19 package org.sleuthkit.autopsy.centralrepository.datamodel;
21 import java.net.UnknownHostException;
22 import java.util.ArrayList;
23 import java.util.List;
24 import java.util.Collection;
25 import java.util.LinkedHashSet;
26 import java.util.stream.Collectors;
27 import java.sql.Connection;
28 import java.sql.PreparedStatement;
29 import java.sql.ResultSet;
30 import java.sql.SQLException;
31 import java.sql.Statement;
32 import java.sql.Types;
33 import java.time.LocalDate;
34 import java.util.HashMap;
37 import java.util.logging.Level;
38 import org.openide.util.NbBundle.Messages;
42 import org.
sleuthkit.datamodel.CaseDbSchemaVersionNumber;
58 private final Map<String, Collection<CorrelationAttribute>>
bulkArtifacts;
66 bulkArtifactsCount = 0;
67 bulkArtifacts =
new HashMap<>();
70 DEFAULT_CORRELATION_TYPES.forEach((type) -> {
71 bulkArtifacts.put(type.getDbTableName(),
new ArrayList<>());
89 public
void newDbInfo(String name, String value) throws EamDbException {
92 PreparedStatement preparedStatement = null;
93 String sql =
"INSERT INTO db_info (name, value) VALUES (?, ?)";
95 preparedStatement = conn.prepareStatement(sql);
96 preparedStatement.setString(1, name);
97 preparedStatement.setString(2, value);
98 preparedStatement.executeUpdate();
99 }
catch (SQLException ex) {
100 throw new EamDbException(
"Error adding new name/value pair to db_info.", ex);
121 PreparedStatement preparedStatement = null;
122 ResultSet resultSet = null;
124 String sql =
"SELECT value FROM db_info WHERE name=?";
126 preparedStatement = conn.prepareStatement(sql);
127 preparedStatement.setString(1, name);
128 resultSet = preparedStatement.executeQuery();
129 if (resultSet.next()) {
130 value = resultSet.getString(
"value");
132 }
catch (SQLException ex) {
155 PreparedStatement preparedStatement = null;
156 String sql =
"UPDATE db_info SET value=? WHERE name=?";
158 preparedStatement = conn.prepareStatement(sql);
159 preparedStatement.setString(1, value);
160 preparedStatement.setString(2, name);
161 preparedStatement.executeUpdate();
162 }
catch (SQLException ex) {
182 PreparedStatement preparedStatement = null;
184 String sql =
"INSERT INTO cases(case_uid, org_id, case_name, creation_date, case_number, "
185 +
"examiner_name, examiner_email, examiner_phone, notes) "
186 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)";
189 preparedStatement = conn.prepareStatement(sql);
191 preparedStatement.setString(1, eamCase.getCaseUUID());
192 if (null == eamCase.getOrg()) {
193 preparedStatement.setNull(2, Types.INTEGER);
195 preparedStatement.setInt(2, eamCase.getOrg().getOrgID());
197 preparedStatement.setString(3, eamCase.getDisplayName());
198 preparedStatement.setString(4, eamCase.getCreationDate());
199 if (
"".equals(eamCase.getCaseNumber())) {
200 preparedStatement.setNull(5, Types.INTEGER);
202 preparedStatement.setString(5, eamCase.getCaseNumber());
204 if (
"".equals(eamCase.getExaminerName())) {
205 preparedStatement.setNull(6, Types.INTEGER);
207 preparedStatement.setString(6, eamCase.getExaminerName());
209 if (
"".equals(eamCase.getExaminerEmail())) {
210 preparedStatement.setNull(7, Types.INTEGER);
212 preparedStatement.setString(7, eamCase.getExaminerEmail());
214 if (
"".equals(eamCase.getExaminerPhone())) {
215 preparedStatement.setNull(8, Types.INTEGER);
217 preparedStatement.setString(8, eamCase.getExaminerPhone());
219 if (
"".equals(eamCase.getNotes())) {
220 preparedStatement.setNull(9, Types.INTEGER);
222 preparedStatement.setString(9, eamCase.getNotes());
225 preparedStatement.executeUpdate();
226 }
catch (SQLException ex) {
244 if (autopsyCase == null) {
250 autopsyCase.getName(),
252 autopsyCase.getDisplayName(),
253 autopsyCase.getCreatedDate(),
254 autopsyCase.getNumber(),
255 autopsyCase.getExaminer(),
256 autopsyCase.getExaminerEmail(),
257 autopsyCase.getExaminerPhone(),
258 autopsyCase.getCaseNotes());
274 if(eamCase == null) {
280 PreparedStatement preparedStatement = null;
281 String sql =
"UPDATE cases "
282 +
"SET org_id=?, case_name=?, creation_date=?, case_number=?, examiner_name=?, examiner_email=?, examiner_phone=?, notes=? "
283 +
"WHERE case_uid=?";
286 preparedStatement = conn.prepareStatement(sql);
288 if (null == eamCase.getOrg()) {
289 preparedStatement.setNull(1, Types.INTEGER);
291 preparedStatement.setInt(1, eamCase.getOrg().getOrgID());
293 preparedStatement.setString(2, eamCase.getDisplayName());
294 preparedStatement.setString(3, eamCase.getCreationDate());
296 if (
"".equals(eamCase.getCaseNumber())) {
297 preparedStatement.setNull(4, Types.INTEGER);
299 preparedStatement.setString(4, eamCase.getCaseNumber());
301 if (
"".equals(eamCase.getExaminerName())) {
302 preparedStatement.setNull(5, Types.INTEGER);
304 preparedStatement.setString(5, eamCase.getExaminerName());
306 if (
"".equals(eamCase.getExaminerEmail())) {
307 preparedStatement.setNull(6, Types.INTEGER);
309 preparedStatement.setString(6, eamCase.getExaminerEmail());
311 if (
"".equals(eamCase.getExaminerPhone())) {
312 preparedStatement.setNull(7, Types.INTEGER);
314 preparedStatement.setString(7, eamCase.getExaminerPhone());
316 if (
"".equals(eamCase.getNotes())) {
317 preparedStatement.setNull(8, Types.INTEGER);
319 preparedStatement.setString(8, eamCase.getNotes());
322 preparedStatement.setString(9, eamCase.getCaseUUID());
324 preparedStatement.executeUpdate();
325 }
catch (SQLException ex) {
347 PreparedStatement preparedStatement = null;
348 ResultSet resultSet = null;
350 String sql =
"SELECT cases.id as case_id, case_uid, case_name, creation_date, case_number, examiner_name, "
351 +
"examiner_email, examiner_phone, notes, organizations.id as org_id, org_name, poc_name, poc_email, poc_phone "
353 +
"LEFT JOIN organizations ON cases.org_id=organizations.id "
354 +
"WHERE case_uid=?";
357 preparedStatement = conn.prepareStatement(sql);
358 preparedStatement.setString(1, caseUUID);
359 resultSet = preparedStatement.executeQuery();
360 if (resultSet.next()) {
363 }
catch (SQLException ex) {
371 return eamCaseResult;
383 List<CorrelationCase> cases =
new ArrayList<>();
385 PreparedStatement preparedStatement = null;
386 ResultSet resultSet = null;
388 String sql =
"SELECT cases.id as case_id, case_uid, case_name, creation_date, case_number, examiner_name, "
389 +
