Autopsy  4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
QueryResults.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.keywordsearch;
20 
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.HashMap;
24 import java.util.List;
25 import java.util.Map;
26 import java.util.Set;
27 import java.util.logging.Level;
28 import java.util.stream.Collectors;
29 import javax.swing.SwingWorker;
30 import org.apache.commons.lang.StringUtils;
31 import org.netbeans.api.progress.ProgressHandle;
32 import org.netbeans.api.progress.aggregate.ProgressContributor;
33 import org.openide.util.NbBundle;
40 import org.sleuthkit.datamodel.AbstractFile;
41 import org.sleuthkit.datamodel.BlackboardArtifact;
42 import org.sleuthkit.datamodel.BlackboardAttribute;
43 import org.sleuthkit.datamodel.Content;
44 import org.sleuthkit.datamodel.SleuthkitCase;
45 import org.sleuthkit.datamodel.TskCoreException;
46 
52 class QueryResults {
53 
54  private static final Logger logger = Logger.getLogger(QueryResults.class.getName());
55  private static final String MODULE_NAME = KeywordSearchModuleFactory.getModuleName();
59  private final KeywordSearchQuery keywordSearchQuery;
60 
64  private final Map<Keyword, List<KeywordHit>> results = new HashMap<>();
65 
66  QueryResults(KeywordSearchQuery query) {
67  this.keywordSearchQuery = query;
68  }
69 
70  void addResult(Keyword keyword, List<KeywordHit> hits) {
71  results.put(keyword, hits);
72  }
73 
74  KeywordSearchQuery getQuery() {
75  return keywordSearchQuery;
76  }
77 
78  List<KeywordHit> getResults(Keyword keyword) {
79  return results.get(keyword);
80  }
81 
82  Set<Keyword> getKeywords() {
83  return results.keySet();
84  }
85 
101  Collection<BlackboardArtifact> writeAllHitsToBlackBoard(ProgressHandle progress, ProgressContributor subProgress, SwingWorker<?, ?> worker, boolean notifyInbox) {
102  final Collection<BlackboardArtifact> newArtifacts = new ArrayList<>();
103  if (progress != null) {
104  progress.start(getKeywords().size());
105  }
106  int unitProgress = 0;
107 
108  for (final Keyword keyword : getKeywords()) {
109  if (worker.isCancelled()) {
110  logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", keyword.getSearchTerm()); //NON-NLS
111  break;
112  }
113 
114  // Update progress object(s), if any
115  if (progress != null) {
116  progress.progress(keyword.toString(), unitProgress);
117  }
118  if (subProgress != null) {
119  String hitDisplayStr = keyword.getSearchTerm();
120  if (hitDisplayStr.length() > 50) {
121  hitDisplayStr = hitDisplayStr.substring(0, 49) + "...";
122  }
123  subProgress.progress(keywordSearchQuery.getKeywordList().getName() + ": " + hitDisplayStr, unitProgress);
124  }
125 
126  for (KeywordHit hit : getOneHitPerObject(keyword)) {
127  String termString = keyword.getSearchTerm();
128  String snippet = hit.getSnippet();
129  if (StringUtils.isBlank(snippet)) {
130  final String snippetQuery = KeywordSearchUtil.escapeLuceneQuery(termString);
131  try {
132  /*
133  * this doesn't work for regex queries... But that is
134  * okay because regex queries always have snippets made
135  * from the content_str field we pull back from Solr
136  */
137  snippet = LuceneQuery.querySnippet(snippetQuery, hit.getSolrObjectId(), hit.getChunkId(), !keywordSearchQuery.isLiteral(), true);
138  } catch (NoOpenCoreException e) {
139  logger.log(Level.WARNING, "Error querying snippet: " + snippetQuery, e); //NON-NLS
140  //no reason to continue
141  break;
142  } catch (Exception e) {
143  logger.log(Level.WARNING, "Error querying snippet: " + snippetQuery, e); //NON-NLS
144  continue;
145  }
146  }
147  Content content = null;
148  try {
149  SleuthkitCase tskCase = Case.getCurrentCase().getSleuthkitCase();
150  content = tskCase.getContentById(hit.getContentID());
151  } catch (TskCoreException | IllegalStateException tskCoreException) {
152  logger.log(Level.SEVERE, "Error adding artifact for keyword hit to blackboard", tskCoreException); //NON-NLS
153  return null;
154  }
155  BlackboardArtifact writeResult = keywordSearchQuery.writeSingleFileHitsToBlackBoard(content, keyword, hit, snippet, keywordSearchQuery.getKeywordList().getName());
156  if (writeResult != null) {
157  newArtifacts.add(writeResult);
158  if (notifyInbox) {
159  try {
160  writeSingleFileInboxMessage(writeResult, content);
161  } catch (TskCoreException ex) {
162  logger.log(Level.WARNING, "Error posting message to Ingest Inbox", ex); //NON-NLS
163  }
164  }
165  } else {
166  logger.log(Level.WARNING, "BB artifact for keyword hit not written, file: {0}, hit: {1}", new Object[]{content, keyword.toString()}); //NON-NLS
167  }
168  }
169  ++unitProgress;
170  }
171 
172  // Update artifact browser
173  if (!newArtifacts.isEmpty()) {
174  newArtifacts.stream()
175  //group artifacts by type
176  .collect(Collectors.groupingBy(BlackboardArtifact::getArtifactTypeID))
177  //for each type send an event
178  .forEach((typeID, artifacts)
179  -> IngestServices.getInstance().fireModuleDataEvent(new ModuleDataEvent(MODULE_NAME, BlackboardArtifact.ARTIFACT_TYPE.fromID(typeID), artifacts)));
180 
181  }
182 
183  return newArtifacts;
184  }
185 
194  private Collection<KeywordHit> getOneHitPerObject(Keyword keyword) {
195  HashMap<Long, KeywordHit> hits = new HashMap<>();
196 
197  // create a list of KeywordHits. KeywordHits with lowest chunkID is added the the list.
