Autopsy  4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
HashsetHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2015 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
32 import java.util.Map;
33 import java.util.Observable;
34 import java.util.Observer;
35 import java.util.Set;
36 import java.util.logging.Level;
37 import org.openide.nodes.ChildFactory;
38 import org.openide.nodes.Children;
39 import org.openide.nodes.Node;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.Lookups;
47 import org.sleuthkit.datamodel.BlackboardArtifact;
48 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
49 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
50 import org.sleuthkit.datamodel.SleuthkitCase;
51 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
52 import org.sleuthkit.datamodel.TskCoreException;
53 import org.sleuthkit.datamodel.TskException;
54 
58 public class HashsetHits implements AutopsyVisitableItem {
59 
60  private static final String HASHSET_HITS = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getLabel();
61  private static final String DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName();
62  private static final Logger logger = Logger.getLogger(HashsetHits.class.getName());
63  private SleuthkitCase skCase;
65 
66  public HashsetHits(SleuthkitCase skCase) {
67  this.skCase = skCase;
68  hashsetResults = new HashsetResults();
69  }
70 
71  @Override
72  public <T> T accept(AutopsyItemVisitor<T> v) {
73  return v.visit(this);
74  }
75 
80  private class HashsetResults extends Observable {
81 
82  // maps hashset name to list of artifacts for that set
83  // NOTE: the map can be accessed by multiple worker threads and needs to be synchronized
84  private final Map<String, Set<Long>> hashSetHitsMap = new LinkedHashMap<>();
85 
86  HashsetResults() {
87  update();
88  }
89 
90  List<String> getSetNames() {
91  List<String> names;
92  synchronized (hashSetHitsMap) {
93  names = new ArrayList<>(hashSetHitsMap.keySet());
94  }
95  Collections.sort(names);
96  return names;
97  }
98 
99  Set<Long> getArtifactIds(String hashSetName) {
100  synchronized (hashSetHitsMap) {
101  return hashSetHitsMap.get(hashSetName);
102  }
103  }
104 
105  @SuppressWarnings("deprecation")
106  final void update() {
107  synchronized (hashSetHitsMap) {
108  hashSetHitsMap.clear();
109  }
110 
111  if (skCase == null) {
112  return;
113  }
114 
115  int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
116  int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
117  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
118  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
119  + "attribute_type_id=" + setNameId //NON-NLS
120  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
121  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
122 
123  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
124  ResultSet resultSet = dbQuery.getResultSet();
125  synchronized (hashSetHitsMap) {
126  while (resultSet.next()) {
127  String setName = resultSet.getString("value_text"); //NON-NLS
128  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
129  if (!hashSetHitsMap.containsKey(setName)) {
130  hashSetHitsMap.put(setName, new HashSet<Long>());
131  }
132  hashSetHitsMap.get(setName).add(artifactId);
133  }
134  }
135  } catch (TskCoreException | SQLException ex) {
136  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
137  }
138 
139  setChanged();
140  notifyObservers();
141  }
142  }
143 
147  public class RootNode extends DisplayableItemNode {
148 
149  public RootNode() {
150  super(Children.create(new HashsetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
151  super.setName(HASHSET_HITS);
152  super.setDisplayName(DISPLAY_NAME);
153  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
154  }
155 
156  @Override
157  public boolean isLeafTypeNode() {
158  return false;
159  }
160 
161  @Override
162  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
163  return v.visit(this);
164  }
165 
166  @Override
167  protected Sheet createSheet() {
168  Sheet s = super.createSheet();
169  Sheet.Set ss = s.get(Sheet.PROPERTIES);
170  if (ss == null) {
171  ss = Sheet.createPropertiesSet();
172  s.put(ss);
173  }
174 
175  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
176  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
177  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
178  getName()));
179 
180  return s;
181  }
182 
183  @Override
184  public String getItemType() {
185  return getClass().getName();
186  }
187  }
188 
192  private class HashsetNameFactory extends ChildFactory.Detachable<String> implements Observer {
193 
194  /*
195  * This should probably be in the HashsetHits class, but the factory has
196  * nice methods for its startup and shutdown, so it seemed like a
197  * cleaner place to register the property change listener.
