Autopsy  4.16.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
SearchData.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.discovery.search;
20 
21 import com.google.common.collect.ImmutableSet;
22 import java.util.ArrayList;
23 import java.util.Arrays;
24 import java.util.Collection;
25 import java.util.Collections;
26 import java.util.EnumSet;
27 import java.util.List;
28 import java.util.Set;
29 import org.openide.util.NbBundle;
31 import org.sleuthkit.datamodel.BlackboardArtifact;
32 
36 public final class SearchData {
37 
38  private final static long BYTES_PER_MB = 1000000;
39  private static final Set<BlackboardArtifact.ARTIFACT_TYPE> DOMAIN_ARTIFACT_TYPES = EnumSet.of(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK, BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE, BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE, BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD, BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY, BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY);
40 
44  @NbBundle.Messages({
45  "SearchData.Frequency.unique.displayName=Unique (1)",
46  "SearchData.Frequency.rare.displayName=Rare (2-10)",
47  "SearchData.Frequency.common.displayName=Common (11 - 100)",
48  "SearchData.Frequency.verycommon.displayName=Very Common (100+)",
49  "SearchData.Frequency.known.displayName=Known (NSRL)",
50  "SearchData.Frequency.unknown.displayName=Unknown",})
51  public enum Frequency {
52  UNIQUE(0, 1, Bundle.SearchData_Frequency_unique_displayName()),
53  RARE(1, 10, Bundle.SearchData_Frequency_rare_displayName()),
54  COMMON(2, 100, Bundle.SearchData_Frequency_common_displayName()),
55  VERY_COMMON(3, 0, Bundle.SearchData_Frequency_verycommon_displayName()),
56  KNOWN(4, 0, Bundle.SearchData_Frequency_known_displayName()),
57  UNKNOWN(5, 0, Bundle.SearchData_Frequency_unknown_displayName());
58 
59  private final int ranking;
60  private final String displayName;
61  private final int maxOccur;
62 
70  Frequency(int ranking, int maxOccur, String displayName) {
71  this.ranking = ranking;
72  this.maxOccur = maxOccur;
73  this.displayName = displayName;
74  }
75 
81  public int getRanking() {
82  return ranking;
83  }
84 
92  public static Frequency fromCount(long count) {
93  if (count <= UNIQUE.getMaxOccur()) {
94  return UNIQUE;
95  } else if (count <= RARE.getMaxOccur()) {
96  return RARE;
97  } else if (count <= COMMON.getMaxOccur()) {
98  return COMMON;
99  }
100  return VERY_COMMON;
101  }
102 
109  public static List<Frequency> getOptionsForFilteringWithCr() {
110  return Arrays.asList(UNIQUE, RARE, COMMON, VERY_COMMON, KNOWN);
111  }
112 
119  public static List<Frequency> getOptionsForFilteringWithoutCr() {
120  return Arrays.asList(KNOWN, UNKNOWN);
121  }
122 
123  @Override
124  public String toString() {
125  return displayName;
126  }
127 
133  public int getMaxOccur() {
134  return maxOccur;
135  }
136  }
137 
141  @NbBundle.Messages({
142  "SearchData.FileSize.XXLARGE.displayName=XXLarge",
143  "SearchData.FileSize.XLARGE.displayName=XLarge",
144  "SearchData.FileSize.LARGE.displayName=Large",
145  "SearchData.FileSize.MEDIUM.displayName=Medium",
146  "SearchData.FileSize.SMALL.displayName=Small",
147  "SearchData.FileSize.XSMALL.displayName=XSmall",
148  "SearchData.FileSize.10PlusGb=: 10GB+",
149  "SearchData.FileSize.5gbto10gb=: 5-10GB",
150  "SearchData.FileSize.1gbto5gb=: 1-5GB",
