org.sleuthkit.autopsy.datamodel.FileTypesByMimeType Class Reference

Inherits Observable, and org.sleuthkit.autopsy.datamodel.AutopsyVisitableItem.

Classes
class	ByMimeTypeNode
class	ByMimeTypeNodeChildren
class	FileTypesByMimeTypeRefresher
class	MediaSubTypeNode
class	MediaSubTypeNodeChildren
class	MediaTypeNode
class	MediaTypeNodeChildren

Static Public Member Functions
static boolean	isEmptyMimeTypeNode (Node node)

Private Member Functions
String	createBaseWhereExpr ()
void	populateHashMap ()
void	refreshMimeTypes ()
void	removeListeners ()

Private Attributes
final HashMap< String, Map< String, Long > >	existingMimeTypeCounts = new HashMap<>()
final PropertyChangeListener	pcl
final RefreshThrottler	refreshThrottler
final SleuthkitCase	skCase
final FileTypes	typesRoot

Static Private Attributes
static final Set< Case.Events >	CASE_EVENTS_OF_INTEREST = EnumSet.of(Case.Events.DATA_SOURCE_ADDED, Case.Events.CURRENT_CASE)
static final Set< IngestManager.IngestJobEvent >	INGEST_JOB_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestJobEvent.COMPLETED, IngestManager.IngestJobEvent.CANCELLED)
static final Logger	logger = Logger.getLogger(FileTypesByMimeType.class.getName())

Detailed Description

Class which contains the Nodes for the 'By Mime Type' view located in the File Types view, shows all files with a mime type. Will initially be empty until file type identification has been performed. Contains a Property Change Listener which is checking for changes in IngestJobEvent Completed or Canceled and IngestModuleEvent Content Changed.

Definition at line 62 of file FileTypesByMimeType.java.

Member Function Documentation

String org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.createBaseWhereExpr ( )

private

Create the base expression used as the where clause in the queries for files by mime type. Filters out certain kinds of files and directories, and known/slack files based on user preferences.

Returns

The base expression to be used in the where clause of queries for files by mime type.

Definition at line 101 of file FileTypesByMimeType.java.

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.MediaSubTypeNodeChildren.makeKeys(), and org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap().

static boolean org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.isEmptyMimeTypeNode ( Node  node )

static

Method to check if the node in question is a ByMimeTypeNode which is empty.

Parameters

node	the Node which you wish to check.

Returns

True if originNode is an instance of ByMimeTypeNode and is empty, false otherwise.

Definition at line 202 of file FileTypesByMimeType.java.

void org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap ( )

private

Performs the query on the database to get all distinct MIME types of files in it, and populate the hashmap with those results.

Definition at line 126 of file FileTypesByMimeType.java.

References org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.createBaseWhereExpr(), and org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.existingMimeTypeCounts.

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.refreshMimeTypes().

void org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.refreshMimeTypes ( )

private

Checking for a current case is a stop gap measure until a different way of handling the closing of cases is worked out. Currently, remote events may be received for a case that is already closed.

Case is closed, do nothing.

Definition at line 211 of file FileTypesByMimeType.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap().

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.FileTypesByMimeTypeRefresher.refresh().

void org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.removeListeners ( )

private

Definition at line 115 of file FileTypesByMimeType.java.

References org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.CASE_EVENTS_OF_INTEREST, org.sleuthkit.autopsy.ingest.IngestManager.getInstance(), org.sleuthkit.autopsy.casemodule.Case.removeEventTypeSubscriber(), org.sleuthkit.autopsy.ingest.IngestManager.removeIngestJobEventListener(), and org.sleuthkit.autopsy.guiutils.RefreshThrottler.unregisterEventListener().

Member Data Documentation

final Set<Case.Events> org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.CASE_EVENTS_OF_INTEREST = EnumSet.of(Case.Events.DATA_SOURCE_ADDED, Case.Events.CURRENT_CASE)

staticprivate

Definition at line 85 of file FileTypesByMimeType.java.

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.removeListeners().

final HashMap<String, Map<String, Long> > org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.existingMimeTypeCounts = new HashMap<>()

private

The nodes of this tree will be determined dynamically by the mimetypes which exist in the database. This hashmap will store them with the media type as the key and a Map, from media subtype to count, as the value.

Definition at line 72 of file FileTypesByMimeType.java.

Referenced by org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.ByMimeTypeNodeChildren.createKeys(), and org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.populateHashMap().

final Set<IngestManager.IngestJobEvent> org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.INGEST_JOB_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestJobEvent.COMPLETED, IngestManager.IngestJobEvent.CANCELLED)

staticprivate

Definition at line 65 of file FileTypesByMimeType.java.

final Logger org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.logger = Logger.getLogger(FileTypesByMimeType.class.getName())

staticprivate

Definition at line 64 of file FileTypesByMimeType.java.

final PropertyChangeListener org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.pcl

private

The pcl is in the class because it has the easiest mechanisms to add and remove itself during its life cycles.

Definition at line 83 of file FileTypesByMimeType.java.

final RefreshThrottler org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.refreshThrottler

private

RefreshThrottler is used to limit the number of refreshes performed when CONTENT_CHANGED and DATA_ADDED ingest module events are received.

Definition at line 91 of file FileTypesByMimeType.java.

final SleuthkitCase org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.skCase

private

Definition at line 66 of file FileTypesByMimeType.java.

final FileTypes org.sleuthkit.autopsy.datamodel.FileTypesByMimeType.typesRoot

private

Root of the File Types tree. Used to provide single answer to question: Should the child counts be shown next to the nodes?

Definition at line 77 of file FileTypesByMimeType.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datamodel/FileTypesByMimeType.java