Autopsy  4.7.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
InterestingHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
32 import java.util.Map;
33 import java.util.Observable;
34 import java.util.Observer;
35 import java.util.Set;
36 import java.util.logging.Level;
37 import org.openide.nodes.ChildFactory;
38 import org.openide.nodes.Children;
39 import org.openide.nodes.Node;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.Lookups;
48 import org.sleuthkit.datamodel.BlackboardArtifact;
49 import org.sleuthkit.datamodel.BlackboardAttribute;
50 import org.sleuthkit.datamodel.SleuthkitCase;
51 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
52 import org.sleuthkit.datamodel.TskCoreException;
53 
54 public class InterestingHits implements AutopsyVisitableItem {
55 
56  private static final String INTERESTING_ITEMS = NbBundle
57  .getMessage(InterestingHits.class, "InterestingHits.interestingItems.text");
58  private static final String DISPLAY_NAME = NbBundle.getMessage(InterestingHits.class, "InterestingHits.displayName.text");
59  private static final Logger logger = Logger.getLogger(InterestingHits.class.getName());
60  private SleuthkitCase skCase;
62 
63  public InterestingHits(SleuthkitCase skCase) {
64  this.skCase = skCase;
65  interestingResults.update();
66  }
67 
68  private class InterestingResults extends Observable {
69 
70  // NOTE: the map can be accessed by multiple worker threads and needs to be synchronized
71  private final Map<String, Map<String, Set<Long>>> interestingItemsMap = new LinkedHashMap<>();
72 
73  public List<String> getSetNames() {
74  List<String> setNames;
75  synchronized (interestingItemsMap) {
76  setNames = new ArrayList<>(interestingItemsMap.keySet());
77  }
78  Collections.sort(setNames);
79  return setNames;
80  }
81 
82  public Set<Long> getArtifactIds(String setName, String typeName) {
83  synchronized (interestingItemsMap) {
84  return interestingItemsMap.get(setName).get(typeName);
85  }
86  }
87 
88  public void update() {
89  synchronized (interestingItemsMap) {
90  interestingItemsMap.clear();
91  }
92  loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
93  loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
94  setChanged();
95  notifyObservers();
96  }
97 
98  /*
99  * Reads the artifacts of specified type, grouped by Set, and loads into
100  * the interestingItemsMap
101  */
102  @SuppressWarnings("deprecation")
103  private void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) {
104  if (skCase == null) {
105  return;
106  }
107 
108  int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
109  int artId = artType.getTypeID();
110  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
111  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
112  + "attribute_type_id=" + setNameId //NON-NLS
113  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
114  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
115 
116  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
117  synchronized (interestingItemsMap) {
118  ResultSet resultSet = dbQuery.getResultSet();
119  while (resultSet.next()) {
120  String value = resultSet.getString("value_text"); //NON-NLS
121  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
122  if (!interestingItemsMap.containsKey(value)) {
123  interestingItemsMap.put(value, new LinkedHashMap<>());
124  interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName(), new HashSet<>());
125  interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(), new HashSet<>());
126  }
127  interestingItemsMap.get(value).get(artType.getDisplayName()).add(artifactId);
128  }
129  }
130  } catch (TskCoreException | SQLException ex) {
131  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
132  }
133  }
134  }
135 
136  @Override
137  public <T> T accept(AutopsyItemVisitor<T> visitor) {
138  return visitor.visit(this);
139  }
140 
144  public class RootNode extends DisplayableItemNode {
145 
146  public RootNode() {
147  super(Children.create(new SetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
148  super.setName(INTERESTING_ITEMS);
149  super.setDisplayName(DISPLAY_NAME);
150  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
151  }
152 
153  @Override
154  public boolean isLeafTypeNode() {
155  return false;
156  }
157 
158  @Override
159  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
160  return visitor.visit(this);
161  }
162 
163  @Override
164  protected Sheet createSheet() {
165  Sheet sheet = super.createSheet();
166  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
167  if (sheetSet == null) {
168  sheetSet = Sheet.createPropertiesSet();
169  sheet.put(sheetSet);
170  }
171 
172  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
173  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.displayName"),
174  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
175  getName()));
176 
177  return sheet;
178  }
179 
180  @Override
181  public String getItemType() {
182  return getClass().getName();
183  }
184  }
185 
186  private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
187 
188  /*
189  * This should probably be in the top-level class, but the factory has
190  * nice methods for its startup and shutdown, so it seemed like a
191  * cleaner place to register the property change listener.