151  "SearchData.FileSize.100mbto1gb=: 100MB-1GB",
152  "SearchData.FileSize.200PlusMb=: 200MB+",
153  "SearchData.FileSize.50mbto200mb=: 50-200MB",
154  "SearchData.FileSize.500kbto100mb=: 500KB-100MB",
155  "SearchData.FileSize.1mbto50mb=: 1-50MB",
156  "SearchData.FileSize.100kbto1mb=: 100KB-1MB",
157  "SearchData.FileSize.16kbto100kb=: 16-100KB",
158  "SearchData.FileSize.upTo500kb=: 0-500KB",
159  "SearchData.FileSize.upTo16kb=: 0-16KB",})
160  public enum FileSize {
161  XXLARGE_VIDEO(0, 10000 * BYTES_PER_MB, -1, Bundle.SearchData_FileSize_XXLARGE_displayName(), Bundle.SearchData_FileSize_10PlusGb()),
162  XLARGE_VIDEO(1, 5000 * BYTES_PER_MB, 10000 * BYTES_PER_MB, Bundle.SearchData_FileSize_XLARGE_displayName(), Bundle.SearchData_FileSize_5gbto10gb()),
163  LARGE_VIDEO(2, 1000 * BYTES_PER_MB, 5000 * BYTES_PER_MB, Bundle.SearchData_FileSize_LARGE_displayName(), Bundle.SearchData_FileSize_1gbto5gb()),
164  MEDIUM_VIDEO(3, 100 * BYTES_PER_MB, 1000 * BYTES_PER_MB, Bundle.SearchData_FileSize_MEDIUM_displayName(), Bundle.SearchData_FileSize_100mbto1gb()),
165  SMALL_VIDEO(4, 500000, 100 * BYTES_PER_MB, Bundle.SearchData_FileSize_SMALL_displayName(), Bundle.SearchData_FileSize_500kbto100mb()),
166  XSMALL_VIDEO(5, 0, 500000, Bundle.SearchData_FileSize_XSMALL_displayName(), Bundle.SearchData_FileSize_upTo500kb()),
167  XXLARGE_IMAGE(6, 200 * BYTES_PER_MB, -1, Bundle.SearchData_FileSize_XXLARGE_displayName(), Bundle.SearchData_FileSize_200PlusMb()),
168  XLARGE_IMAGE(7, 50 * BYTES_PER_MB, 200 * BYTES_PER_MB, Bundle.SearchData_FileSize_XLARGE_displayName(), Bundle.SearchData_FileSize_50mbto200mb()),
169  LARGE_IMAGE(8, 1 * BYTES_PER_MB, 50 * BYTES_PER_MB, Bundle.SearchData_FileSize_LARGE_displayName(), Bundle.SearchData_FileSize_1mbto50mb()),
170  MEDIUM_IMAGE(9, 100000, 1 * BYTES_PER_MB, Bundle.SearchData_FileSize_MEDIUM_displayName(), Bundle.SearchData_FileSize_100kbto1mb()),
171  SMALL_IMAGE(10, 16000, 100000, Bundle.SearchData_FileSize_SMALL_displayName(), Bundle.SearchData_FileSize_16kbto100kb()),
172  XSMALL_IMAGE(11, 0, 16000, Bundle.SearchData_FileSize_XSMALL_displayName(), Bundle.SearchData_FileSize_upTo16kb());
173 
174  private final int ranking; // Must be unique for each value
175  private final long minBytes; // Note that the size must be strictly greater than this to match
176  private final long maxBytes;
177  private final String sizeGroup;
178  private final String displaySize;
179  final static long NO_MAXIMUM = -1;
180 
191  FileSize(int ranking, long minB, long maxB, String displayName, String displaySize) {
192  this.ranking = ranking;
193  this.minBytes = minB;
194  if (maxB >= 0) {
195  this.maxBytes = maxB;
196  } else {
197  this.maxBytes = NO_MAXIMUM;
198  }
199  this.sizeGroup = displayName;
200  this.displaySize = displaySize;
201  }
202 
211  public static FileSize fromImageSize(long size) {
212  if (size > XXLARGE_IMAGE.getMinBytes()) {
213  return XXLARGE_IMAGE;
214  } else if (size > XLARGE_IMAGE.getMinBytes()) {
215  return XLARGE_IMAGE;
216  } else if (size > LARGE_IMAGE.getMinBytes()) {
217  return LARGE_IMAGE;
218  } else if (size > MEDIUM_IMAGE.getMinBytes()) {
219  return MEDIUM_IMAGE;
220  } else if (size > SMALL_IMAGE.getMinBytes()) {
221  return SMALL_IMAGE;
222  } else {
223  return XSMALL_IMAGE;
224  }
225  }
226 
235  public static FileSize fromVideoSize(long size) {
