Autopsy  4.17.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
SearchData.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.discovery.search;
20 
21 import com.google.common.collect.ImmutableSet;
22 import java.util.ArrayList;
23 import java.util.Arrays;
24 import java.util.Collection;
25 import java.util.Collections;
26 import java.util.EnumSet;
27 import java.util.List;
28 import java.util.Set;
29 import org.openide.util.NbBundle;
31 import org.sleuthkit.datamodel.BlackboardArtifact;
32 
36 public final class SearchData {
37 
38  private final static long BYTES_PER_MB = 1000000;
39  private static final Set<BlackboardArtifact.ARTIFACT_TYPE> DOMAIN_ARTIFACT_TYPES =
40  EnumSet.of(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK,
41  BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE,
42  BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE,
43  BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD,
44  BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY,
45  BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY);
46 
47 
51  @NbBundle.Messages({
52  "SearchData.prevNotable.displayName=Previously Notable",
53  "SearchData.notPrevNotable.displayName=Previously Not Notable"
54  })
55  public enum PreviouslyNotable {
56  PREVIOUSLY_NOTABLE(0, Bundle.SearchData_prevNotable_displayName()),
57  NOT_PREVIOUSLY_NOTABLE(1, Bundle.SearchData_notPrevNotable_displayName());
58 
59  private final int ranking;
60  private final String displayName;
61 
62  PreviouslyNotable(int ranking, String displayName) {
63  this.ranking = ranking;
64  this.displayName = displayName;
65  }
66 
67  public int getRanking() {
68  return ranking;
69  }
70 
71  @Override
72  public String toString() {
73  return displayName;
74  }
75  }
76 
81  @NbBundle.Messages({
82  "# {0} - minValue",
83  "# {1} - maxValue",
84  "SearchData.PageViews.rangeTemplate={0}-{1} page views",
85  "SearchData.PageViews.over1000=1000+ page views"
86  })
87  public enum PageViews {
88  OVER_1000(1001, Long.MAX_VALUE), // ranking, minValue, maxValue
89  UP_TO_1000(501, 1000),
90  UP_TO_500(101, 500),
91  UP_TO_100(51, 100),
92  UP_TO_50(11, 50),
93  UP_TO_10(0, 10);
94 
95  private final long minValue;
96  private final long maxValue;
97 
98  PageViews(long minValue, long maxValue) {
99  this.maxValue = maxValue;
100  this.minValue = minValue;
101  }
102 
103  @Override
104  public String toString() {
105  if (this == PageViews.OVER_1000) {
106  return Bundle.SearchData_PageViews_over1000();
107  } else {
108  return Bundle.SearchData_PageViews_rangeTemplate(Long.toString(minValue), Long.toString(maxValue));
109  }
110  }
111 
115  boolean covers(long count) {
116  return count >= minValue && count <= maxValue;
117  }
118 
122  public static PageViews fromPageViewCount(long count) {
123  for (PageViews view : PageViews.values()) {
124  if (view.covers(count)) {
125  return view;
126  }
127  }
128  return null;
129  }
130  }
131 
135  @NbBundle.Messages({
136  "SearchData.Frequency.unique.displayName=Unique (1)",
137  "SearchData.Frequency.rare.displayName=Rare (2-10)",
138  "SearchData.Frequency.common.displayName=Common (11 - 100)",
139  "SearchData.Frequency.verycommon.displayName=Very Common (100+)",
140  "SearchData.Frequency.known.displayName=Known (NSRL)",
141  "SearchData.Frequency.unknown.displayName=Unknown",})
142  public enum Frequency {
143  UNIQUE(0, 1, Bundle.SearchData_Frequency_unique_displayName()),
144  RARE(1, 10, Bundle.SearchData_Frequency_rare_displayName()),
145  COMMON(2, 100, Bundle.SearchData_Frequency_common_displayName()),
146  VERY_COMMON(3, 0, Bundle.SearchData_Frequency_verycommon_displayName()),
147  KNOWN(4, 0, Bundle.SearchData_Frequency_known_displayName()),
148  UNKNOWN(5, 0, Bundle.SearchData_Frequency_unknown_displayName());
149 
150  private final int ranking;
151  private final String displayName;
