Autopsy
4.12.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Inherited by org.sleuthkit.autopsy.centralrepository.datamodel.AbstractSqlEamDb.
Public Member Functions | |
void | addArtifactInstance (CorrelationAttributeInstance eamArtifact) throws EamDbException |
void | addAttributeInstanceBulk (CorrelationAttributeInstance eamArtifact) throws EamDbException |
void | addDataSourceObjectId (int rowId, long dataSourceObjectId) throws EamDbException |
void | addReferenceInstance (EamGlobalFileInstance eamGlobalFileInstance, CorrelationAttributeInstance.Type correlationType) throws EamDbException |
void | bulkInsertCases (List< CorrelationCase > cases) throws EamDbException |
void | bulkInsertReferenceTypeEntries (Set< EamGlobalFileInstance > globalInstances, CorrelationAttributeInstance.Type contentType) throws EamDbException |
void | commitAttributeInstancesBulk () throws EamDbException |
void | deleteOrganization (EamOrganization organizationToDelete) throws EamDbException |
void | deleteReferenceSet (int referenceSetID) throws EamDbException |
List< EamGlobalSet > | getAllReferenceSets (CorrelationAttributeInstance.Type correlationType) throws EamDbException |
List< CorrelationAttributeInstance > | getArtifactInstancesByTypeValue (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException |
List< CorrelationAttributeInstance > | getArtifactInstancesByTypeValues (CorrelationAttributeInstance.Type aType, List< String > values) throws EamDbException, CorrelationAttributeNormalizationException |
List< CorrelationAttributeInstance > | getArtifactInstancesByTypeValuesAndCases (CorrelationAttributeInstance.Type aType, List< String > values, List< Integer > caseIds) throws EamDbException, CorrelationAttributeNormalizationException |
CorrelationCase | getCase (Case autopsyCase) throws EamDbException |
CorrelationCase | getCaseById (int caseId) throws EamDbException |
CorrelationCase | getCaseByUUID (String caseUUID) throws EamDbException |
List< CorrelationCase > | getCases () throws EamDbException |
CorrelationAttributeInstance | getCorrelationAttributeInstance (CorrelationAttributeInstance.Type type, CorrelationCase correlationCase, CorrelationDataSource correlationDataSource, String value, String filePath) throws EamDbException, CorrelationAttributeNormalizationException |
CorrelationAttributeInstance | getCorrelationAttributeInstance (CorrelationAttributeInstance.Type type, CorrelationCase correlationCase, CorrelationDataSource correlationDataSource, long objectID) throws EamDbException, CorrelationAttributeNormalizationException |
CorrelationAttributeInstance.Type | getCorrelationTypeById (int typeId) throws EamDbException |
Long | getCountArtifactInstancesByCaseDataSource (CorrelationDataSource correlationDataSource) throws EamDbException |
Long | getCountArtifactInstancesByTypeValue (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException |
Long | getCountArtifactInstancesKnownBad (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException |
Long | getCountUniqueCaseDataSourceTuplesHavingTypeValue (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException |
Long | getCountUniqueDataSources () throws EamDbException |
CorrelationDataSource | getDataSource (CorrelationCase correlationCase, Long caseDbDataSourceId) throws EamDbException |
CorrelationDataSource | getDataSourceById (CorrelationCase correlationCase, int dataSourceId) throws EamDbException |
List< CorrelationDataSource > | getDataSources () throws EamDbException |
String | getDbInfo (String name) throws EamDbException |
List< CorrelationAttributeInstance.Type > | getDefinedCorrelationTypes () throws EamDbException |
List< CorrelationAttributeInstance.Type > | getEnabledCorrelationTypes () throws EamDbException |
CoordinationService.Lock | getExclusiveMultiUserDbLock () throws EamDbException |
int | getFrequencyPercentage (CorrelationAttributeInstance corAttr) throws EamDbException, CorrelationAttributeNormalizationException |
List< String > | getListCasesHavingArtifactInstancesKnownBad (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException |
EamOrganization | getOrganizationByID (int orgID) throws EamDbException |