"examiner_email, examiner_phone, notes, organizations.id as org_id, org_name, poc_name, poc_email, poc_phone "
391 +
"LEFT JOIN organizations ON cases.org_id=organizations.id";
394 preparedStatement = conn.prepareStatement(sql);
395 resultSet = preparedStatement.executeQuery();
396 while (resultSet.next()) {
398 cases.add(eamCaseResult);
400 }
catch (SQLException ex) {
401 throw new EamDbException(
"Error getting all cases.", ex);
420 PreparedStatement preparedStatement = null;
422 String sql =
"INSERT INTO data_sources(device_id, case_id, name) VALUES (?, ?, ?)";
425 preparedStatement = conn.prepareStatement(sql);
427 preparedStatement.setString(1, eamDataSource.getDeviceID());
428 preparedStatement.setInt(2, eamDataSource.getCaseID());
429 preparedStatement.setString(3, eamDataSource.getName());
431 preparedStatement.executeUpdate();
432 }
catch (SQLException ex) {
451 if(correlationCase == null) {
458 PreparedStatement preparedStatement = null;
459 ResultSet resultSet = null;
461 String sql =
"SELECT * FROM data_sources WHERE device_id=? AND case_id=?";
464 preparedStatement = conn.prepareStatement(sql);
465 preparedStatement.setString(1, dataSourceDeviceId);
466 preparedStatement.setInt(2, correlationCase.getID());
467 resultSet = preparedStatement.executeQuery();
468 if (resultSet.next()) {
471 }
catch (SQLException ex) {
479 return eamDataSourceResult;
491 List<CorrelationDataSource> dataSources =
new ArrayList<>();
493 PreparedStatement preparedStatement = null;
494 ResultSet resultSet = null;
496 String sql =
"SELECT * FROM data_sources";
499 preparedStatement = conn.prepareStatement(sql);
500 resultSet = preparedStatement.executeQuery();
501 while (resultSet.next()) {
503 dataSources.add(eamDataSourceResult);
505 }
catch (SQLException ex) {
506 throw new EamDbException(
"Error getting all data sources.", ex);
524 if(eamArtifact == null) {
527 if(eamArtifact.getCorrelationType() == null) {
530 if(eamArtifact.getCorrelationValue() == null) {
536 List<CorrelationAttributeInstance> eamInstances = eamArtifact.getInstances();
537 PreparedStatement preparedStatement = null;
541 StringBuilder sql =
new StringBuilder();
542 sql.append(
"INSERT INTO ");
543 sql.append(tableName);
544 sql.append(
"(case_id, data_source_id, value, file_path, known_status, comment) ");
545 sql.append(
"VALUES ((SELECT id FROM cases WHERE case_uid=? LIMIT 1), ");
546 sql.append(
"(SELECT id FROM data_sources WHERE device_id=? AND case_id=? LIMIT 1), ?, ?, ?, ?)");
549 preparedStatement = conn.prepareStatement(sql.toString());
551 if (!eamArtifact.getCorrelationValue().isEmpty()) {
552 if(eamInstance.getCorrelationCase() == null) {
553 throw new EamDbException(
"CorrelationAttributeInstance has null case");
555 if(eamInstance.getCorrelationDataSource() == null) {
556 throw new EamDbException(
"CorrelationAttributeInstance has null data source");
558 if(eamInstance.getKnownStatus() == null) {
559 throw new EamDbException(
"CorrelationAttributeInstance has null known status");
562 preparedStatement.setString(1, eamInstance.getCorrelationCase().getCaseUUID());
563 preparedStatement.setString(2, eamInstance.getCorrelationDataSource().getDeviceID());
564 preparedStatement.setInt(3, eamInstance.getCorrelationDataSource().getCaseID());
565 preparedStatement.setString(4, eamArtifact.getCorrelationValue());
566 preparedStatement.setString(5, eamInstance.getFilePath());
567 preparedStatement.setByte(6, eamInstance.getKnownStatus().getFileKnownValue());
568 if (
"".equals(eamInstance.getComment())) {
569 preparedStatement.setNull(7, Types.INTEGER);
571 preparedStatement.setString(7, eamInstance.getComment());
574 preparedStatement.executeUpdate();
577 }
catch (SQLException ex) {
578 throw new EamDbException(
"Error inserting new artifact into artifacts table.", ex);
603 List<CorrelationAttributeInstance> artifactInstances =
new ArrayList<>();
606 PreparedStatement preparedStatement = null;
607 ResultSet resultSet = null;
610 StringBuilder sql =
new StringBuilder();
611 sql.append(
"SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id FROM ");
612 sql.append(tableName);
613 sql.append(
" LEFT JOIN cases ON ");
614 sql.append(tableName);
615 sql.append(
".case_id=cases.id");
616 sql.append(
" LEFT JOIN data_sources ON ");
617 sql.append(tableName);
618 sql.append(
".data_source_id=data_sources.id");
619 sql.append(
" WHERE value=?");
622 preparedStatement = conn.prepareStatement(sql.toString());
623 preparedStatement.setString(1, value);
624 resultSet = preparedStatement.executeQuery();
625 while (resultSet.next()) {
627 artifactInstances.add(artifactInstance);
629 }
catch (SQLException ex) {
630 throw new EamDbException(
"Error getting artifact instances by artifactType and artifactValue.", ex);
637 return artifactInstances;
656 if(filePath == null) {
661 List<CorrelationAttributeInstance> artifactInstances =
new ArrayList<>();
664 PreparedStatement preparedStatement = null;
665 ResultSet resultSet = null;
668 StringBuilder sql =
new StringBuilder();
669 sql.append(
"SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id FROM ");
670 sql.append(tableName);
671 sql.append(
" LEFT JOIN cases ON ");
672 sql.append(tableName);
673 sql.append(
".case_id=cases.id");
674 sql.append(
" LEFT JOIN data_sources ON ");
675 sql.append(tableName);
676 sql.append(
".data_source_id=data_sources.id");
677 sql.append(
" WHERE file_path=?");
680 preparedStatement = conn.prepareStatement(sql.toString());
681 preparedStatement.setString(1, filePath.toLowerCase());
682 resultSet = preparedStatement.executeQuery();
683 while (resultSet.next()) {
685 artifactInstances.add(artifactInstance);
687 }
catch (SQLException ex) {
688 throw new EamDbException(
"Error getting artifact instances by artifactType and artifactValue.", ex);
695 return artifactInstances;
719 Long instanceCount = 0L;
720 PreparedStatement preparedStatement = null;
721 ResultSet resultSet = null;
724 StringBuilder sql =
new StringBuilder();
725 sql.append(
"SELECT count(*) FROM ");
726 sql.append(tableName);
727 sql.append(
" WHERE value=?");
730 preparedStatement = conn.prepareStatement(sql.toString());
731 preparedStatement.setString(1, value.toLowerCase());
732 resultSet = preparedStatement.executeQuery();
734 instanceCount = resultSet.getLong(1);
735 }
