19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
33 import java.util.Observable;
34 import java.util.Observer;
36 import java.util.logging.Level;
37 import org.openide.nodes.ChildFactory;
38 import org.openide.nodes.Children;
39 import org.openide.nodes.Node;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.Lookups;
50 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
56 .getMessage(
InterestingHits.class,
"InterestingHits.interestingItems.text");
64 interestingResults.
update();
73 List<String> setNames;
75 setNames =
new ArrayList<>(interestingItemsMap.keySet());
77 Collections.sort(setNames);
83 return interestingItemsMap.get(setName).get(typeName);
89 interestingItemsMap.clear();
91 loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
92 loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
101 @SuppressWarnings(
"deprecation")
103 if (skCase == null) {
107 int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
108 int artId = artType.getTypeID();
109 String query =
"SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id "
110 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
111 +
"attribute_type_id=" + setNameId
112 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
113 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
115 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
117 ResultSet resultSet = dbQuery.getResultSet();
118 while (resultSet.next()) {
119 String value = resultSet.getString(
"value_text");
120 long artifactId = resultSet.getLong(
"artifact_id");
121 if (!interestingItemsMap.containsKey(value)) {
122 interestingItemsMap.put(value,
new LinkedHashMap<>());
123 interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName(),
new HashSet<>());
124 interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(),
new HashSet<>());
126 interestingItemsMap.get(value).get(artType.getDisplayName()).add(artifactId);
129 }
catch (TskCoreException | SQLException ex) {
130 logger.log(Level.WARNING,
"SQL Exception occurred: ", ex);
137 return v.
visit(
this);
146 super(Children.create(
new SetNameFactory(),
true), Lookups.singleton(DISPLAY_NAME));
147 super.setName(INTERESTING_ITEMS);
148 super.setDisplayName(DISPLAY_NAME);
149 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
159 return v.
visit(
this);
164 Sheet s = super.createSheet();
165 Sheet.Set ss = s.get(Sheet.PROPERTIES);
167 ss = Sheet.createPropertiesSet();
171 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
172 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.displayName"),
173 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
181 return getClass().getName();
185 private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
192 private final PropertyChangeListener
pcl = (PropertyChangeEvent evt) -> {
193 String eventType = evt.getPropertyName();
210 if (null != eventData && (eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()
211 || eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID())) {
212 interestingResults.
update();
214 }
catch (IllegalStateException notUsed) {
229 interestingResults.
update();
230 }
catch (IllegalStateException notUsed) {
237 if (evt.getNewValue() == null) {
249 interestingResults.
update();
250 interestingResults.addObserver(
this);
258 interestingResults.deleteObserver(
this);
273 public void update(Observable o, Object arg) {
283 super(Children.create(
new HitTypeFactory(setName),
true), Lookups.singleton(setName));
285 super.setName(setName);
287 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
288 interestingResults.addObserver(
this);
292 int sizeOfSet = interestingResults.
getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size()
293 + interestingResults.
getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName()).size();
294 super.setDisplayName(setName +
" (" + sizeOfSet +
")");
304 Sheet s = super.createSheet();
305 Sheet.Set ss = s.get(Sheet.PROPERTIES);
307 ss = Sheet.createPropertiesSet();
311 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
312 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
313 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
321 return v.
visit(
this);
325 public void update(Observable o, Object arg) {
335 return getClass().getName();
342 private final Map<Long, BlackboardArtifact>
artifactHits =
new HashMap<>();
347 interestingResults.addObserver(
this);
352 list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName());
353 list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName());
363 public void update(Observable o, Object arg) {
374 super(Children.create(
new HitFactory(setName, typeName),
true), Lookups.singleton(setName));
377 super.setName(typeName);
379 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
380 interestingResults.addObserver(
this);
384 super.setDisplayName(typeName +
" (" + interestingResults.
getArtifactIds(setName, typeName).size() +
")");
394 Sheet s = super.createSheet();
395 Sheet.Set ss = s.get(Sheet.PROPERTIES);
397 ss = Sheet.createPropertiesSet();
400 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
401 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
402 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
409 return v.
visit(
this);
413 public void update(Observable o, Object arg) {
423 return getClass().getName();
427 private class HitFactory extends ChildFactory<Long> implements Observer {
431 private final Map<Long, BlackboardArtifact>
artifactHits =
new HashMap<>();
437 interestingResults.addObserver(
this);
443 if (skCase == null) {
447 interestingResults.
getArtifactIds(setName, typeName).forEach((
id) -> {
449 if (!artifactHits.containsKey(
id)) {
450 BlackboardArtifact art = skCase.getBlackboardArtifact(
id);
451 artifactHits.put(
id, art);
454 }
catch (TskCoreException ex) {
455 logger.log(Level.SEVERE,
"TSK Exception occurred", ex);
463 BlackboardArtifact art = artifactHits.get(l);
468 public void update(Observable o, Object arg) {
static final String DISPLAY_NAME
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static final String INTERESTING_ITEMS
HitTypeFactory(String setName)
static synchronized IngestManager getInstance()
boolean createKeys(List< String > list)
Node createNodeForKey(String key)
Node createNodeForKey(Long l)
void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType)
void update(Observable o, Object arg)
boolean createKeys(List< String > list)
boolean createKeys(List< Long > list)
List< String > getSetNames()
HitFactory(String setName, String typeName)
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
final PropertyChangeListener pcl
void update(Observable o, Object arg)
SetNameNode(String setName)
void addIngestJobEventListener(final PropertyChangeListener listener)
Set< Long > getArtifactIds(String setName, String typeName)
void update(Observable o, Object arg)
void update(Observable o, Object arg)
final Map< Long, BlackboardArtifact > artifactHits
void addIngestModuleEventListener(final PropertyChangeListener listener)
Node createNodeForKey(String key)
InterestingItemTypeNode(String setName, String typeName)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
InterestingHits(SleuthkitCase skCase)
final Map< Long, BlackboardArtifact > artifactHits
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
final InterestingResults interestingResults
final Map< String, Map< String, Set< Long > > > interestingItemsMap
void update(Observable o, Object arg)
static final Logger logger