Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Static Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.timeline.TimeLineController Class Reference


class  AutopsyCaseListener
class  AutopsyIngestJobListener
class  AutopsyIngestModuleListener

Public Member Functions

 TimeLineController (Case autoCase) throws IOException
synchronized void advance ()
void applyDefaultFilters ()
synchronized ReadOnlyBooleanProperty canAdvanceProperty ()
synchronized ReadOnlyBooleanProperty canRetreatProperty ()
ReadOnlyBooleanProperty eventsDBStaleProperty ()
Case getAutopsyCase ()
FilteredEventsModel getEventsModel ()
ObservableSet< TimeLineEventgetPinnedEvents ()
ObservableList< DescriptionFiltergetQuickHideFilters ()
synchronized ObservableList< Long > getSelectedEventIDs ()
synchronized Interval getSelectedTimeRange ()
synchronized ReadOnlyListProperty< Task<?> > getTasks ()
synchronized ViewMode getViewMode ()
boolean isEventsDBStale ()
synchronized void monitorTask (final Task<?> task)
void pinEvent (TimeLineEvent event)
synchronized void pushDescrLOD (DescriptionLoD newLOD)
synchronized void pushEventTypeZoom (EventTypeZoomLevel typeZoomeLevel)
synchronized void pushFilters (RootFilter filter)
synchronized void pushPeriod (ReadablePeriod period)
synchronized void pushTimeAndType (Interval timeRange, EventTypeZoomLevel typeZoom)
synchronized boolean pushTimeRange (Interval timeRange)
synchronized boolean pushTimeUnit (TimeUnits timeUnit)
synchronized void pushZoomInTime ()
synchronized void pushZoomOutTime ()
void rebuildRepo ()
synchronized void registerForEvents (Object o)
synchronized void retreat ()
synchronized ReadOnlyObjectProperty< Interval > selectedTimeRangeProperty ()
synchronized void selectEventIDs (Collection< Long > eventIDs)
void selectTimeAndType (Interval interval, EventType type)
void setStatusMessage (String string)
synchronized void setViewMode (ViewMode viewMode)
void shutDownTimeLine ()
ReadOnlyStringProperty statusMessageProperty ()
synchronized ReadOnlyStringProperty taskMessageProperty ()
synchronized ReadOnlyDoubleProperty taskProgressProperty ()
synchronized ReadOnlyStringProperty taskTitleProperty ()
void unPinEvent (TimeLineEvent event)
synchronized void unRegisterForEvents (Object o)
synchronized ReadOnlyObjectProperty< ViewModeviewModeProperty ()
void zoomOutToActivity ()

Static Public Member Functions

static DateTimeZone getJodaTimeZone ()
static ReadOnlyObjectProperty< TimeZone > getTimeZone ()
static ZoneId getTimeZoneID ()
static DateTimeFormatter getZonedFormatter ()
static synchronized void setTimeZone (TimeZone timeZone)

Private Member Functions

synchronized void advance (ZoomParams newState)
List< String > getRebuildReasons ()
void promptForRebuild (AbstractFile file, BlackboardArtifact artifact)
void rebuildRepo (AbstractFile file, BlackboardArtifact artifact)
void rebuildRepoHelper (Function< Consumer< Worker.State >, CancellationProgressTask<?>> repoBuilder, Boolean markDBNotStale, AbstractFile file, BlackboardArtifact artifact)
void rebuildTagsTable (AbstractFile file, BlackboardArtifact artifact)
void setEventsDBStale (final Boolean stale)
boolean showFullRange ()
void showInListView (ViewInTimelineRequestedEvent requestEvent)
synchronized void showWindow ()

