Inherits org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.

Classes
class	CityCountsList

class	CityData

class	CityRecordCount

class	GeoResult

class	PointFetcher

interface	SupplierWithException

Public Member Functions
	GeolocationSummary ()

	GeolocationSummary (SupplierWithException< ClosestCityMapper, IOException > cityMapper, SleuthkitCaseProvider provider)

Set< Integer >	getArtifactTypeIdsForRefresh ()

default Set< Case.Events >	getCaseEventUpdates ()

CityData	getCityCounts (DataSource dataSource, int daysCount, int maxCount) throws SleuthkitCaseProviderException, GeoLocationDataException, InterruptedException, IOException

List< ARTIFACT_TYPE >	getGeoTypes ()

default Set< IngestJobEvent >	getIngestJobEventUpdates ()

default boolean	isRefreshRequired (ModuleDataEvent evt)

default boolean	isRefreshRequired (ModuleContentEvent evt)

default boolean	isRefreshRequired (IngestManager.IngestJobEvent evt)

default boolean	isRefreshRequired (AbstractFile evt)

boolean	isRefreshRequired (IngestJobEvent evt)

default boolean	isRefreshRequiredForCaseEvent (PropertyChangeEvent evt)

Public Attributes
Set< IngestJobEvent >	INGEST_JOB_EVENTS

Private Member Functions
Pair< CityRecord, Long >	getClosestWithTime (ClosestCityMapper cityMapper, MapWaypoint pt)

Pair< Integer, Integer >	getCounts (List< Long > points, Long minTime)

GeoResult	getGeoResult (DataSource dataSource) throws SleuthkitCaseProviderException, GeoLocationDataException, InterruptedException

boolean	greaterThanOrEqual (Long minTime, Long time)

Stream< Pair< CityRecord, Long > >	processGeoResult (GeoResult geoResult, ClosestCityMapper cityMapper)

Stream< Pair< CityRecord, Long > >	reduceGrouping (Set< MapWaypoint > points, ClosestCityMapper cityMapper)

Private Attributes
final SupplierWithException< ClosestCityMapper, IOException >	cityMapper

final SleuthkitCaseProvider	provider

Static Private Attributes
static final long	DAY_SECS = 24 * 60 * 60

static final Pair< Integer, Integer >	EMPTY_COUNT = Pair.of(0, 0)

static final Set< Integer >	GPS_ARTIFACT_TYPE_IDS

static final List< ARTIFACT_TYPE >	GPS_ARTIFACT_TYPES

Detailed Description

Gathers summary data about Geolocation information for a data source.

Definition at line 48 of file GeolocationSummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GeolocationSummary ( )

Default constructor.

Definition at line 261 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.DEFAULT.

org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GeolocationSummary	(	SupplierWithException< ClosestCityMapper, IOException >	cityMapper,
		SleuthkitCaseProvider	provider
	)

Main constructor.

Parameters

cityMapper	A means of acquiring a ClosestCityMapper that can throw an IOException.
provider	A means of acquiring a SleuthkitCaseProvider.

Definition at line 272 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.cityMapper, and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.provider.

Member Function Documentation

Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getArtifactTypeIdsForRefresh ( )

Returns: The set of artifact type id's that should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.

Definition at line 285 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GPS_ARTIFACT_TYPE_IDS.

default Set<Case.Events> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.getCaseEventUpdates ( )

inherited

Returns: The set of Case Events for which data should be updated.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Definition at line 57 of file DefaultUpdateGovernor.java.

CityData org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCityCounts	(	DataSource	dataSource,
		int	daysCount,
		int	maxCount
	)		throws SleuthkitCaseProviderException, GeoLocationDataException, InterruptedException, IOException

Get this list of hits per city where the list is sorted descending by number of found hits (i.e. most hits is first index).

Parameters

dataSource	The data source.
daysCount	Number of days to go back.
maxCount	Maximum number of results.

Returns: The sorted list.

