19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
33 import java.util.Observable;
34 import java.util.Observer;
36 import java.util.logging.Level;
37 import org.openide.nodes.ChildFactory;
38 import org.openide.nodes.Children;
39 import org.openide.nodes.Node;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.NbBundle;
42 import org.openide.util.WeakListeners;
43 import org.openide.util.lookup.Lookups;
52 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
60 .getMessage(
InterestingHits.class,
"InterestingHits.interestingItems.text");
88 this.filteringDSObjId = objId;
89 interestingResults.
update();
98 List<String> setNames;
100 setNames =
new ArrayList<>(interestingItemsMap.keySet());
102 Collections.sort(setNames);
108 return interestingItemsMap.get(setName).get(typeName);
114 interestingItemsMap.clear();
116 loadArtifacts(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT);
117 loadArtifacts(BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT);
126 @SuppressWarnings(
"deprecation")
128 if (skCase == null) {
132 int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
133 int artId = artType.getTypeID();
134 String query =
"SELECT value_text,blackboard_artifacts.artifact_obj_id,attribute_type_id "
135 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
136 +
"attribute_type_id=" + setNameId
137 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
138 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
139 if (filteringDSObjId > 0) {
140 query +=
" AND blackboard_artifacts.data_source_obj_id = " +
filteringDSObjId;
143 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
145 ResultSet resultSet = dbQuery.getResultSet();
146 while (resultSet.next()) {
147 String value = resultSet.getString(
"value_text");
148 long artifactObjId = resultSet.getLong(
"artifact_obj_id");
149 if (!interestingItemsMap.containsKey(value)) {
150 interestingItemsMap.put(value,
new LinkedHashMap<>());
151 interestingItemsMap.get(value).put(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getDisplayName(),
new HashSet<>());
152 interestingItemsMap.get(value).put(BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(),
new HashSet<>());
154 interestingItemsMap.get(value).get(artType.getDisplayName()).add(artifactObjId);
157 }
catch (TskCoreException | SQLException ex) {
158 logger.log(Level.WARNING,
"SQL Exception occurred: ", ex);
165 return visitor.
visit(
this);
175 Lookups.singleton(DISPLAY_NAME),
178 BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT,
179 BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT);
180 super.setName(INTERESTING_ITEMS);
181 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
191 return visitor.
visit(
this);
196 Sheet sheet = super.createSheet();
197 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
198 if (sheetSet == null) {
199 sheetSet = Sheet.createPropertiesSet();
203 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
204 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.displayName"),
205 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
213 return getClass().getName();
217 private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
224 private final PropertyChangeListener
pcl = (PropertyChangeEvent evt) -> {
225 String eventType = evt.getPropertyName();
242 if (null != eventData && (eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()
244 interestingResults.
update();
261 interestingResults.
update();
269 if (evt.getNewValue() == null) {
276 private final PropertyChangeListener
weakPcl = WeakListeners.propertyChange(pcl, null);
283 interestingResults.
update();
284 interestingResults.addObserver(
this);
293 interestingResults.deleteObserver(
this);
308 public void update(Observable o, Object arg) {
318 super(Children.create(
new HitTypeFactory(setName),
true), Lookups.singleton(setName));
320 super.setName(setName);
322 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
323 interestingResults.addObserver(
this);
327 int sizeOfSet = interestingResults.
getArtifactIds(setName, BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size()
328 + interestingResults.
getArtifactIds(setName, BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getDisplayName()).size();
329 super.setDisplayName(setName +
" (" + sizeOfSet +
")");
339 Sheet sheet = super.createSheet();
340 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
341 if (sheetSet == null) {
342 sheetSet = Sheet.createPropertiesSet();
346 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
347 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
348 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
356 return visitor.
visit(
this);
360 public void update(Observable o, Object arg) {
370 return getClass().getName();
377 private final Map<Long, BlackboardArtifact>
artifactHits =
new HashMap<>();
382 interestingResults.addObserver(
this);
387 list.add(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getDisplayName());
388 list.add(BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName());
398 public void update(Observable o, Object arg) {
409 super(Children.create(
new HitFactory(setName, typeName),
true), Lookups.singleton(setName));
417 super.setName(setName +
"_" + typeName);
419 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
420 interestingResults.addObserver(
this);
424 super.setDisplayName(typeName +
" (" + interestingResults.
getArtifactIds(setName, typeName).size() +
")");
434 Sheet sheet = super.createSheet();
435 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
436 if (sheetSet == null) {
437 sheetSet = Sheet.createPropertiesSet();
440 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
441 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
442 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
449 return visitor.
visit(
this);
453 public void update(Observable o, Object arg) {
463 return getClass().getName();
471 private final Map<Long, AnalysisResult>
artifactHits =
new HashMap<>();
479 super(setName +
"_" + typeName);
482 interestingResults.addObserver(
this);
488 if (skCase != null) {
489 interestingResults.
getArtifactIds(setName, typeName).forEach((
id) -> {
491 if (!artifactHits.containsKey(
id)) {
492 AnalysisResult art = skCase.getBlackboard().getAnalysisResultById(
id);
496 artifactHits.put(
id, art);
498 }
catch (TskCoreException ex) {
499 logger.log(Level.SEVERE,
"TSK Exception occurred", ex);
503 return new ArrayList<>(artifactHits.values());
505 return Collections.emptyList();
514 public void update(Observable o, Object arg) {
static final String DISPLAY_NAME
BlackboardArtifact.Type getBlackboardArtifactType()
Node createNodeForKey(AnalysisResult art)
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static final String INTERESTING_ITEMS
HitTypeFactory(String setName)
static final Set< IngestManager.IngestModuleEvent > INGEST_MODULE_EVENTS_OF_INTEREST
final long filteringDSObjId
static synchronized IngestManager getInstance()
boolean createKeys(List< String > list)
Node createNodeForKey(String key)
void update(Observable o, Object arg)
InterestingHits(SleuthkitCase skCase, long objId)
boolean createKeys(List< String > list)
final Map< Long, AnalysisResult > artifactHits
List< String > getSetNames()
HitFactory(String setName, String typeName)
void removeIngestJobEventListener(final PropertyChangeListener listener)
final PropertyChangeListener pcl
void update(Observable o, Object arg)
SetNameNode(String setName)
void addIngestJobEventListener(final PropertyChangeListener listener)
final long filteringDSObjId
static final Set< IngestManager.IngestJobEvent > INGEST_JOB_EVENTS_OF_INTEREST
Set< Long > getArtifactIds(String setName, String typeName)
final PropertyChangeListener weakPcl
void update(Observable o, Object arg)
void update(Observable o, Object arg)
T visit(DataSourceFilesNode in)
void loadArtifacts(BlackboardArtifact.Type artType)
List< AnalysisResult > makeKeys()
void addIngestModuleEventListener(final PropertyChangeListener listener)
Node createNodeForKey(String key)
InterestingItemTypeNode(String setName, String typeName)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
InterestingHits(SleuthkitCase skCase)
final Map< Long, BlackboardArtifact > artifactHits
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
final InterestingResults interestingResults
final Map< String, Map< String, Set< Long > > > interestingItemsMap
void update(Observable o, Object arg)
static final Logger logger