Autopsy  4.8.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
InterestingHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.Collections;
27 import java.util.EnumSet;
28 import java.util.HashMap;
29 import java.util.HashSet;
30 import java.util.LinkedHashMap;
31 import java.util.List;
32 import java.util.Map;
33 import java.util.Objects;
34 import java.util.Observable;
35 import java.util.Observer;
36 import java.util.Set;
37 import java.util.logging.Level;
38 import org.openide.nodes.ChildFactory;
39 import org.openide.nodes.Children;
40 import org.openide.nodes.Node;
41 import org.openide.nodes.Sheet;
42 import org.openide.util.NbBundle;
43 import org.openide.util.lookup.Lookups;
51 import org.sleuthkit.datamodel.BlackboardArtifact;
52 import org.sleuthkit.datamodel.BlackboardAttribute;
53 import org.sleuthkit.datamodel.SleuthkitCase;
54 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
55 import org.sleuthkit.datamodel.TskCoreException;
56 
57 public class InterestingHits implements AutopsyVisitableItem {
58 
59  private static final String INTERESTING_ITEMS = NbBundle
60  .getMessage(InterestingHits.class, "InterestingHits.interestingItems.text");
61  private static final String DISPLAY_NAME = NbBundle.getMessage(InterestingHits.class, "InterestingHits.displayName.text");
62  private static final Logger logger = Logger.getLogger(InterestingHits.class.getName());
63  private SleuthkitCase skCase;
65  private final long datasourceObjId;
66 
73  public InterestingHits(SleuthkitCase skCase) {
74  this(skCase, 0);
75  }
76 
84  public InterestingHits(SleuthkitCase skCase, long objId) {
85  this.skCase = skCase;
86  this.datasourceObjId = objId;
87  interestingResults.update();
88  }
89 
90  private class InterestingResults extends Observable {
91 
92  // NOTE: the map can be accessed by multiple worker threads and needs to be synchronized
93  private final Map<String, Map<String, Set<Long>>> interestingItemsMap = new LinkedHashMap<>();
94 
95  public List<String> getSetNames() {
96  List<String> setNames;
97  synchronized (interestingItemsMap) {
98  setNames = new ArrayList<>(interestingItemsMap.keySet());
99  }
100  Collections.sort(setNames);
101  return setNames;
102  }
103 
104  public Set<Long> getArtifactIds(String setName, String typeName) {
105  synchronized (interestingItemsMap) {
106  return interestingItemsMap.get(setName).get(typeName);
107  }
108  }
109 
110  public void update() {
111  synchronized (interestingItemsMap) {
112  interestingItemsMap.clear();
113  }
114  loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
115  loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
116  setChanged();
117  notifyObservers();
118  }
119 
120  /*
121  * Reads the artifacts of specified type, grouped by Set, and loads into
122  * the interestingItemsMap
123  */
124  @SuppressWarnings("deprecation")
125  private void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) {
126  if (skCase == null) {
127  return;
128  }
129 
130  int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
131  int artId = artType.getTypeID();
132  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
133  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
134  + "attribute_type_id=" + setNameId //NON-NLS
135  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
136  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
137  if (Objects.equals(CasePreferences.getGroupItemsInTreeByDataSource(), true)) {
138  query += " AND blackboard_artifacts.data_source_obj_id = " + datasourceObjId;
139  }
140 
141  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
142  synchronized (interestingItemsMap) {
143  ResultSet resultSet = dbQuery.getResultSet();
144  while (resultSet.next()) {
145  String value = resultSet.getString("value_text"); //NON-NLS
146  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
147  if (!interestingItemsMap.containsKey(value)) {
148  interestingItemsMap.put(value, new LinkedHashMap<>());
149  interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName(), new HashSet<>());
150  interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(), new HashSet<>());
151  }
152  interestingItemsMap.get(value).get(artType.getDisplayName()).add(artifactId);
153  }
154  }
155  } catch (TskCoreException | SQLException ex) {
156  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
157  }
158  }
159  }
160 
161  @Override
162  public <T> T accept(AutopsyItemVisitor<T> visitor) {
163  return visitor.visit(this);
164  }
165 
169  public class RootNode extends DisplayableItemNode {
170 
171  public RootNode() {
172  super(Children.create(new SetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
173  super.setName(INTERESTING_ITEMS);
174  super.setDisplayName(DISPLAY_NAME);
175  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
176  }
177 
178  @Override
179  public boolean isLeafTypeNode() {
180  return false;
181  }
182 
183  @Override
184  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
185  return visitor.visit(this);
186  }
187 
188  @Override
189  protected Sheet createSheet() {
190  Sheet sheet = super.createSheet();
191  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
192  if (sheetSet == null) {
193  sheetSet = Sheet.createPropertiesSet();
194  sheet.put(sheetSet);
195  }
196 
197  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
198  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.displayName"),
199  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
200  getName()));
201 
202  return sheet;
203  }
204 
205  @Override
206  public String getItemType() {
207  return getClass().getName();
208  }
209  }
210 
211  private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
212 
213  /*
214  * This should probably be in the top-level class, but the factory has
215  * nice methods for its startup and shutdown, so it seemed like a
216  * cleaner place to register the property change listener.
