19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
33 import java.util.Objects;
34 import java.util.Observable;
35 import java.util.Observer;
37 import java.util.logging.Level;
38 import org.openide.nodes.ChildFactory;
39 import org.openide.nodes.Children;
40 import org.openide.nodes.Node;
41 import org.openide.nodes.Sheet;
42 import org.openide.util.NbBundle;
43 import org.openide.util.lookup.Lookups;
54 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
60 .getMessage(
InterestingHits.class,
"InterestingHits.interestingItems.text");
86 this.datasourceObjId = objId;
87 interestingResults.
update();
96 List<String> setNames;
98 setNames =
new ArrayList<>(interestingItemsMap.keySet());
100 Collections.sort(setNames);
106 return interestingItemsMap.get(setName).get(typeName);
112 interestingItemsMap.clear();
114 loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
115 loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
124 @SuppressWarnings(
"deprecation")
126 if (skCase == null) {
130 int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
131 int artId = artType.getTypeID();
132 String query =
"SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id "
133 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
134 +
"attribute_type_id=" + setNameId
135 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
136 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
138 query +=
" AND blackboard_artifacts.data_source_obj_id = " +
datasourceObjId;
141 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
143 ResultSet resultSet = dbQuery.getResultSet();
144 while (resultSet.next()) {
145 String value = resultSet.getString(
"value_text");
146 long artifactId = resultSet.getLong(
"artifact_id");
147 if (!interestingItemsMap.containsKey(value)) {
148 interestingItemsMap.put(value,
new LinkedHashMap<>());
149 interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName(),
new HashSet<>());
150 interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(),
new HashSet<>());
152 interestingItemsMap.get(value).get(artType.getDisplayName()).add(artifactId);
155 }
catch (TskCoreException | SQLException ex) {
156 logger.log(Level.WARNING,
"SQL Exception occurred: ", ex);
163 return visitor.
visit(
this);
172 super(Children.create(
new SetNameFactory(),
true), Lookups.singleton(DISPLAY_NAME));
173 super.setName(INTERESTING_ITEMS);
174 super.setDisplayName(DISPLAY_NAME);
175 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
185 return visitor.
visit(
this);
190 Sheet sheet = super.createSheet();
191 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
192 if (sheetSet == null) {
193 sheetSet = Sheet.createPropertiesSet();
197 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
198 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.displayName"),
199 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
207 return getClass().getName();
211 private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
218 private final PropertyChangeListener
pcl = (PropertyChangeEvent evt) -> {
219 String eventType = evt.getPropertyName();
236 if (null != eventData && (eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()
237 || eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID())) {
238 interestingResults.
update();
255 interestingResults.
update();
263 if (evt.getNewValue() == null) {
275 interestingResults.
update();
276 interestingResults.addObserver(
this);
284 interestingResults.deleteObserver(
this);
299 public void update(Observable o, Object arg) {
309 super(Children.create(
new HitTypeFactory(setName),
true), Lookups.singleton(setName));
311 super.setName(setName);
313 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
314 interestingResults.addObserver(
this);
318 int sizeOfSet = interestingResults.
getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size()
319 + interestingResults.
getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName()).size();
320 super.setDisplayName(setName +
" (" + sizeOfSet +
")");
330 Sheet sheet = super.createSheet();
331 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
332 if (sheetSet == null) {
333 sheetSet = Sheet.createPropertiesSet();
337 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
338 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
339 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
347 return visitor.
visit(
this);
351 public void update(Observable o, Object arg) {
361 return getClass().getName();
368 private final Map<Long, BlackboardArtifact>
artifactHits =
new HashMap<>();
373 interestingResults.addObserver(
this);
378 list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName());
379 list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName());
389 public void update(Observable o, Object arg) {
400 super(Children.create(
new HitFactory(setName, typeName),
true), Lookups.singleton(setName));
403 super.setName(typeName);
405 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/interesting_item.png");
406 interestingResults.addObserver(
this);
410 super.setDisplayName(typeName +
" (" + interestingResults.
getArtifactIds(setName, typeName).size() +
")");
420 Sheet sheet = super.createSheet();
421 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
422 if (sheetSet == null) {
423 sheetSet = Sheet.createPropertiesSet();
426 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
427 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.name"),
428 NbBundle.getMessage(
this.getClass(),
"InterestingHits.createSheet.name.desc"),
435 return visitor.
visit(
this);
439 public void update(Observable o, Object arg) {
449 return getClass().getName();
453 private class HitFactory extends ChildFactory<Long> implements Observer {
457 private final Map<Long, BlackboardArtifact>
artifactHits =
new HashMap<>();
463 interestingResults.addObserver(
this);
469 if (skCase == null) {
473 interestingResults.
getArtifactIds(setName, typeName).forEach((
id) -> {
475 if (!artifactHits.containsKey(
id)) {
476 BlackboardArtifact art = skCase.getBlackboardArtifact(
id);
477 artifactHits.put(
id, art);
480 }
catch (TskCoreException ex) {
481 logger.log(Level.SEVERE,
"TSK Exception occurred", ex);
489 BlackboardArtifact art = artifactHits.get(l);
494 public void update(Observable o, Object arg) {
static final String DISPLAY_NAME
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static final String INTERESTING_ITEMS
HitTypeFactory(String setName)
static synchronized IngestManager getInstance()
boolean createKeys(List< String > list)
Node createNodeForKey(String key)
Node createNodeForKey(Long l)
void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType)
void update(Observable o, Object arg)
InterestingHits(SleuthkitCase skCase, long objId)
boolean createKeys(List< String > list)
boolean createKeys(List< Long > list)
List< String > getSetNames()
HitFactory(String setName, String typeName)
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
final PropertyChangeListener pcl
void update(Observable o, Object arg)
SetNameNode(String setName)
void addIngestJobEventListener(final PropertyChangeListener listener)
final long datasourceObjId
Set< Long > getArtifactIds(String setName, String typeName)
void update(Observable o, Object arg)
void update(Observable o, Object arg)
static Boolean getGroupItemsInTreeByDataSource()
final Map< Long, BlackboardArtifact > artifactHits
void addIngestModuleEventListener(final PropertyChangeListener listener)
Node createNodeForKey(String key)
InterestingItemTypeNode(String setName, String typeName)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
InterestingHits(SleuthkitCase skCase)
final Map< Long, BlackboardArtifact > artifactHits
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
final InterestingResults interestingResults
final Map< String, Map< String, Set< Long > > > interestingItemsMap
void update(Observable o, Object arg)
static final Logger logger