List< EamOrganization > | getOrganizations () throws EamDbException |
List< EamGlobalFileInstance > | getReferenceInstancesByTypeValue (CorrelationAttributeInstance.Type aType, String aValue) throws EamDbException, CorrelationAttributeNormalizationException |
EamGlobalSet | getReferenceSetByID (int globalSetID) throws EamDbException |
EamOrganization | getReferenceSetOrganization (int referenceSetID) throws EamDbException |
List< CorrelationAttributeInstance.Type > | getSupportedCorrelationTypes () throws EamDbException |
boolean | isArtifactKnownBadByReference (CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException |
boolean | isFileHashInReferenceSet (String hash, int referenceSetID) throws EamDbException, CorrelationAttributeNormalizationException |
boolean | isValueInReferenceSet (String value, int referenceSetID, int correlationTypeID) throws EamDbException, CorrelationAttributeNormalizationException |
CorrelationCase | newCase (CorrelationCase eamCase) throws EamDbException |
CorrelationCase | newCase (Case autopsyCase) throws EamDbException |
int | newCorrelationType (CorrelationAttributeInstance.Type newType) throws EamDbException |
CorrelationDataSource | newDataSource (CorrelationDataSource eamDataSource) throws EamDbException |
void | newDbInfo (String name, String value) throws EamDbException |
EamOrganization | newOrganization (EamOrganization eamOrg) throws EamDbException |
int | newReferenceSet (EamGlobalSet eamGlobalSet) throws EamDbException |
void | processInstanceTable (CorrelationAttributeInstance.Type type, InstanceTableCallback instanceTableCallback) throws EamDbException |
void | processInstanceTableWhere (CorrelationAttributeInstance.Type type, String whereClause, InstanceTableCallback instanceTableCallback) throws EamDbException |
boolean | referenceSetExists (String referenceSetName, String version) throws EamDbException |
boolean | referenceSetIsValid (int referenceSetID, String referenceSetName, String version) throws EamDbException |
void | reset () throws EamDbException |
void | saveSettings () |
void | setAttributeInstanceKnownStatus (CorrelationAttributeInstance eamArtifact, TskData.FileKnown knownStatus) throws EamDbException |
void | shutdownConnections () throws EamDbException |
void | updateAttributeInstanceComment (CorrelationAttributeInstance eamArtifact) throws EamDbException |
void | updateCase (CorrelationCase eamCase) throws EamDbException |
void | updateCorrelationType (CorrelationAttributeInstance.Type aType) throws EamDbException |
void | updateDataSourceMd5Hash (CorrelationDataSource eamDataSource) throws EamDbException |
void | updateDataSourceName (CorrelationDataSource eamDataSource, String newName) throws EamDbException |
void | updateDataSourceSha1Hash (CorrelationDataSource eamDataSource) throws EamDbException |
void | updateDataSourceSha256Hash (CorrelationDataSource eamDataSource) throws EamDbException |
void | updateDbInfo (String name, String value) throws EamDbException |
void | updateOrganization (EamOrganization updatedOrganization) throws EamDbException |
void | updateSettings () |
void | upgradeSchema () throws EamDbException, SQLException, IncompatibleCentralRepoException |
Static Public Member Functions | |
static EamDb | getInstance () throws EamDbException |
static boolean | isEnabled () |
Main interface for interacting with the database
Definition at line 31 of file EamDb.java.
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addArtifactInstance | ( | CorrelationAttributeInstance | eamArtifact | ) | throws EamDbException |
Inserts new Artifact(s) into the database. Should add associated Case and Data Source first.
eamArtifact | The artifact to add |
Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.actionPerformed(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addAttributeInstanceBulk | ( | CorrelationAttributeInstance | eamArtifact | ) | throws EamDbException |
Adds an eamArtifact to an internal list to be later added to DB. Artifact can have 1 or more Artifact Instances. Insert will be triggered by a threshold or a call to commitAttributeInstancesBulk().
