19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.EnumSet;
27 import java.util.HashMap;
28 import java.util.LinkedHashMap;
29 import java.util.List;
31 import java.util.Observable;
32 import java.util.Observer;
34 import java.util.logging.Level;
35 import org.openide.nodes.ChildFactory;
36 import org.openide.nodes.Children;
37 import org.openide.nodes.Node;
38 import org.openide.nodes.Sheet;
39 import org.openide.util.NbBundle;
40 import org.openide.util.lookup.Lookups;
49 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
60 private static final String
LABEL_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getLabel();
61 private static final String
DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getDisplayName();
75 public static final Map<String, String>
parsePath(String path) {
76 Map<String, String> parsed =
new HashMap<>();
77 String[] split = path.split(MAIL_PATH_SEPARATOR);
78 if (split.length < 4) {
79 parsed.put(MAIL_ACCOUNT, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultAcct.text"));
80 parsed.put(MAIL_FOLDER, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultFolder.text"));
83 parsed.put(MAIL_ACCOUNT, split[2]);
84 parsed.put(MAIL_FOLDER, split[3]);
111 this.filteringDSObjId = objId;
118 return visitor.
visit(
this);
123 private final Map<String, Map<String, List<Long>>>
accounts =
new LinkedHashMap<>();
131 return accounts.keySet();
137 return accounts.get(account).keySet();
143 return accounts.get(account).get(folder);
147 @SuppressWarnings(
"deprecation")
152 if (skCase == null) {
156 int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID();
157 int pathAttrId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID();
158 String query =
"SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id "
159 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
160 +
"attribute_type_id=" + pathAttrId
161 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
162 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
163 if (filteringDSObjId > 0) {
164 query +=
" AND blackboard_artifacts.data_source_obj_id = " +
filteringDSObjId;
167 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
168 ResultSet resultSet = dbQuery.getResultSet();
170 while (resultSet.next()) {
171 final String path = resultSet.getString(
"value_text");
172 final long artifactId = resultSet.getLong(
"artifact_id");
173 final Map<String, String> parsedPath =
parsePath(path);
174 final String account = parsedPath.get(MAIL_ACCOUNT);
175 final String folder = parsedPath.get(MAIL_FOLDER);
177 Map<String, List<Long>> folders = accounts.get(account);
178 if (folders == null) {
179 folders =
new LinkedHashMap<>();
180 accounts.put(account, folders);
182 List<Long> messages = folders.get(folder);
183 if (messages == null) {
184 messages =
new ArrayList<>();
185 folders.put(folder, messages);
187 messages.add(artifactId);
190 }
catch (TskCoreException | SQLException ex) {
191 logger.log(Level.WARNING,
"Cannot initialize email extraction: ", ex);
205 super(Children.create(
new AccountFactory(),
true), Lookups.singleton(DISPLAY_NAME));
206 super.setName(LABEL_NAME);
207 super.setDisplayName(DISPLAY_NAME);
208 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/mail-icon-16.png");
219 return visitor.
visit(
this);
224 Sheet sheet = super.createSheet();
225 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
226 if (sheetSet == null) {
227 sheetSet = Sheet.createPropertiesSet();
231 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
232 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
233 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
241 return getClass().getName();
248 private class AccountFactory extends ChildFactory.Detachable<String> implements Observer {
254 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
256 public void propertyChange(PropertyChangeEvent evt) {
257 String eventType = evt.getPropertyName();
274 if (null != eventData && eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
300 if (evt.getNewValue() == null) {
314 emailResults.addObserver(
this);
322 emailResults.deleteObserver(
this);
337 public void update(Observable o, Object arg) {
350 super(Children.create(
new FolderFactory(accountName),
true), Lookups.singleton(accountName));
351 super.setName(accountName);
353 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/account-icon-16.png");
355 emailResults.addObserver(
this);
359 super.setDisplayName(accountName +
" (" + emailResults.
getFolders(accountName) +
")");
364 Sheet sheet = super.createSheet();
365 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
366 if (sheetSet == null) {
367 sheetSet = Sheet.createPropertiesSet();
371 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
372 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
373 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
386 return visitor.
visit(
this);
390 public void update(Observable o, Object arg) {
396 return getClass().getName();
403 private class FolderFactory extends ChildFactory<String> implements Observer {
410 emailResults.addObserver(
this);
415 list.addAll(emailResults.
getFolders(accountName));
421 return new FolderNode(accountName, folderName);
425 public void update(Observable o, Object arg) {
439 super(Children.create(
new MessageFactory(accountName, folderName),
true), Lookups.singleton(accountName));
440 super.setName(folderName);
441 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/folder-icon-16.png");
445 emailResults.addObserver(
this);
449 super.setDisplayName(folderName +
" (" + emailResults.
getArtifactIds(accountName, folderName).size() +
")");
460 Sheet sheet = super.createSheet();
461 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
462 if (sheetSet == null) {
463 sheetSet = Sheet.createPropertiesSet();
467 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
468 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
469 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
477 return visitor.
visit(
this);
481 public void update(Observable o, Object arg) {
487 return getClass().getName();
500 super(accountName +
"_" + folderName);
503 emailResults.addObserver(
this);
512 public void update(Observable o, Object arg) {
518 List<BlackboardArtifact> keys =
new ArrayList<>();
520 if (skCase != null) {
521 emailResults.
getArtifactIds(accountName, folderName).forEach((
id) -> {
523 keys.add(skCase.getBlackboardArtifact(
id));
524 }
catch (TskCoreException ex) {
525 logger.log(Level.WARNING,
"Error getting mail messages keys", ex);
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)