catch (SQLException ex) {
736 throw new EamDbException(
"Error getting count of artifact instances by artifactType and artifactValue.", ex);
743 return instanceCount;
748 if (corAttr == null) {
753 Double commonalityPercentage = uniqueTypeValueTuples / uniqueCaseDataSourceTuples * 100;
754 return commonalityPercentage.intValue();
775 Long instanceCount = 0L;
776 PreparedStatement preparedStatement = null;
777 ResultSet resultSet = null;
780 StringBuilder sql =
new StringBuilder();
781 sql.append(
"SELECT count(*) FROM (SELECT DISTINCT case_id, data_source_id FROM ");
782 sql.append(tableName);
783 sql.append(
" WHERE value=?) AS ");
784 sql.append(tableName);
785 sql.append(
"_distinct_case_data_source_tuple");
788 preparedStatement = conn.prepareStatement(sql.toString());
789 preparedStatement.setString(1, value);
790 resultSet = preparedStatement.executeQuery();
792 instanceCount = resultSet.getLong(1);
793 }
catch (SQLException ex) {
794 throw new EamDbException(
"Error counting unique caseDisplayName/dataSource tuples having artifactType and artifactValue.", ex);
801 return instanceCount;
808 Long instanceCount = 0L;
809 PreparedStatement preparedStatement = null;
810 ResultSet resultSet = null;
812 String stmt =
"SELECT count(*) FROM data_sources";
815 preparedStatement = conn.prepareStatement(stmt);
816 resultSet = preparedStatement.executeQuery();
818 instanceCount = resultSet.getLong(1);
819 }
catch (SQLException ex) {
820 throw new EamDbException(
"Error counting data sources.", ex);
827 return instanceCount;
845 Long instanceCount = 0L;
847 PreparedStatement preparedStatement = null;
848 ResultSet resultSet = null;
851 StringBuilder sql =
new StringBuilder();
852 sql.append(
"SELECT 0 ");
857 sql.append(
"+ (SELECT count(*) FROM ");
858 sql.append(table_name);
859 sql.append(
" WHERE case_id=(SELECT id FROM cases WHERE case_uid=?) and data_source_id=(SELECT id FROM data_sources WHERE device_id=?))");
863 preparedStatement = conn.prepareStatement(sql.toString());
865 for (
int i = 0; i < artifactTypes.size(); ++i) {
866 preparedStatement.setString(2 * i + 1, caseUUID);
867 preparedStatement.setString(2 * i + 2, dataSourceID);
870 resultSet = preparedStatement.executeQuery();
872 instanceCount = resultSet.getLong(1);
873 }
catch (SQLException ex) {
874 throw new EamDbException(
"Error counting artifact instances by caseName/dataSource.", ex);
881 return instanceCount;
894 if(eamArtifact.getCorrelationType() == null) {
899 bulkArtifacts.get(eamArtifact.getCorrelationType().getDbTableName()).add(eamArtifact);
900 bulkArtifactsCount++;
902 if (bulkArtifactsCount >= bulkArtifactsThreshold) {
924 PreparedStatement bulkPs = null;
928 if (bulkArtifactsCount == 0) {
935 StringBuilder sql =
new StringBuilder();
936 sql.append(
"INSERT INTO ");
937 sql.append(tableName);
938 sql.append(
" (case_id, data_source_id, value, file_path, known_status, comment) ");
939 sql.append(
"VALUES ((SELECT id FROM cases WHERE case_uid=? LIMIT 1), ");
940 sql.append(
"(SELECT id FROM data_sources WHERE device_id=? AND case_id=? LIMIT 1), ?, ?, ?, ?) ");
943 bulkPs = conn.prepareStatement(sql.toString());
945 Collection<CorrelationAttribute> eamArtifacts = bulkArtifacts.get(type.getDbTableName());
947 List<CorrelationAttributeInstance> eamInstances = eamArtifact.getInstances();
950 if (!eamArtifact.getCorrelationValue().isEmpty()) {
952 if(eamInstance.getCorrelationCase() == null) {
953 throw new EamDbException(
"Correlation attribute instance has null case");
955 if(eamInstance.getCorrelationDataSource() == null) {
956 throw new EamDbException(
"Correlation attribute instance has null data source");
958 if(eamInstance.getKnownStatus()== null) {
959 throw new EamDbException(
"Correlation attribute instance has null known known status");
962 bulkPs.setString(1, eamInstance.getCorrelationCase().getCaseUUID());
963 bulkPs.setString(2, eamInstance.getCorrelationDataSource().getDeviceID());
964 bulkPs.setInt(3, eamInstance.getCorrelationDataSource().getCaseID());
965 bulkPs.setString(4, eamArtifact.getCorrelationValue());
966 bulkPs.setString(5, eamInstance.getFilePath());
967 bulkPs.setByte(6, eamInstance.getKnownStatus().getFileKnownValue());
968 if (
"".equals(eamInstance.getComment())) {
969 bulkPs.setNull(7, Types.INTEGER);
971 bulkPs.setString(7, eamInstance.getComment());
978 bulkPs.executeBatch();
979 bulkArtifacts.get(type.getDbTableName()).clear();
983 bulkArtifactsCount = 0;
985 }
catch (SQLException ex) {
986 throw new EamDbException(
"Error inserting bulk artifacts.", ex);
1002 if (cases.isEmpty()) {
1009 PreparedStatement bulkPs = null;
1011 String sql =
"INSERT INTO cases(case_uid, org_id, case_name, creation_date, case_number, "
1012 +
"examiner_name, examiner_email, examiner_phone, notes) "
1013 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) "
1015 bulkPs = conn.prepareStatement(sql);
1018 bulkPs.setString(1, eamCase.getCaseUUID());
1019 if (null == eamCase.getOrg()) {
1020 bulkPs.setNull(2, Types.INTEGER);
1022 bulkPs.setInt(2, eamCase.getOrg().getOrgID());
1024 bulkPs.setString(3, eamCase.getDisplayName());
1025 bulkPs.setString(4, eamCase.getCreationDate());
1027 if (
"".equals(eamCase.getCaseNumber())) {
1028 bulkPs.setNull(5, Types.INTEGER);
1030 bulkPs.setString(5, eamCase.getCaseNumber());
1032 if (
"".equals(eamCase.getExaminerName())) {
1033 bulkPs.setNull(6, Types.INTEGER);
1035 bulkPs.setString(6, eamCase.getExaminerName());
1037 if (
"".equals(eamCase.getExaminerEmail())) {
1038 bulkPs.setNull(7, Types.INTEGER);
1040 bulkPs.setString(7, eamCase.getExaminerEmail());
1042 if (
"".equals(eamCase.getExaminerPhone())) {
1043 bulkPs.setNull(8, Types.INTEGER);
1045 bulkPs.setString(8, eamCase.getExaminerPhone());
1047 if (
"".equals(eamCase.getNotes())) {
1048 bulkPs.setNull(9, Types.INTEGER);
1050 bulkPs.setString(9, eamCase.getNotes());
1058 if (counter >= bulkArtifactsThreshold) {
1059 bulkPs.executeBatch();
1064 bulkPs.executeBatch();
1065 }
catch (SQLException ex) {
1085 if(eamArtifact == null) {
1086 throw new EamDbException(
"Correlation attribute is null");
1088 if(knownStatus == null) {
1089 throw new EamDbException(
"Known status is null");
1092 throw new EamDbException(
"Error: Artifact must have exactly one (1) Artifact Instance to set as notable.");