Exceptions

SleuthkitCaseProviderException
GeoLocationDataException
InterruptedException

Definition at line 435 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.cityMapper, org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.DAY_SECS, org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.SupplierWithException< T, E extends Throwable >.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCounts(), org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getGeoResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.processGeoResult().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.GeolocationPanel.GeolocationPanel().

Pair<CityRecord, Long> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getClosestWithTime	(	ClosestCityMapper	cityMapper,
		MapWaypoint	pt
	)

private

Retrieves a tuple of the closest city (or null if a closest city cannot be determined) and the time stamp of the point in seconds from epoch. If the point is null, null is returned.

Parameters

cityMapper	The means of mapping a point to the closest city.
pt	The geolocation point.

Returns: A tuple of the closest city and timestamp in seconds from epoch.

Definition at line 338 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.geolocation.MapWaypoint.getTimestamp(), org.sleuthkit.autopsy.geolocation.KdTree< T extends KdTree.XYZPoint >.XYZPoint.getX(), and org.sleuthkit.autopsy.geolocation.KdTree< T extends KdTree.XYZPoint >.XYZPoint.getY().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.processGeoResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.reduceGrouping().

Pair<Integer, Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCounts	(	List< Long >	points,
		Long	minTime
	)

private

Based on a set of waypoints, determines the count of total waypoints and a total of waypoints whose time stamp is greater than or equal to minTime.

Parameters

points	The list of way points.
minTime	The minimum time for most recent points count.

Returns: A pair where the left value is the total count of way points and the right is the total list of way points that are >= minTime.

Definition at line 318 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.EMPTY_COUNT, and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.greaterThanOrEqual().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCityCounts().

GeoResult org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getGeoResult ( DataSource dataSource ) throws SleuthkitCaseProviderException, GeoLocationDataException, InterruptedException

private

Fetches all GPS data for the data source from the current case.

Parameters

dataSource The data source.

Returns: The GPS data pertaining to the data source.

Exceptions

SleuthkitCaseProviderException
GeoLocationDataException
InterruptedException

Definition at line 539 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.geolocation.datamodel.WaypointBuilder.getAllWaypoints(), org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GPS_ARTIFACT_TYPES, and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.provider.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCityCounts().

List<ARTIFACT_TYPE> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getGeoTypes ( )

Returns: Returns all the geolocation artifact types.

Definition at line 280 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GPS_ARTIFACT_TYPES.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.GeolocationPanel.openGeolocationWindow().

default Set<IngestJobEvent> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getIngestJobEventUpdates ( )

inherited

Returns: The set of Ingest Job Events for which data should be updated.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.

Definition at line 52 of file DefaultArtifactUpdateGovernor.java.

References org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.INGEST_JOB_EVENTS.

boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.greaterThanOrEqual	(	Long	minTime,
		Long	time
	)

private

Returns whether or not the time is >= the provided minimum time handling the event where either time is null.

Parameters

minTime	The minimum time. If null is provided, this function will return false.
time	The time to check. If null is provided and the min time is non-null, then this function will return false.

Returns: If minTime == null then false. If minTime != null && time == null then false. Otherwise time >= minTime.

Definition at line 300 of file GeolocationSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCounts().

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.isRefreshRequired ( ModuleDataEvent evt )

inherited

Given a module data event, whether or not an update should occur.

Parameters

evt	The ModuleDataEvent that is occurring.

Returns: Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.

Definition at line 38 of file DefaultArtifactUpdateGovernor.java.

References org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getArtifactTypeIdsForRefresh(), and org.sleuthkit.autopsy.ingest.ModuleDataEvent.getBlackboardArtifactType().

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequired ( ModuleContentEvent evt )

inherited

Given a module content event, whether or not an update should occur.

Parameters

evt	The ModuleContentEvent.

Returns: Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.TimelineSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.ContainerSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

Definition at line 42 of file DefaultUpdateGovernor.java.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.isRefreshRequired ( IngestManager.IngestJobEvent evt )

inherited

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.