Private Attributes

final Case autoCase
final PropertyChangeListener caseListener = new AutopsyCaseListener()
final ReadOnlyObjectWrapper< ZoomParamscurrentParams = new ReadOnlyObjectWrapper<>()
EventBus eventbus = new EventBus("TimeLineController_EventBus")
final ReadOnlyBooleanWrapper eventsDBStale = new ReadOnlyBooleanWrapper(true)
final EventsRepository eventsRepository
final ExecutorService executor = Executors.newSingleThreadExecutor()
final FilteredEventsModel filteredEvents
final History< ZoomParamshistoryManager = new History<>()
final PropertyChangeListener ingestJobListener = new AutopsyIngestJobListener()
final PropertyChangeListener ingestModuleListener = new AutopsyIngestModuleListener()
final ZoomParams InitialZoomState
boolean listeningToAutopsy = false
final PerCaseTimelineProperties perCaseTimelineProperties
final ObservableSet< TimeLineEventpinnedEvents = FXCollections.observableSet()
final ObservableSet< TimeLineEventpinnedEventsUnmodifiable = FXCollections.unmodifiableObservableSet(pinnedEvents)
final PromptDialogManager promptDialogManager = new PromptDialogManager(this)
final ObservableList< DescriptionFilterquickHideFilters = FXCollections.observableArrayList()
final ObservableList< Long > selectedEventIDs = FXCollections.<Long>observableArrayList()
final ReadOnlyObjectWrapper< Interval > selectedTimeRange = new ReadOnlyObjectWrapper<>()
final ReadOnlyStringWrapper statusMessage = new ReadOnlyStringWrapper()
final ReadOnlyStringWrapper taskMessage = new ReadOnlyStringWrapper()
final ReadOnlyDoubleWrapper taskProgress = new ReadOnlyDoubleWrapper(-1)
final ReadOnlyListWrapper< Task<?> > tasks = new ReadOnlyListWrapper<>(FXCollections.observableArrayList())
final ReadOnlyStringWrapper taskTitle = new ReadOnlyStringWrapper()
TimeLineTopComponent topComponent
final ReadOnlyObjectWrapper< ViewModeviewMode = new ReadOnlyObjectWrapper<>(ViewMode.COUNTS)

Static Private Attributes

static final Logger LOGGER = Logger.getLogger(TimeLineController.class.getName())
static final ReadOnlyObjectWrapper< TimeZone > timeZone = new ReadOnlyObjectWrapper<>(TimeZone.getDefault())

Detailed Description

Controller in the MVC design along with FilteredEventsModel TimeLineView. Forwards interpreted user gestures form views to model. Provides model to view. Is entry point for timeline module.

Concurrency Policy:

Definition at line 116 of file

Constructor & Destructor Documentation

org.sleuthkit.autopsy.timeline.TimeLineController.TimeLineController ( Case  autoCase) throws IOException

Member Function Documentation

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.advance ( )

Definition at line 803 of file

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.advance ( ZoomParams  newState)

Definition at line 811 of file

void org.sleuthkit.autopsy.timeline.TimeLineController.applyDefaultFilters ( )
synchronized ReadOnlyBooleanProperty org.sleuthkit.autopsy.timeline.TimeLineController.canAdvanceProperty ( )

Definition at line 298 of file

synchronized ReadOnlyBooleanProperty org.sleuthkit.autopsy.timeline.TimeLineController.canRetreatProperty ( )

Definition at line 302 of file

ReadOnlyBooleanProperty org.sleuthkit.autopsy.timeline.TimeLineController.eventsDBStaleProperty ( )
Case org.sleuthkit.autopsy.timeline.TimeLineController.getAutopsyCase ( )
FilteredEventsModel org.sleuthkit.autopsy.timeline.TimeLineController.getEventsModel ( )
static DateTimeZone org.sleuthkit.autopsy.timeline.TimeLineController.getJodaTimeZone ( )
ObservableSet<TimeLineEvent> org.sleuthkit.autopsy.timeline.TimeLineController.getPinnedEvents ( )

Definition at line 386 of file

ObservableList<DescriptionFilter> org.sleuthkit.autopsy.timeline.TimeLineController.getQuickHideFilters ( )
List<String> org.sleuthkit.autopsy.timeline.TimeLineController.getRebuildReasons ( )

Get a list of reasons why the user might won't to rebuild the database. The potential reasons are not necessarily orthogonal to each other.

