Autopsy  4.12.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
HashsetHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
32 import java.util.Map;
33 import java.util.Observable;
34 import java.util.Observer;
35 import java.util.Set;
36 import java.util.logging.Level;
37 import org.openide.nodes.ChildFactory;
38 import org.openide.nodes.Children;
39 import org.openide.nodes.Node;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.Lookups;
48 import org.sleuthkit.datamodel.BlackboardArtifact;
49 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
50 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
51 import org.sleuthkit.datamodel.SleuthkitCase;
52 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
53 import org.sleuthkit.datamodel.TskCoreException;
54 
58 public class HashsetHits implements AutopsyVisitableItem {
59 
60  private static final String HASHSET_HITS = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getLabel();
61  private static final String DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName();
62  private static final Logger logger = Logger.getLogger(HashsetHits.class.getName());
65  private SleuthkitCase skCase;
67  private final long filteringDSObjId; // 0 if not filtering/grouping by data source
68 
75  public HashsetHits(SleuthkitCase skCase) {
76  this(skCase, 0);
77  }
78 
86  public HashsetHits(SleuthkitCase skCase, long objId) {
87  this.skCase = skCase;
88  this.filteringDSObjId = objId;
89  hashsetResults = new HashsetResults();
90  }
91 
92  @Override
93  public <T> T accept(AutopsyItemVisitor<T> visitor) {
94  return visitor.visit(this);
95  }
96 
101  private class HashsetResults extends Observable {
102 
103  // maps hashset name to list of artifacts for that set
104  // NOTE: the map can be accessed by multiple worker threads and needs to be synchronized
105  private final Map<String, Set<Long>> hashSetHitsMap = new LinkedHashMap<>();
106 
107  HashsetResults() {
108  update();
109  }
110 
111  List<String> getSetNames() {
112  List<String> names;
113  synchronized (hashSetHitsMap) {
114  names = new ArrayList<>(hashSetHitsMap.keySet());
115  }
116  Collections.sort(names);
117  return names;
118  }
119 
120  Set<Long> getArtifactIds(String hashSetName) {
121  synchronized (hashSetHitsMap) {
122  return hashSetHitsMap.get(hashSetName);
123  }
124  }
125 
126  @SuppressWarnings("deprecation")
127  final void update() {
128  synchronized (hashSetHitsMap) {
129  hashSetHitsMap.clear();
130  }
131 
132  if (skCase == null) {
133  return;
134  }
135 
136  int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
137  int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
138  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
139  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
140  + "attribute_type_id=" + setNameId //NON-NLS
141  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
142  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
143  if (filteringDSObjId > 0) {
144  query += " AND blackboard_artifacts.data_source_obj_id = " + filteringDSObjId;
145  }
146 
147  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
148  ResultSet resultSet = dbQuery.getResultSet();
149  synchronized (hashSetHitsMap) {
150  while (resultSet.next()) {
151  String setName = resultSet.getString("value_text"); //NON-NLS
152  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
153  if (!hashSetHitsMap.containsKey(setName)) {
154  hashSetHitsMap.put(setName, new HashSet<>());
155  }
156  hashSetHitsMap.get(setName).add(artifactId);
157  }
158  }
159  } catch (TskCoreException | SQLException ex) {
160  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
161  }
162 
163  setChanged();
164  notifyObservers();
165  }
166  }
167 
171  public class RootNode extends DisplayableItemNode {
172 
173  public RootNode() {
174  super(Children.create(new HashsetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
175  super.setName(HASHSET_HITS);
176  super.setDisplayName(DISPLAY_NAME);
177  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
178  }
179 
180  @Override
181  public boolean isLeafTypeNode() {
182  return false;
183  }
184 
185  @Override
186  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
187  return visitor.visit(this);
188  }
189 
190  @Override
191  protected Sheet createSheet() {
192  Sheet sheet = super.createSheet();
193  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
194  if (sheetSet == null) {
195  sheetSet = Sheet.createPropertiesSet();
196  sheet.put(sheetSet);
197  }
198 
199  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
200  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
201  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
202  getName()));
203 
204  return sheet;
205  }
206 
207  @Override
208  public String getItemType() {
209  return getClass().getName();
210  }
211  }
212 
216  private class HashsetNameFactory extends ChildFactory.Detachable<String> implements Observer {
217 
218  /*
219  * This should probably be in the HashsetHits class, but the factory has
220  * nice methods for its startup and shutdown, so it seemed like a
221  * cleaner place to register the property change listener.