1095 List<CorrelationAttributeInstance> eamInstances = eamArtifact.
getInstances();
1099 throw new EamDbException(
"Correlation case is null");
1102 throw new EamDbException(
"Correlation data source is null");
1107 PreparedStatement preparedUpdate = null;
1108 PreparedStatement preparedQuery = null;
1109 ResultSet resultSet = null;
1113 StringBuilder sqlQuery =
new StringBuilder();
1114 sqlQuery.append(
"SELECT id FROM ");
1115 sqlQuery.append(tableName);
1116 sqlQuery.append(
" WHERE case_id=(SELECT id FROM cases WHERE case_uid=?) ");
1117 sqlQuery.append(
"AND data_source_id=(SELECT id FROM data_sources WHERE device_id=?) ");
1118 sqlQuery.append(
"AND value=? ");
1119 sqlQuery.append(
"AND file_path=?");
1121 StringBuilder sqlUpdate =
new StringBuilder();
1122 sqlUpdate.append(
"UPDATE ");
1123 sqlUpdate.append(tableName);
1124 sqlUpdate.append(
" SET known_status=?, comment=? ");
1125 sqlUpdate.append(
"WHERE id=?");
1128 preparedQuery = conn.prepareStatement(sqlQuery.toString());
1132 preparedQuery.setString(4, eamInstance.
getFilePath());
1133 resultSet = preparedQuery.executeQuery();
1134 if (resultSet.next()) {
1135 int instance_id = resultSet.getInt(
"id");
1136 preparedUpdate = conn.prepareStatement(sqlUpdate.toString());
1138 preparedUpdate.setByte(1, knownStatus.getFileKnownValue());
1143 preparedUpdate.setNull(2, Types.INTEGER);
1145 preparedUpdate.setString(2, eamInstance.
getComment());
1147 preparedUpdate.setInt(3, instance_id);
1149 preparedUpdate.executeUpdate();
1157 if (null == correlationCaseWithId) {
1164 eamArtifact.
getInstances().get(0).setKnownStatus(knownStatus);
1168 }
catch (SQLException ex) {
1169 throw new EamDbException(
"Error getting/setting artifact instance knownStatus=" + knownStatus.getName(), ex);
1195 List<CorrelationAttributeInstance> artifactInstances =
new ArrayList<>();
1198 PreparedStatement preparedStatement = null;
1199 ResultSet resultSet = null;
1202 StringBuilder sql =
new StringBuilder();
1203 sql.append(
"SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id FROM ");
1204 sql.append(tableName);
1205 sql.append(
" LEFT JOIN cases ON ");
1206 sql.append(tableName);
1207 sql.append(
".case_id=cases.id");
1208 sql.append(
" LEFT JOIN data_sources ON ");
1209 sql.append(tableName);
1210 sql.append(
".data_source_id=data_sources.id");
1211 sql.append(
" WHERE value=? AND known_status=?");
1214 preparedStatement = conn.prepareStatement(sql.toString());
1215 preparedStatement.setString(1, value);
1216 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1217 resultSet = preparedStatement.executeQuery();
1218 while (resultSet.next()) {
1220 artifactInstances.add(artifactInstance);
1222 }
catch (SQLException ex) {
1223 throw new EamDbException(
"Error getting notable artifact instances.", ex);
1230 return artifactInstances;
1249 Long badInstances = 0L;
1250 PreparedStatement preparedStatement = null;
1251 ResultSet resultSet = null;
1254 StringBuilder sql =
new StringBuilder();
1255 sql.append(
"SELECT count(*) FROM ");
1256 sql.append(tableName);
1257 sql.append(
" WHERE value=? AND known_status=?");
1260 preparedStatement = conn.prepareStatement(sql.toString());
1261 preparedStatement.setString(1, value);
1262 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1263 resultSet = preparedStatement.executeQuery();
1265 badInstances = resultSet.getLong(1);
1266 }
catch (SQLException ex) {
1267 throw new EamDbException(
"Error getting count of notable artifact instances.", ex);
1274 return badInstances;
1297 Collection<String> caseNames =
new LinkedHashSet<>();
1299 PreparedStatement preparedStatement = null;
1300 ResultSet resultSet = null;
1303 StringBuilder sql =
new StringBuilder();
1304 sql.append(
"SELECT DISTINCT case_name FROM ");
1305 sql.append(tableName);
1306 sql.append(
" INNER JOIN cases ON ");
1307 sql.append(tableName);
1308 sql.append(
".case_id=cases.id WHERE ");
1309 sql.append(tableName);
1310 sql.append(
".value=? AND ");
1311 sql.append(tableName);
1312 sql.append(
".known_status=?");
1315 preparedStatement = conn.prepareStatement(sql.toString());
1316 preparedStatement.setString(1, value);
1317 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1318 resultSet = preparedStatement.executeQuery();
1319 while (resultSet.next()) {
1320 caseNames.add(resultSet.getString(
"case_name"));
1322 }
catch (SQLException ex) {
1323 throw new EamDbException(
"Error getting notable artifact instances.", ex);
1330 return caseNames.stream().collect(Collectors.toList());
1354 PreparedStatement preparedStatement = null;
1355 String sql =
"DELETE FROM reference_sets WHERE id=?";
1358 preparedStatement = conn.prepareStatement(sql);
1359 preparedStatement.setInt(1, referenceSetID);
1360 preparedStatement.executeUpdate();
1361 }
catch (SQLException ex) {
1362 throw new EamDbException(
"Error deleting reference set " + referenceSetID, ex);
1379 PreparedStatement preparedStatement = null;
1380 String sql =
"DELETE FROM %s WHERE reference_set_id=?";
1386 preparedStatement = conn.prepareStatement(String.format(sql, fileTableName));
1387 preparedStatement.setInt(1, referenceSetID);