A list of reasons why the user might won't to rebuild the database.

Definition at line 637 of file

References org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Notify.error().

synchronized ObservableList<Long> org.sleuthkit.autopsy.timeline.TimeLineController.getSelectedEventIDs ( )

Get an ObservableList of selected event IDs

A list of the selected event IDs

Definition at line 241 of file

Referenced by, and org.sleuthkit.autopsy.timeline.TimeLineTopComponent.TimeLineTopComponent().

synchronized Interval org.sleuthkit.autopsy.timeline.TimeLineController.getSelectedTimeRange ( )

Get the selected time range.

The selected time range.

Definition at line 259 of file

synchronized ReadOnlyListProperty<Task<?> > org.sleuthkit.autopsy.timeline.TimeLineController.getTasks ( )

Definition at line 181 of file

static ReadOnlyObjectProperty<TimeZone> org.sleuthkit.autopsy.timeline.TimeLineController.getTimeZone ( )
static ZoneId org.sleuthkit.autopsy.timeline.TimeLineController.getTimeZoneID ( )
synchronized ViewMode org.sleuthkit.autopsy.timeline.TimeLineController.getViewMode ( )
static DateTimeFormatter org.sleuthkit.autopsy.timeline.TimeLineController.getZonedFormatter ( )
boolean org.sleuthkit.autopsy.timeline.TimeLineController.isEventsDBStale ( )

Is the events db out of date (stale)?

True if the events db is out of date , false otherwise

Definition at line 272 of file

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.monitorTask ( final Task<?>  task)

submit a task for execution and add it to the list of tasks whose progress is monitored and displayed in the progress bar


Definition at line 861 of file

Referenced by org.sleuthkit.autopsy.timeline.ui.AbstractTimeLineView.refresh(), and org.sleuthkit.autopsy.timeline.ui.ViewFrame.refreshHistorgram().

void org.sleuthkit.autopsy.timeline.TimeLineController.pinEvent ( TimeLineEvent  event)

Definition at line 378 of file

void org.sleuthkit.autopsy.timeline.TimeLineController.promptForRebuild ( AbstractFile  file,
BlackboardArtifact  artifact 

Prompt the user to confirm rebuilding the db. Checks if a database rebuild is necessary and includes the reasons in the prompt. If the user confirms, rebuilds the database. Shows the timeline window when the rebuild is done, or immediately if the rebuild is not confirmed.

fileThe AbstractFile from which to choose an event to show in the List View.
artifactThe BlackboardArtifact to show in the List View.

Definition at line 592 of file

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.pushDescrLOD ( DescriptionLoD  newLOD)
synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.pushEventTypeZoom ( EventTypeZoomLevel  typeZoomeLevel)
synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.pushFilters ( RootFilter  filter)
synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.pushPeriod ( ReadablePeriod  period)

Request a time range the same length as the given period and centered around the middle of the currently viewed time range.

periodThe period of time to show around the current center of the view.

Definition at line 670 of file

References org.sleuthkit.autopsy.timeline.utils.IntervalUtils.getIntervalAroundMiddle().

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.pushTimeAndType ( Interval  timeRange,
EventTypeZoomLevel  typeZoom 
synchronized boolean org.sleuthkit.autopsy.timeline.TimeLineController.pushTimeRange ( Interval  timeRange)

Set the new interval to view, and record it in the history. The interval will be clamped to the span of events in the current case.

timeRangeThe Interval to view.
True if the interval was changed. False if the interval was the same as the existing one and no change happened.

Definition at line 728 of file

References org.sleuthkit.autopsy.timeline.zooming.ZoomParams.hasTimeRange(), and org.sleuthkit.autopsy.timeline.zooming.ZoomParams.withTimeRange().