152  private final int maxOccur;
153 
161  Frequency(int ranking, int maxOccur, String displayName) {
162  this.ranking = ranking;
163  this.maxOccur = maxOccur;
164  this.displayName = displayName;
165  }
166 
172  public int getRanking() {
173  return ranking;
174  }
175 
183  public static Frequency fromCount(long count) {
184  if (count <= UNIQUE.getMaxOccur()) {
185  return UNIQUE;
186  } else if (count <= RARE.getMaxOccur()) {
187  return RARE;
188  } else if (count <= COMMON.getMaxOccur()) {
189  return COMMON;
190  }
191  return VERY_COMMON;
192  }
193 
200  public static List<Frequency> getOptionsForFilteringWithCr() {
201  return Arrays.asList(UNIQUE, RARE, COMMON, VERY_COMMON, KNOWN);
202  }
203 
210  public static List<Frequency> getOptionsForFilteringWithoutCr() {
211  return Arrays.asList(KNOWN, UNKNOWN);
212  }
213 
214  @Override
215  public String toString() {
216  return displayName;
217  }
218 
224  public int getMaxOccur() {
225  return maxOccur;
226  }
227  }
228 
232  @NbBundle.Messages({
233  "SearchData.FileSize.XXLARGE.displayName=XXLarge",
234  "SearchData.FileSize.XLARGE.displayName=XLarge",
235  "SearchData.FileSize.LARGE.displayName=Large",
236  "SearchData.FileSize.MEDIUM.displayName=Medium",
237  "SearchData.FileSize.SMALL.displayName=Small",
238  "SearchData.FileSize.XSMALL.displayName=XSmall",
239  "SearchData.FileSize.10PlusGb=: 10GB+",
240  "SearchData.FileSize.5gbto10gb=: 5-10GB",
241  "SearchData.FileSize.1gbto5gb=: 1-5GB",
242  "SearchData.FileSize.100mbto1gb=: 100MB-1GB",
243  "SearchData.FileSize.200PlusMb=: 200MB+",
244  "SearchData.FileSize.50mbto200mb=: 50-200MB",
245  "SearchData.FileSize.500kbto100mb=: 500KB-100MB",
246  "SearchData.FileSize.1mbto50mb=: 1-50MB",
247  "SearchData.FileSize.100kbto1mb=: 100KB-1MB",
248  "SearchData.FileSize.16kbto100kb=: 16-100KB",
249  "SearchData.FileSize.upTo500kb=: 0-500KB",
250  "SearchData.FileSize.upTo16kb=: 0-16KB",})
251  public enum FileSize {
252  XXLARGE_VIDEO(0, 10000 * BYTES_PER_MB, -1, Bundle.SearchData_FileSize_XXLARGE_displayName(), Bundle.SearchData_FileSize_10PlusGb()),
253  XLARGE_VIDEO(1, 5000 * BYTES_PER_MB, 10000 * BYTES_PER_MB, Bundle.SearchData_FileSize_XLARGE_displayName(), Bundle.SearchData_FileSize_5gbto10gb()),
254  LARGE_VIDEO(2, 1000 * BYTES_PER_MB, 5000 * BYTES_PER_MB, Bundle.SearchData_FileSize_LARGE_displayName(), Bundle.SearchData_FileSize_1gbto5gb()),
255  MEDIUM_VIDEO(3, 100 * BYTES_PER_MB, 1000 * BYTES_PER_MB, Bundle.SearchData_FileSize_MEDIUM_displayName(), Bundle.SearchData_FileSize_100mbto1gb()),
256  SMALL_VIDEO(4, 500000, 100 * BYTES_PER_MB, Bundle.SearchData_FileSize_SMALL_displayName(), Bundle.SearchData_FileSize_500kbto100mb()),
257  XSMALL_VIDEO(5, 0, 500000, Bundle.SearchData_FileSize_XSMALL_displayName(), Bundle.SearchData_FileSize_upTo500kb()),
258  XXLARGE_IMAGE(6, 200 * BYTES_PER_MB, -1, Bundle.SearchData_FileSize_XXLARGE_displayName(), Bundle.SearchData_FileSize_200PlusMb()),
259  XLARGE_IMAGE(7, 50 * BYTES_PER_MB, 200 * BYTES_PER_MB, Bundle.SearchData_FileSize_XLARGE_displayName(), Bundle.SearchData_FileSize_50mbto200mb()),
260  LARGE_IMAGE(8, 1 * BYTES_PER_MB, 50 * BYTES_PER_MB, Bundle.SearchData_FileSize_LARGE_displayName(), Bundle.SearchData_FileSize_1mbto50mb()),
261  MEDIUM_IMAGE(9, 100000, 1 * BYTES_PER_MB, Bundle.SearchData_FileSize_MEDIUM_displayName(), Bundle.SearchData_FileSize_100kbto1mb()),
262  SMALL_IMAGE(10, 16000, 100000, Bundle.SearchData_FileSize_SMALL_displayName(), Bundle.SearchData_FileSize_16kbto100kb()),
263  XSMALL_IMAGE(11, 0, 16000, Bundle.SearchData_FileSize_XSMALL_displayName(), Bundle.SearchData_FileSize_upTo16kb());
264 
265  private final int ranking; // Must be unique for each value
266  private final long minBytes; // Note that the size must be strictly greater than this to match
267  private final long maxBytes;
268  private final String sizeGroup;
