19 package org.sleuthkit.autopsy.keywordsearch;
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.HashMap;
24 import java.util.List;
27 import java.util.logging.Level;
28 import java.util.stream.Collectors;
29 import javax.swing.SwingWorker;
30 import org.apache.commons.lang.StringUtils;
31 import org.netbeans.api.progress.ProgressHandle;
32 import org.netbeans.api.progress.aggregate.ProgressContributor;
33 import org.openide.util.NbBundle;
54 private static final Logger logger = Logger.getLogger(QueryResults.class.getName());
55 private static final String MODULE_NAME = KeywordSearchModuleFactory.getModuleName();
59 private final KeywordSearchQuery keywordSearchQuery;
64 private final Map<Keyword, List<KeywordHit>> results =
new HashMap<>();
66 QueryResults(KeywordSearchQuery query) {
67 this.keywordSearchQuery = query;
70 void addResult(Keyword keyword, List<KeywordHit> hits) {
71 results.put(keyword, hits);
74 KeywordSearchQuery getQuery() {
75 return keywordSearchQuery;
78 List<KeywordHit> getResults(Keyword keyword) {
79 return results.get(keyword);
82 Set<Keyword> getKeywords() {
83 return results.keySet();
101 Collection<BlackboardArtifact> writeAllHitsToBlackBoard(ProgressHandle progress, ProgressContributor subProgress, SwingWorker<?, ?> worker,
boolean notifyInbox) {
102 final Collection<BlackboardArtifact> newArtifacts =
new ArrayList<>();
103 if (progress != null) {
104 progress.start(getKeywords().size());
106 int unitProgress = 0;
108 for (
final Keyword keyword : getKeywords()) {
109 if (worker.isCancelled()) {
110 logger.log(Level.INFO,
"Cancel detected, bailing before new keyword processed: {0}", keyword.getSearchTerm());
115 if (progress != null) {
116 progress.progress(keyword.toString(), unitProgress);
118 if (subProgress != null) {
119 String hitDisplayStr = keyword.getSearchTerm();
120 if (hitDisplayStr.length() > 50) {
121 hitDisplayStr = hitDisplayStr.substring(0, 49) +
"...";
123 subProgress.progress(keywordSearchQuery.getKeywordList().getName() +
": " + hitDisplayStr, unitProgress);
126 for (KeywordHit hit : getOneHitPerObject(keyword)) {
127 String termString = keyword.getSearchTerm();
128 String snippet = hit.getSnippet();
129 if (StringUtils.isBlank(snippet)) {
130 final String snippetQuery = KeywordSearchUtil.escapeLuceneQuery(termString);
137 snippet = LuceneQuery.querySnippet(snippetQuery, hit.getSolrObjectId(), hit.getChunkId(), !keywordSearchQuery.isLiteral(),
true);
138 }
catch (NoOpenCoreException e) {
139 logger.log(Level.WARNING,
"Error querying snippet: " + snippetQuery, e);
142 }
catch (Exception e) {
143 logger.log(Level.WARNING,
"Error querying snippet: " + snippetQuery, e);
147 Content content = null;
149 SleuthkitCase tskCase = Case.getCurrentCase().getSleuthkitCase();
150 content = tskCase.getContentById(hit.getContentID());
151 }
catch (TskCoreException | IllegalStateException tskCoreException) {
152 logger.log(Level.SEVERE,
"Error adding artifact for keyword hit to blackboard", tskCoreException);
155 BlackboardArtifact writeResult = keywordSearchQuery.writeSingleFileHitsToBlackBoard(content, keyword, hit, snippet, keywordSearchQuery.getKeywordList().getName());
156 if (writeResult != null) {
157 newArtifacts.add(writeResult);
160 writeSingleFileInboxMessage(writeResult, content);
161 }
catch (TskCoreException ex) {
162 logger.log(Level.WARNING,
"Error posting message to Ingest Inbox", ex);
166 logger.log(Level.WARNING,
"BB artifact for keyword hit not written, file: {0}, hit: {1}",
new Object[]{content, keyword.toString()});
173 if (!newArtifacts.isEmpty()) {
174 newArtifacts.stream()
176 .collect(Collectors.groupingBy(BlackboardArtifact::getArtifactTypeID))
178 .forEach((typeID, artifacts)
179 -> IngestServices.getInstance().fireModuleDataEvent(
new ModuleDataEvent(MODULE_NAME, BlackboardArtifact.ARTIFACT_TYPE.fromID(typeID), artifacts)));
194 private Collection<KeywordHit> getOneHitPerObject(Keyword keyword) {
195 HashMap<Long, KeywordHit> hits =
new HashMap<>();
198 for (KeywordHit hit : getResults(keyword)) {
199 if (!hits.containsKey(hit.getSolrObjectId())) {
200 hits.put(hit.getSolrObjectId(), hit);
201 }
else if (hit.getChunkId() < hits.get(hit.getSolrObjectId()).getChunkId()) {
202 hits.put(hit.getSolrObjectId(), hit);
205 return hits.values();
218 private void writeSingleFileInboxMessage(BlackboardArtifact artifact, Content hitContent)
throws TskCoreException {
219 StringBuilder subjectSb =
new StringBuilder();
220 StringBuilder detailsSb =
new StringBuilder();
222 if (!keywordSearchQuery.isLiteral()) {
223 subjectSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.regExpHitLbl"));
225 subjectSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.kwHitLbl"));
228 String uniqueKey = null;
229 BlackboardAttribute attr = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD));
231 final String keyword = attr.getValueString();
232 subjectSb.append(keyword);
233 uniqueKey = keyword.toLowerCase();
235 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
237 detailsSb.append(
"<tr>");
238 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.kwHitThLbl"));
239 detailsSb.append(
"<td>").append(EscapeUtil.escapeHtml(keyword)).append(
"</td>");
240 detailsSb.append(
"</tr>");
244 attr = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW));
246 detailsSb.append(
"<tr>");
247 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.previewThLbl"));
248 detailsSb.append(
"<td>").append(EscapeUtil.escapeHtml(attr.getValueString())).append(
"</td>");
249 detailsSb.append(
"</tr>");
253 detailsSb.append(
"<tr>");
254 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.fileThLbl"));
255 if (hitContent instanceof AbstractFile) {
256 AbstractFile hitFile = (AbstractFile) hitContent;
257 detailsSb.append(
"<td>").append(hitFile.getParentPath()).append(hitFile.getName()).append(
"</td>");
259 detailsSb.append(
"<td>").append(hitContent.getName()).append(
"</td>");
261 detailsSb.append(
"</tr>");
264 attr = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
266 detailsSb.append(
"<tr>");
267 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.listThLbl"));
268 detailsSb.append(
"<td>").append(attr.getValueString()).append(
"</td>");
269 detailsSb.append(
"</tr>");
273 if (!keywordSearchQuery.isLiteral()) {
274 attr = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP));
276 detailsSb.append(
"<tr>");
277 detailsSb.append(NbBundle.getMessage(
this.getClass(),
"KeywordSearchIngestModule.regExThLbl"));
278 detailsSb.append(
"<td>").append(attr.getValueString()).append(
"</td>");
279 detailsSb.append(
"</tr>");
283 detailsSb.append(
"</table>");
285 IngestServices.getInstance().postMessage(IngestMessage.createDataMessage(MODULE_NAME, subjectSb.toString(), detailsSb.toString(), uniqueKey, artifact));