Autopsy  4.10.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases Class Reference

Inherits JPanel, and org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Classes

class  UniquePathKey
 

Public Member Functions

 DataContentViewerOtherCases ()
 
DataContentViewer createInstance ()
 
Component getComponent ()
 
String getTitle ()
 
String getToolTip ()
 
int isPreferred (Node node)
 
boolean isSupported (Node node)
 
void resetComponent ()
 
void setNode (Node node)
 

Private Member Functions

void addOrUpdateNodeData (final Case autopsyCase, Map< UniquePathKey, OtherOccurrenceNodeInstanceData > nodeDataMap, AbstractFile newFile) throws TskCoreException, EamDbException
 
void customizeComponents ()
 
AbstractFile getAbstractFileFromNode (Node node)
 
BlackboardArtifact getBlackboardArtifactFromNode (Node node)
 
List< AbstractFile > getCaseDbMatches (CorrelationAttributeInstance corAttr, Case openCase) throws NoCurrentCaseException, TskCoreException, EamDbException
 
Map< UniquePathKey, OtherOccurrenceNodeInstanceData > getCorrelatedInstances (CorrelationAttributeInstance corAttr, String dataSourceName, String deviceId)
 
Collection< CorrelationAttributeInstancegetCorrelationAttributesFromNode (Node node)
 
void initComponents ()
 
String makeDataSourceString (String caseUUID, String deviceId, String dataSourceName)
 
void populateTable (Node node)
 
void reset ()
 
void rightClickPopupMenuPopupMenuWillBecomeVisible (javax.swing.event.PopupMenuEvent evt)
 
void saveToCSV () throws NoCurrentCaseException
 
void setColumnWidths ()
 
void setEarliestCaseDate ()
 
void showCaseDetails (int selectedRowViewIdx)
 
void showCommonalityDetails ()
 
void updateOnCaseSelection ()
 
void updateOnDataSourceSelection ()
 
void writeSelectedRowsToFileAsCSV (File destFile)
 

Private Attributes

javax.swing.JScrollPane caseScrollPane
 
javax.swing.JTable casesTable
 
final OtherOccurrencesCasesTableModel casesTableModel
 
final Collection< CorrelationAttributeInstancecorrelationAttributes
 
javax.swing.JFileChooser CSVFileChooser
 
String dataSourceName = ""
 
javax.swing.JScrollPane dataSourceScrollPane
 
javax.swing.JTable dataSourcesTable
 
String deviceId = ""
 
javax.swing.JLabel earliestCaseDate
 
javax.swing.JLabel earliestCaseLabel
 
javax.swing.JMenuItem exportToCSVMenuItem
 
AbstractFile file
 
javax.swing.JTable filesTable
 
javax.swing.JLabel foundInLabel
 
javax.swing.JSplitPane jSplitPane2
 
javax.swing.JSplitPane jSplitPane3
 
javax.swing.JPanel otherCasesPanel
 
javax.swing.JScrollPane propertiesTableScrollPane
 
javax.swing.JPopupMenu rightClickPopupMenu
 
javax.swing.JMenuItem selectAllMenuItem
 
javax.swing.JMenuItem showCaseDetailsMenuItem
 
javax.swing.JMenuItem showCommonalityMenuItem
 
javax.swing.JPanel tableContainerPanel
 
final OtherOccurrencesFilesTableModel tableModel
 

Static Private Attributes

static final int DEFAULT_MIN_CELL_WIDTH = 15
 
static final Logger LOGGER = Logger.getLogger(DataContentViewerOtherCases.class.getName())
 
static final CorrelationCaseWrapper NO_ARTIFACTS_CASE = new CorrelationCaseWrapper(Bundle.DataContentViewerOtherCases_table_noArtifacts())
 
static final CorrelationCaseWrapper NO_RESULTS_CASE = new CorrelationCaseWrapper(Bundle.DataContentViewerOtherCases_table_noArtifacts())
 
static final long serialVersionUID = -1L
 

Detailed Description

View correlation results from other cases

Definition at line 90 of file DataContentViewerOtherCases.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.DataContentViewerOtherCases ( )

Creates new form DataContentViewerOtherCases

Definition at line 112 of file DataContentViewerOtherCases.java.