236  if (size > XXLARGE_VIDEO.getMinBytes()) {
237  return XXLARGE_VIDEO;
238  } else if (size > XLARGE_VIDEO.getMinBytes()) {
239  return XLARGE_VIDEO;
240  } else if (size > LARGE_VIDEO.getMinBytes()) {
241  return LARGE_VIDEO;
242  } else if (size > MEDIUM_VIDEO.getMinBytes()) {
243  return MEDIUM_VIDEO;
244  } else if (size > SMALL_VIDEO.getMinBytes()) {
245  return SMALL_VIDEO;
246  } else {
247  return XSMALL_VIDEO;
248  }
249  }
250 
256  public long getMaxBytes() {
257  return maxBytes;
258  }
259 
265  public long getMinBytes() {
266  return minBytes;
267  }
268 
274  public int getRanking() {
275  return ranking;
276  }
277 
278  @Override
279  public String toString() {
280  return sizeGroup + displaySize;
281  }
282 
288  public String getSizeGroup() {
289  return sizeGroup;
290  }
291 
298  public static List<FileSize> getDefaultSizeOptions() {
299  return Arrays.asList(XXLARGE_IMAGE, XLARGE_IMAGE, LARGE_IMAGE, MEDIUM_IMAGE, SMALL_IMAGE, XSMALL_IMAGE);
300  }
301 
307  public static List<FileSize> getOptionsForVideos() {
308  return Arrays.asList(XXLARGE_VIDEO, XLARGE_VIDEO, LARGE_VIDEO, MEDIUM_VIDEO, SMALL_VIDEO, XSMALL_VIDEO);
309  }
310  }
311 
312  //Discovery uses a different list of document mime types than FileTypeUtils.FileTypeCategory.DOCUMENTS
313  private static final ImmutableSet<String> DOCUMENT_MIME_TYPES
314  = new ImmutableSet.Builder<String>()
315  .add("text/html", //NON-NLS
316  "text/csv", //NON-NLS
317  "application/rtf", //NON-NLS
318  "application/pdf", //NON-NLS
319  "application/xhtml+xml", //NON-NLS
320  "application/x-msoffice", //NON-NLS
321  "application/msword", //NON-NLS
322  "application/msword2", //NON-NLS
323  "application/vnd.wordperfect", //NON-NLS
324  "application/vnd.openxmlformats-officedocument.wordprocessingml.document", //NON-NLS
325  "application/vnd.ms-powerpoint", //NON-NLS
326  "application/vnd.openxmlformats-officedocument.presentationml.presentation", //NON-NLS
327  "application/vnd.ms-excel", //NON-NLS
328  "application/vnd.ms-excel.sheet.4", //NON-NLS
329  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
330  "application/vnd.oasis.opendocument.presentation", //NON-NLS
331  "application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
332  "application/vnd.oasis.opendocument.text" //NON-NLS
333  ).build();
334 
335  private static final ImmutableSet<String> IMAGE_UNSUPPORTED_DOC_TYPES
336  = new ImmutableSet.Builder<String>()
337  .add("application/pdf", //NON-NLS
338  "application/xhtml+xml").build(); //NON-NLS
339 
347  public static Collection<String> getDocTypesWithoutImageExtraction() {
348  return Collections.unmodifiableCollection(IMAGE_UNSUPPORTED_DOC_TYPES);
349  }
350 
354  @NbBundle.Messages({
355  "SearchData.FileType.Audio.displayName=Audio",
356  "SearchData.FileType.Video.displayName=Video",
357  "SearchData.FileType.Image.displayName=Image",
358  "SearchData.FileType.Documents.displayName=Document",
359  "SearchData.FileType.Executables.displayName=Executable",
360  "SearchData.AttributeType.Domain.displayName=Domain",
361  "SearchData.FileType.Other.displayName=Other/Unknown"})
362  public enum Type {
363 
364  IMAGE(0, Bundle.SearchData_FileType_Image_displayName(), FileTypeUtils.FileTypeCategory.IMAGE.getMediaTypes(), new ArrayList<>()),
365  AUDIO(1, Bundle.SearchData_FileType_Audio_displayName(), FileTypeUtils.FileTypeCategory.AUDIO.getMediaTypes(), new ArrayList<>()),