eamArtifact | The artifact to add |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addDataSourceObjectId | ( | int | rowId, |
long | dataSourceObjectId | ||
) | throws EamDbException |
Set the data source object id for a specific entry in the data_sources table
rowId | - the row id for the data_sources table entry |
dataSourceObjectId | - the object id for the data source from the caseDb |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.addReferenceInstance | ( | EamGlobalFileInstance | eamGlobalFileInstance, |
CorrelationAttributeInstance.Type | correlationType | ||
) | throws EamDbException |
Add a new reference instance
eamGlobalFileInstance | The reference instance to add |
correlationType | Correlation Type that this Reference Instance is |
EamDbException |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.bulkInsertCases | ( | List< CorrelationCase > | cases | ) | throws EamDbException |
Executes a bulk insert of the cases
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.bulkInsertReferenceTypeEntries | ( | Set< EamGlobalFileInstance > | globalInstances, |
CorrelationAttributeInstance.Type | contentType | ||
) | throws EamDbException |
Insert the bulk collection of Global File Instances
globalInstances | a Set of EamGlobalFileInstances to insert into the db. |
contentType | the Type of the global instances |
EamDbException |
Referenced by org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.doInBackground().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.commitAttributeInstancesBulk | ( | ) | throws EamDbException |
Executes a bulk insert of the eamArtifacts added from the addAttributeInstanceBulk() method
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.deleteOrganization | ( | EamOrganization | organizationToDelete | ) | throws EamDbException |
Delete an organization if it is not being used by any case.
organizationToDelete | the organization to be deleted |
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.deleteButtonActionPerformed().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.deleteReferenceSet | ( | int | referenceSetID | ) | throws EamDbException |
Remove a reference set and all values contained in it.
referenceSetID |
EamDbException |
Referenced by org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.cancel(), and org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.deleteIncompleteSet().
List<EamGlobalSet> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getAllReferenceSets | ( | CorrelationAttributeInstance.Type | correlationType | ) | throws EamDbException |
Get all reference sets
correlationType | Type of sets to return |
EamDbException |
Referenced by org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getCentralRepoHashSetsFromDatabase().
List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesByTypeValue | ( | CorrelationAttributeInstance.Type | aType, |
String | value | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Retrieves eamArtifact instances from the database that are associated with the eamArtifactType and eamArtifactValue of the given eamArtifact.
aType | The type of the artifact |
value | The correlation value |
Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelatedInstances(), org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run().
List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesByTypeValues | ( | CorrelationAttributeInstance.Type | aType, |
List< String > | values | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Retrieves eamArtifact instances from the database that are associated with the eamArtifactType and eamArtifactValues of the given eamArtifact.
aType | EamArtifact.Type to search for |
values | The list of correlation values to get CorrelationAttributeInstances for |
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseByCountCallback.process(), and org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseByCaseCallback.process().
List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getArtifactInstancesByTypeValuesAndCases | ( | CorrelationAttributeInstance.Type | aType, |
List< String > | values, | ||
List< Integer > | caseIds | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Retrieves eamArtifact instances from the database that are associated with the eamArtifactType and eamArtifactValues of the given eamArtifact for the specified cases.
aType | The type of the artifact |
values | The list of correlation values to get CorrelationAttributeInstances for |
caseIds | The list of central repository case ids to get CorrelationAttributeInstances for |
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseByCountCallback.process(), and org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseByCaseCallback.process().
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCase | ( | Case | autopsyCase | ) | throws EamDbException |
Retrieves Central Repo case based on an Autopsy Case
autopsyCase | Autopsy case to find corresponding CR case for |
EamDbException |
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeSearchAction.createAndShowPanel(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getInstanceFromContent(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeCorrelationAttributeInstanceUsingTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromContent(), org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources(), org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.AnalysisCompleteTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceAddedTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.CurrentCaseTask.run(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceNameChangedTask.run().
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCaseById | ( | int | caseId | ) | throws EamDbException |
Retrieves Case details based on Case ID
caseId | unique identifier for a case |
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseCommonAttributeRowCallback.process().
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCaseByUUID | ( | String | caseUUID | ) | throws EamDbException |
Retrieves Case details based on Case UUID
caseUUID | unique identifier for a case |
Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCaseCreatedDate(), and org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCaseDetails().
List<CorrelationCase> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCases | ( | ) | throws EamDbException |
Retrieves cases that are in DB.
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeSearchAction.createAndShowPanel(), and org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setEarliestCaseDate().
CorrelationAttributeInstance org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationAttributeInstance | ( | CorrelationAttributeInstance.Type | type, |
CorrelationCase | correlationCase, | ||
CorrelationDataSource | correlationDataSource, | ||
String | value, | ||
String | filePath | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Find a correlation attribute in the Central Repository database given the instance type, case, data source, value, and file path.
