Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
HashsetHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2015 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.HashSet;
28 import java.util.LinkedHashMap;
29 import java.util.List;
30 import java.util.Map;
31 import java.util.Observable;
32 import java.util.Observer;
33 import java.util.Set;
34 import java.util.logging.Level;
35 import org.openide.nodes.ChildFactory;
36 import org.openide.nodes.Children;
37 import org.openide.nodes.Node;
38 import org.openide.nodes.Sheet;
39 import org.openide.util.NbBundle;
40 import org.openide.util.lookup.Lookups;
45 import org.sleuthkit.datamodel.BlackboardArtifact;
46 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
47 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
48 import org.sleuthkit.datamodel.SleuthkitCase;
49 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
50 import org.sleuthkit.datamodel.TskCoreException;
51 import org.sleuthkit.datamodel.TskException;
52 
56 public class HashsetHits implements AutopsyVisitableItem {
57 
58  private static final String HASHSET_HITS = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getLabel();
59  private static final String DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName();
60  private static final Logger logger = Logger.getLogger(HashsetHits.class.getName());
61  private SleuthkitCase skCase;
63 
64  public HashsetHits(SleuthkitCase skCase) {
65  this.skCase = skCase;
66  hashsetResults = new HashsetResults();
67  }
68 
69  @Override
70  public <T> T accept(AutopsyItemVisitor<T> v) {
71  return v.visit(this);
72  }
73 
78  private class HashsetResults extends Observable {
79 
80  // maps hashset name to list of artifacts for that set
81  // NOTE: the map can be accessed by multiple worker threads and needs to be synchronized
82  private final Map<String, Set<Long>> hashSetHitsMap = new LinkedHashMap<>();
83 
84  HashsetResults() {
85  update();
86  }
87 
88  List<String> getSetNames() {
89  List<String> names;
90  synchronized (hashSetHitsMap) {
91  names = new ArrayList<>(hashSetHitsMap.keySet());
92  }
93  Collections.sort(names);
94  return names;
95  }
96 
97  Set<Long> getArtifactIds(String hashSetName) {
98  synchronized (hashSetHitsMap) {
99  return hashSetHitsMap.get(hashSetName);
100  }
101  }
102 
103  @SuppressWarnings("deprecation")
104  final void update() {
105  synchronized (hashSetHitsMap) {
106  hashSetHitsMap.clear();
107  }
108 
109  if (skCase == null) {
110  return;
111  }
112 
113  int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
114  int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
115  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
116  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
117  + "attribute_type_id=" + setNameId //NON-NLS
118  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
119  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
120 
121  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
122  ResultSet resultSet = dbQuery.getResultSet();
123  synchronized (hashSetHitsMap) {
124  while (resultSet.next()) {
125  String setName = resultSet.getString("value_text"); //NON-NLS
126  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
127  if (!hashSetHitsMap.containsKey(setName)) {
128  hashSetHitsMap.put(setName, new HashSet<Long>());
129  }
130  hashSetHitsMap.get(setName).add(artifactId);
131  }
132  }
133  } catch (TskCoreException | SQLException ex) {
134  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
135  }
136 
137  setChanged();
138  notifyObservers();
139  }
140  }
141 
145  public class RootNode extends DisplayableItemNode {
146 
147  public RootNode() {
148  super(Children.create(new HashsetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
149  super.setName(HASHSET_HITS);
150  super.setDisplayName(DISPLAY_NAME);
151  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
152  }
153 
154  @Override
155  public boolean isLeafTypeNode() {
156  return false;
157  }
158 
159  @Override
160  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
161  return v.visit(this);
162  }
163 
164  @Override
165  protected Sheet createSheet() {
166  Sheet s = super.createSheet();
167  Sheet.Set ss = s.get(Sheet.PROPERTIES);
168  if (ss == null) {
169  ss = Sheet.createPropertiesSet();
170  s.put(ss);
171  }
172 
173  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
174  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
175  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
176  getName()));
177 
178  return s;
179  }
180 
181  @Override
182  public String getItemType() {
183  return getClass().getName();
184  }
185  }
186 
190  private class HashsetNameFactory extends ChildFactory.Detachable<String> implements Observer {
191 
192  /*
193  * This should probably be in the HashsetHits class, but the factory has
194  * nice methods for its startup and shutdown, so it seemed like a
195  * cleaner place to register the property change listener.