192  */
193  private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
194  String eventType = evt.getPropertyName();
195  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
202  try {
210  ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
211  if (null != eventData && (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()
212  || eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID())) {
213  interestingResults.update();
214  }
215  } catch (NoCurrentCaseException notUsed) {
219  }
220  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
221  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
228  try {
230  interestingResults.update();
231  } catch (NoCurrentCaseException notUsed) {
235  }
236  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
237  // case was closed. Remove listeners so that we don't get called with a stale case handle
238  if (evt.getNewValue() == null) {
239  removeNotify();
240  skCase = null;
241  }
242  }
243  };
244 
245  @Override
246  protected void addNotify() {
250  interestingResults.update();
251  interestingResults.addObserver(this);
252  }
253 
254  @Override
255  protected void removeNotify() {
259  interestingResults.deleteObserver(this);
260  }
261 
262  @Override
263  protected boolean createKeys(List<String> list) {
264  list.addAll(interestingResults.getSetNames());
265  return true;
266  }
267 
268  @Override
269  protected Node createNodeForKey(String key) {
270  return new SetNameNode(key);
271  }
272 
273  @Override
274  public void update(Observable o, Object arg) {
275  refresh(true);
276  }
277  }
278 
279  public class SetNameNode extends DisplayableItemNode implements Observer {
280 
281  private final String setName;
282 
283  public SetNameNode(String setName) {//, Set<Long> children) {
284  super(Children.create(new HitTypeFactory(setName), true), Lookups.singleton(setName));
285  this.setName = setName;
286  super.setName(setName);
288  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
289  interestingResults.addObserver(this);
290  }
291 
292  private void updateDisplayName() {
293  int sizeOfSet = interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size()
294  + interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName()).size();
295  super.setDisplayName(setName + " (" + sizeOfSet + ")");
296  }
297 
298  @Override
299  public boolean isLeafTypeNode() {
300  return false;
301  }
302 
303  @Override
304  protected Sheet createSheet() {
305  Sheet sheet = super.createSheet();
306  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
307  if (sheetSet == null) {
308  sheetSet = Sheet.createPropertiesSet();
309  sheet.put(sheetSet);
310  }
311 
312  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
313  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
314  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
315  getName()));
316 
317  return sheet;
318  }
319 
320  @Override
321  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
322  return visitor.visit(this);
323  }
324 
325  @Override
326  public void update(Observable o, Object arg) {
328  }
329 
330  @Override
331  public String getItemType() {
336  return getClass().getName();
337  }
338  }
339 
340  private class HitTypeFactory extends ChildFactory<String> implements Observer {
341 
342  private final String setName;
343  private final Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
344 
345  private HitTypeFactory(String setName) {
346  super();
347  this.setName = setName;
348  interestingResults.addObserver(this);
349  }
350 
351  @Override
352  protected boolean createKeys(List<String> list) {
353  list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName());
354  list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName());
355  return true;
356  }
357 
358  @Override
359  protected Node createNodeForKey(String key) {
360  return new InterestingItemTypeNode(setName, key);
361  }
362 
363  @Override
364  public void update(Observable o, Object arg) {
365  refresh(true);
366  }
367  }
368 
369  public class InterestingItemTypeNode extends DisplayableItemNode implements Observer {
370 
371  private final String typeName;
372  private final String setName;
373 
374  private InterestingItemTypeNode(String setName, String typeName) {
375  super(Children.create(new HitFactory(setName, typeName), true), Lookups.singleton(setName));
376  this.typeName = typeName;
377  this.setName = setName;
378  super.setName(typeName);
380  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
381  interestingResults.addObserver(this);
382  }
383 
384  private void updateDisplayName() {
385  super.setDisplayName(typeName + " (" + interestingResults.getArtifactIds(setName, typeName).size() + ")");
386  }
387 
388  @Override
389  public boolean isLeafTypeNode() {
390  return true;
391  }
392 
393  @Override
394  protected Sheet createSheet() {
395  Sheet sheet = super.createSheet();
396  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
397  if (sheetSet == null) {
398  sheetSet = Sheet.createPropertiesSet();
399  sheet.put(sheetSet);
400  }
401  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
402  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
403  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
404  getName()));
405  return sheet;
406  }
407 
408  @Override
409  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
410  return visitor.visit(this);
411  }
412 
413  @Override
414  public void update(Observable o, Object arg) {
416  }
417 
418  @Override
419  public String getItemType() {
424  return getClass().getName();
425  }
426  }
427 
428  private class HitFactory extends ChildFactory<Long> implements Observer {
429 
430  private final String setName;
431  private final String typeName;
432  private final Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
433 
434  private HitFactory(String setName, String typeName) {
435  super();
436  this.setName = setName;
437  this.typeName = typeName;
438  interestingResults.addObserver(this);
439  }
440 
441  @Override
442  protected boolean createKeys(List<Long> list) {
443 
444  if (skCase == null) {
445  return true;
446  }
447 
448  interestingResults.getArtifactIds(setName, typeName).forEach((id) -> {
449  try {
450  if (!artifactHits.containsKey(id)) {
451  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
452  artifactHits.put(id, art);
453  }
454  list.add(id);
455  } catch (TskCoreException ex) {
456  logger.log(Level.SEVERE, "TSK Exception occurred", ex); //NON-NLS
457  }
458  });
459  return true;
460  }
461 
462  @Override
463  protected Node createNodeForKey(Long l) {
464  BlackboardArtifact art = artifactHits.get(l);
465  return (null == art) ? null : new BlackboardArtifactNode(art);
466  }
467 
468  @Override
469  public void update(Observable o, Object arg) {
470  refresh(true);
471  }
472  }
473 }
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
Set< Long > getArtifactIds(String setName, String typeName)
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:420
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:465
final Map< String, Map< String, Set< Long > > > interestingItemsMap

Copyright © 2012-2016 Basis Technology. Generated on: Mon Jun 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.