Method exists to support instances added using Central Repository version 1,1 and older
type | The type of instance. |
correlationCase | The case tied to the instance. |
correlationDataSource | The data source tied to the instance. |
value | The value tied to the instance. |
filePath | The file path tied to the instance. |
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getInstanceFromContent(), and org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseCommonAttributeRowCallback.process().
CorrelationAttributeInstance org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationAttributeInstance | ( | CorrelationAttributeInstance.Type | type, |
CorrelationCase | correlationCase, | ||
CorrelationDataSource | correlationDataSource, | ||
long | objectID | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Find a correlation attribute in the Central Repository database given the instance type, case, data source, object id.
type | The type of instance. |
correlationCase | The case tied to the instance. |
correlationDataSource | The data source tied to the instance. |
objectID | The object id of the file tied to the instance. |
EamDbException |
CorrelationAttributeInstance.Type org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationTypeById | ( | int | typeId | ) | throws EamDbException |
Get the EamArtifact.Type that has the given Type.Id.
typeId | Type.Id of Correlation Type to get |
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.addCorrelationAttributeToList(), org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.doInBackground(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getCentralRepoHashSetsFromDatabase(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getInstanceFromContent(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromContent(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstancesFromBlackboardArtifact().
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountArtifactInstancesByCaseDataSource | ( | CorrelationDataSource | correlationDataSource | ) | throws EamDbException |
Retrieves number of eamArtifact instances in the database that are associated with the given data source.
correlationDataSource | Data source to search for |
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountArtifactInstancesByTypeValue | ( | CorrelationAttributeInstance.Type | aType, |
String | value | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Retrieves number of artifact instances in the database that are associated with the ArtifactType and artifactValue of the given artifact.
aType | EamArtifact.Type to search for |
value | Value to search for |
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountArtifactInstancesKnownBad | ( | CorrelationAttributeInstance.Type | aType, |
String | value | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Count matching eamArtifacts instances that have knownStatus = "Bad".
aType | EamArtifact.Type to search for |
value | Value to search for |
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountUniqueCaseDataSourceTuplesHavingTypeValue | ( | CorrelationAttributeInstance.Type | aType, |
String | value | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Retrieves number of unique caseDisplayName / dataSource tuples in the database that are associated with the artifactType and artifactValue of the given artifact.
aType | EamArtifact.Type to search for |
value | Value to search for |
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCountSearchResults.filterMetadata(), org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCaseSearchResults.filterValue(), org.sleuthkit.autopsy.datamodel.AbstractAbstractFileNode< SpecialDirectory >.getCountPropertyAndDescription(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getCountPropertyAndDescription().
Long org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCountUniqueDataSources | ( | ) | throws EamDbException |
Retrieves number of data sources in the database.
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCaseSearchResults.filterMetadata(), and org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCountSearchResults.filterMetadata().
CorrelationDataSource org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDataSource | ( | CorrelationCase | correlationCase, |
Long | caseDbDataSourceId | ||
) | throws EamDbException |
Retrieves Data Source details based on data source device ID
correlationCase | the current CorrelationCase used for ensuring uniqueness of DataSource |
caseDbDataSourceId | the data source device ID number |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.AnalysisCompleteTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceAddedTask.run(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceNameChangedTask.run().
CorrelationDataSource org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDataSourceById | ( | CorrelationCase | correlationCase, |
int | dataSourceId | ||
) | throws EamDbException |
Retrieves Data Source details based on data source ID
correlationCase | the current CorrelationCase used for ensuring uniqueness of DataSource |
dataSourceId | the data source ID number |
Referenced by org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseCommonAttributeRowCallback.process().
List<CorrelationDataSource> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDataSources | ( | ) | throws EamDbException |
Retrieves data sources that are in DB
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources().
String org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDbInfo | ( | String | name | ) | throws EamDbException |
Get the value for the given name from the name/value db_info table.
name | Name to search for |
EamDbException |
List<CorrelationAttributeInstance.Type> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDefinedCorrelationTypes | ( | ) | throws EamDbException |
Get the list of EamArtifact.Type's that are defined in the DB and can be used to correlate artifacts.
