Autopsy  4.12.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
DataResultFilterNode.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.directorytree;
20 
21 import java.awt.event.ActionEvent;
22 import java.beans.PropertyVetoException;
23 import java.text.MessageFormat;
24 import java.util.ArrayList;
25 import java.util.Collection;
26 import java.util.HashSet;
27 import java.util.List;
28 import java.util.logging.Level;
29 import javax.swing.AbstractAction;
30 import javax.swing.Action;
31 import org.openide.explorer.ExplorerManager;
32 import org.openide.nodes.AbstractNode;
33 import org.openide.nodes.FilterNode;
34 import org.openide.nodes.Node;
35 import org.openide.nodes.Sheet;
36 import org.openide.util.NbBundle;
37 import org.openide.util.Utilities;
69 import org.sleuthkit.datamodel.AbstractFile;
70 import org.sleuthkit.datamodel.BlackboardArtifact;
71 import org.sleuthkit.datamodel.BlackboardAttribute;
72 import org.sleuthkit.datamodel.Content;
73 import org.sleuthkit.datamodel.DerivedFile;
74 import org.sleuthkit.datamodel.Directory;
75 import org.sleuthkit.datamodel.File;
76 import org.sleuthkit.datamodel.LayoutFile;
77 import org.sleuthkit.datamodel.LocalFile;
78 import org.sleuthkit.datamodel.LocalDirectory;
79 import org.sleuthkit.datamodel.SlackFile;
80 import org.sleuthkit.datamodel.TskException;
81 import org.sleuthkit.datamodel.VirtualDirectory;
82 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
83 import org.sleuthkit.datamodel.Report;
84 import org.sleuthkit.datamodel.TskCoreException;
85 
91 public class DataResultFilterNode extends FilterNode {
92 
93  private static final Logger LOGGER = Logger.getLogger(DataResultFilterNode.class.getName());
94 
97 
98  // Assumptions are made in GetPreferredActionsDisplayableItemNodeVisitor that
99  // sourceEm is the directory tree explorer manager.
100  private final ExplorerManager sourceEm;
101 
109  public DataResultFilterNode(Node node) {
110  this(node, null);
111  }
112 
122  public DataResultFilterNode(Node node, ExplorerManager em) {
123  super(node, new DataResultFilterChildren(node, em));
124  this.sourceEm = em;
125  }
126 
135  @Override
136  public Action[] getActions(boolean popup) {
137 
138  List<Action> actions = new ArrayList<>();
139 
140  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
141  List<Action> accept = originalNode.accept(getActionsDIV);
142  if (accept != null) {
143  actions.addAll(accept);
144  }
145 
146  //actions.add(new IndexContentFilesAction(nodeContent, "Index"));
147  return actions.toArray(new Action[actions.size()]);
148  }
149 
156  @Override
157  public Action getPreferredAction() {
158  final Node original = this.getOriginal();
159  // Once had a org.openide.nodes.ChildFactory$WaitFilterNode passed in
160  if ((original instanceof DisplayableItemNode) == false) {
161  return null;
162  }
163 
164  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
165  return originalNode.accept(getPreferredActionsDIV);
166  }
167 
168  @Override
169  public Node.PropertySet[] getPropertySets() {
170  Node.PropertySet[] propertySets = super.getPropertySets();
171 
172  for (int i = 0; i < propertySets.length; i++) {
173  Node.PropertySet ps = propertySets[i];
174 
175  if (ps.getName().equals(Sheet.PROPERTIES)) {
176  Sheet.Set newPs = new Sheet.Set();
177  newPs.setName(ps.getName());
178  newPs.setDisplayName(ps.getDisplayName());
179  newPs.setShortDescription(ps.getShortDescription());
180 
181  newPs.put(ps.getProperties());
182  newPs.remove(AbstractFsContentNode.HIDE_PARENT);
183  propertySets[i] = newPs;
184  }
185  }
186 
187  return propertySets;
188  }
189 
201  @Override
202  public String getDisplayName() {
203  final Node orig = getOriginal();
204  String name = orig.getDisplayName();
205  if ((orig instanceof BlackboardArtifactNode)) {
206  name = ((BlackboardArtifactNode) orig).getSourceName();
207  }
208  return name;
209  }
210 
217  public void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo) {
218  if (getOriginal() instanceof DisplayableItemNode) {
219  ((DisplayableItemNode) getOriginal()).setChildNodeSelectionInfo(selectedChildNodeInfo);
220  }
221  }
222 