Member Function Documentation

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.addOrUpdateNodeData ( final Case  autopsyCase,
Map< UniquePathKey, OtherOccurrenceNodeInstanceData >  nodeDataMap,
AbstractFile  newFile 
) throws TskCoreException, EamDbException
private

Adds the file to the nodeDataMap map if it does not already exist

Parameters
autopsyCase
nodeDataMap
newFile
Exceptions
TskCoreException
EamDbException

Definition at line 650 of file DataContentViewerOtherCases.java.

DataContentViewer org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.createInstance ( )

Create and return a new instance of your viewer. The reason that this is needed is because the specific viewer modules will be found via NetBeans Lookup and the type will only be DataContentViewer. This method is used to get an instance of your specific type.

Returns
A new instance of the viewer

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 350 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.customizeComponents ( )
private
AbstractFile org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getAbstractFileFromNode ( Node  node)
private

Get the associated AbstractFile from a node, if it exists.

Parameters
nodeThe node
Returns
The associated AbstractFile, or null

Definition at line 400 of file DataContentViewerOtherCases.java.

BlackboardArtifact org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getBlackboardArtifactFromNode ( Node  node)
private

Get the associated BlackboardArtifact from a node, if it exists.

Parameters
nodeThe node
Returns
The associated BlackboardArtifact, or null

Definition at line 377 of file DataContentViewerOtherCases.java.

List<AbstractFile> org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCaseDbMatches ( CorrelationAttributeInstance  corAttr,
Case  openCase 
) throws NoCurrentCaseException, TskCoreException, EamDbException
private

Get all other abstract files in the current case with the same MD5 as the selected node.

Parameters
corAttrThe CorrelationAttribute containing the MD5 to search for
openCaseThe current case
Returns
List of matching AbstractFile objects
Exceptions
NoCurrentCaseException
TskCoreException
EamDbException

Definition at line 624 of file DataContentViewerOtherCases.java.

Component org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getComponent ( )

Return the Swing Component to display. Implementations of this method that extend JPanel and do a 'return this;'. Otherwise return an internal instance of the JPanel.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 355 of file DataContentViewerOtherCases.java.

Map<UniquePathKey, OtherOccurrenceNodeInstanceData> org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelatedInstances ( CorrelationAttributeInstance  corAttr,
String  dataSourceName,
String  deviceId 
)
private

Query the central repo database (if enabled) and the case database to find all artifact instances correlated to the given central repository artifact. If the central repo is not enabled, this will only return files from the current case with matching MD5 hashes.

Parameters
corAttrCorrelationAttribute to query for
dataSourceNameData source to filter results
deviceIdDevice Id to filter results
Returns
A collection of correlated artifact instances

Definition at line 556 of file DataContentViewerOtherCases.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.getCorrelationType(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.getCorrelationValue(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type.getDisplayName(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance(), org.sleuthkit.autopsy.casemodule.Case.getName(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isEnabled().

Collection<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode ( Node  node)
private
String org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getTitle ( )

Returns the title of this viewer to display in the tab.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 340 of file DataContentViewerOtherCases.java.

String org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getToolTip ( )

Returns a short description of this viewer to use as a tool tip for its tab.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 345 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.initComponents ( )
private

This method is called from within the constructor to initialize the form. WARNING: Do NOT modify this code. The content of this method is always regenerated by the Form Editor.

Definition at line 890 of file DataContentViewerOtherCases.java.

int org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.isPreferred ( Node  node)

Checks whether the given viewer is preferred for the Node. This is a bit subjective, but the idea is that Autopsy wants to display the most relevant tab. The more generic the viewer, the lower the return value should be. This will only be called on viewers that support the given node (i.e., isSupported() has already returned true).