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), and org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData().
List<CorrelationAttributeInstance.Type> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getEnabledCorrelationTypes | ( | ) | throws EamDbException |
Get the list of enabled EamArtifact.Type's that will be used to correlate artifacts.
EamDbException |
CoordinationService.Lock org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getExclusiveMultiUserDbLock | ( | ) | throws EamDbException |
Gets an exclusive lock (if applicable). Will return the lock if successful, null if unsuccessful because locking isn't supported, and throw an exception if we should have been able to get the lock but failed (meaning the database is in use).
EamDbException | if the coordination service is running but we fail to get the lock |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().
int org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getFrequencyPercentage | ( | CorrelationAttributeInstance | corAttr | ) | throws EamDbException, CorrelationAttributeNormalizationException |
Calculate the percentage of data sources that have this attribute value.
corAttr | Attribute type and value to get data about |
Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCommonalityDetails().
|
static |
Get the instance
EamDbException |
Definition at line 40 of file EamDb.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.allowUseOfCentralRepository(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.DISABLED, and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.getSelectedPlatform().
Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.actionPerformed(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.addCorrelationAttributeToList(), org.sleuthkit.autopsy.centralrepository.optionspanel.EamDbSettingsDialog.bnOkActionPerformed(), org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.cancel(), org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeSearchAction.createAndShowPanel(), org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.deleteButtonActionPerformed(), org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.deleteIncompleteSet(), org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.doInBackground(), org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCaseSearchResults.filterMetadata(), org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCountSearchResults.filterMetadata(), org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCaseSearchResults.filterValue(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCaseCreatedDate(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getCentralRepoHashSetsFromDatabase(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelatedInstances(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), org.sleuthkit.autopsy.datamodel.AbstractAbstractFileNode< SpecialDirectory >.getCountPropertyAndDescription(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getCountPropertyAndDescription(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getInstanceFromContent(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeCorrelationAttributeInstanceUsingTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromContent(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstancesFromBlackboardArtifact(), org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.ManageOrganizationsDialog(), org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources(), org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData(), org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseByCountCallback.process(), org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseByCaseCallback.process(), org.sleuthkit.autopsy.commonpropertiessearch.InterCaseSearchResultsProcessor.InterCaseCommonAttributeRowCallback.process(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.IngestModuleEventListener.propertyChange(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.IngestJobEventListener.propertyChange(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setEarliestCaseDate(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.setMd5(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.setSha1(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.setSha256(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCaseDetails(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.showCommonalityDetails(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().
List<String> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getListCasesHavingArtifactInstancesKnownBad | ( | CorrelationAttributeInstance.Type | aType, |
String | value | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Gets list of distinct case display names, where each case has 1+ Artifact Instance matching eamArtifact with knownStatus = "Bad".
aType | EamArtifact.Type to search for |
value | Value to search for |
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run().
EamOrganization org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getOrganizationByID | ( | int | orgID | ) | throws EamDbException |
Get an organization having the given ID
orgID | The id to look up |
EamDbException |
List<EamOrganization> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getOrganizations | ( | ) | throws EamDbException |
Get all organizations
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.ManageOrganizationsDialog.populateListAndSelect().
List<EamGlobalFileInstance> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getReferenceInstancesByTypeValue | ( | CorrelationAttributeInstance.Type | aType, |
String | aValue | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Get all reference entries having a given correlation type and value
aType | Type to use for matching |
aValue | Value to use for matching |
EamDbException |
EamGlobalSet org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getReferenceSetByID | ( | int | globalSetID | ) | throws EamDbException |
Get a global set by ID
globalSetID | The ID to look up |
EamDbException |
EamOrganization org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getReferenceSetOrganization | ( | int | referenceSetID | ) | throws EamDbException |
Get the organization associated with the given reference set.
referenceSetID | ID of the reference set |
EamDbException |
List<CorrelationAttributeInstance.Type> org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getSupportedCorrelationTypes | ( | ) | throws EamDbException |
Get the list of supported EamArtifact.Type's that can be used to correlate artifacts.