Referenced by org.sleuthkit.autopsy.timeline.ui.ViewFrame.PickerListener.invalidated(), and org.sleuthkit.autopsy.timeline.ui.IntervalSelector< DateTime >.zoomToSelectedInterval().

synchronized boolean org.sleuthkit.autopsy.timeline.TimeLineController.pushTimeUnit ( TimeUnits  timeUnit)

Change the view by setting a new time range that is the length of timeUnit and centered at the current center.

timeUnitThe unit of time to view
true if the view actually changed.

Definition at line 762 of file

References org.sleuthkit.autopsy.timeline.zooming.TimeUnits.FOREVER, org.sleuthkit.autopsy.timeline.utils.IntervalUtils.getIntervalAroundMiddle(), and org.sleuthkit.autopsy.timeline.zooming.TimeUnits.getPeriod().

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.pushZoomInTime ( )
synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.pushZoomOutTime ( )
void org.sleuthkit.autopsy.timeline.TimeLineController.rebuildRepo ( )

Rebuild the entire repo in the background, and show the timeline when done.

Definition at line 487 of file

Referenced by org.sleuthkit.autopsy.timeline.actions.UpdateDB.UpdateDB().

void org.sleuthkit.autopsy.timeline.TimeLineController.rebuildRepo ( AbstractFile  file,
BlackboardArtifact  artifact 

Rebuild the entire repo in the background, and show the timeline when done.

fileThe AbstractFile from which to choose an event to show in the List View.
artifactThe BlackboardArtifact to show in the List View.

Definition at line 500 of file

void org.sleuthkit.autopsy.timeline.TimeLineController.rebuildRepoHelper ( Function< Consumer< Worker.State >, CancellationProgressTask<?>>  repoBuilder,
Boolean  markDBNotStale,
AbstractFile  file,
BlackboardArtifact  artifact 

Rebuild the repo using the given repoBuilder (expected to be a member reference to EventsRepository.rebuildRepository() or EventsRepository.rebuildTags()) and display the UI when it is done. If either file or artifact is not null the user will be prompted to choose a derived event and time range to show in the Timeline List View.

repoBuilderA Function from Consumer<Worker.State> to CancellationProgressTask<?>. Ie a function that given a worker state listener, produces a task with that listener attached. Expected to be a method reference to either EventsRepository.rebuildRepository() or EventsRepository.rebuildTags()
markDBNotStaleAfter the repo is rebuilt should it be marked not stale
fileThe AbstractFile from which to choose an event to show in the List View.
artifactThe BlackboardArtifact to show in the List View.

Definition at line 414 of file

References org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Notify.error(), org.sleuthkit.autopsy.ingest.IngestManager.getInstance(), org.sleuthkit.autopsy.ingest.IngestManager.isIngestRunning(), and org.sleuthkit.autopsy.timeline.TimeLineController.showFullRange().

void org.sleuthkit.autopsy.timeline.TimeLineController.rebuildTagsTable ( AbstractFile  file,
BlackboardArtifact  artifact 

Drop the tags table and rebuild it in the background, and show the timeline when done.

fileThe AbstractFile from which to choose an event to show in the List View.
artifactThe BlackboardArtifact to show in the List View.

Definition at line 513 of file

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.registerForEvents ( Object  o)

Register the given object to receive events.

oThe object to register. Must implement public methods annotated with Subscribe.

Definition at line 917 of file

Referenced by org.sleuthkit.autopsy.timeline.ui.ViewFrame.syncViewMode().

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.retreat ( )
synchronized ReadOnlyObjectProperty<Interval> org.sleuthkit.autopsy.timeline.TimeLineController.selectedTimeRangeProperty ( )

Get a read only observable view of the selected time range.

A read only view of the selected time range.