1388 preparedStatement.executeUpdate();
1389 }
catch (SQLException ex) {
1390 throw new EamDbException(
"Error deleting files from reference set " + referenceSetID, ex);
1411 if(refSet == null) {
1445 Long matchingInstances = 0L;
1446 PreparedStatement preparedStatement = null;
1447 ResultSet resultSet = null;
1448 String sql =
"SELECT count(*) FROM %s WHERE value=? AND reference_set_id=?";
1453 preparedStatement = conn.prepareStatement(String.format(sql, fileTableName));
1454 preparedStatement.setString(1, value);
1455 preparedStatement.setInt(2, referenceSetID);
1456 resultSet = preparedStatement.executeQuery();
1458 matchingInstances = resultSet.getLong(1);
1459 }
catch (SQLException ex) {
1460 throw new EamDbException(
"Error determining if value (" + value +
") is in reference set " + referenceSetID, ex);
1467 return 0 < matchingInstances;
1491 Long badInstances = 0L;
1492 PreparedStatement preparedStatement = null;
1493 ResultSet resultSet = null;
1494 String sql =
"SELECT count(*) FROM %s WHERE value=? AND known_status=?";
1498 preparedStatement.setString(1, value);
1499 preparedStatement.setByte(2, TskData.FileKnown.BAD.getFileKnownValue());
1500 resultSet = preparedStatement.executeQuery();
1502 badInstances = resultSet.getLong(1);
1503 }
catch (SQLException ex) {
1504 throw new EamDbException(
"Error determining if artifact is notable by reference.", ex);
1511 return 0 < badInstances;
1525 if(eamOrg == null) {
1530 ResultSet generatedKeys = null;
1531 PreparedStatement preparedStatement = null;
1532 String sql =
"INSERT INTO organizations(org_name, poc_name, poc_email, poc_phone) VALUES (?, ?, ?, ?)";
1535 preparedStatement = conn.prepareStatement(sql, Statement.RETURN_GENERATED_KEYS);
1536 preparedStatement.setString(1, eamOrg.getName());
1537 preparedStatement.setString(2, eamOrg.getPocName());
1538 preparedStatement.setString(3, eamOrg.getPocEmail());
1539 preparedStatement.setString(4, eamOrg.getPocPhone());
1541 preparedStatement.executeUpdate();
1542 generatedKeys = preparedStatement.getGeneratedKeys();
1543 if (generatedKeys.next()) {
1544 return generatedKeys.getLong(1);
1546 throw new SQLException(
"Creating user failed, no ID obtained.");
1548 }
catch (SQLException ex) {
1549 throw new EamDbException(
"Error inserting new organization.", ex);
1568 List<EamOrganization> orgs =
new ArrayList<>();
1569 PreparedStatement preparedStatement = null;
1570 ResultSet resultSet = null;
1571 String sql =
"SELECT * FROM organizations";
1574 preparedStatement = conn.prepareStatement(sql);
1575 resultSet = preparedStatement.executeQuery();
1576 while (resultSet.next()) {
1581 }
catch (SQLException ex) {
1582 throw new EamDbException(
"Error getting all organizations.", ex);
1603 PreparedStatement preparedStatement = null;
1604 ResultSet resultSet = null;
1605 String sql =
"SELECT * FROM organizations WHERE id=?";
1608 preparedStatement = conn.prepareStatement(sql);
1609 preparedStatement.setInt(1, orgID);
1610 resultSet = preparedStatement.executeQuery();
1614 }
catch (SQLException ex) {
1615 throw new EamDbException(
"Error getting organization by id.", ex);
1634 if(globalSet == null) {
1635 throw new EamDbException(
"Reference set with ID " + referenceSetID +
" not found");
1650 if(updatedOrganization == null) {
1655 PreparedStatement preparedStatement = null;
1656 String sql =
"UPDATE organizations SET org_name = ?, poc_name = ?, poc_email = ?, poc_phone = ? WHERE id = ?";
1658 preparedStatement = conn.prepareStatement(sql);
1659 preparedStatement.setString(1, updatedOrganization.getName());
1660 preparedStatement.setString(2, updatedOrganization.getPocName());
1661 preparedStatement.setString(3, updatedOrganization.getPocEmail());
1662 preparedStatement.setString(4, updatedOrganization.getPocPhone());
1663 preparedStatement.setInt(5, updatedOrganization.getOrgID());
1664 preparedStatement.executeUpdate();
1665 }
catch (SQLException ex) {
1673 @Messages({
"AbstractSqlEamDb.deleteOrganization.inUseException.message=Can not delete organization "
1674 +
"which is currently in use by a case or reference set in the central repository.",
1675 "AbstractSqlEamDb.deleteOrganization.errorDeleting.message=Error executing query when attempting to delete organization by id."})
1678 if(organizationToDelete == null) {
1683 PreparedStatement checkIfUsedStatement = null;
1684 ResultSet resultSet = null;
1685 String checkIfUsedSql =
"SELECT (select count(*) FROM cases WHERE org_id=?) + (select count(*) FROM reference_sets WHERE org_id=?)";
1686 PreparedStatement deleteOrgStatement = null;
1687 String deleteOrgSql =
"DELETE FROM organizations WHERE id=?";
1689 checkIfUsedStatement = conn.prepareStatement(checkIfUsedSql);
1690 checkIfUsedStatement.setInt(1, organizationToDelete.
getOrgID());
1691 checkIfUsedStatement.setInt(2, organizationToDelete.
getOrgID());
1692 resultSet = checkIfUsedStatement.executeQuery();
1694 if (resultSet.getLong(1) > 0) {
1695 throw new EamDbException(Bundle.AbstractSqlEamDb_deleteOrganization_inUseException_message());
1697 deleteOrgStatement = conn.prepareStatement(deleteOrgSql);
1698 deleteOrgStatement.setInt(1, organizationToDelete.