EamDbException |
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isArtifactKnownBadByReference | ( | CorrelationAttributeInstance.Type | aType, |
String | value | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Is the artifact known as bad according to the reference entries?
aType | EamArtifact.Type to search for |
value | Value to search for |
|
static |
Is the database enabled?
Definition at line 93 of file EamDb.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.allowUseOfCentralRepository(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.DISABLED, and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbPlatformEnum.getSelectedPlatform().
Referenced by org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.cancel(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.configureSettings(), org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeSearchAction.createAndShowPanel(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createSheet(), org.sleuthkit.autopsy.commonpropertiessearch.CommonAttributeCountSearchResults.filterMetadata(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.CentralRepoContextMenuActionsProvider.getActions(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCaseCreatedDate(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getCentralRepoHashSetsFromDatabase(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelatedInstances(), org.sleuthkit.autopsy.datamodel.AbstractAbstractFileNode< SpecialDirectory >.getCorrelationAttributeInstance(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getCorrelationAttributeInstance(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), org.sleuthkit.autopsy.datamodel.AbstractAbstractFileNode< SpecialDirectory >.getProperties(), org.sleuthkit.autopsy.allcasessearch.AllCasesSearchAction.isEnabled(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.isSupported(), org.sleuthkit.autopsy.centralrepository.datamodel.DataSourceUpdateService.openCaseResources(), org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.rightClickPopupMenuPopupMenuWillBecomeVisible(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.ContentTagTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.BlackboardTagTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.AnalysisCompleteTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceAddedTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.CurrentCaseTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceNameChangedTask.run(), org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.setEarliestCaseDate(), org.sleuthkit.autopsy.communications.relationships.SummaryViewer.setSelectionInfo(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.updateHashSetsFromCentralRepository(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isFileHashInReferenceSet | ( | String | hash, |
int | referenceSetID | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Check if the given file hash is in this reference set. Only searches the reference_files table.
hash | |
referenceSetID |
EamDbException |
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.isValueInReferenceSet | ( | String | value, |
int | referenceSetID, | ||
int | correlationTypeID | ||
) | throws EamDbException, CorrelationAttributeNormalizationException |
Check if the given value is in a specific reference set
value | |
referenceSetID | |
correlationTypeID |
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCase | ( | CorrelationCase | eamCase | ) | throws EamDbException |
Creates new Case in the database
Expects the Organization for this case to already exist in the database.
eamCase | The case to add |
Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.AnalysisCompleteTask.run(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.CurrentCaseTask.run().
CorrelationCase org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCase | ( | Case | autopsyCase | ) | throws EamDbException |
Creates new Case in the database from the given case
autopsyCase | The case to add |
int org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCorrelationType | ( | CorrelationAttributeInstance.Type | newType | ) | throws EamDbException |
Add a new EamArtifact.Type to the db.
newType | New type to add. |
EamDbException |
CorrelationDataSource org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newDataSource | ( | CorrelationDataSource | eamDataSource | ) | throws EamDbException |
Creates new Data Source in the database
eamDataSource | the data source to add |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newDbInfo | ( | String | name, |
String | value | ||
) | throws EamDbException |
Add a new name/value pair in the db_info table.
name | Key to set |
value | Value to set |
EamDbException |
EamOrganization org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newOrganization | ( | EamOrganization | eamOrg | ) | throws EamDbException |
Add a new organization
eamOrg | The organization to add |
EamDbException |
int org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newReferenceSet | ( | EamGlobalSet | eamGlobalSet | ) | throws EamDbException |
Add a new Global Set
eamGlobalSet | The global set to add |
EamDbException |
Referenced by org.sleuthkit.autopsy.modules.hashdatabase.ImportCentralRepoDbProgressDialog.CentralRepoImportWorker.doInBackground().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.processInstanceTable | ( | CorrelationAttributeInstance.Type | type, |
InstanceTableCallback | instanceTableCallback | ||
) | throws EamDbException |
Process the Artifact instance in the EamDb
type | EamArtifact.Type to search for |
instanceTableCallback | callback to process the instance |
EamDbException |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.processInstanceTableWhere | ( | CorrelationAttributeInstance.Type | type, |
String | whereClause, | ||
InstanceTableCallback | instanceTableCallback | ||
) | throws EamDbException |
Process the Artifact instance in the EamDb
type | EamArtifact.Type to search for |
instanceTableCallback | callback to process the instance |
whereClause | query string to execute |
EamDbException |
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.referenceSetExists | ( | String | referenceSetName, |
String | version | ||
) | throws EamDbException |
Check whether a reference set with the given name/version is in the central repo. Used to check for name collisions when creating reference sets.