Definition at line 250 of file

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.selectEventIDs ( Collection< Long >  eventIDs)

Select the given event IDs and set their spanning interval as the selected time range.

eventIDsThe eventIDs to select

Definition at line 821 of file

Referenced by org.sleuthkit.autopsy.timeline.ui.detailview.DetailViewPane.DetailViewPane().

void org.sleuthkit.autopsy.timeline.TimeLineController.selectTimeAndType ( Interval  interval,
EventType  type 
void org.sleuthkit.autopsy.timeline.TimeLineController.setEventsDBStale ( final Boolean  stale)

Set the events database stale or not

staleThe new state of the events db: stale/not-stale

Definition at line 285 of file

References org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Notify.error().

void org.sleuthkit.autopsy.timeline.TimeLineController.setStatusMessage ( String  string)

Definition at line 161 of file

static synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.setTimeZone ( TimeZone  timeZone)
synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.setViewMode ( ViewMode  viewMode)

Set a new ViewMode as the active one.

viewModeThe new ViewMode to set.

Definition at line 315 of file

boolean org.sleuthkit.autopsy.timeline.TimeLineController.showFullRange ( )

Show the entire range of the timeline.

Definition at line 520 of file

Referenced by org.sleuthkit.autopsy.timeline.TimeLineController.rebuildRepoHelper().

void org.sleuthkit.autopsy.timeline.TimeLineController.showInListView ( ViewInTimelineRequestedEvent  requestEvent)

Show the events and the amount of time indicated in the given ViewInTimelineRequestedEvent in the List View.

requestEventContains the ID of the requested events and the timerange to show.

Definition at line 534 of file

References org.sleuthkit.autopsy.timeline.ViewMode.LIST.

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.showWindow ( )

Show the timeline TimeLineTopComponent. This method will construct a new instance of TimeLineTopComponent if necessary.

Definition at line 697 of file

void org.sleuthkit.autopsy.timeline.TimeLineController.shutDownTimeLine ( )
ReadOnlyStringProperty org.sleuthkit.autopsy.timeline.TimeLineController.statusMessageProperty ( )

Status is a string that will be displayed in the status bar as a kind of user hint/information when it is not empty

The status property

Definition at line 157 of file

synchronized ReadOnlyStringProperty org.sleuthkit.autopsy.timeline.TimeLineController.taskMessageProperty ( )

Definition at line 189 of file

synchronized ReadOnlyDoubleProperty org.sleuthkit.autopsy.timeline.TimeLineController.taskProgressProperty ( )

Definition at line 185 of file

synchronized ReadOnlyStringProperty org.sleuthkit.autopsy.timeline.TimeLineController.taskTitleProperty ( )

Definition at line 193 of file

void org.sleuthkit.autopsy.timeline.TimeLineController.unPinEvent ( TimeLineEvent  event)

Definition at line 382 of file

synchronized void org.sleuthkit.autopsy.timeline.TimeLineController.unRegisterForEvents ( Object  o)

Un-register the given object, so it no longer receives events.

oThe object to un-register.

Definition at line 926 of file

synchronized ReadOnlyObjectProperty<ViewMode> org.sleuthkit.autopsy.timeline.TimeLineController.viewModeProperty ( )
void org.sleuthkit.autopsy.timeline.TimeLineController.zoomOutToActivity ( )

Member Data Documentation

final Case org.sleuthkit.autopsy.timeline.TimeLineController.autoCase

Definition at line 164 of file

final PropertyChangeListener org.sleuthkit.autopsy.timeline.TimeLineController.caseListener = new AutopsyCaseListener()

Definition at line 204 of file

final ReadOnlyObjectWrapper<ZoomParams> org.sleuthkit.autopsy.timeline.TimeLineController.currentParams = new ReadOnlyObjectWrapper<>()

Definition at line 223 of file

EventBus org.sleuthkit.autopsy.timeline.TimeLineController.eventbus = new EventBus("TimeLineController_EventBus")

Definition at line 149 of file

final ReadOnlyBooleanWrapper org.sleuthkit.autopsy.timeline.TimeLineController.eventsDBStale = new ReadOnlyBooleanWrapper(true)

Definition at line 232 of file

final EventsRepository org.sleuthkit.autopsy.timeline.TimeLineController.eventsRepository

Definition at line 214 of file

final ExecutorService org.sleuthkit.autopsy.timeline.TimeLineController.executor = Executors.newSingleThreadExecutor()

Definition at line 138 of file

final FilteredEventsModel org.sleuthkit.autopsy.timeline.TimeLineController.filteredEvents

