19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
33 import java.util.Observable;
34 import java.util.Observer;
36 import java.util.logging.Level;
37 import org.openide.nodes.ChildFactory;
38 import org.openide.nodes.Children;
39 import org.openide.nodes.Node;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.Lookups;
48 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
49 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
51 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
60 private static final String
HASHSET_HITS = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getLabel();
61 private static final String
DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName();
90 List<String> getSetNames() {
93 names =
new ArrayList<>(hashSetHitsMap.keySet());
95 Collections.sort(names);
99 Set<Long> getArtifactIds(String hashSetName) {
101 return hashSetHitsMap.get(hashSetName);
105 @SuppressWarnings(
"deprecation")
106 final
void update() {
108 hashSetHitsMap.clear();
111 if (skCase == null) {
115 int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
116 int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
117 String query =
"SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id "
118 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
119 +
"attribute_type_id=" + setNameId
120 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
121 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
123 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
124 ResultSet resultSet = dbQuery.getResultSet();
126 while (resultSet.next()) {
127 String setName = resultSet.getString(
"value_text");
128 long artifactId = resultSet.getLong(
"artifact_id");
129 if (!hashSetHitsMap.containsKey(setName)) {
130 hashSetHitsMap.put(setName,
new HashSet<Long>());
132 hashSetHitsMap.get(setName).add(artifactId);
135 }
catch (TskCoreException | SQLException ex) {
136 logger.log(Level.WARNING,
"SQL Exception occurred: ", ex);
150 super(Children.create(
new HashsetNameFactory(),
true), Lookups.singleton(DISPLAY_NAME));
151 super.setName(HASHSET_HITS);
152 super.setDisplayName(DISPLAY_NAME);
153 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/hashset_hits.png");
163 return v.
visit(
this);
168 Sheet s = super.createSheet();
169 Sheet.Set ss = s.get(Sheet.PROPERTIES);
171 ss = Sheet.createPropertiesSet();
175 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"HashsetHits.createSheet.name.name"),
176 NbBundle.getMessage(
this.getClass(),
"HashsetHits.createSheet.name.displayName"),
177 NbBundle.getMessage(
this.getClass(),
"HashsetHits.createSheet.name.desc"),
185 return getClass().getName();
199 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
201 public void propertyChange(PropertyChangeEvent evt) {
202 String eventType = evt.getPropertyName();
218 if (null != eventData && eventData.
getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
219 hashsetResults.update();
221 }
catch (IllegalStateException notUsed) {
236 hashsetResults.update();
237 }
catch (IllegalStateException notUsed) {
244 if (evt.getNewValue() == null) {
257 hashsetResults.update();
258 hashsetResults.addObserver(
this);
266 hashsetResults.deleteObserver(
this);
271 list.addAll(hashsetResults.getSetNames());
281 public void update(Observable o, Object arg) {
294 super(Children.create(
new HitFactory(hashSetName),
true), Lookups.singleton(hashSetName));
295 super.setName(hashSetName);
298 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/hashset_hits.png");
299 hashsetResults.addObserver(
this);
306 super.setDisplayName(hashSetName +
" (" + hashsetResults.getArtifactIds(hashSetName).size() +
")");
316 Sheet s = super.createSheet();
317 Sheet.Set ss = s.get(Sheet.PROPERTIES);
319 ss = Sheet.createPropertiesSet();
323 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"HashsetHits.createSheet.name.name"),
324 NbBundle.getMessage(
this.getClass(),
"HashsetHits.createSheet.name.displayName"),
325 NbBundle.getMessage(
this.getClass(),
"HashsetHits.createSheet.name.desc"),
333 return v.
visit(
this);
337 public void update(Observable o, Object arg) {
347 return getClass().getName();
354 private class HitFactory extends ChildFactory.Detachable<Long> implements Observer {
366 hashsetResults.addObserver(
this);
371 hashsetResults.deleteObserver(
this);
377 if (skCase == null) {
381 hashsetResults.getArtifactIds(hashsetName).forEach((
id) -> {
383 if (!artifactHits.containsKey(
id)) {
384 BlackboardArtifact art = skCase.getBlackboardArtifact(
id);
385 artifactHits.put(
id, art);
388 }
catch (TskException ex) {
389 logger.log(Level.SEVERE,
"TSK Exception occurred", ex);
397 BlackboardArtifact art = artifactHits.get(
id);
402 public void update(Observable o, Object arg) {
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
Map< Long, BlackboardArtifact > artifactHits
static synchronized IngestManager getInstance()
HashsetNameNode(String hashSetName)
static final String DISPLAY_NAME
HitFactory(String hashsetName)
boolean createKeys(List< String > list)
Node createNodeForKey(String key)
static final String HASHSET_HITS
static final Logger logger
T visit(DataSourcesNode in)
void update(Observable o, Object arg)
HashsetHits(SleuthkitCase skCase)
void removeIngestJobEventListener(final PropertyChangeListener listener)
boolean createKeys(List< Long > list)
void addIngestJobEventListener(final PropertyChangeListener listener)
final Map< String, Set< Long > > hashSetHitsMap
void update(Observable o, Object arg)
final PropertyChangeListener pcl
void addIngestModuleEventListener(final PropertyChangeListener listener)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
void update(Observable o, Object arg)
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Node createNodeForKey(Long id)
final HashsetResults hashsetResults