Autopsy  4.15.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
GetSCOTask.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2019-2020 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.lang.ref.WeakReference;
24 import java.util.List;
25 import java.util.logging.Level;
26 import org.openide.util.NbBundle.Messages;
34 import org.sleuthkit.datamodel.AbstractFile;
35 import org.sleuthkit.datamodel.BlackboardArtifact;
36 import org.sleuthkit.datamodel.Tag;
37 import org.sleuthkit.datamodel.TskCoreException;
39 
45 class GetSCOTask implements Runnable {
46 
47  private final WeakReference<AbstractContentNode<?>> weakNodeRef;
48  private final PropertyChangeListener listener;
49  private static final Logger logger = Logger.getLogger(GetSCOTask.class.getName());
50 
51  GetSCOTask(WeakReference<AbstractContentNode<?>> weakContentRef, PropertyChangeListener listener) {
52  this.weakNodeRef = weakContentRef;
53  this.listener = listener;
54  }
55 
56  @Messages({"GetSCOTask.occurrences.defaultDescription=No correlation properties found",
57  "GetSCOTask.occurrences.multipleProperties=Multiple different correlation properties exist for this result"})
58  @Override
59  public void run() {
60  AbstractContentNode<?> contentNode = weakNodeRef.get();
61 
62  //Check for stale reference or if columns are disabled
63  if (contentNode == null || UserPreferences.getHideSCOColumns()) {
64  return;
65  }
66  // get the SCO column values
67  List<Tag> tags = contentNode.getAllTagsFromDatabase();
68 
69  SCOData scoData = new SCOData();
70  scoData.setScoreAndDescription(contentNode.getScorePropertyAndDescription(tags));
71  //getting the correlation attribute and setting the comment column is done before the eamdb isEnabled check
72  //because the Comment column will reflect the presence of comments in the CR when the CR is enabled, but reflect tag comments regardless
73  CorrelationAttributeInstance fileAttribute = contentNode.getCorrelationAttributeInstance();
74  scoData.setComment(contentNode.getCommentProperty(tags, fileAttribute));
75 
76  if (CentralRepository.isEnabled()) {
77  Type type = null;
78  String value = null;
79  String description = Bundle.GetSCOTask_occurrences_defaultDescription();
80  if (contentNode instanceof BlackboardArtifactNode) {
81  BlackboardArtifact bbArtifact = ((BlackboardArtifactNode) contentNode).getArtifact();
82  //for specific artifact types we still want to display information for the file instance correlation attribute
83  if (bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
84  || bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
85  || bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID()
86  || bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
87  || bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()
88  || bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_OBJECT_DETECTED.getTypeID()
89  || bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID()
90  || bbArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
91  try {
92  if (bbArtifact.getParent() instanceof AbstractFile) {
93  type = CorrelationAttributeInstance.getDefaultCorrelationTypes().get(CorrelationAttributeInstance.FILES_TYPE_ID);
94  value = ((AbstractFile) bbArtifact.getParent()).getMd5Hash();
95  }
96  } catch (TskCoreException | CentralRepoException ex) {
97  logger.log(Level.WARNING, "Unable to get correlation type or value to determine value for O column for artifact", ex);
98  }
99  } else {
100  List<CorrelationAttributeInstance> listOfPossibleAttributes = CorrelationAttributeUtil.makeCorrAttrsForCorrelation(bbArtifact);
101  if (listOfPossibleAttributes.size() > 1) {
102  //Don't display anything if there is more than 1 correlation property for an artifact but let the user know
103  description = Bundle.GetSCOTask_occurrences_multipleProperties();
104  } else if (!listOfPossibleAttributes.isEmpty()) {
105  //there should only be one item in the list
106  type = listOfPossibleAttributes.get(0).getCorrelationType();
107  value = listOfPossibleAttributes.get(0).getCorrelationValue();
108  }
109  }
110  } else if (contentNode.getContent() instanceof AbstractFile) {
111  //use the file instance correlation attribute if the node is not a BlackboardArtifactNode
112  try {
113  type = CorrelationAttributeInstance.getDefaultCorrelationTypes().get(CorrelationAttributeInstance.FILES_TYPE_ID);
114  value = ((AbstractFile) contentNode.getContent()).getMd5Hash();
115  } catch (CentralRepoException ex) {
116  logger.log(Level.WARNING, "Unable to get correlation type to determine value for O column for file", ex);
117  }
118  }
119  scoData.setCountAndDescription(contentNode.getCountPropertyAndDescription(type, value, description));
120  }
121 
122  // signal SCO data is available.
123  if (listener
124  != null) {
125  listener.propertyChange(new PropertyChangeEvent(
126  AutopsyEvent.SourceType.LOCAL.toString(),
127  AbstractAbstractFileNode.NodeSpecificEvents.SCO_AVAILABLE.toString(),
128  null, scoData));
129  }
130  }
131 }

Copyright © 2012-2020 Basis Technology. Generated on: Mon Jul 6 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.