19 package org.sleuthkit.autopsy.centralrepository.eventlisteners;
21 import com.google.common.util.concurrent.ThreadFactoryBuilder;
22 import java.beans.PropertyChangeEvent;
23 import java.beans.PropertyChangeListener;
24 import java.util.List;
25 import java.util.concurrent.ExecutorService;
26 import java.util.concurrent.Executors;
27 import java.util.logging.Level;
28 import java.util.stream.Collectors;
29 import org.openide.util.NbBundle.Messages;
60 @Messages({
"caseeventlistener.evidencetag=Evidence"})
61 final class CaseEventListener implements PropertyChangeListener {
64 private final ExecutorService jobProcessingExecutor;
65 private static final String CASE_EVENT_THREAD_NAME =
"Case-Event-Listener-%d";
68 jobProcessingExecutor = Executors.newSingleThreadExecutor(
new ThreadFactoryBuilder().setNameFormat(CASE_EVENT_THREAD_NAME).build());
76 public void propertyChange(PropertyChangeEvent evt) {
81 LOGGER.log(Level.SEVERE,
"Failed to get instance of db manager.", ex);
84 switch (
Case.
Events.valueOf(evt.getPropertyName())) {
85 case CONTENT_TAG_ADDED:
86 case CONTENT_TAG_DELETED: {
87 jobProcessingExecutor.submit(
new ContentTagTask(dbManager, evt));
91 case BLACKBOARD_ARTIFACT_TAG_DELETED:
92 case BLACKBOARD_ARTIFACT_TAG_ADDED: {
93 jobProcessingExecutor.submit(
new BlackboardTagTask(dbManager, evt));
97 case DATA_SOURCE_ADDED: {
98 jobProcessingExecutor.submit(
new DataSourceAddedTask(dbManager, evt));
101 case TAG_DEFINITION_CHANGED: {
102 jobProcessingExecutor.submit(
new TagDefinitionChangeTask(evt));
106 jobProcessingExecutor.submit(
new CurrentCaseTask(dbManager, evt));
115 private final PropertyChangeEvent
event;
129 TskData.FileKnown knownStatus;
135 final ContentTag tagAdded = tagAddedEvent.getAddedTag();
138 if (tagAdded.getContent() instanceof AbstractFile) {
139 af = (AbstractFile) tagAdded.getContent();
140 knownStatus = TskData.FileKnown.BAD;
141 comment = tagAdded.getComment();
143 LOGGER.log(Level.WARNING,
"Error updating non-file object");
170 .map(tag -> tag.getName().getDisplayName())
172 .collect(Collectors.toList())
176 if (content instanceof AbstractFile) {
177 af = (AbstractFile) content;
178 knownStatus = TskData.FileKnown.UNKNOWN;
181 LOGGER.log(Level.WARNING,
"Error updating non-file object");
188 }
catch (TskCoreException ex) {
189 LOGGER.log(Level.SEVERE,
"Failed to find content", ex);
195 knownStatus, comment);
197 if (eamArtifact != null) {
202 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
211 private final PropertyChangeEvent
event;
225 BlackboardArtifact bbArtifact;
226 TskData.FileKnown knownStatus;
232 final BlackboardArtifactTag tagAdded = tagAddedEvent.getAddedTag();
235 content = tagAdded.getContent();
236 bbArtifact = tagAdded.getArtifact();
237 knownStatus = TskData.FileKnown.BAD;
238 comment = tagAdded.getComment();
265 .map(tag -> tag.getName().getDisplayName())
267 .collect(Collectors.toList())
271 knownStatus = TskData.FileKnown.UNKNOWN;
278 }
catch (TskCoreException ex) {
279 LOGGER.log(Level.SEVERE,
"Failed to find content", ex);
284 if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
290 eamArtifact.getInstances().get(0).setComment(comment);
294 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database while setting artifact known status.", ex);
303 private final PropertyChangeEvent
event;
315 String modifiedTagName = (String) event.getOldValue();
326 for (BlackboardArtifactTag bbTag : artifactTags) {
328 boolean hasTagWithConflictingKnownStatus =