231  if (getOriginal() instanceof DisplayableItemNode) {
232  return ((DisplayableItemNode) getOriginal()).getChildNodeSelectionInfo();
233  } else {
234  return null;
235  }
236  }
237 
243  private static class DataResultFilterChildren extends FilterNode.Children {
244 
245  private final ExplorerManager sourceEm;
246  private final boolean filterArtifacts; // display message artifacts in the DataSource subtree
247 
251  private DataResultFilterChildren(Node arg, ExplorerManager sourceEm) {
252  super(arg);
253 
254  filterArtifacts = SelectionContext.getSelectionContext(arg).equals(SelectionContext.DATA_SOURCES);
255 
256  this.sourceEm = sourceEm;
257  }
258 
259  @Override
260  protected Node[] createNodes(Node key) {
261  // filter out all non-message artifacts, if displaying the results from the Data Source tree
262  BlackboardArtifact art = key.getLookup().lookup(BlackboardArtifact.class);
263  if (art != null
264  && filterArtifacts
265  && art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()
266  && art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()) {
267  return new Node[]{};
268  }
269 
270  return new Node[]{new DataResultFilterNode(key, sourceEm)};
271  }
272  }
273 
274  @NbBundle.Messages("DataResultFilterNode.viewSourceArtifact.text=View Source Result")
279  private static class GetPopupActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<List<Action>> {
280 
281  @Override
282  public List<Action> visit(BlackboardArtifactNode ban) {
283  //set up actions for artifact node based on its Content object
284  //TODO all actions need to be consolidated in single place!
285  //they should be set in individual Node subclass and using a utility to get Actions per Content sub-type
286  // TODO UPDATE: There is now a DataModelActionsFactory utility;
287 
288  List<Action> actionsList = new ArrayList<>();
289 
290  //merge predefined specific node actions if bban subclasses have their own
291  for (Action a : ban.getActions(true)) {
292  actionsList.add(a);
293  }
294  BlackboardArtifact ba = ban.getLookup().lookup(BlackboardArtifact.class);
295  final int artifactTypeID = ba.getArtifactTypeID();
296 
297  if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
298  || artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
299  if (ban.getLookup().lookup(AbstractFile.class) != null) {
300  // We only want the "View File in Directory" actions if we have a file...it is
301  // possible that we have a keyword hit on a Report.
302  actionsList.add(new ViewContextAction(
303  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), ban));
304  }
305  } else if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
306  //action to go to the source artifact
307  actionsList.add(new ViewSourceArtifactAction(DataResultFilterNode_viewSourceArtifact_text(), ba));
308  // action to go to the source file of the artifact
309  actionsList.add(new ViewContextAction(
310  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
311  } else {
312  // if the artifact links to another file, add an action to go to
313  // that file
314  Content c = findLinked(ban);
315  if (c != null) {
316  actionsList.add(new ViewContextAction(
317  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), c));
318  }
319  // action to go to the source file of the artifact
320  // action to go to the source file of the artifact
321  Content fileContent = ban.getLookup().lookup(AbstractFile.class);
322  if (fileContent == null) {
323  Content content = ban.getLookup().lookup(Content.class);
324  actionsList.add(new ViewContextAction("View Source Content in Directory", content));
325  } else {
326  actionsList.add(new ViewContextAction(
327  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
328  }
329  }
330  Content c = ban.getLookup().lookup(File.class);
331  Node n = null;
332  if (c != null) {
333  n = new FileNode((AbstractFile) c);
334  } else if ((c = ban.getLookup().lookup(Directory.class)) != null) {
335  n = new DirectoryNode((Directory) c);
336  } else if ((c = ban.getLookup().lookup(VirtualDirectory.class)) != null) {
337  n = new VirtualDirectoryNode((VirtualDirectory) c);
338  } else if ((c = ban.getLookup().lookup(LocalDirectory.class)) != null) {
