FileTypesByMimeType.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2011-2017 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.datamodel;

import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Observable;
import java.util.Observer;
import java.util.logging.Level;
import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.lang3.StringUtils;
import org.openide.nodes.AbstractNode;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.core.UserPreferences;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.ContentVisitor;
import org.sleuthkit.datamodel.DerivedFile;
import org.sleuthkit.datamodel.Directory;
import org.sleuthkit.datamodel.File;
import org.sleuthkit.datamodel.LayoutFile;
import org.sleuthkit.datamodel.LocalFile;
import org.sleuthkit.datamodel.SlackFile;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskData;

public final class FileTypesByMimeType extends Observable implements AutopsyVisitableItem {

    private final SleuthkitCase skCase;
    private final HashMap<String, List<String>> existingMimeTypes = new HashMap<>();
    private static final Logger LOGGER = Logger.getLogger(FileTypesByMimeType.class.getName());

    private void removeListeners() {
        deleteObservers();
        IngestManager.getInstance().removeIngestJobEventListener(pcl);
        Case.removePropertyChangeListener(pcl);
    }

    /*
     * The pcl is in the class because it has the easiest mechanisms to add and
     * remove itself during its life cycles.
     */
    private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
        String eventType = evt.getPropertyName();
        if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
                || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {

            try {
                Case.getCurrentCase();
                populateHashMap();
            } catch (IllegalStateException notUsed) {
            }
        } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
            if (evt.getNewValue() == null) {
                removeListeners();
            }
        }
    };

    private List<String> getMediaTypeList() {
        synchronized (existingMimeTypes) {
            List<String> mediaTypes = new ArrayList<>(existingMimeTypes.keySet());
            Collections.sort(mediaTypes);
            return mediaTypes;
        }
    }

    private void populateHashMap() {
        StringBuilder allDistinctMimeTypesQuery = new StringBuilder();
        allDistinctMimeTypesQuery.append("SELECT DISTINCT mime_type from tsk_files where mime_type IS NOT null");  //NON-NLS
        allDistinctMimeTypesQuery.append(" AND dir_type = ").append(TskData.TSK_FS_NAME_TYPE_ENUM.REG.getValue()); //NON-NLS
        allDistinctMimeTypesQuery.append(" AND (type IN (").append(TskData.TSK_DB_FILES_TYPE_ENUM.FS.ordinal()).append(","); //NON-NLS
        allDistinctMimeTypesQuery.append(TskData.TSK_DB_FILES_TYPE_ENUM.CARVED.ordinal()).append(",");
        allDistinctMimeTypesQuery.append(TskData.TSK_DB_FILES_TYPE_ENUM.DERIVED.ordinal()).append(",");
        if (!UserPreferences.hideSlackFilesInViewsTree()) {
            allDistinctMimeTypesQuery.append(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.ordinal()).append(",");
        }
        allDistinctMimeTypesQuery.append(TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL.ordinal()).append("))");
        synchronized (existingMimeTypes) {
            existingMimeTypes.clear();

            if (skCase == null) {

                return;
            }
            try (SleuthkitCase.CaseDbQuery dbQuery = skCase.executeQuery(allDistinctMimeTypesQuery.toString())) {
                ResultSet resultSet = dbQuery.getResultSet();
                while (resultSet.next()) {
                    final String mime_type = resultSet.getString("mime_type"); //NON-NLS
                    if (!mime_type.isEmpty()) {
                        String mimeType[] = mime_type.split("/");
                        //if the mime_type contained multiple slashes then everything after the first slash will become the subtype
                        final String mimeMediaSubType = StringUtils.join(ArrayUtils.subarray(mimeType, 1, mimeType.length), "/");
                        if (mimeType.length > 1 && !mimeType[0].isEmpty() && !mimeMediaSubType.isEmpty()) {
                            if (!existingMimeTypes.containsKey(mimeType[0])) {
                                existingMimeTypes.put(mimeType[0], new ArrayList<>());
                            }
                            existingMimeTypes.get(mimeType[0]).add(mimeMediaSubType);
                        }
                    }
                }
            } catch (TskCoreException | SQLException ex) {
                LOGGER.log(Level.SEVERE, "Unable to populate File Types by MIME Type tree view from DB: ", ex); //NON-NLS
            }
        }

        setChanged();

        notifyObservers();
    }

    FileTypesByMimeType(SleuthkitCase skCase) {
        IngestManager.getInstance().addIngestJobEventListener(pcl);
        Case.addPropertyChangeListener(pcl);
        this.skCase = skCase;
        populateHashMap();
    }

    @Override
    public <T> T accept(AutopsyItemVisitor<T> v) {
        return v.visit(this);
    }

    public static boolean isEmptyMimeTypeNode(Node node) {
        boolean isEmptyMimeNode = false;
        if (node instanceof FileTypesByMimeType.ByMimeTypeNode && ((FileTypesByMimeType.ByMimeTypeNode) node).isEmpty()) {
            isEmptyMimeNode = true;
        }
        return isEmptyMimeNode;

    }

    class ByMimeTypeNode extends DisplayableItemNode {

        @NbBundle.Messages("FileTypesByMimeType.name.text=By MIME Type")
        final String NAME = Bundle.FileTypesByMimeType_name_text();

        ByMimeTypeNode() {
            super(Children.create(new ByMimeTypeNodeChildren(), true));
            super.setName(NAME);
            super.setDisplayName(NAME);
            this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file_types.png");
        }

        @Override
        public boolean isLeafTypeNode() {
            return false;
        }

        @Override
        public <T> T accept(DisplayableItemNodeVisitor<T> v) {
            return v.visit(this);
        }

        @Override
        public String getItemType() {
            return getClass().getName();
        }

        boolean isEmpty() {
            return existingMimeTypes.isEmpty();
        }

    }

    private class ByMimeTypeNodeChildren extends ChildFactory<String> implements Observer {

        private ByMimeTypeNodeChildren() {
            super();
            addObserver(this);
        }

        @Override
        protected boolean createKeys(List<String> mediaTypeNodes) {
            if (!existingMimeTypes.isEmpty()) {
                mediaTypeNodes.addAll(getMediaTypeList());
            }
            return true;
        }

        @Override
        protected Node createNodeForKey(String key) {
            return new MediaTypeNode(key);
        }

        @Override
        public void update(Observable o, Object arg) {
            refresh(true);
        }

    }

    class MediaTypeNode extends DisplayableItemNode {

        MediaTypeNode(String name) {
            super(Children.create(new MediaTypeNodeChildren(name), true));
            setName(name);
            setDisplayName(name);
            this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file_types.png");
        }

        @Override
        public boolean isLeafTypeNode() {
            return false;
        }

        @Override
        public <T> T accept(DisplayableItemNodeVisitor<T> v) {
            return v.visit(this);
        }

        @Override
        public String getItemType() {
            return getClass().getName();
        }

    }

    private class MediaTypeNodeChildren extends ChildFactory<String> implements Observer {

        String mediaType;

        MediaTypeNodeChildren(String name) {
            addObserver(this);
            this.mediaType = name;
        }

        @Override
        protected boolean createKeys(List<String> mediaTypeNodes) {
            mediaTypeNodes.addAll(existingMimeTypes.get(mediaType));
            return true;
        }

        @Override
        protected Node createNodeForKey(String subtype) {
            String mimeType = mediaType + "/" + subtype;
            return new MediaSubTypeNode(mimeType);
        }

        @Override
        public void update(Observable o, Object arg) {
            refresh(true);
        }

    }

    class MediaSubTypeNode extends DisplayableItemNode implements Observer {

        private MediaSubTypeNode(String mimeType) {
            super(Children.create(new MediaSubTypeNodeChildren(mimeType), true));
            addObserver(this);
            init(mimeType);
        }

        private void init(String mimeType) {
            super.setName(mimeType);
            updateDisplayName(mimeType);
            this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file-filter-icon.png"); //NON-NLS
        }

        private void updateDisplayName(String mimeType) {
            final long count = new MediaSubTypeNodeChildren(mimeType).calculateItems(skCase, mimeType);
            String[] mimeTypeParts = mimeType.split("/");
            //joins up all remaining parts of the mimeType into one sub-type string
            super.setDisplayName(StringUtils.join(ArrayUtils.subarray(mimeTypeParts, 1, mimeTypeParts.length), "/") + " (" + count + ")");
        }

        @Override
        public boolean isLeafTypeNode() {
            return true;
        }

        @Override
        public <T> T accept(DisplayableItemNodeVisitor<T> v) {
            return v.visit(this);
        }

        @Override
        public String getItemType() {
            return getClass().getName();
        }

        @Override
        public void update(Observable o, Object arg) {
            updateDisplayName(getName());
        }
    }

    private class MediaSubTypeNodeChildren extends ChildFactory.Detachable<Content> implements Observer {

        private final String mimeType;

        private MediaSubTypeNodeChildren(String mimeType) {
            super();
            addObserver(this);
            this.mimeType = mimeType;
        }

        private long calculateItems(SleuthkitCase sleuthkitCase, String mime_type) {
            try {
                return sleuthkitCase.countFilesWhere(createQuery(mime_type));
            } catch (TskCoreException ex) {
                LOGGER.log(Level.SEVERE, "Error getting file search view count", ex); //NON-NLS
                return 0;
            }
        }

        @Override
        protected boolean createKeys(List<Content> list) {
            try {
                List<AbstractFile> files = skCase.findAllFilesWhere(createQuery(mimeType));
                list.addAll(files);
            } catch (TskCoreException ex) {
                LOGGER.log(Level.SEVERE, "Couldn't get search results", ex); //NON-NLS
            }
            return true;
        }

        private String createQuery(String mime_type) {
            StringBuilder query = new StringBuilder();
            query.append("(dir_type = ").append(TskData.TSK_FS_NAME_TYPE_ENUM.REG.getValue()).append(")"); //NON-NLS
            query.append(" AND (type IN (").append(TskData.TSK_DB_FILES_TYPE_ENUM.FS.ordinal()).append(",");  //NON-NLS
            query.append(TskData.TSK_DB_FILES_TYPE_ENUM.CARVED.ordinal()).append(",");
            query.append(TskData.TSK_DB_FILES_TYPE_ENUM.DERIVED.ordinal()).append(",");
            if (!UserPreferences.hideSlackFilesInViewsTree()) {
                query.append(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.ordinal()).append(",");
            }
            query.append(TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL.ordinal()).append("))");
            if (UserPreferences.hideKnownFilesInViewsTree()) {
                query.append(" AND (known IS NULL OR known != ").append(TskData.FileKnown.KNOWN.getFileKnownValue()).append(")"); //NON-NLS
            }
            query.append(" AND mime_type = '").append(mime_type).append("'");  //NON-NLS
            return query.toString();
        }

        @Override
        public void update(Observable o, Object arg) {
            refresh(true);
        }

        @Override
        protected Node createNodeForKey(Content key) {
            return key.accept(new ContentVisitor.Default<AbstractNode>() {
                @Override
                public FileNode visit(File f) {
                    return new FileNode(f, false);
                }

                @Override
                public DirectoryNode visit(Directory d) {
                    return new DirectoryNode(d);
                }

                @Override
                public LayoutFileNode visit(LayoutFile lf) {
                    return new LayoutFileNode(lf);
                }

                @Override
                public LocalFileNode visit(DerivedFile df) {
                    return new LocalFileNode(df);
                }

                @Override
                public LocalFileNode visit(LocalFile lf) {
                    return new LocalFileNode(lf);
                }

                @Override
                public SlackFileNode visit(SlackFile sf) {
                    return new SlackFileNode(sf, false);
                }

                @Override
                protected AbstractNode defaultVisit(Content di) {
                    throw new UnsupportedOperationException(NbBundle.getMessage(this.getClass(), "FileTypeChildren.exception.notSupported.msg", di.toString()));
                }
            });
        }
    }

}