getOrgID());
1699 deleteOrgStatement.executeUpdate();
1700 }
catch (SQLException ex) {
1701 throw new EamDbException(Bundle.AbstractSqlEamDb_deleteOrganization_errorDeleting_message(), ex);
1721 if(eamGlobalSet == null){
1725 if(eamGlobalSet.getFileKnownStatus() == null){
1726 throw new EamDbException(
"File known status on the EamGlobalSet is null");
1729 if(eamGlobalSet.getType() == null){
1735 PreparedStatement preparedStatement1 = null;
1736 PreparedStatement preparedStatement2 = null;
1737 ResultSet resultSet = null;
1738 String sql1 =
"INSERT INTO reference_sets(org_id, set_name, version, known_status, read_only, type, import_date) VALUES (?, ?, ?, ?, ?, ?, ?)";
1739 String sql2 =
"SELECT id FROM reference_sets WHERE org_id=? AND set_name=? AND version=? AND import_date=? LIMIT 1";
1742 preparedStatement1 = conn.prepareStatement(sql1);
1743 preparedStatement1.setInt(1, eamGlobalSet.getOrgID());
1744 preparedStatement1.setString(2, eamGlobalSet.getSetName());
1745 preparedStatement1.setString(3, eamGlobalSet.getVersion());
1746 preparedStatement1.setInt(4, eamGlobalSet.getFileKnownStatus().getFileKnownValue());
1747 preparedStatement1.setBoolean(5, eamGlobalSet.isReadOnly());
1748 preparedStatement1.setInt(6, eamGlobalSet.getType().getId());
1749 preparedStatement1.setString(7, eamGlobalSet.getImportDate().toString());
1751 preparedStatement1.executeUpdate();
1753 preparedStatement2 = conn.prepareStatement(sql2);
1754 preparedStatement2.setInt(1, eamGlobalSet.getOrgID());
1755 preparedStatement2.setString(2, eamGlobalSet.getSetName());
1756 preparedStatement2.setString(3, eamGlobalSet.getVersion());
1757 preparedStatement2.setString(4, eamGlobalSet.getImportDate().toString());
1759 resultSet = preparedStatement2.executeQuery();
1761 return resultSet.getInt(
"id");
1763 }
catch (SQLException ex) {
1786 PreparedStatement preparedStatement1 = null;
1787 ResultSet resultSet = null;
1788 String sql1 =
"SELECT * FROM reference_sets WHERE id=?";
1791 preparedStatement1 = conn.prepareStatement(sql1);
1792 preparedStatement1.setInt(1, referenceSetID);
1793 resultSet = preparedStatement1.executeQuery();
1794 if(resultSet.next()) {
1800 }
catch (SQLException ex) {
1801 throw new EamDbException(
"Error getting reference set by id.", ex);
1821 if(correlationType == null){
1822 throw new EamDbException(
"Correlation type is null");
1825 List<EamGlobalSet> results =
new ArrayList<>();
1828 PreparedStatement preparedStatement1 = null;
1829 ResultSet resultSet = null;
1830 String sql1 =
"SELECT * FROM reference_sets WHERE type=" + correlationType.getId();
1833 preparedStatement1 = conn.prepareStatement(sql1);
1834 resultSet = preparedStatement1.executeQuery();
1835 while (resultSet.next()) {
1839 }
catch (SQLException ex) {
1840 throw new EamDbException(
"Error getting reference sets.", ex);
1860 throw new EamDbException(
"known status of EamGlobalFileInstance is null");
1862 if(correlationType == null){
1863 throw new EamDbException(
"Correlation type is null");
1868 PreparedStatement preparedStatement = null;
1870 String sql =
"INSERT INTO %s(reference_set_id, value, known_status, comment) VALUES (?, ?, ?, ?)";
1874 preparedStatement.setInt(1, eamGlobalFileInstance.
getGlobalSetID());
1875 preparedStatement.setString(2, eamGlobalFileInstance.
getMD5Hash());
1876 preparedStatement.setByte(3, eamGlobalFileInstance.
getKnownStatus().getFileKnownValue());
1877 preparedStatement.setString(4, eamGlobalFileInstance.
getComment());
1878 preparedStatement.executeUpdate();
1879 }
catch (SQLException ex) {
1880 throw new EamDbException(
"Error inserting new reference instance into reference_ table.", ex);
1901 PreparedStatement preparedStatement1 = null;
1902 ResultSet resultSet = null;
1903 String sql1 =
"SELECT * FROM reference_sets WHERE set_name=? AND version=?";
1906 preparedStatement1 = conn.prepareStatement(sql1);
1907 preparedStatement1.setString(1, referenceSetName);
1908 preparedStatement1.setString(2, version);
1909 resultSet = preparedStatement1.executeQuery();
1910 return (resultSet.next());
1912 }
catch (SQLException ex) {
1913 throw new EamDbException(
"Error testing whether reference set exists (name: " + referenceSetName
1914 +
" version: " + version, ex);
1929 if(contentType == null) {
1930 throw new EamDbException(
"Null correlation type");
1932 if(globalInstances == null) {
1933 throw new EamDbException(
"Null set of EamGlobalFileInstance");
1938 PreparedStatement bulkPs = null;
1940 conn.setAutoCommit(
false);
1943 String sql =
"INSERT INTO %s(reference_set_id, value, known_status, comment) VALUES (?, ?, ?, ?) "
1949 if(globalInstance.getKnownStatus() == null){
1950 throw new EamDbException(
"EamGlobalFileInstance with value " + globalInstance.getMD5Hash() +
" has null known status");
1953 bulkPs.setInt(1, globalInstance.getGlobalSetID());
1954 bulkPs.setString(2, globalInstance.getMD5Hash());
1955 bulkPs.setByte(3, globalInstance.getKnownStatus().getFileKnownValue());
1956 bulkPs.setString(4, globalInstance.getComment());
1960 bulkPs.executeBatch();
1962 }
catch (SQLException | EamDbException ex) {
1965 }
catch (SQLException ex2) {
1968 throw new EamDbException(
"Error inserting bulk artifacts.", ex);
1993 List<EamGlobalFileInstance> globalFileInstances =
new ArrayList<>();
1994 PreparedStatement preparedStatement1 = null;
1995 ResultSet resultSet = null;
1996 String sql1 =
"SELECT * FROM %s WHERE value=?";
2000 preparedStatement1.setString(1, aValue);
2001 resultSet = preparedStatement1.executeQuery();
2002 while (resultSet.next()) {
2005 return globalFileInstances;
2007 }
catch (SQLException ex) {
2008 throw new EamDbException(
"Error getting reference instances by type and value.", ex);
2027 if (newType == null) {
2028 throw new EamDbException(
"null correlation type");
2033 PreparedStatement preparedStatement = null;
2034 PreparedStatement preparedStatementQuery = null;
2035 ResultSet resultSet = null;
2040 if (-1 == newType.getId()) {
2041 insertSql =
"INSERT INTO correlation_types(display_name, db_table_name, supported, enabled) VALUES (?, ?, ?, ?)";
2043 insertSql =
"INSERT INTO correlation_types(id, display_name, db_table_name, supported, enabled) VALUES (?, ?, ?, ?, ?)";
2045 querySql =
"SELECT * FROM correlation_types WHERE display_name=? AND db_table_name=?";
2048 preparedStatement = conn.prepareStatement(insertSql);