269  private final String displaySize;
270  final static long NO_MAXIMUM = -1;
271 
282  FileSize(int ranking, long minB, long maxB, String displayName, String displaySize) {
283  this.ranking = ranking;
284  this.minBytes = minB;
285  if (maxB >= 0) {
286  this.maxBytes = maxB;
287  } else {
288  this.maxBytes = NO_MAXIMUM;
289  }
290  this.sizeGroup = displayName;
291  this.displaySize = displaySize;
292  }
293 
302  public static FileSize fromImageSize(long size) {
303  if (size > XXLARGE_IMAGE.getMinBytes()) {
304  return XXLARGE_IMAGE;
305  } else if (size > XLARGE_IMAGE.getMinBytes()) {
306  return XLARGE_IMAGE;
307  } else if (size > LARGE_IMAGE.getMinBytes()) {
308  return LARGE_IMAGE;
309  } else if (size > MEDIUM_IMAGE.getMinBytes()) {
310  return MEDIUM_IMAGE;
311  } else if (size > SMALL_IMAGE.getMinBytes()) {
312  return SMALL_IMAGE;
313  } else {
314  return XSMALL_IMAGE;
315  }
316  }
317 
326  public static FileSize fromVideoSize(long size) {
327  if (size > XXLARGE_VIDEO.getMinBytes()) {
328  return XXLARGE_VIDEO;
329  } else if (size > XLARGE_VIDEO.getMinBytes()) {
330  return XLARGE_VIDEO;
331  } else if (size > LARGE_VIDEO.getMinBytes()) {
332  return LARGE_VIDEO;
333  } else if (size > MEDIUM_VIDEO.getMinBytes()) {
334  return MEDIUM_VIDEO;
335  } else if (size > SMALL_VIDEO.getMinBytes()) {
336  return SMALL_VIDEO;
337  } else {
338  return XSMALL_VIDEO;
339  }
340  }
341 
347  public long getMaxBytes() {
348  return maxBytes;
349  }
350 
356  public long getMinBytes() {
357  return minBytes;
358  }
359 
365  public int getRanking() {
366  return ranking;
367  }
368 
369  @Override
370  public String toString() {
371  return sizeGroup + displaySize;
372  }
373 
379  public String getSizeGroup() {
380  return sizeGroup;
381  }
382 
389  public static List<FileSize> getDefaultSizeOptions() {
390  return Arrays.asList(XXLARGE_IMAGE, XLARGE_IMAGE, LARGE_IMAGE, MEDIUM_IMAGE, SMALL_IMAGE, XSMALL_IMAGE);
391  }
392 
398  public static List<FileSize> getOptionsForVideos() {
399  return Arrays.asList(XXLARGE_VIDEO, XLARGE_VIDEO, LARGE_VIDEO, MEDIUM_VIDEO, SMALL_VIDEO, XSMALL_VIDEO);
400  }
401  }
402 
403  //Discovery uses a different list of document mime types than FileTypeUtils.FileTypeCategory.DOCUMENTS
404  private static final ImmutableSet<String> DOCUMENT_MIME_TYPES
405  = new ImmutableSet.Builder<String>()
406  .add("text/html", //NON-NLS
407  "text/csv", //NON-NLS
408  "application/rtf", //NON-NLS
409  "application/pdf", //NON-NLS
410  "application/xhtml+xml", //NON-NLS
411  "application/x-msoffice", //NON-NLS
412  "application/msword", //NON-NLS
413  "application/msword2", //NON-NLS
414  "application/vnd.wordperfect", //NON-NLS
415  "application/vnd.openxmlformats-officedocument.wordprocessingml.document", //NON-NLS
416  "application/vnd.ms-powerpoint", //NON-NLS
417  "application/vnd.openxmlformats-officedocument.presentationml.presentation", //NON-NLS
418  "application/vnd.ms-excel", //NON-NLS
419  "application/vnd.ms-excel.sheet.4", //NON-NLS
420  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
421  "application/vnd.oasis.opendocument.presentation", //NON-NLS
422  "application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
423  "application/vnd.oasis.opendocument.text" //NON-NLS
424  ).build();
425 
426  private static final ImmutableSet<String> IMAGE_UNSUPPORTED_DOC_TYPES
427  = new ImmutableSet.Builder<String>()
428  .add("application/pdf", //NON-NLS
429  "application/xhtml+xml").build(); //NON-NLS
430 
438  public static Collection<String> getDocTypesWithoutImageExtraction() {
439  return Collections.unmodifiableCollection(IMAGE_UNSUPPORTED_DOC_TYPES);
440  }
441 
445  @NbBundle.Messages({
446  "SearchData.FileType.Audio.displayName=Audio",
447  "SearchData.FileType.Video.displayName=Video",
448  "SearchData.FileType.Image.displayName=Image",
