19 package org.sleuthkit.autopsy.commonfilesearch;
21 import java.sql.ResultSet;
22 import java.sql.SQLException;
23 import java.util.Collections;
24 import java.util.HashMap;
26 import java.util.logging.Level;
45 final class InterCaseSearchResultsProcessor {
50 private final Type correlationType;
52 private static final Logger LOGGER = Logger.getLogger(CommonAttributePanel.class.getName());
57 private final String interCaseWhereClause;
62 private final String singleInterCaseWhereClause;
71 InterCaseSearchResultsProcessor(CorrelationAttributeInstance.Type theType) {
72 this.correlationType = theType;
73 interCaseWhereClause = getInterCaseWhereClause();
74 singleInterCaseWhereClause = getSingleInterCaseWhereClause();
77 private String getInterCaseWhereClause() {
78 String tableName = EamDbUtil.correlationTypeToInstanceTableName(correlationType);
79 StringBuilder sqlString =
new StringBuilder(250);
80 sqlString.append(
"value IN (SELECT value FROM ")
82 .append(
" WHERE value IN (SELECT value FROM ")
84 .append(
" WHERE case_id=%s AND (known_status !=%s OR known_status IS NULL) GROUP BY value)")
85 .append(
" GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value");
86 return sqlString.toString();
89 private String getSingleInterCaseWhereClause() {
90 String tableName = EamDbUtil.correlationTypeToInstanceTableName(correlationType);
91 StringBuilder sqlString =
new StringBuilder(250);
92 sqlString.append(
"value IN (SELECT value FROM ")
94 .append(
" WHERE value IN (SELECT value FROM ")
96 .append(
" WHERE case_id=%s AND (known_status !=%s OR known_status IS NULL) GROUP BY value)")
97 .append(
" AND (case_id=%s OR case_id=%s) GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value");
98 return sqlString.toString();
108 CorrelationAttributeInstance findSingleCorrelationAttribute(
int attrbuteId) {
111 InterCaseCommonAttributeRowCallback instancetableCallback =
new InterCaseCommonAttributeRowCallback();
112 EamDb DbManager = EamDb.getInstance();
113 DbManager.processInstanceTableWhere(correlationType, String.format(
"id = %s", attrbuteId), instancetableCallback);
115 return instancetableCallback.getCorrelationAttribute();
117 }
catch (EamDbException ex) {
118 LOGGER.log(Level.SEVERE,
"Error accessing EamDb processing InstanceTable row.", ex);
130 Map<Integer, CommonAttributeValueList> findInterCaseCommonAttributeValues(Case currentCase) {
132 InterCaseCommonAttributesCallback instancetableCallback =
new InterCaseCommonAttributesCallback();
133 EamDb DbManager = EamDb.getInstance();
135 int caseId = DbManager.getCase(currentCase).getID();
137 DbManager.processInstanceTableWhere(correlationType, String.format(interCaseWhereClause, caseId,
138 TskData.FileKnown.KNOWN.getFileKnownValue()),
139 instancetableCallback);
141 return instancetableCallback.getInstanceCollatedCommonFiles();
143 }
catch (EamDbException ex) {
144 LOGGER.log(Level.SEVERE,
"Error accessing EamDb processing CaseInstancesTable.", ex);
146 return new HashMap<>();
157 Map<Integer, CommonAttributeValueList> findSingleInterCaseCommonAttributeValues(Case currentCase, CorrelationCase singleCase) {
159 InterCaseCommonAttributesCallback instancetableCallback =
new InterCaseCommonAttributesCallback();
160 EamDb DbManager = EamDb.getInstance();
161 int caseId = DbManager.getCase(currentCase).getID();
162 int targetCaseId = singleCase.getID();
163 DbManager.processInstanceTableWhere(correlationType, String.format(singleInterCaseWhereClause, caseId,
164 TskData.FileKnown.KNOWN.getFileKnownValue(), caseId, targetCaseId), instancetableCallback);
165 return instancetableCallback.getInstanceCollatedCommonFiles();
166 }
catch (EamDbException ex) {
167 LOGGER.log(Level.SEVERE,
"Error accessing EamDb processing CaseInstancesTable.", ex);
169 return new HashMap<>();
178 final Map<Integer, CommonAttributeValueList> instanceCollatedCommonFiles =
new HashMap<>();
186 while (resultSet.next()) {
190 if (previousRowMd5.isEmpty()) {
191 previousRowMd5 = corValue;
193 if (corValue == null || HashUtility.isNoDataMd5(corValue)) {
201 if (commonAttributeValue != null) {
203 if (instanceCollatedCommonFiles.containsKey(size)) {
204 instanceCollatedCommonFiles.get(size).addMetadataToList(commonAttributeValue);
207 value.addMetadataToList(commonAttributeValue);
208 instanceCollatedCommonFiles.put(size, value);
211 }
catch (SQLException ex) {
212 LOGGER.log(Level.WARNING,
"Error getting artifact instances from database.", ex);
226 if (commonAttributeValue == null) {
229 if (!corValue.equals(previousRowMd5)) {
231 if (instanceCollatedCommonFiles.containsKey(size)) {
232 instanceCollatedCommonFiles.get(size).addMetadataToList(commonAttributeValue);
235 value.addMetadataToList(commonAttributeValue);
236 instanceCollatedCommonFiles.put(size, value);
240 previousRowMd5 = corValue;
246 commonAttributeValue.addInstance(searchResult);
249 Map<Integer, CommonAttributeValueList> getInstanceCollatedCommonFiles() {
250 return Collections.unmodifiableMap(instanceCollatedCommonFiles);
267 while (resultSet.next()) {
277 LOGGER.log(Level.INFO,
"Unable to get CorrelationAttributeInstance.", ex);
282 LOGGER.log(Level.WARNING,
"Error getting single correlation artifact instance from database.", ex);
287 return correlationAttributeInstance;
void countAndAddCommonAttributes(String corValue, int resultId)
CommonAttributeValue commonAttributeValue
static String getFilePath(ResultSet resultSet)
static int getId(ResultSet resultSet)
CorrelationDataSource getDataSourceById(CorrelationCase correlationCase, int dataSourceId)
CorrelationCase getCaseById(int caseId)
static EamDb getInstance()
void process(ResultSet resultSet)
CorrelationAttributeInstance getCorrelationAttributeInstance(CorrelationAttributeInstance.Type type, CorrelationCase correlationCase, CorrelationDataSource correlationDataSource, String value, String filePath)
static int getDataSourceId(ResultSet resultSet)
void process(ResultSet resultSet)
static int getCaseId(ResultSet resultSet)
static String getValue(ResultSet resultSet)