222  */
223  private final PropertyChangeListener pcl = new PropertyChangeListener() {
224  @Override
225  public void propertyChange(PropertyChangeEvent evt) {
226  String eventType = evt.getPropertyName();
227  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
234  try {
241  ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
242  if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
243  hashsetResults.update();
244  }
245  } catch (NoCurrentCaseException notUsed) {
249  }
250  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
251  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
258  try {
260  hashsetResults.update();
261  } catch (NoCurrentCaseException notUsed) {
265  }
266  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
267  // case was closed. Remove listeners so that we don't get called with a stale case handle
268  if (evt.getNewValue() == null) {
269  removeNotify();
270  skCase = null;
271  }
272  }
273  }
274  };
275 
276  @Override
277  protected void addNotify() {
281  hashsetResults.update();
282  hashsetResults.addObserver(this);
283  }
284 
285  @Override
286  protected void removeNotify() {
290  hashsetResults.deleteObserver(this);
291  }
292 
293  @Override
294  protected boolean createKeys(List<String> list) {
295  list.addAll(hashsetResults.getSetNames());
296  return true;
297  }
298 
299  @Override
300  protected Node createNodeForKey(String key) {
301  return new HashsetNameNode(key);
302  }
303 
304  @Override
305  public void update(Observable o, Object arg) {
306  refresh(true);
307  }
308  }
309 
313  public class HashsetNameNode extends DisplayableItemNode implements Observer {
314 
315  private final String hashSetName;
316 
317  public HashsetNameNode(String hashSetName) {
318  super(Children.create(new HitFactory(hashSetName), true), Lookups.singleton(hashSetName));
319  super.setName(hashSetName);
320  this.hashSetName = hashSetName;
322  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
323  hashsetResults.addObserver(this);
324  }
325 
329  private void updateDisplayName() {
330  super.setDisplayName(hashSetName + " (" + hashsetResults.getArtifactIds(hashSetName).size() + ")");
331  }
332 
333  @Override
334  public boolean isLeafTypeNode() {
335  return true;
336  }
337 
338  @Override
339  protected Sheet createSheet() {
340  Sheet sheet = super.createSheet();
341  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
342  if (sheetSet == null) {
343  sheetSet = Sheet.createPropertiesSet();
344  sheet.put(sheetSet);
345  }
346 
347  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
348  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
349  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
350  getName()));
351 
352  return sheet;
353  }
354 
355  @Override
356  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
357  return visitor.visit(this);
358  }
359 
360  @Override
361  public void update(Observable o, Object arg) {
363  }
364 
365  @Override
366  public String getItemType() {
371  return getClass().getName();
372  }
373  }
374 
378  private class HitFactory extends BaseChildFactory<BlackboardArtifact> implements Observer {
379 
380  private final String hashsetName;
381  private final Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
382 
383  private HitFactory(String hashsetName) {
384  super(hashsetName);
385  this.hashsetName = hashsetName;
386  }
387 
388  @Override
389  protected void onAdd() {
390  hashsetResults.addObserver(this);
391  }
392 
393  @Override
394  protected void onRemove() {
395  hashsetResults.deleteObserver(this);
396  }
397 
398  @Override
399  protected Node createNodeForKey(BlackboardArtifact key) {
400  return new BlackboardArtifactNode(key);
401  }
402 
403  @Override
404  public void update(Observable o, Object arg) {
405  refresh(true);
406  }
407 
408  @Override
409  protected List<BlackboardArtifact> makeKeys() {
410  if (skCase != null) {
411 
412  hashsetResults.getArtifactIds(hashsetName).forEach((id) -> {
413  try {
414  if (!artifactHits.containsKey(id)) {
415  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
416  artifactHits.put(id, art);
417  }
418  } catch (TskCoreException ex) {
419  logger.log(Level.SEVERE, "TSK Exception occurred", ex); //NON-NLS
420  }
421  });
422  return new ArrayList<>(artifactHits.values());
423  }
424  return Collections.emptyList();
425  }
426  }
427 }
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
final Map< Long, BlackboardArtifact > artifactHits
static final Set< IngestManager.IngestModuleEvent > INGEST_MODULE_EVENTS_OF_INTEREST
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static final Set< IngestManager.IngestJobEvent > INGEST_JOB_EVENTS_OF_INTEREST
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:477
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:522
HashsetHits(SleuthkitCase skCase, long objId)

Copyright © 2012-2018 Basis Technology. Generated on: Wed Sep 18 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.