449  "SearchData.FileType.Documents.displayName=Document",
450  "SearchData.FileType.Executables.displayName=Executable",
451  "SearchData.AttributeType.Domain.displayName=Domain",
452  "SearchData.FileType.Other.displayName=Other/Unknown"})
453  public enum Type {
454 
455  IMAGE(0, Bundle.SearchData_FileType_Image_displayName(), FileTypeUtils.FileTypeCategory.IMAGE.getMediaTypes(), new ArrayList<>()),
456  AUDIO(1, Bundle.SearchData_FileType_Audio_displayName(), FileTypeUtils.FileTypeCategory.AUDIO.getMediaTypes(), new ArrayList<>()),
457  VIDEO(2, Bundle.SearchData_FileType_Video_displayName(), FileTypeUtils.FileTypeCategory.VIDEO.getMediaTypes(), new ArrayList<>()),
458  EXECUTABLE(3, Bundle.SearchData_FileType_Executables_displayName(), FileTypeUtils.FileTypeCategory.EXECUTABLE.getMediaTypes(), new ArrayList<>()),
459  DOCUMENT(4, Bundle.SearchData_FileType_Documents_displayName(), DOCUMENT_MIME_TYPES, new ArrayList<>()),
460  DOMAIN(6, Bundle.SearchData_AttributeType_Domain_displayName(), new ArrayList<>(), DOMAIN_ARTIFACT_TYPES),
461  OTHER(5, Bundle.SearchData_FileType_Other_displayName(), new ArrayList<>(), new ArrayList<>());
462 
463  private final int ranking; // For ordering in the UI
464  private final String displayName;
465  private final Collection<String> mediaTypes;
466  private final Collection<BlackboardArtifact.ARTIFACT_TYPE> artifactTypes;
467 
478  Type(int value, String displayName, Collection<String> mediaTypes, Collection<BlackboardArtifact.ARTIFACT_TYPE> artifactTypes) {
479  this.ranking = value;
480  this.displayName = displayName;
481  this.mediaTypes = mediaTypes;
482  this.artifactTypes = artifactTypes;
483  }
484 
490  public Collection<String> getMediaTypes() {
491  return Collections.unmodifiableCollection(mediaTypes);
492  }
493 
499  public Collection<BlackboardArtifact.ARTIFACT_TYPE> getArtifactTypes() {
500  return Collections.unmodifiableCollection(artifactTypes);
501  }
502 
503  @Override
504  public String toString() {
505  return displayName;
506  }
507 
513  public int getRanking() {
514  return ranking;
515  }
516 
517  }
518 
522  @NbBundle.Messages({
523  "SearchData.Score.notable.displayName=Notable",
524  "SearchData.Score.interesting.displayName=Interesting",
525  "SearchData.Score.unknown.displayName=Unknown",})
526  public enum Score {
527  NOTABLE(0, Bundle.SearchData_Score_notable_displayName()),
528  INTERESTING(1, Bundle.SearchData_Score_interesting_displayName()),
529  UNKNOWN(2, Bundle.SearchData_Score_unknown_displayName());
530 
531  private final int ranking;
532  private final String displayName;
533 
540  Score(int ranking, String displayName) {
541  this.ranking = ranking;
542  this.displayName = displayName;
543  }
544 
550  public int getRanking() {
551  return ranking;
552  }
553 
559  public static List<Score> getOptionsForFiltering() {
560  return Arrays.asList(NOTABLE, INTERESTING);
561  }
562 
563  @Override
564  public String toString() {
565  return displayName;
566  }
567  }
568 
572  private SearchData() {
573  // Class should not be instantiated
574  }
575 }
static Collection< String > getDocTypesWithoutImageExtraction()
Type(int value, String displayName, Collection< String > mediaTypes, Collection< BlackboardArtifact.ARTIFACT_TYPE > artifactTypes)
static final ImmutableSet< String > IMAGE_UNSUPPORTED_DOC_TYPES
Collection< BlackboardArtifact.ARTIFACT_TYPE > getArtifactTypes()
Frequency(int ranking, int maxOccur, String displayName)
final Collection< BlackboardArtifact.ARTIFACT_TYPE > artifactTypes
FileSize(int ranking, long minB, long maxB, String displayName, String displaySize)
static final ImmutableSet< String > DOCUMENT_MIME_TYPES
static final Set< BlackboardArtifact.ARTIFACT_TYPE > DOMAIN_ARTIFACT_TYPES
Definition: SearchData.java:39

Copyright © 2012-2021 Basis Technology. Generated on: Tue Jan 19 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.