Definition at line 47 of file DefaultArtifactUpdateGovernor.java.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequired ( AbstractFile evt )

inherited

Whether or not a newly added AbstractFile should trigger an update.

Parameters

evt	The AbstractFile.

Returns: True if an update should occur.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.TimelineSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.ContainerSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

Definition at line 67 of file DefaultUpdateGovernor.java.

boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.isRefreshRequired ( IngestJobEvent evt )

inherited

Given an ingest job event, determines whether or not an update should occur.

Parameters

evt	The event.

Returns: Whether or not this event should trigger an update.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.TimelineSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequiredForCaseEvent ( PropertyChangeEvent evt )

inherited

Given a case event, whether or not an update should occur.

Parameters

evt	The event.

Returns: Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Definition at line 37 of file DefaultUpdateGovernor.java.

Stream<Pair<CityRecord, Long> > org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.processGeoResult	(	GeoResult	geoResult,
		ClosestCityMapper	cityMapper
	)

private

Convert a geo result taken from the Geolocation and convert to a stream of tuples where each tuple represents a point with the closest city and the time stamp in seconds from epoch.

Parameters

geoResult	The result from the Geolocation API.
cityMapper	The means of mapping a point to the closest city.

Returns: A list of tuples where each tuple represents a point to be counted with a combination of the closest city and the timestamp.

Exceptions

IOException

Definition at line 394 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GeoResult.getAreas(), org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getClosestWithTime(), org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GeoResult.getMapWaypoints(), org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GeoResult.getTracks(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.reduceGrouping().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCityCounts().

Stream<Pair<CityRecord, Long> > org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.reduceGrouping	(	Set< MapWaypoint >	points,
		ClosestCityMapper	cityMapper
	)

private

Converts a set of waypoints representing a grouping (i.e. track, area) into a stream of the unique cities identified in this grouping and the latest time stamp for each grouping.

Parameters

points	The points in the grouping.
cityMapper	The means of mapping a point to the closest city.

Returns: A stream of tuples where each tuple will be a unique city (or null if a closest is not determined) and the latest timestamp for each.

Definition at line 359 of file GeolocationSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getClosestWithTime().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.processGeoResult().

Member Data Documentation

final SupplierWithException<ClosestCityMapper, IOException> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.cityMapper

private

Definition at line 242 of file GeolocationSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GeolocationSummary(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCityCounts().

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.DAY_SECS = 24 * 60 * 60

staticprivate

Definition at line 239 of file GeolocationSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCityCounts().

final Pair<Integer, Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.EMPTY_COUNT = Pair.of(0, 0)

staticprivate

Definition at line 237 of file GeolocationSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getCounts().

final Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GPS_ARTIFACT_TYPE_IDS

staticprivate

Initial value:

= GPS_ARTIFACT_TYPES.stream()
            .map(artifactType -> artifactType.getTypeID())
            .collect(Collectors.toSet())

Definition at line 233 of file GeolocationSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getArtifactTypeIdsForRefresh().

final List<ARTIFACT_TYPE> org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GPS_ARTIFACT_TYPES

staticprivate

Initial value:

= Arrays.asList(
            BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK,
            BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION,
            BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE,
            BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH,
            BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACK,
            BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT,
            BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF,
            BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_AREA
    )

Definition at line 221 of file GeolocationSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getGeoResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getGeoTypes().

Set<IngestJobEvent> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.INGEST_JOB_EVENTS

inherited

Initial value:

= new HashSet<>(

Arrays.asList(IngestJobEvent.COMPLETED, IngestJobEvent.CANCELLED))

Definition at line 34 of file DefaultArtifactUpdateGovernor.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getIngestJobEventUpdates().

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.provider

private

Definition at line 241 of file GeolocationSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.GeolocationSummary(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.GeolocationSummary.getGeoResult().

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/GeolocationSummary.java

Classes

Public Member Functions

Public Attributes

Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation