Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
HashsetHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2015 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.HashMap;
28 import java.util.HashSet;
29 import java.util.LinkedHashMap;
30 import java.util.List;
31 import java.util.Map;
32 import java.util.Observable;
33 import java.util.Observer;
34 import java.util.Set;
35 import java.util.logging.Level;
36 import org.openide.nodes.ChildFactory;
37 import org.openide.nodes.Children;
38 import org.openide.nodes.Node;
39 import org.openide.nodes.Sheet;
40 import org.openide.util.NbBundle;
41 import org.openide.util.lookup.Lookups;
53 
57 public class HashsetHits implements AutopsyVisitableItem {
58 
59  private static final String HASHSET_HITS = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getLabel();
60  private static final String DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName();
61  private static final Logger logger = Logger.getLogger(HashsetHits.class.getName());
64 
65  public HashsetHits(SleuthkitCase skCase) {
66  this.skCase = skCase;
67  hashsetResults = new HashsetResults();
68  }
69 
70  @Override
71  public <T> T accept(AutopsyItemVisitor<T> v) {
72  return v.visit(this);
73  }
74 
79  private class HashsetResults extends Observable {
80 
81  // maps hashset name to list of artifacts for that set
82  // NOTE: the map can be accessed by multiple worker threads and needs to be synchronized
83  private final Map<String, Set<Long>> hashSetHitsMap = new LinkedHashMap<>();
84 
85  HashsetResults() {
86  update();
87  }
88 
89  List<String> getSetNames() {
90  List<String> names;
91  synchronized (hashSetHitsMap) {
92  names = new ArrayList<>(hashSetHitsMap.keySet());
93  }
94  Collections.sort(names);
95  return names;
96  }
97 
98  Set<Long> getArtifactIds(String hashSetName) {
99  synchronized (hashSetHitsMap) {
100  return hashSetHitsMap.get(hashSetName);
101  }
102  }
103 
104  @SuppressWarnings("deprecation")
105  final void update() {
106  synchronized (hashSetHitsMap) {
107  hashSetHitsMap.clear();
108  }
109 
110  if (skCase == null) {
111  return;
112  }
113 
114  int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
115  int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
116  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
117  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
118  + "attribute_type_id=" + setNameId //NON-NLS
119  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
120  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
121 
122  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
123  ResultSet resultSet = dbQuery.getResultSet();
124  synchronized (hashSetHitsMap) {
125  while (resultSet.next()) {
126  String setName = resultSet.getString("value_text"); //NON-NLS
127  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
128  if (!hashSetHitsMap.containsKey(setName)) {
129  hashSetHitsMap.put(setName, new HashSet<Long>());
130  }
131  hashSetHitsMap.get(setName).add(artifactId);
132  }
133  }
134  } catch (TskCoreException | SQLException ex) {
135  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
136  }
137 
138  setChanged();
139  notifyObservers();
140  }
141  }
142 
146  public class RootNode extends DisplayableItemNode {
147 
148  public RootNode() {
149  super(Children.create(new HashsetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
150  super.setName(HASHSET_HITS);
151  super.setDisplayName(DISPLAY_NAME);
152  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
153  }
154 
155  @Override
156  public boolean isLeafTypeNode() {
157  return false;
158  }
159 
160  @Override
161  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
162  return v.visit(this);
163  }
164 
165  @Override
166  protected Sheet createSheet() {
167  Sheet s = super.createSheet();
168  Sheet.Set ss = s.get(Sheet.PROPERTIES);
169  if (ss == null) {
170  ss = Sheet.createPropertiesSet();
171  s.put(ss);
172  }
173 
174  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
175  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
176  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
177  getName()));
178 
179  return s;
180  }
181 
182  @Override
183  public String getItemType() {
184  return getClass().getName();
185  }
186  }
187 
191  private class HashsetNameFactory extends ChildFactory.Detachable<String> implements Observer {
192 
193  /*
194  * This should probably be in the HashsetHits class, but the factory has
195  * nice methods for its startup and shutdown, so it seemed like a
196  * cleaner place to register the property change listener.