339  n = new LocalDirectoryNode((LocalDirectory) c);
340  } else if ((c = ban.getLookup().lookup(LayoutFile.class)) != null) {
341  n = new LayoutFileNode((LayoutFile) c);
342  } else if ((c = ban.getLookup().lookup(LocalFile.class)) != null
343  || (c = ban.getLookup().lookup(DerivedFile.class)) != null) {
344  n = new LocalFileNode((AbstractFile) c);
345  if (FileTypeExtensions.getArchiveExtensions().contains("." + ((AbstractFile) c).getNameExtension().toLowerCase())) {
346  try {
347  if (c.getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED).size() > 0) {
348  actionsList.add(new ExtractArchiveWithPasswordAction((AbstractFile) c));
349  }
350  } catch (TskCoreException ex) {
351  LOGGER.log(Level.WARNING, "Unable to add unzip with password action to context menus", ex);
352  }
353  }
354  } else if ((c = ban.getLookup().lookup(SlackFile.class)) != null) {
355  n = new SlackFileNode((SlackFile) c);
356  } else if ((c = ban.getLookup().lookup(Report.class)) != null) {
357  actionsList.addAll(DataModelActionsFactory.getActions(c, false));
358  }
359  if (n != null) {
360  final Collection<AbstractFile> selectedFilesList
361  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(AbstractFile.class));
362  actionsList.add(null); // creates a menu separator
363  actionsList.add(new NewWindowViewAction(
364  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInNewWin.text"), n));
365  if (selectedFilesList.size() == 1) {
366  actionsList.add(new ExternalViewerAction(
367  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.openInExtViewer.text"), n));
368  } else {
369  actionsList.add(ExternalViewerShortcutAction.getInstance());
370  }
371  actionsList.add(null); // creates a menu separator
372  actionsList.add(ExtractAction.getInstance());
373  actionsList.add(ExportCSVAction.getInstance());
374  actionsList.add(null); // creates a menu separator
375  actionsList.add(AddContentTagAction.getInstance());
376  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
377 
378  if (selectedFilesList.size() == 1) {
379  actionsList.add(DeleteFileContentTagAction.getInstance());
380  }
381  } else {
382  // There's no specific file associated with the artifact, but
383  // we can still tag the artifact itself
384  actionsList.add(null);
385  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
386  }
387 
388  final Collection<BlackboardArtifact> selectedArtifactsList
389  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class));
390  if (selectedArtifactsList.size() == 1) {
392  }
393 
394  if (n != null) {
395  actionsList.addAll(ContextMenuExtensionPoint.getActions());
396  }
397 
398  return actionsList;
399  }
400 
401  @Override
402  public List<Action> visit(Reports.ReportsListNode ditem) {
403  // The base class Action is "Collapse All", inappropriate.
404  return null;
405  }
406 
407  @Override
408  public List<Action> visit(FileTypesNode fileTypes) {
409  return defaultVisit(fileTypes);
410  }
411 
412  @Override
413  protected List<Action> defaultVisit(DisplayableItemNode ditem) {
414  //preserve the default node's actions
415  List<Action> actions = new ArrayList<>();
416 
417  for (Action action : ditem.getActions(true)) {
418  actions.add(action);
419  }
420 
421  return actions;
422  }
423 
424  private Content findLinked(BlackboardArtifactNode ba) {
425  BlackboardArtifact art = ba.getLookup().lookup(BlackboardArtifact.class);
426  Content c = null;
427  try {
428  for (BlackboardAttribute attr : art.getAttributes()) {
429  if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) {
430  switch (attr.getAttributeType().getValueType()) {
431  case INTEGER:
432  int i = attr.getValueInt();
433  if (i != -1) {
434  c = art.getSleuthkitCase().getContentById(i);
435  }
436  break;
437  case LONG:
438  long l = attr.getValueLong();
439  if (l != -1) {
440  c = art.getSleuthkitCase().getContentById(l);
441  }
442  break;
443  }
444  }
445  }
446  } catch (TskException ex) {
447  Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error getting linked file", ex); //NON-NLS
448  }
449  return c;
450  }
451 
452  }
453 
454  /*
455  * Action for double-click / preferred action on nodes.