referenceSetName | |
version |
EamDbException |
boolean org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.referenceSetIsValid | ( | int | referenceSetID, |
String | referenceSetName, | ||
String | version | ||
) | throws EamDbException |
Check whether a reference set with the given parameters exists in the central repository. Used to check whether reference sets saved in the settings are still present.
referenceSetID | |
referenceSetName | |
version |
EamDbException |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.reset | ( | ) | throws EamDbException |
Reset the database (testing method)
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.saveSettings | ( | ) |
Save settings
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.setAttributeInstanceKnownStatus | ( | CorrelationAttributeInstance | eamArtifact, |
TskData.FileKnown | knownStatus | ||
) | throws EamDbException |
Sets an eamArtifact instance to the given known status. If eamArtifact exists, it is updated. If eamArtifact does not exist nothing happens
eamArtifact | Artifact containing exactly one (1) ArtifactInstance. |
knownStatus | The status to change the artifact to |
Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.ContentTagTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.BlackboardTagTask.run(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.shutdownConnections | ( | ) | throws EamDbException |
Shutdown the connection pool.
This closes the connection pool including all idle database connections. It will not close active/in-use connections. Thus, it is vital that there are no in-use connections when you call this method.
EamDbException | if there is a problem closing the connection pool. |
Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.EamDbSettingsDialog.bnOkActionPerformed(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateAttributeInstanceComment | ( | CorrelationAttributeInstance | eamArtifact | ) | throws EamDbException |
Update a correlation attribute instance comment in the database with that in the associated CorrelationAttribute object.
eamArtifact | The correlation attribute whose database instance will be updated. |
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.actionPerformed().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateCase | ( | CorrelationCase | eamCase | ) | throws EamDbException |
Updates an existing Case in the database
eamCase | The case to update |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateCorrelationType | ( | CorrelationAttributeInstance.Type | aType | ) | throws EamDbException |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateDataSourceMd5Hash | ( | CorrelationDataSource | eamDataSource | ) | throws EamDbException |
Updates the MD5 hash value in an existing data source in the database.
eamDataSource | The data source to update |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.setMd5().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateDataSourceName | ( | CorrelationDataSource | eamDataSource, |
String | newName | ||
) | throws EamDbException |
Changes the name of a data source in the DB
eamDataSource | The data source |
newName | The new name |
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.DataSourceNameChangedTask.run().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateDataSourceSha1Hash | ( | CorrelationDataSource | eamDataSource | ) | throws EamDbException |
Updates the SHA-1 hash value in an existing data source in the database.
eamDataSource | The data source to update |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.setSha1().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateDataSourceSha256Hash | ( | CorrelationDataSource | eamDataSource | ) | throws EamDbException |
Updates the SHA-256 hash value in an existing data source in the database.
eamDataSource | The data source to update |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.setSha256().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateDbInfo | ( | String | name, |
String | value | ||
) | throws EamDbException |
Update the value for a name in the name/value db_info table.
name | Name to find |
value | Value to assign to name. |
EamDbException |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateOrganization | ( | EamOrganization | updatedOrganization | ) | throws EamDbException |
Update an existing organization.
updatedOrganization | the values the Organization with the same ID will be updated to in the database. |
EamDbException |
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.updateSettings | ( | ) |
Update settings
When using updateSettings, if any database settings have changed, you should call shutdownConnections() before using any API methods. That will ensure that any old connections are closed and all new connections will be made using the new settings.
Referenced by org.sleuthkit.autopsy.centralrepository.optionspanel.EamDbSettingsDialog.bnOkActionPerformed().
void org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.upgradeSchema | ( | ) | throws EamDbException, SQLException, IncompatibleCentralRepoException |
Upgrade the schema of the database (if needed)
EamDbException |
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.upgradeDatabase().
Copyright © 2012-2018 Basis Technology. Generated on: Wed Sep 18 2019
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.