197  */
198  private final PropertyChangeListener pcl = new PropertyChangeListener() {
199  @Override
200  public void propertyChange(PropertyChangeEvent evt) {
201  String eventType = evt.getPropertyName();
202  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
209  try {
216  ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
217  if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
218  hashsetResults.update();
219  }
220  } catch (IllegalStateException notUsed) {
224  }
225  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
226  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
233  try {
235  hashsetResults.update();
236  } catch (IllegalStateException notUsed) {
240  }
241  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
242  // case was closed. Remove listeners so that we don't get called with a stale case handle
243  if (evt.getNewValue() == null) {
244  removeNotify();
245  skCase = null;
246  }
247  }
248  }
249  };
250 
251  @Override
252  protected void addNotify() {
256  hashsetResults.update();
257  hashsetResults.addObserver(this);
258  }
259 
260  @Override
261  protected void removeNotify() {
265  hashsetResults.deleteObserver(this);
266  }
267 
268  @Override
269  protected boolean createKeys(List<String> list) {
270  list.addAll(hashsetResults.getSetNames());
271  return true;
272  }
273 
274  @Override
275  protected Node createNodeForKey(String key) {
276  return new HashsetNameNode(key);
277  }
278 
279  @Override
280  public void update(Observable o, Object arg) {
281  refresh(true);
282  }
283  }
284 
288  public class HashsetNameNode extends DisplayableItemNode implements Observer {
289 
290  private final String hashSetName;
291 
292  public HashsetNameNode(String hashSetName) {
293  super(Children.create(new HitFactory(hashSetName), true), Lookups.singleton(hashSetName));
294  super.setName(hashSetName);
295  this.hashSetName = hashSetName;
297  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
298  hashsetResults.addObserver(this);
299  }
300 
304  private void updateDisplayName() {
305  super.setDisplayName(hashSetName + " (" + hashsetResults.getArtifactIds(hashSetName).size() + ")");
306  }
307 
308  @Override
309  public boolean isLeafTypeNode() {
310  return true;
311  }
312 
313  @Override
314  protected Sheet createSheet() {
315  Sheet s = super.createSheet();
316  Sheet.Set ss = s.get(Sheet.PROPERTIES);
317  if (ss == null) {
318  ss = Sheet.createPropertiesSet();
319  s.put(ss);
320  }
321 
322  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
323  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
324  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
325  getName()));
326 
327  return s;
328  }
329 
330  @Override
331  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
332  return v.visit(this);
333  }
334 
335  @Override
336  public void update(Observable o, Object arg) {
338  }
339 
340  @Override
341  public String getItemType() {
346  return getClass().getName();
347  }
348  }
349 
353  private class HitFactory extends ChildFactory.Detachable<Long> implements Observer {
354 
355  private String hashsetName;
356  private Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
357 
358  private HitFactory(String hashsetName) {
359  super();
360  this.hashsetName = hashsetName;
361  }
362 
363  @Override
364  protected void addNotify() {
365  hashsetResults.addObserver(this);
366  }
367 
368  @Override
369  protected void removeNotify() {
370  hashsetResults.deleteObserver(this);
371  }
372 
373  @Override
374  protected boolean createKeys(List<Long> list) {
375 
376  if (skCase == null) {
377  return true;
378  }
379 
380  hashsetResults.getArtifactIds(hashsetName).forEach((id) -> {
381  try {
382  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
383 
384  artifactHits.put(id, art);
385  list.add(id);
386  } catch (TskException ex) {
387  logger.log(Level.SEVERE, "TSK Exception occurred", ex); //NON-NLS
388  }
389  });
390  return true;
391  }
392 
393  @Override
394  protected Node createNodeForKey(Long id) {
395  BlackboardArtifact art = artifactHits.get(id);
396  return (null == art) ? null : new BlackboardArtifactNode(art);
397  }
398 
399  @Override
400  public void update(Observable o, Object arg) {
401  refresh(true);
402  }
403  }
404 }
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
static void removePropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:384
BlackboardArtifact getBlackboardArtifact(long artifactID)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static void addPropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:372
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
CaseDbQuery executeQuery(String query)

Copyright © 2012-2016 Basis Technology. Generated on: Mon Apr 24 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.