The following are some examples of the current levels in use. If the selected node is an artifact, the level may be determined by both the artifact and its associated file.

Level 7 - Based on the artifact, if any, in the selected node and specific to an artifact type or types. Current content viewers that can return level 7 are the Messages tab (only supported for email and SMS) and the Indexed Text tab when the selected node is a Keyword Search hit.

Level 6 - Based on the artifact, if any, in the selected node but not restricted to particular types. The current content viewer that can return level 6 is the Results tab. It returns this level for most artifact types, unless the associated file is assumed to be of greater interest (for example, a Hash Set Hit will not be level 6 because the file itself is of greater interest).

Level 5 - Based on the file in the selected node and very specific to the file type. The current content viewer that will return level 5 is the Application tab, which supports media files (such as images) and certain types of databases.

Level 4 - Based on the file in the selected node but fairly general. Currently this is the level returned by the Indexed Text tab if Keyword Search has been run (unless the node is a Keyword Search hit or a Credit Card account). This is the default tab for most files.

Level 3 - Based on the artifact, if any, in the selected node where the artifact is thought to be of less interest than the associated file. This level is returned by the Results tab for artifacts like Hash Set Hits.

Level 1 - Very general and should always be available. The Hex, Strings, and Metadata tabs are all this level

Level 0 - For cases where the content viewer should never be displayed by default.

Parameters
nodeNode to check for preference
Returns
an int (0-10) higher return means the viewer has higher priority

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 365 of file DataContentViewerOtherCases.java.

boolean org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.isSupported ( Node  node)

Checks whether the given node is supported by the viewer. This will be used to enable or disable the tab for the viewer.

Parameters
nodeNode to check for support
Returns
True if the node can be displayed / processed, else false

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 684 of file DataContentViewerOtherCases.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isEnabled().

String org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.makeDataSourceString ( String  caseUUID,
String  deviceId,
String  dataSourceName 
)
private

Create a unique string to be used as a key for deduping data sources as best as possible

Definition at line 785 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.populateTable ( Node  node)
private
void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.reset ( )
private

Reset the UI and clear cached data.

Definition at line 329 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.resetComponent ( )

Resets the contents of the viewer / component.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 360 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.rightClickPopupMenuPopupMenuWillBecomeVisible ( javax.swing.event.PopupMenuEvent  evt)
private
void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.saveToCSV ( ) throws NoCurrentCaseException
private
void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setColumnWidths ( )
private
void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setEarliestCaseDate ( )
private

Gets the list of Eam Cases and determines the earliest case creation date. Sets the label to display the earliest date string to the user.

Definition at line 515 of file DataContentViewerOtherCases.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCases(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isEnabled().

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setNode ( Node  selectedNode)

Autopsy will call this when this panel is focused with the file that should be analyzed. When called with null, must clear all references to previous nodes.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.

Definition at line 701 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCaseDetails ( int  selectedRowViewIdx)
private
void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCommonalityDetails ( )
private

Show how common the selected correlationAttributes are with details dialog.

Definition at line 180 of file DataContentViewerOtherCases.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getFrequencyPercentage(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance().

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.updateOnCaseSelection ( )
private

Updates diplayed information to be correct for the current case selection

Definition at line 792 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.updateOnDataSourceSelection ( )
private

Updates diplayed information to be correct for the current data source selection

Definition at line 828 of file DataContentViewerOtherCases.java.

void org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.writeSelectedRowsToFileAsCSV ( File  destFile)
private

Member Data Documentation

javax.swing.JScrollPane org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.caseScrollPane
private

Definition at line 1068 of file DataContentViewerOtherCases.java.

javax.swing.JTable org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.casesTable
private

Definition at line 1069 of file DataContentViewerOtherCases.java.

final OtherOccurrencesCasesTableModel org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.casesTableModel
private

Definition at line 100 of file DataContentViewerOtherCases.java.

final Collection<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.correlationAttributes
private

Definition at line 101 of file DataContentViewerOtherCases.java.

javax.swing.JFileChooser org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.CSVFileChooser
private

Definition at line 1067 of file DataContentViewerOtherCases.java.

