19 package org.sleuthkit.autopsy.keywordsearch;
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.HashMap;
24 import java.util.List;
27 import java.util.logging.Level;
28 import java.util.stream.Collectors;
29 import javax.swing.SwingWorker;
30 import org.netbeans.api.progress.ProgressHandle;
31 import org.netbeans.api.progress.aggregate.ProgressContributor;
32 import org.openide.util.NbBundle;
50 private static final Logger logger = Logger.getLogger(QueryResults.class.getName());
51 private static final String MODULE_NAME = KeywordSearchModuleFactory.getModuleName();
55 private final KeywordSearchQuery keywordSearchQuery;
60 private final Map<Keyword, List<KeywordHit>> results =
new HashMap<>();
66 private final KeywordList keywordList;
68 QueryResults(KeywordSearchQuery query, KeywordList keywordList) {
69 this.keywordSearchQuery = query;
70 this.keywordList = keywordList;
73 void addResult(Keyword keyword, List<KeywordHit> hits) {
74 results.put(keyword, hits);
78 KeywordList getKeywordList() {
82 KeywordSearchQuery getQuery() {
83 return keywordSearchQuery;
86 List<KeywordHit> getResults(Keyword keyword) {
87 return results.get(keyword);
90 Set<Keyword> getKeywords() {
91 return results.keySet();
109 Collection<BlackboardArtifact> writeAllHitsToBlackBoard(ProgressHandle progress, ProgressContributor subProgress, SwingWorker<Object, Void> worker,
boolean notifyInbox) {
110 final Collection<BlackboardArtifact> newArtifacts =
new ArrayList<>();
111 if (progress != null) {
112 progress.start(getKeywords().size());
114 int unitProgress = 0;
116 for (
final Keyword keyword : getKeywords()) {
117 if (worker.isCancelled()) {
118 logger.log(Level.INFO,
"Cancel detected, bailing before new keyword processed: {0}", keyword.getSearchTerm());
123 if (progress != null) {
124 progress.progress(keyword.toString(), unitProgress);
126 if (subProgress != null) {
127 String hitDisplayStr = keyword.getSearchTerm();
128 if (hitDisplayStr.length() > 50) {
129 hitDisplayStr = hitDisplayStr.substring(0, 49) +
"...";
131 subProgress.progress(keywordList.getName() +
": " + hitDisplayStr, unitProgress);
134 for (KeywordHit hit : getOneHitPerObject(keyword)) {
135 String termString = keyword.getSearchTerm();
136 final String snippetQuery = KeywordSearchUtil.escapeLuceneQuery(termString);
139 snippet = LuceneQuery.querySnippet(snippetQuery, hit.getSolrObjectId(), hit.getChunkId(), !keywordSearchQuery.isLiteral(),
true);
140 }
catch (NoOpenCoreException e) {
141 logger.log(Level.WARNING,
"Error querying snippet: " + snippetQuery, e);
144 }
catch (Exception e) {
145 logger.log(Level.WARNING,
"Error querying snippet: " + snippetQuery, e);
148 if (snippet != null) {
149 KeywordCachedArtifact writeResult = keywordSearchQuery.writeSingleFileHitsToBlackBoard(termString, hit, snippet, keywordList.getName());
150 if (writeResult != null) {
151 newArtifacts.add(writeResult.getArtifact());
153 writeSingleFileInboxMessage(writeResult, hit.getContent());
156 logger.log(Level.WARNING,
"BB artifact for keyword hit not written, file: {0}, hit: {1}",
new Object[]{hit.getContent(), keyword.toString()});
164 if (!newArtifacts.isEmpty()) {
165 newArtifacts.stream()
167 .collect(Collectors.groupingBy(BlackboardArtifact::getArtifactTypeID))
169 .forEach((typeID, artifacts) ->
170 IngestServices.getInstance().fireModuleDataEvent(
new ModuleDataEvent(MODULE_NAME, BlackboardArtifact.ARTIFACT_TYPE.fromID(typeID), artifacts)));
185 private Collection<KeywordHit> getOneHitPerObject(Keyword keyword) {
187 HashMap<Long, KeywordHit> hits =
new HashMap<>();
190 for (KeywordHit hit : getResults(keyword)) {
191 if (!hits.containsKey(hit.getSolrObjectId())) {
192 hits.put(hit.getSolrObjectId(), hit);
193 }
else if (hit.getChunkId() < hits.get(hit.getSolrObjectId()).getChunkId()) {
194 hits.put(hit.getSolrObjectId(), hit);
197 return hits.values();
206 private void writeSingleFileInboxMessage(KeywordCachedArtifact written, Content hitContent) {
207 StringBuilder subjectSb =
new StringBuilder();
208 StringBuilder detailsSb =
new StringBuilder();
210 if (!keywordSearchQuery.isLiteral()) {
211 subjectSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.regExpHitLbl"));
213 subjectSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.kwHitLbl"));
215 String uniqueKey = null;
216 BlackboardAttribute attr = written.getAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID());
218 final String keyword = attr.getValueString();
219 subjectSb.append(keyword);
220 uniqueKey = keyword.toLowerCase();
224 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
226 detailsSb.append(
"<tr>");
227 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.kwHitThLbl"));
228 detailsSb.append(
"<td>").append(EscapeUtil.escapeHtml(attr.getValueString())).append(
"</td>");
229 detailsSb.append(
"</tr>");
232 attr = written.getAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID());
234 detailsSb.append(
"<tr>");
235 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.previewThLbl"));
236 detailsSb.append(
"<td>").append(EscapeUtil.escapeHtml(attr.getValueString())).append(
"</td>");
237 detailsSb.append(
"</tr>");
241 detailsSb.append(
"<tr>");
242 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.fileThLbl"));
243 if (hitContent instanceof AbstractFile) {
244 AbstractFile hitFile = (AbstractFile) hitContent;
245 detailsSb.append(
"<td>").append(hitFile.getParentPath()).append(hitFile.getName()).append(
"</td>");
247 detailsSb.append(
"<td>").append(hitContent.getName()).append(
"</td>");
249 detailsSb.append(
"</tr>");
252 attr = written.getAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID());
254 detailsSb.append(
"<tr>");
255 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.listThLbl"));
256 detailsSb.append(
"<td>").append(attr.getValueString()).append(
"</td>");
257 detailsSb.append(
"</tr>");
260 if (!keywordSearchQuery.isLiteral()) {
261 attr = written.getAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID());
263 detailsSb.append(
"<tr>");
264 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.regExThLbl"));
265 detailsSb.append(
"<td>").append(attr.getValueString()).append(
"</td>");
266 detailsSb.append(
"</tr>");
269 detailsSb.append(
"</table>");
271 IngestServices.getInstance().postMessage(IngestMessage.createDataMessage(MODULE_NAME, subjectSb.toString(), detailsSb.toString(), uniqueKey, written.getArtifact()));