2050 if (-1 == newType.getId()) {
2051 preparedStatement.setString(1, newType.getDisplayName());
2052 preparedStatement.setString(2, newType.getDbTableName());
2053 preparedStatement.setInt(3, newType.isSupported() ? 1 : 0);
2054 preparedStatement.setInt(4, newType.isEnabled() ? 1 : 0);
2056 preparedStatement.setInt(1, newType.getId());
2057 preparedStatement.setString(2, newType.getDisplayName());
2058 preparedStatement.setString(3, newType.getDbTableName());
2059 preparedStatement.setInt(4, newType.isSupported() ? 1 : 0);
2060 preparedStatement.setInt(5, newType.isEnabled() ? 1 : 0);
2063 preparedStatement.executeUpdate();
2065 preparedStatementQuery = conn.prepareStatement(querySql);
2066 preparedStatementQuery.setString(1, newType.getDisplayName());
2067 preparedStatementQuery.setString(2, newType.getDbTableName());
2069 resultSet = preparedStatementQuery.executeQuery();
2070 if (resultSet.next()) {
2072 typeId = correlationType.getId();
2074 }
catch (SQLException ex) {
2075 throw new EamDbException(
"Error inserting new correlation type.", ex);
2090 PreparedStatement preparedStatement = null;
2091 ResultSet resultSet = null;
2092 String sql =
"SELECT * FROM correlation_types";
2095 preparedStatement = conn.prepareStatement(sql);
2096 resultSet = preparedStatement.executeQuery();
2097 while (resultSet.next()) {
2102 }
catch (SQLException ex) {
2103 throw new EamDbException(
"Error getting all correlation types.", ex);
2125 PreparedStatement preparedStatement = null;
2126 ResultSet resultSet = null;
2127 String sql =
"SELECT * FROM correlation_types WHERE enabled=1";
2130 preparedStatement = conn.prepareStatement(sql);
2131 resultSet = preparedStatement.executeQuery();
2132 while (resultSet.next()) {
2137 }
catch (SQLException ex) {
2138 throw new EamDbException(
"Error getting enabled correlation types.", ex);
2160 PreparedStatement preparedStatement = null;
2161 ResultSet resultSet = null;
2162 String sql =
"SELECT * FROM correlation_types WHERE supported=1";
2165 preparedStatement = conn.prepareStatement(sql);
2166 resultSet = preparedStatement.executeQuery();
2167 while (resultSet.next()) {
2172 }
catch (SQLException ex) {
2173 throw new EamDbException(
"Error getting supported correlation types.", ex);
2192 PreparedStatement preparedStatement = null;
2193 String sql =
"UPDATE correlation_types SET display_name=?, db_table_name=?, supported=?, enabled=? WHERE id=?";
2196 preparedStatement = conn.prepareStatement(sql);
2197 preparedStatement.setString(1, aType.getDisplayName());
2198 preparedStatement.setString(2, aType.getDbTableName());
2199 preparedStatement.setInt(3, aType.isSupported() ? 1 : 0);
2200 preparedStatement.setInt(4, aType.isEnabled() ? 1 : 0);
2201 preparedStatement.setInt(5, aType.getId());
2202 preparedStatement.executeUpdate();
2204 }
catch (SQLException ex) {
2205 throw new EamDbException(
"Error updating correlation type.", ex);
2227 PreparedStatement preparedStatement = null;
2228 ResultSet resultSet = null;
2229 String sql =
"SELECT * FROM correlation_types WHERE id=?";
2232 preparedStatement = conn.prepareStatement(sql);
2233 preparedStatement.setInt(1, typeId);
2234 resultSet = preparedStatement.executeQuery();
2235 if(resultSet.next()) {
2239 throw new EamDbException(
"Failed to find entry for correlation type ID = " + typeId);
2242 }
catch (SQLException ex) {
2243 throw new EamDbException(
"Error getting correlation type by id.", ex);
2262 if (null == resultSet) {
2268 resultSet.getInt(
"org_id");
2269 if (!resultSet.wasNull()) {
2272 resultSet.getString(
"org_name"),
2273 resultSet.getString(
"poc_name"),
2274 resultSet.getString(
"poc_email"),
2275 resultSet.getString(
"poc_phone"));
2285 eamCase.
setNotes(resultSet.getString(
"notes"));
2291 if (null == resultSet) {
2296 resultSet.getInt(
"case_id"),
2297 resultSet.getInt(
"id"),
2298 resultSet.getString(
"device_id"),
2299 resultSet.getString(
"name")
2302 return eamDataSource;
2306 if (null == resultSet) {
2311 resultSet.getInt(
"id"),
2312 resultSet.getString(
"display_name"),
2313 resultSet.getString(
"db_table_name"),
2314 resultSet.getBoolean(
"supported"),
2315 resultSet.getBoolean(
"enabled")
2318 return eamArtifactType;
2332 if (null == resultSet) {
2336 new CorrelationCase(resultSet.getInt(
"case_id"), resultSet.getString(
"case_uid"), resultSet.getString(
"case_name")),
2337 new CorrelationDataSource(resultSet.getInt(
"case_id"), -1, resultSet.getString(
"device_id"), resultSet.getString(
"name")),
2338 resultSet.getString(
"file_path"),
2339 resultSet.getString(
"comment"),
2340 TskData.FileKnown.valueOf(resultSet.getByte(
"known_status"))
2343 return eamArtifactInstance;
2347 if (null == resultSet) {
2352 resultSet.getInt(
"id"),
2353 resultSet.getString(
"org_name"),
2354 resultSet.getString(
"poc_name"),
2355 resultSet.getString(
"poc_email"),
2356 resultSet.getString(
"poc_phone")
2359 return eamOrganization;
2363 if (null == resultSet) {
2368 resultSet.getInt(
"id"),
2369 resultSet.getInt(
"org_id"),
2370 resultSet.getString(
"set_name"),
2371 resultSet.getString(
"version"),
2372 TskData.FileKnown.valueOf(resultSet.getByte(
"known_status")),
2373 resultSet.getBoolean(
"read_only"),
2375 LocalDate.parse(resultSet.getString(
"import_date"))
2378 return eamGlobalSet;
2382 if (null == resultSet) {
2387 resultSet.getInt(
"id"),
2388 resultSet.getInt(
"reference_set_id"),
2389 resultSet.getString(
"value"),
2390 TskData.FileKnown.valueOf(resultSet.getByte(
"known_status")),
2391 resultSet.getString(
"comment")
2394 return eamGlobalFileInstance;
2405 ResultSet resultSet = null;
2406 Statement statement;
2407 Connection conn = null;
2411 conn.setAutoCommit(
false);
2412 statement = conn.createStatement();
2414 int minorVersion = 0;
2415 int majorVersion = 0;
2416 resultSet = statement.executeQuery(
"SELECT value FROM db_info WHERE name='SCHEMA_MINOR_VERSION'");
2417 if (resultSet.next()) {
2418 String minorVersionStr = resultSet.getString(
"value");
2420 minorVersion = Integer.parseInt(minorVersionStr);
2421 }
catch (NumberFormatException ex) {
2422 throw new EamDbException(
"Bad value for schema minor version (" + minorVersionStr +
") - database is corrupt");
2426 resultSet = statement.executeQuery(
"SELECT value FROM db_info WHERE name='SCHEMA_VERSION'");
2427 if (resultSet.next()) {
2428 String majorVersionStr = resultSet.getString(
"value");
