org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary Class Reference

Classes
class	PastCasesResult

Public Member Functions
	PastCasesSummary ()
	PastCasesSummary (SleuthkitCaseProvider provider, java.util.logging.Logger logger)
PastCasesResult	getPastCasesData (DataSource dataSource) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException

Private Member Functions
BlackboardArtifact	getParentArtifact (BlackboardArtifact artifact) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException
boolean	hasDeviceAssociatedArtifact (BlackboardArtifact artifact) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException

Static Private Member Functions
static List< Pair< String, Long > >	getCaseCounts (Stream< String > cases)
static List< String >	getCasesFromArtifact (BlackboardArtifact artifact)
static boolean	isCentralRepoGenerated (List< String > sources)

Private Attributes
final SleuthkitCaseProvider	caseProvider
final java.util.logging.Logger	logger

Static Private Attributes
static final Set< Integer >	ARTIFACT_UPDATE_TYPE_IDS
static final String	CASE_SEPARATOR = ","
static final String	CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim()
static final Set< Integer >	CR_DEVICE_TYPE_IDS
static final BlackboardAttribute.Type	TYPE_COMMENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_OTHER_CASES)

Detailed Description

Provides information about how a data source relates to a previous case. NOTE: This code is fragile and has certain expectations about how the central repository handles creating artifacts. So, if the central repository changes ingest process, this code could break. This code expects that the central repository ingest module:

a) Creates a TSK_PREVIOUSLY_NOTABLE artifact for a file whose hash is in the central repository as a notable file.

b) Creates a TSK_PREVIOUSLY_SEEN artifact for a matching id in the central repository.

c) The created artifact will have a TSK_OTHER_CASES attribute attached where one of the sources for the attribute matches CentralRepoIngestModuleFactory.getModuleName(). The module display name at time of ingest will match CentralRepoIngestModuleFactory.getModuleName() as well.

d) The content of that TSK_OTHER_CASES attribute will be of the form "case1,case2...caseN"

Definition at line 66 of file PastCasesSummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.PastCasesSummary

(

)

Main constructor.

Definition at line 125 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.DEFAULT, and org.sleuthkit.autopsy.coreutils.Logger.getLogger().

org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.PastCasesSummary	(	SleuthkitCaseProvider	provider,
		java.util.logging.Logger	logger
	)

Main constructor with external dependencies specified. This constructor is designed with unit testing in mind since mocked dependencies can be utilized.

Parameters

provider	The object providing the current SleuthkitCase.
logger	The logger to use.

Definition at line 141 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.logger.

Member Function Documentation

static List<Pair<String, Long> > org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCounts ( Stream< String >  cases )

staticprivate

Given a stream of case ids, groups the strings in a case-insensitive manner, and then provides a list of cases and the occurrence count sorted from max to min.

Parameters

cases

A stream of cases.

Returns

The list of unique cases and their occurrences sorted from max to min.

Definition at line 213 of file PastCasesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getPastCasesData().

static List<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromArtifact ( BlackboardArtifact  artifact )

staticprivate

Gets a list of cases from the TSK_OTHER_CASES of an artifact. The cases string is expected to be of a form of "case1,case2...caseN".

Parameters

artifact

The artifact.

Returns

The list of cases if found or empty list if not.

Definition at line 176 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.isCentralRepoGenerated(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.TYPE_COMMENT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getPastCasesData().

BlackboardArtifact org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getParentArtifact ( BlackboardArtifact  artifact ) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException

private

Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves it's parent artifact.

Parameters

artifact

The input artifact.

Returns

The artifact if found or null if not.

Exceptions

TskCoreException
NoCurrentCaseException

Definition at line 240 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.hasDeviceAssociatedArtifact().

PastCasesResult org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getPastCasesData

(

DataSource

dataSource

)

throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException

Returns the past cases data to be shown in the past cases tab.

Parameters

dataSource

The data source.

Returns

The retrieved data or null if null dataSource.

Exceptions

SleuthkitCaseProviderException
TskCoreException
NoCurrentCaseException

Definition at line 281 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCounts(), org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromArtifact(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.hasDeviceAssociatedArtifact().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.PastCasesSummaryGetter.getPastCasesData().

boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.hasDeviceAssociatedArtifact ( BlackboardArtifact  artifact ) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException

private

Returns true if the artifact has an associated artifact of a device type.

Parameters

artifact

The artifact.

Returns

True if there is a device associated artifact.

Exceptions

TskCoreException
NoCurrentCaseException

Definition at line 261 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getParentArtifact().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getPastCasesData().

static boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.isCentralRepoGenerated ( List< String >  sources )

staticprivate

Given the provided sources for an attribute, aims to determine if one of those sources is the Central Repository Ingest Module.

Parameters

sources

The list of sources found on an attribute.

Returns

Whether or not this attribute (and subsequently the parent artifact) is created by the Central Repository Ingest Module.

Definition at line 158 of file PastCasesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromArtifact().

Member Data Documentation

final Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.ARTIFACT_UPDATE_TYPE_IDS

staticprivate

Initial value:

= new HashSet<>(Arrays.asList(
            ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID(), 
            ARTIFACT_TYPE.TSK_PREVIOUSLY_NOTABLE.getTypeID()
    ))

Definition at line 102 of file PastCasesSummary.java.

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.CASE_SEPARATOR = ","

staticprivate

Definition at line 117 of file PastCasesSummary.java.

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.caseProvider

private

Definition at line 119 of file PastCasesSummary.java.

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim()

staticprivate

Definition at line 107 of file PastCasesSummary.java.

final Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.CR_DEVICE_TYPE_IDS

staticprivate

Initial value:

= new HashSet<>(Arrays.asList(
            ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID(),
            ARTIFACT_TYPE.TSK_DEVICE_INFO.getTypeID(),
            ARTIFACT_TYPE.TSK_SIM_ATTACHED.getTypeID(),
            ARTIFACT_TYPE.TSK_WIFI_NETWORK_ADAPTER.getTypeID()
    ))

Definition at line 110 of file PastCasesSummary.java.

final java.util.logging.Logger org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.logger

private

Definition at line 120 of file PastCasesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.PastCasesSummary().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.TYPE_COMMENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_OTHER_CASES)

staticprivate

Definition at line 108 of file PastCasesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromArtifact().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java