366  VIDEO(2, Bundle.SearchData_FileType_Video_displayName(), FileTypeUtils.FileTypeCategory.VIDEO.getMediaTypes(), new ArrayList<>()),
367  EXECUTABLE(3, Bundle.SearchData_FileType_Executables_displayName(), FileTypeUtils.FileTypeCategory.EXECUTABLE.getMediaTypes(), new ArrayList<>()),
368  DOCUMENT(4, Bundle.SearchData_FileType_Documents_displayName(), DOCUMENT_MIME_TYPES, new ArrayList<>()),
369  DOMAIN(6, Bundle.SearchData_AttributeType_Domain_displayName(), new ArrayList<>(), DOMAIN_ARTIFACT_TYPES),
370  OTHER(5, Bundle.SearchData_FileType_Other_displayName(), new ArrayList<>(), new ArrayList<>());
371 
372  private final int ranking; // For ordering in the UI
373  private final String displayName;
374  private final Collection<String> mediaTypes;
375  private final Collection<BlackboardArtifact.ARTIFACT_TYPE> artifactTypes;
376 
387  Type(int value, String displayName, Collection<String> mediaTypes, Collection<BlackboardArtifact.ARTIFACT_TYPE> artifactTypes) {
388  this.ranking = value;
389  this.displayName = displayName;
390  this.mediaTypes = mediaTypes;
391  this.artifactTypes = artifactTypes;
392  }
393 
399  public Collection<String> getMediaTypes() {
400  return Collections.unmodifiableCollection(mediaTypes);
401  }
402 
408  public Collection<BlackboardArtifact.ARTIFACT_TYPE> getArtifactTypes() {
409  return Collections.unmodifiableCollection(artifactTypes);
410  }
411 
412  @Override
413  public String toString() {
414  return displayName;
415  }
416 
422  public int getRanking() {
423  return ranking;
424  }
425 
426  }
427 
431  @NbBundle.Messages({
432  "SearchData.Score.notable.displayName=Notable",
433  "SearchData.Score.interesting.displayName=Interesting",
434  "SearchData.Score.unknown.displayName=Unknown",})
435  public enum Score {
436  NOTABLE(0, Bundle.SearchData_Score_notable_displayName()),
437  INTERESTING(1, Bundle.SearchData_Score_interesting_displayName()),
438  UNKNOWN(2, Bundle.SearchData_Score_unknown_displayName());
439 
440  private final int ranking;
441  private final String displayName;
442 
449  Score(int ranking, String displayName) {
450  this.ranking = ranking;
451  this.displayName = displayName;
452  }
453 
459  public int getRanking() {
460  return ranking;
461  }
462 
468  public static List<Score> getOptionsForFiltering() {
469  return Arrays.asList(NOTABLE, INTERESTING);
470  }
471 
472  @Override
473  public String toString() {
474  return displayName;
475  }
476  }
477 
481  private SearchData() {
482  // Class should not be instantiated
483  }
484 }
static Collection< String > getDocTypesWithoutImageExtraction()
Type(int value, String displayName, Collection< String > mediaTypes, Collection< BlackboardArtifact.ARTIFACT_TYPE > artifactTypes)
static final ImmutableSet< String > IMAGE_UNSUPPORTED_DOC_TYPES
Collection< BlackboardArtifact.ARTIFACT_TYPE > getArtifactTypes()
Frequency(int ranking, int maxOccur, String displayName)
Definition: SearchData.java:70
final Collection< BlackboardArtifact.ARTIFACT_TYPE > artifactTypes
FileSize(int ranking, long minB, long maxB, String displayName, String displaySize)
static final ImmutableSet< String > DOCUMENT_MIME_TYPES
static final Set< BlackboardArtifact.ARTIFACT_TYPE > DOMAIN_ARTIFACT_TYPES
Definition: SearchData.java:39

Copyright © 2012-2020 Basis Technology. Generated on: Tue Sep 22 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.