false;
332 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
333 Content content = bbTag.getContent();
336 if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
340 BlackboardArtifact bbArtifact = bbTag.getArtifact();
344 for (BlackboardArtifactTag t : tags) {
346 if (t.getName().equals(tagName)) {
350 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
352 hasTagWithConflictingKnownStatus =
true;
358 if (!hasTagWithConflictingKnownStatus) {
371 for (ContentTag contentTag : fileTags) {
373 boolean hasTagWithConflictingKnownStatus =
false;
377 if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
378 Content content = contentTag.getContent();
382 for (ContentTag t : tags) {
384 if (t.getName().equals(tagName)) {
388 if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
390 hasTagWithConflictingKnownStatus =
true;
396 if (!hasTagWithConflictingKnownStatus) {
398 tagName.getKnownStatus(),
"");
399 if (eamArtifact != null) {
404 }
catch (TskCoreException ex) {
405 LOGGER.log(Level.SEVERE,
"Cannot update known status in central repository for tag: " + modifiedTagName, ex);
407 LOGGER.log(Level.SEVERE,
"Cannot get central repository for tag: " + modifiedTagName, ex);
415 private final PropertyChangeEvent
event;
429 Content newDataSource = dataSourceAddedEvent.
getDataSource();
434 if (null == correlationCase) {
437 if (null == dbManager.
getDataSource(correlationCase, deviceId)) {
441 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
442 }
catch (TskCoreException | TskDataException ex) {
443 LOGGER.log(Level.SEVERE,
"Error getting data source from DATA_SOURCE_ADDED event content.", ex);
451 private final PropertyChangeEvent
event;
464 if ((null == event.getOldValue()) && (event.getNewValue() instanceof
Case)) {
465 Case curCase = (
Case) event.getNewValue();
475 if (dbManager.
getCase(curCase) == null) {
479 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
CorrelationDataSource getDataSource(CorrelationCase correlationCase, String dataSourceDeviceId)
static CorrelationAttribute getCorrelationAttributeFromContent(Content content, TskData.FileKnown knownStatus, String comment)
final PropertyChangeEvent event
DataSourceAddedTask(EamDb db, PropertyChangeEvent evt)
CorrelationCase newCase(CorrelationCase eamCase)
DeletedBlackboardArtifactTagInfo getDeletedTagInfo()
static CorrelationDataSource fromTSKDataSource(CorrelationCase correlationCase, Content dataSource)
TagDefinitionChangeTask(PropertyChangeEvent evt)
static void shutDownTaskExecutor(ExecutorService executor)
ContentTagTask(EamDb db, PropertyChangeEvent evt)
TagsManager getTagsManager()
void setArtifactInstanceKnownStatus(CorrelationAttribute eamArtifact, TskData.FileKnown knownStatus)
static EamDb getInstance()
CurrentCaseTask(EamDb db, PropertyChangeEvent evt)
static boolean isEnabled()
SleuthkitCase getSleuthkitCase()
BLACKBOARD_ARTIFACT_TAG_ADDED
CorrelationCase getCase(Case autopsyCase)
static Case getCurrentCase()
BlackboardTagTask(EamDb db, PropertyChangeEvent evt)
synchronized static Logger getLogger(String name)
final PropertyChangeEvent event
final PropertyChangeEvent event
DeletedContentTagInfo getDeletedTagInfo()
final PropertyChangeEvent event
void newDataSource(CorrelationDataSource eamDataSource)
static List< CorrelationAttribute > getCorrelationAttributeFromBlackboardArtifact(BlackboardArtifact bbArtifact, boolean addInstanceDetails, boolean checkEnabled)
final PropertyChangeEvent event