217  */
218  private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
219  String eventType = evt.getPropertyName();
220  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
227  try {
235  ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
236  if (null != eventData && (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()
237  || eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID())) {
238  interestingResults.update();
239  }
240  } catch (NoCurrentCaseException notUsed) {
244  }
245  } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
246  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
253  try {
255  interestingResults.update();
256  } catch (NoCurrentCaseException notUsed) {
260  }
261  } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
262  // case was closed. Remove listeners so that we don't get called with a stale case handle
263  if (evt.getNewValue() == null) {
264  removeNotify();
265  skCase = null;
266  }
267  }
268  };
269 
270  @Override
271  protected void addNotify() {
275  interestingResults.update();
276  interestingResults.addObserver(this);
277  }
278 
279  @Override
280  protected void removeNotify() {
284  interestingResults.deleteObserver(this);
285  }
286 
287  @Override
288  protected boolean createKeys(List<String> list) {
289  list.addAll(interestingResults.getSetNames());
290  return true;
291  }
292 
293  @Override
294  protected Node createNodeForKey(String key) {
295  return new SetNameNode(key);
296  }
297 
298  @Override
299  public void update(Observable o, Object arg) {
300  refresh(true);
301  }
302  }
303 
304  public class SetNameNode extends DisplayableItemNode implements Observer {
305 
306  private final String setName;
307 
308  public SetNameNode(String setName) {//, Set<Long> children) {
309  super(Children.create(new HitTypeFactory(setName), true), Lookups.singleton(setName));
310  this.setName = setName;
311  super.setName(setName);
313  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
314  interestingResults.addObserver(this);
315  }
316 
317  private void updateDisplayName() {
318  int sizeOfSet = interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size()
319  + interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName()).size();
320  super.setDisplayName(setName + " (" + sizeOfSet + ")");
321  }
322 
323  @Override
324  public boolean isLeafTypeNode() {
325  return false;
326  }
327 
328  @Override
329  protected Sheet createSheet() {
330  Sheet sheet = super.createSheet();
331  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
332  if (sheetSet == null) {
333  sheetSet = Sheet.createPropertiesSet();
334  sheet.put(sheetSet);
335  }
336 
337  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
338  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
339  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
340  getName()));
341 
342  return sheet;
343  }
344 
345  @Override
346  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
347  return visitor.visit(this);
348  }
349 
350  @Override
351  public void update(Observable o, Object arg) {
353  }
354 
355  @Override
356  public String getItemType() {
361  return getClass().getName();
362  }
363  }
364 
365  private class HitTypeFactory extends ChildFactory<String> implements Observer {
366 
367  private final String setName;
368  private final Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
369 
370  private HitTypeFactory(String setName) {
371  super();
372  this.setName = setName;
373  interestingResults.addObserver(this);
374  }
375 
376  @Override
377  protected boolean createKeys(List<String> list) {
378  list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName());
379  list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName());
380  return true;
381  }
382 
383  @Override
384  protected Node createNodeForKey(String key) {
385  return new InterestingItemTypeNode(setName, key);
386  }
387 
388  @Override
389  public void update(Observable o, Object arg) {
390  refresh(true);
391  }
392  }
393 
394  public class InterestingItemTypeNode extends DisplayableItemNode implements Observer {
395 
396  private final String typeName;
397  private final String setName;
398 
399  private InterestingItemTypeNode(String setName, String typeName) {
400  super(Children.create(new HitFactory(setName, typeName), true), Lookups.singleton(setName));
401  this.typeName = typeName;
402  this.setName = setName;
403  super.setName(typeName);
405  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
406  interestingResults.addObserver(this);
407  }
408 
409  private void updateDisplayName() {
410  super.setDisplayName(typeName + " (" + interestingResults.getArtifactIds(setName, typeName).size() + ")");
411  }
412 
413  @Override
414  public boolean isLeafTypeNode() {
415  return true;
416  }
417 
418  @Override
419  protected Sheet createSheet() {
420  Sheet sheet = super.createSheet();
421  Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
422  if (sheetSet == null) {
423  sheetSet = Sheet.createPropertiesSet();
424  sheet.put(sheetSet);
425  }
426  sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
427  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
428  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
429  getName()));
430  return sheet;
431  }
432 
433  @Override
434  public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
435  return visitor.visit(this);
436  }
437 
438  @Override
439  public void update(Observable o, Object arg) {
441  }
442 
443  @Override
444  public String getItemType() {
449  return getClass().getName();
450  }
451  }
452 
453  private class HitFactory extends ChildFactory<Long> implements Observer {
454 
455  private final String setName;
456  private final String typeName;
457  private final Map<Long, BlackboardArtifact> artifactHits = new HashMap<>();
458 
459  private HitFactory(String setName, String typeName) {
460  super();
461  this.setName = setName;
462  this.typeName = typeName;
463  interestingResults.addObserver(this);
464  }
465 
466  @Override
467  protected boolean createKeys(List<Long> list) {
468 
469  if (skCase == null) {
470  return true;
471  }
472 
473  interestingResults.getArtifactIds(setName, typeName).forEach((id) -> {
474  try {
475  if (!artifactHits.containsKey(id)) {
476  BlackboardArtifact art = skCase.getBlackboardArtifact(id);
477  artifactHits.put(id, art);
478  }
479  list.add(id);
480  } catch (TskCoreException ex) {
481  logger.log(Level.SEVERE, "TSK Exception occurred", ex); //NON-NLS
482  }
483  });
484  return true;
485  }
486 
487  @Override
488  protected Node createNodeForKey(Long l) {
489  BlackboardArtifact art = artifactHits.get(l);
490  return (null == art) ? null : new BlackboardArtifactNode(art);
491  }
492 
493  @Override
494  public void update(Observable o, Object arg) {
495  refresh(true);
496  }
497  }
498 }
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType)
InterestingHits(SleuthkitCase skCase, long objId)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
Set< Long > getArtifactIds(String setName, String typeName)
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:428
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Definition: Case.java:473
final Map< String, Map< String, Set< Long > > > interestingItemsMap

Copyright © 2012-2018 Basis Technology. Generated on: Thu Oct 4 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.