Definition at line 212 of file

final History<ZoomParams> org.sleuthkit.autopsy.timeline.TimeLineController.historyManager = new History<>()

Definition at line 220 of file

final PropertyChangeListener org.sleuthkit.autopsy.timeline.TimeLineController.ingestJobListener = new AutopsyIngestJobListener()

Definition at line 205 of file

final PropertyChangeListener org.sleuthkit.autopsy.timeline.TimeLineController.ingestModuleListener = new AutopsyIngestModuleListener()

Definition at line 206 of file

final ZoomParams org.sleuthkit.autopsy.timeline.TimeLineController.InitialZoomState

Definition at line 217 of file

boolean org.sleuthkit.autopsy.timeline.TimeLineController.listeningToAutopsy = false

Definition at line 202 of file

final Logger org.sleuthkit.autopsy.timeline.TimeLineController.LOGGER = Logger.getLogger(TimeLineController.class.getName())

Definition at line 118 of file

final PerCaseTimelineProperties org.sleuthkit.autopsy.timeline.TimeLineController.perCaseTimelineProperties

Definition at line 165 of file

final ObservableSet<TimeLineEvent> org.sleuthkit.autopsy.timeline.TimeLineController.pinnedEvents = FXCollections.observableSet()

Definition at line 375 of file

final ObservableSet<TimeLineEvent> org.sleuthkit.autopsy.timeline.TimeLineController.pinnedEventsUnmodifiable = FXCollections.unmodifiableObservableSet(pinnedEvents)

Definition at line 376 of file

final PromptDialogManager org.sleuthkit.autopsy.timeline.TimeLineController.promptDialogManager = new PromptDialogManager(this)

Definition at line 234 of file

final ObservableList<DescriptionFilter> org.sleuthkit.autopsy.timeline.TimeLineController.quickHideFilters = FXCollections.observableArrayList()

Definition at line 168 of file

final ObservableList<Long> org.sleuthkit.autopsy.timeline.TimeLineController.selectedEventIDs = FXCollections.<Long>observableArrayList()

Definition at line 227 of file

final ReadOnlyObjectWrapper<Interval> org.sleuthkit.autopsy.timeline.TimeLineController.selectedTimeRange = new ReadOnlyObjectWrapper<>()

Definition at line 230 of file

final ReadOnlyStringWrapper org.sleuthkit.autopsy.timeline.TimeLineController.statusMessage = new ReadOnlyStringWrapper()

Definition at line 148 of file

final ReadOnlyStringWrapper org.sleuthkit.autopsy.timeline.TimeLineController.taskMessage = new ReadOnlyStringWrapper()

Definition at line 144 of file

final ReadOnlyDoubleWrapper org.sleuthkit.autopsy.timeline.TimeLineController.taskProgress = new ReadOnlyDoubleWrapper(-1)

Definition at line 142 of file

final ReadOnlyListWrapper<Task<?> > org.sleuthkit.autopsy.timeline.TimeLineController.tasks = new ReadOnlyListWrapper<>(FXCollections.observableArrayList())

Definition at line 140 of file

final ReadOnlyStringWrapper org.sleuthkit.autopsy.timeline.TimeLineController.taskTitle = new ReadOnlyStringWrapper()

Definition at line 146 of file

final ReadOnlyObjectWrapper<TimeZone> org.sleuthkit.autopsy.timeline.TimeLineController.timeZone = new ReadOnlyObjectWrapper<>(TimeZone.getDefault())
TimeLineTopComponent org.sleuthkit.autopsy.timeline.TimeLineController.topComponent

Definition at line 198 of file

final ReadOnlyObjectWrapper<ViewMode> org.sleuthkit.autopsy.timeline.TimeLineController.viewMode = new ReadOnlyObjectWrapper<>(ViewMode.COUNTS)

Definition at line 209 of file

The documentation for this class was generated from the following file:

Copyright © 2012-2016 Basis Technology. Generated on: Mon Apr 24 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.