456  */
457  private class GetPreferredActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<AbstractAction> {
458 
459  @Override
460  public AbstractAction visit(InstanceCountNode icn) {
461  return null;
462  }
463 
464  @Override
465  public AbstractAction visit(InstanceCaseNode icn) {
466  return null;
467  }
468 
469  @Override
470  public AbstractAction visit(InstanceDataSourceNode icn) {
471  return null;
472  }
473 
474  @Override
475  public AbstractAction visit(CommonAttributeValueNode md5n) {
476  return null;
477  }
478 
479  @Override
480  public AbstractAction visit(CaseDBCommonAttributeInstanceNode fin) {
481  return null;
482  }
483 
484  @Override
485  public AbstractAction visit(CentralRepoCommonAttributeInstanceNode iccan) {
486  return null;
487  }
488 
489  @Override
490  public AbstractAction visit(BlackboardArtifactNode ban) {
491 
492  Action preferredAction = ban.getPreferredAction();
493  if(preferredAction instanceof AbstractAction) {
494  return (AbstractAction) preferredAction;
495  }
496 
497  BlackboardArtifact artifact = ban.getArtifact();
498  try {
499  if ((artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID())
500  || (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_MESSAGE.getTypeID())) {
501  if (artifact.hasChildren()) {
502  return openChild(ban);
503  }
504  }
505  } catch (TskCoreException ex) {
506  LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting children from blackboard artifact{0}.", artifact.getArtifactID()), ex); //NON-NLS
507  }
508  return new ViewContextAction(
509  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInDir.text"), ban);
510  }
511 
512  @Override
513  public AbstractAction visit(DirectoryNode dn) {
514  if (dn.getDisplayName().equals(DirectoryNode.DOTDOTDIR)) {
515  return openParent(dn);
516  } else if (dn.getDisplayName().equals(DirectoryNode.DOTDIR) == false) {
517  return openChild(dn);
518  } else {
519  return null;
520  }
521  }
522 
523  @Override
524  public AbstractAction visit(FileNode fn) {
525  if (fn.hasContentChildren()) {
526  return openChild(fn);
527  } else {
528  return null;
529  }
530  }
531 
532  @Override
533  public AbstractAction visit(LocalFileNode dfn) {
534  if (dfn.hasContentChildren()) {
535  return openChild(dfn);
536  } else {
537  return null;
538  }
539  }
540 
541  @Override
542  public AbstractAction visit(Reports.ReportNode reportNode) {
543  return reportNode.getPreferredAction();
544  }
545 
546  @Override
547  protected AbstractAction defaultVisit(DisplayableItemNode c) {
548  return openChild(c);
549  }
550 
551  @Override
552  public AbstractAction visit(FileTypesNode fileTypes) {
553  return openChild(fileTypes);
554  }
555 
564  private AbstractAction openChild(final AbstractNode dataModelNode) {
565  // get the current selection from the directory tree explorer manager,
566  // which is a DirectoryTreeFilterNode. One of that node's children
567  // is a DirectoryTreeFilterNode that wraps the dataModelNode. We need
568  // to set that wrapped node as the selection and root context of the
569  // directory tree explorer manager (sourceEm)
570  if(sourceEm == null) {
571  return null;
572  }
573  final Node currentSelectionInDirectoryTree = sourceEm.getSelectedNodes()[0];
574 
575  return new AbstractAction() {
576  @Override
577  public void actionPerformed(ActionEvent e) {
578  if (currentSelectionInDirectoryTree != null) {
579  // Find the filter version of the passed in dataModelNode.
580  final org.openide.nodes.Children children = currentSelectionInDirectoryTree.getChildren();
581  // This call could break if the DirectoryTree is re-implemented with lazy ChildFactory objects.
582  Node newSelection = children.findChild(dataModelNode.getName());
583 
584  /*
585  * We got null here when we were viewing a ZIP file in
586  * the Views -> Archives area and double clicking on it
587  * got to this code. It tried to find the child in the
588  * tree and didn't find it. An exception was then thrown
589  * from setting the selected node to be null.
590  */
591  if (newSelection != null) {
592  try {
593  sourceEm.setExploredContextAndSelection(newSelection, new Node[]{newSelection});
594  } catch (PropertyVetoException ex) {
595  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
596  logger.log(Level.WARNING, "Error: can't open the selected directory.", ex); //NON-NLS
597  }
598  }
599  }
600  }
601  };
602  }
603 
612  private AbstractAction openParent(AbstractNode node) {
613  if(sourceEm == null) {
614  return null;
615  }
616  // @@@ Why do we ignore node?
617  Node[] selectedFilterNodes = sourceEm.getSelectedNodes();
618  Node selectedFilterNode = selectedFilterNodes[0];
619  final Node parentNode = selectedFilterNode.getParentNode();
620 
621  return new AbstractAction() {
622  @Override
623  public void actionPerformed(ActionEvent e) {
624  try {
625  sourceEm.setSelectedNodes(new Node[]{parentNode});
626  } catch (PropertyVetoException ex) {
627  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
628  logger.log(Level.WARNING, "Error: can't open the parent directory.", ex); //NON-NLS
629  }
630  }
631  };
632  }
633  }
634 }
abstract< T > T accept(DisplayableItemNodeVisitor< T > visitor)
static List< Action > getActions(File file, boolean isArtifactSource)
static final DisplayableItemNodeVisitor< List< Action > > getActionsDIV
static synchronized AddBlackboardArtifactTagAction getInstance()
static synchronized DeleteFileBlackboardArtifactTagAction getInstance()
static synchronized ExportCSVAction getInstance()
static synchronized ExtractAction getInstance()
void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo)
static synchronized DeleteFileContentTagAction getInstance()
final DisplayableItemNodeVisitor< AbstractAction > getPreferredActionsDIV
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static synchronized AddContentTagAction getInstance()

Copyright © 2012-2018 Basis Technology. Generated on: Wed Sep 18 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.