemType() {
419  return getClass().getName() + type.getDisplayName();
420  }
421  }
422 
426  private class ArtifactFactory extends ChildFactory.Detachable<BlackboardArtifact> {
427 
428  private BlackboardArtifact.Type type;
429 
430  public ArtifactFactory(BlackboardArtifact.Type type) {
431  super();
432  this.type = type;
433  }
434 
435  private final PropertyChangeListener pcl = new PropertyChangeListener() {
436  @Override
437  public void propertyChange(PropertyChangeEvent evt) {
438  String eventType = evt.getPropertyName();
439  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
446  try {
454  final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
455  if (null != event && event.getBlackboardArtifactType().equals(type)) {
456  refresh(true);
457  }
458  } catch (NoCurrentCaseException notUsed) {
462  }
463  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
464  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
471  try {
473  refresh(true);
474  } catch (NoCurrentCaseException notUsed) {
478  }
479  }
480  }
481  };
482 
483  @Override
484  protected void addNotify() {
487  }
488 
489  @Override
490  protected void removeNotify() {
493  }
494 
495  @Override
496  protected boolean createKeys(List<BlackboardArtifact> list) {
497  if (skCase != null) {
498  try {
499  List<BlackboardArtifact> arts =
500  Objects.equals(CasePreferences.getGroupItemsInTreeByDataSource(), true) ?
501  blackboard.getArtifacts(type.getTypeID(), datasourceObjId) :
502  skCase.getBlackboardArtifacts(type.getTypeID());
503  list.addAll(arts);
504  } catch (TskException ex) {
505  Logger.getLogger(ArtifactFactory.class.getName()).log(Level.SEVERE, "Couldn't get blackboard artifacts from database", ex); //NON-NLS
506  }
507  }
508  return true;
509  }
510 
511  @Override
512  protected Node createNodeForKey(BlackboardArtifact key) {
513  return new BlackboardArtifactNode(key);
514  }
515  }
516 }
boolean createKeys(List< BlackboardArtifact.Type > list)
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
final ArrayList< BlackboardArtifact.Type > doNotShow
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
ExtractedContent(SleuthkitCase skCase, long objId)
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:437
final HashMap< BlackboardArtifact.Type, TypeNode > typeNodeList
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:482

Copyright © 2012-2018 Basis Technology. Generated on: Fri Mar 22 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.