196  */
197  private final PropertyChangeListener pcl = new PropertyChangeListener() {
198  @Override
199  public void propertyChange(PropertyChangeEvent evt) {
200  String eventType = evt.getPropertyName();
201  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
208  try {
215  ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
216  if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
217  hashsetResults.update();
218  }
219  } catch (IllegalStateException notUsed) {
223  }
224  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
225  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
232  try {
234  hashsetResults.update();
235  } catch (IllegalStateException notUsed) {
239  }
240  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
241  // case was closed. Remove listeners so that we don't get called with a stale case handle
242  if (evt.getNewValue() == null) {
243  removeNotify();
244  skCase = null;
245  }
246  }
247  }
248  };
249 
250  @Override
251  protected void addNotify() {
255  hashsetResults.update();
256  hashsetResults.addObserver(this);
257  }
258 
259  @Override
260  protected void removeNotify() {
264  hashsetResults.deleteObserver(this);
265  }
266 
267  @Override
268  protected boolean createKeys(List<String> list) {
269  list.addAll(hashsetResults.getSetNames());
270  return true;
271  }
272 
273  @Override
274  protected Node createNodeForKey(String key) {
275  return new HashsetNameNode(key);
276  }
277 
278  @Override
279  public void update(Observable o, Object arg) {
280  refresh(true);
281  }
282  }
283 
287  public class HashsetNameNode extends DisplayableItemNode implements Observer {
288 
289  private final String hashSetName;
290 
291  public HashsetNameNode(String hashSetName) {
292  super(Children.create(new HitFactory(hashSetName), true), Lookups.singleton(hashSetName));
293  super.setName(hashSetName);
294  this.hashSetName = hashSetName;
296  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
297  hashsetResults.addObserver(this);
298  }
299 
303  private void updateDisplayName() {
304  super.setDisplayName(hashSetName + " (" + hashsetResults.getArtifactIds(hashSetName).size() + ")");
305  }
306 
307  @Override
308  public boolean isLeafTypeNode() {
309  return true;
310  }
311 
312  @Override
313  protected Sheet createSheet() {
314  Sheet s = super.createSheet();
315  Sheet.Set ss = s.get(Sheet.PROPERTIES);
316  if (ss == null) {
317  ss = Sheet.createPropertiesSet();
318  s.put(ss);
319  }
320 
321  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
322  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
323  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
324  getName()));
325 
326  return s;
327  }
328 
329  @Override
330  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
331  return v.visit(this);
332  }
333 
334  @Override
335  public void update(Observable o, Object arg) {
337  }
338 
339  @Override
340  public String getItemType() {
345  return getClass().getName();
346  }
347  }
348 
352  private class HitFactory extends ChildFactory.Detachable<Long> implements Observer {
353 
354  private String hashsetName;
355 
356  private HitFactory(String hashsetName) {
357  super();
358  this.hashsetName = hashsetName;
359  }
360 
361  @Override
362  protected void addNotify() {
363  hashsetResults.addObserver(this);
364  }
365 
366  @Override
367  protected void removeNotify() {
368  hashsetResults.deleteObserver(this);
369  }
370 
371  @Override
372  protected boolean createKeys(List<Long> list) {
373  list.addAll(hashsetResults.getArtifactIds(hashsetName));
374  return true;
375  }
376 
377  @Override
378  protected Node createNodeForKey(Long id) {
379  if (skCase == null) {
380  return null;
381  }
382 
383  try {
384  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
385  return new BlackboardArtifactNode(art);
386  } catch (TskException ex) {
387  logger.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
388  }
389  return null;
390  }
391 
392  @Override
393  public void update(Observable o, Object arg) {
394  refresh(true);
395  }
396  }
397 }
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
static void removePropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:318
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static void addPropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:306
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161

Copyright © 2012-2016 Basis Technology. Generated on: Mon Jan 2 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.