198  */
199  private final PropertyChangeListener pcl = new PropertyChangeListener() {
200  @Override
201  public void propertyChange(PropertyChangeEvent evt) {
202  String eventType = evt.getPropertyName();
203  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
210  try {
217  ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
218  if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
219  hashsetResults.update();
220  }
221  } catch (IllegalStateException notUsed) {
225  }
226  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
227  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
234  try {
236  hashsetResults.update();
237  } catch (IllegalStateException notUsed) {
241  }
242  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
243  // case was closed. Remove listeners so that we don't get called with a stale case handle
244  if (evt.getNewValue() == null) {
245  removeNotify();
246  skCase = null;
247  }
248  }
249  }
250  };
251 
252  @Override
253  protected void addNotify() {
257  hashsetResults.update();
258  hashsetResults.addObserver(this);
259  }
260 
261  @Override
262  protected void removeNotify() {
266  hashsetResults.deleteObserver(this);
267  }
268 
269  @Override
270  protected boolean createKeys(List<String> list) {
271  list.addAll(hashsetResults.getSetNames());
272  return true;
273  }
274 
275  @Override
276  protected Node createNodeForKey(String key) {
277  return new HashsetNameNode(key);
278  }
279 
280  @Override
281  public void update(Observable o, Object arg) {
282  refresh(true);
283  }
284  }
285 
289  public class HashsetNameNode extends DisplayableItemNode implements Observer {
290 
291  private final String hashSetName;
292 
293  public HashsetNameNode(String hashSetName) {
294  super(Children.create(new HitFactory(hashSetName), true), Lookups.singleton(hashSetName));
295  super.setName(hashSetName);
296  this.hashSetName = hashSetName;
298  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
299  hashsetResults.addObserver(this);
300  }
301 
305  private void updateDisplayName() {
306  super.setDisplayName(hashSetName + " (" + hashsetResults.getArtifactIds(hashSetName).size() + ")");
307  }
308 
309  @Override
310  public boolean isLeafTypeNode() {
311  return true;
312  }
313 
314  @Override
315  protected Sheet createSheet() {
316  Sheet s = super.createSheet();
317  Sheet.Set ss = s.get(Sheet.PROPERTIES);
318  if (ss == null) {
319  ss = Sheet.createPropertiesSet();
320  s.put(ss);
321  }
322 
323  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.name"),
324  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.displayName"),
325  NbBundle.getMessage(this.getClass(), "HashsetHits.createSheet.name.desc"),
326  getName()));
327 
328  return s;
329  }
330 
331  @Override
332  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
333  return v.visit(this);
334  }
335 
336  @Override
337  public void update(Observable o, Object arg) {
339  }
340 
341  @Override
342  public String getItemType() {
347  return getClass().getName();
348  }
349  }
350 
354  private class HitFactory extends ChildFactory.Detachable<Long> implements Observer {
355 
356  private String hashsetName;
357  private Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
358 
359  private HitFactory(String hashsetName) {
360  super();
361  this.hashsetName = hashsetName;
362  }
363 
364  @Override
365  protected void addNotify() {
366  hashsetResults.addObserver(this);
367  }
368 
369  @Override
370  protected void removeNotify() {
371  hashsetResults.deleteObserver(this);
372  }
373 
374  @Override
375  protected boolean createKeys(List<Long> list) {
376 
377  if (skCase == null) {
378  return true;
379  }
380 
381  hashsetResults.getArtifactIds(hashsetName).forEach((id) -> {
382  try {
383  if (!artifactHits.containsKey(id)) {
384  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
385  artifactHits.put(id, art);
386  }
387  list.add(id);
388  } catch (TskException ex) {
389  logger.log(Level.SEVERE, "TSK Exception occurred", ex); //NON-NLS
390  }
391  });
392  return true;
393  }
394 
395  @Override
396  protected Node createNodeForKey(Long id) {
397  BlackboardArtifact art = artifactHits.get(id);
398  return (null == art) ? null : new BlackboardArtifactNode(art);
399  }
400 
401  @Override
402  public void update(Observable o, Object arg) {
403  refresh(true);
404  }
405  }
406 }
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:395
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:440

Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.