198  for (KeywordHit hit : getResults(keyword)) {
199  if (!hits.containsKey(hit.getSolrObjectId())) {
200  hits.put(hit.getSolrObjectId(), hit);
201  } else if (hit.getChunkId() < hits.get(hit.getSolrObjectId()).getChunkId()) {
202  hits.put(hit.getSolrObjectId(), hit);
203  }
204  }
205  return hits.values();
206  }
207 
218  private void writeSingleFileInboxMessage(BlackboardArtifact artifact, Content hitContent) throws TskCoreException {
219  StringBuilder subjectSb = new StringBuilder();
220  StringBuilder detailsSb = new StringBuilder();
221 
222  if (!keywordSearchQuery.isLiteral()) {
223  subjectSb.append(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.regExpHitLbl"));
224  } else {
225  subjectSb.append(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.kwHitLbl"));
226  }
227 
228  String uniqueKey = null;
229  BlackboardAttribute attr = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD));
230  if (attr != null) {
231  final String keyword = attr.getValueString();
232  subjectSb.append(keyword);
233  uniqueKey = keyword.toLowerCase();
234  //details
235  detailsSb.append("<table border='0' cellpadding='4' width='280'>"); //NON-NLS
236  //hit
237  detailsSb.append("<tr>"); //NON-NLS
238  detailsSb.append(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.kwHitThLbl"));
239  detailsSb.append("<td>").append(EscapeUtil.escapeHtml(keyword)).append("</td>"); //NON-NLS
240  detailsSb.append("</tr>"); //NON-NLS
241  }
242 
243  //preview
244  attr = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW));
245  if (attr != null) {
246  detailsSb.append("<tr>"); //NON-NLS
247  detailsSb.append(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.previewThLbl"));
248  detailsSb.append("<td>").append(EscapeUtil.escapeHtml(attr.getValueString())).append("</td>"); //NON-NLS
249  detailsSb.append("</tr>"); //NON-NLS
250  }
251 
252  //file
253  detailsSb.append("<tr>"); //NON-NLS
254  detailsSb.append(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.fileThLbl"));
255  if (hitContent instanceof AbstractFile) {
256  AbstractFile hitFile = (AbstractFile) hitContent;
257  detailsSb.append("<td>").append(hitFile.getParentPath()).append(hitFile.getName()).append("</td>"); //NON-NLS
258  } else {
259  detailsSb.append("<td>").append(hitContent.getName()).append("</td>"); //NON-NLS
260  }
261  detailsSb.append("</tr>"); //NON-NLS
262 
263  //list
264  attr = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
265  if (attr != null) {
266  detailsSb.append("<tr>"); //NON-NLS
267  detailsSb.append(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.listThLbl"));
268  detailsSb.append("<td>").append(attr.getValueString()).append("</td>"); //NON-NLS
269  detailsSb.append("</tr>"); //NON-NLS
270  }
271 
272  //regex
273  if (!keywordSearchQuery.isLiteral()) {
274  attr = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP));
275  if (attr != null) {
276  detailsSb.append("<tr>"); //NON-NLS
277  detailsSb.append(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.regExThLbl"));
278  detailsSb.append("<td>").append(attr.getValueString()).append("</td>"); //NON-NLS
279  detailsSb.append("</tr>"); //NON-NLS
280  }
281  }
282 
283  detailsSb.append("</table>"); //NON-NLS
284 
285  IngestServices.getInstance().postMessage(IngestMessage.createDataMessage(MODULE_NAME, subjectSb.toString(), detailsSb.toString(), uniqueKey, artifact));
286  }
287 }

Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.