2430 majorVersion = Integer.parseInt(majorVersionStr);
2431 }
catch (NumberFormatException ex) {
2432 throw new EamDbException(
"Bad value for schema version (" + majorVersionStr +
") - database is corrupt");
2436 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(majorVersion, minorVersion);
2438 LOGGER.log(Level.INFO,
"Central Repository is up to date");
2443 if (dbSchemaVersion.compareTo(
new CaseDbSchemaVersionNumber(1, 1)) < 0) {
2444 statement.execute(
"ALTER TABLE reference_sets ADD COLUMN known_status INTEGER;");
2445 statement.execute(
"ALTER TABLE reference_sets ADD COLUMN read_only BOOLEAN;");
2446 statement.execute(
"ALTER TABLE reference_sets ADD COLUMN type INTEGER;");
2451 EamDbUtil.insertDefaultOrganization(conn);
2454 if (!updateSchemaVersion(conn)) {
2455 throw new EamDbException(
"Error updating schema version");
2460 }
catch (SQLException | EamDbException ex) {
2465 }
catch (SQLException ex2) {
2466 LOGGER.log(Level.SEVERE,
"Database rollback failed", ex2);
String getCorrelationValue()
CorrelationAttribute.Type getCorrelationTypeById(int typeId)
void bulkInsertCases(List< CorrelationCase > cases)
TskData.FileKnown getKnownStatus()
int getFrequencyPercentage(CorrelationAttribute corAttr)
CorrelationCase getCase(Case autopsyCase)
List< CorrelationAttributeInstance > getArtifactInstancesByTypeValue(CorrelationAttribute.Type aType, String value)
void deleteReferenceSet(int referenceSetID)
CorrelationCase newCase(Case autopsyCase)
void updateOrganization(EamOrganization updatedOrganization)
void addArtifact(CorrelationAttribute eamArtifact)
CorrelationCase getEamCaseFromResultSet(ResultSet resultSet)
void setCreationDate(String creationDate)
List< EamOrganization > getOrganizations()
EamOrganization getReferenceSetOrganization(int referenceSetID)
Type getCorrelationType()
static final int FILES_TYPE_ID
abstract Connection connect()
void updateCorrelationType(CorrelationAttribute.Type aType)
List< EamGlobalFileInstance > getReferenceInstancesByTypeValue(CorrelationAttribute.Type aType, String aValue)
void prepareBulkArtifact(CorrelationAttribute eamArtifact)
CorrelationCase newCase(CorrelationCase eamCase)
static void closeResultSet(ResultSet resultSet)
Long getCountArtifactInstancesByCaseDataSource(String caseUUID, String dataSourceID)
Long getCountArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
int newReferenceSet(EamGlobalSet eamGlobalSet)
List< String > getListCasesHavingArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
String getDbInfo(String name)
Long getCountUniqueDataSources()
void deleteReferenceSetEntry(int referenceSetID)
List< CorrelationDataSource > getDataSources()
int bulkArtifactsThreshold
void setExaminerPhone(String examinerPhone)
void setExaminerName(String examinerName)
void setCaseNumber(String caseNumber)
final List< CorrelationAttribute.Type > DEFAULT_CORRELATION_TYPES
void deleteReferenceSetEntries(int referenceSetID)
abstract String getConflictClause()
void deleteOrganization(EamOrganization organizationToDelete)
CorrelationAttribute.Type getCorrelationTypeById(int typeId)
static String correlationTypeToReferenceTableName(CorrelationAttribute.Type type)
EamOrganization getOrganizationByID(int orgID)
void setOrg(EamOrganization org)
List< CorrelationAttributeInstance > getArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
List< CorrelationAttributeInstance > getArtifactInstancesByPath(CorrelationAttribute.Type aType, String filePath)
long newOrganization(EamOrganization eamOrg)
static EamDb getInstance()
void setNotes(String notes)
List< CorrelationAttribute.Type > getDefinedCorrelationTypes()
static void closeConnection(Connection conn)
boolean isValueInReferenceSet(String value, int referenceSetID, int correlationTypeID)
EamGlobalSet getReferenceSetByID(int referenceSetID)
void addReferenceInstance(EamGlobalFileInstance eamGlobalFileInstance, CorrelationAttribute.Type correlationType)
void setArtifactInstanceKnownStatus(CorrelationAttribute eamArtifact, TskData.FileKnown knownStatus)
boolean referenceSetExists(String referenceSetName, String version)
boolean isFileHashInReferenceSet(String hash, int referenceSetID)
CorrelationAttribute.Type getCorrelationTypeFromResultSet(ResultSet resultSet)
boolean isArtifactKnownBadByReference(CorrelationAttribute.Type aType, String value)
List< CorrelationAttributeInstance > getInstances()
CorrelationAttributeInstance getEamArtifactInstanceFromResultSet(ResultSet resultSet)
void updateCase(CorrelationCase eamCase)
EamGlobalSet getEamGlobalSetFromResultSet(ResultSet resultSet)
EamOrganization getEamOrganizationFromResultSet(ResultSet resultSet)
CorrelationDataSource getCorrelationDataSource()
void bulkInsertReferenceTypeEntries(Set< EamGlobalFileInstance > globalInstances, CorrelationAttribute.Type contentType)
List< CorrelationAttribute.Type > getSupportedCorrelationTypes()
Long getCountArtifactInstancesByTypeValue(CorrelationAttribute.Type aType, String value)
CorrelationCase getCaseByUUID(String caseUUID)
static String correlationTypeToInstanceTableName(CorrelationAttribute.Type type)
Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttribute.Type aType, String value)
CorrelationDataSource getEamDataSourceFromResultSet(ResultSet resultSet)
void bulkInsertArtifacts()
static final CaseDbSchemaVersionNumber CURRENT_DB_SCHEMA_VERSION
CorrelationDataSource getDataSource(CorrelationCase correlationCase, String dataSourceDeviceId)
List< CorrelationAttribute.Type > getEnabledCorrelationTypes()
List< CorrelationCase > getCases()
void newDataSource(CorrelationDataSource eamDataSource)
synchronized static Logger getLogger(String name)
static List< CorrelationAttribute.Type > getDefaultCorrelationTypes()
boolean referenceSetIsValid(int referenceSetID, String setName, String version)
int newCorrelationType(CorrelationAttribute.Type newType)
EamGlobalFileInstance getEamGlobalFileInstanceFromResultSet(ResultSet resultSet)
CorrelationCase getCorrelationCase()
void newDbInfo(String name, String value)
static EamOrganization getDefault()
List< EamGlobalSet > getAllReferenceSets(CorrelationAttribute.Type correlationType)
static final Logger LOGGER
void setExaminerEmail(String examinerEmail)
final Map< String, Collection< CorrelationAttribute > > bulkArtifacts
static void closePreparedStatement(PreparedStatement preparedStatement)
void updateDbInfo(String name, String value)