String org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.dataSourceName = ""
private

Definition at line 102 of file DataContentViewerOtherCases.java.

javax.swing.JScrollPane org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.dataSourceScrollPane
private

Definition at line 1070 of file DataContentViewerOtherCases.java.

javax.swing.JTable org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.dataSourcesTable
private

Definition at line 1071 of file DataContentViewerOtherCases.java.

final int org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.DEFAULT_MIN_CELL_WIDTH = 15
staticprivate

Definition at line 97 of file DataContentViewerOtherCases.java.

String org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.deviceId = ""
private

Definition at line 103 of file DataContentViewerOtherCases.java.

javax.swing.JLabel org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.earliestCaseDate
private

Definition at line 1072 of file DataContentViewerOtherCases.java.

javax.swing.JLabel org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.earliestCaseLabel
private

Definition at line 1073 of file DataContentViewerOtherCases.java.

javax.swing.JMenuItem org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.exportToCSVMenuItem
private

Definition at line 1074 of file DataContentViewerOtherCases.java.

AbstractFile org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.file
private

Could be null.

Definition at line 107 of file DataContentViewerOtherCases.java.

javax.swing.JTable org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.filesTable
private

Definition at line 1075 of file DataContentViewerOtherCases.java.

javax.swing.JLabel org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.foundInLabel
private

Definition at line 1076 of file DataContentViewerOtherCases.java.

javax.swing.JSplitPane org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.jSplitPane2
private

Definition at line 1077 of file DataContentViewerOtherCases.java.

javax.swing.JSplitPane org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.jSplitPane3
private

Definition at line 1078 of file DataContentViewerOtherCases.java.

final Logger org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.LOGGER = Logger.getLogger(DataContentViewerOtherCases.class.getName())
staticprivate

Definition at line 94 of file DataContentViewerOtherCases.java.

final CorrelationCaseWrapper org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.NO_ARTIFACTS_CASE = new CorrelationCaseWrapper(Bundle.DataContentViewerOtherCases_table_noArtifacts())
staticprivate

Definition at line 95 of file DataContentViewerOtherCases.java.

final CorrelationCaseWrapper org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.NO_RESULTS_CASE = new CorrelationCaseWrapper(Bundle.DataContentViewerOtherCases_table_noArtifacts())
staticprivate

Definition at line 96 of file DataContentViewerOtherCases.java.

javax.swing.JPanel org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.otherCasesPanel
private

Definition at line 1079 of file DataContentViewerOtherCases.java.

javax.swing.JScrollPane org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.propertiesTableScrollPane
private

Definition at line 1080 of file DataContentViewerOtherCases.java.

javax.swing.JPopupMenu org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.rightClickPopupMenu
private

Definition at line 1081 of file DataContentViewerOtherCases.java.

javax.swing.JMenuItem org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.selectAllMenuItem
private

Definition at line 1082 of file DataContentViewerOtherCases.java.

final long org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.serialVersionUID = -1L
staticprivate

Definition at line 92 of file DataContentViewerOtherCases.java.

javax.swing.JMenuItem org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCaseDetailsMenuItem
private

Definition at line 1083 of file DataContentViewerOtherCases.java.

javax.swing.JMenuItem org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCommonalityMenuItem
private

Definition at line 1084 of file DataContentViewerOtherCases.java.

javax.swing.JPanel org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.tableContainerPanel
private

Definition at line 1085 of file DataContentViewerOtherCases.java.

final OtherOccurrencesFilesTableModel org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.tableModel
private

Definition at line 99 of file DataContentViewerOtherCases.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2018 Basis Technology. Generated on: Fri Mar 22 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.