19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.EnumSet;
27 import java.util.HashMap;
28 import java.util.LinkedHashMap;
29 import java.util.List;
31 import java.util.Objects;
32 import java.util.Observable;
33 import java.util.Observer;
35 import java.util.logging.Level;
36 import org.openide.nodes.ChildFactory;
37 import org.openide.nodes.Children;
38 import org.openide.nodes.Node;
39 import org.openide.nodes.Sheet;
40 import org.openide.util.NbBundle;
41 import org.openide.util.lookup.Lookups;
52 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
63 private static final String
LABEL_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getLabel();
64 private static final String
DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getDisplayName();
78 public static final Map<String, String>
parsePath(String path) {
79 Map<String, String> parsed =
new HashMap<>();
80 String[] split = path.split(MAIL_PATH_SEPARATOR);
81 if (split.length < 4) {
82 parsed.put(MAIL_ACCOUNT, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultAcct.text"));
83 parsed.put(MAIL_FOLDER, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultFolder.text"));
86 parsed.put(MAIL_ACCOUNT, split[2]);
87 parsed.put(MAIL_FOLDER, split[3]);
114 this.datasourceObjId = objId;
121 return visitor.
visit(
this);
126 private final Map<String, Map<String, List<Long>>>
accounts =
new LinkedHashMap<>();
134 return accounts.keySet();
140 return accounts.get(account).keySet();
146 return accounts.get(account).get(folder);
150 @SuppressWarnings(
"deprecation")
155 if (skCase == null) {
159 int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID();
160 int pathAttrId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID();
161 String query =
"SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id "
162 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
163 +
"attribute_type_id=" + pathAttrId
164 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
165 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
167 query +=
" AND blackboard_artifacts.data_source_obj_id = " +
datasourceObjId;
170 try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
171 ResultSet resultSet = dbQuery.getResultSet();
173 while (resultSet.next()) {
174 final String path = resultSet.getString(
"value_text");
175 final long artifactId = resultSet.getLong(
"artifact_id");
176 final Map<String, String> parsedPath =
parsePath(path);
177 final String account = parsedPath.get(MAIL_ACCOUNT);
178 final String folder = parsedPath.get(MAIL_FOLDER);
180 Map<String, List<Long>> folders = accounts.get(account);
181 if (folders == null) {
182 folders =
new LinkedHashMap<>();
183 accounts.put(account, folders);
185 List<Long> messages = folders.get(folder);
186 if (messages == null) {
187 messages =
new ArrayList<>();
188 folders.put(folder, messages);
190 messages.add(artifactId);
193 }
catch (TskCoreException | SQLException ex) {
194 logger.log(Level.WARNING,
"Cannot initialize email extraction: ", ex);
208 super(Children.create(
new AccountFactory(),
true), Lookups.singleton(DISPLAY_NAME));
209 super.setName(LABEL_NAME);
210 super.setDisplayName(DISPLAY_NAME);
211 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/mail-icon-16.png");
222 return visitor.
visit(
this);
227 Sheet sheet = super.createSheet();
228 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
229 if (sheetSet == null) {
230 sheetSet = Sheet.createPropertiesSet();
234 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
235 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
236 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
244 return getClass().getName();
251 private class AccountFactory extends ChildFactory.Detachable<String> implements Observer {
257 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
259 public void propertyChange(PropertyChangeEvent evt) {
260 String eventType = evt.getPropertyName();
277 if (null != eventData && eventData.
getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
303 if (evt.getNewValue() == null) {
317 emailResults.addObserver(
this);
325 emailResults.deleteObserver(
this);
340 public void update(Observable o, Object arg) {
353 super(Children.create(
new FolderFactory(accountName),
true), Lookups.singleton(accountName));
354 super.setName(accountName);
356 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/account-icon-16.png");
358 emailResults.addObserver(
this);
362 super.setDisplayName(accountName +
" (" + emailResults.
getFolders(accountName) +
")");
367 Sheet sheet = super.createSheet();
368 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
369 if (sheetSet == null) {
370 sheetSet = Sheet.createPropertiesSet();
374 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
375 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
376 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
389 return visitor.
visit(
this);
393 public void update(Observable o, Object arg) {
399 return getClass().getName();
406 private class FolderFactory extends ChildFactory<String> implements Observer {
413 emailResults.addObserver(
this);
418 list.addAll(emailResults.
getFolders(accountName));
424 return new FolderNode(accountName, folderName);
428 public void update(Observable o, Object arg) {
442 super(Children.create(
new MessageFactory(accountName, folderName),
true), Lookups.singleton(accountName));
443 super.setName(folderName);
444 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/folder-icon-16.png");
448 emailResults.addObserver(
this);
452 super.setDisplayName(folderName +
" (" + emailResults.
getArtifactIds(accountName, folderName).size() +
")");
463 Sheet sheet = super.createSheet();
464 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
465 if (sheetSet == null) {
466 sheetSet = Sheet.createPropertiesSet();
470 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
471 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
472 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
480 return visitor.
visit(
this);
484 public void update(Observable o, Object arg) {
490 return getClass().getName();
506 emailResults.addObserver(
this);
511 list.addAll(emailResults.
getArtifactIds(accountName, folderName));
517 if (skCase == null) {
521 BlackboardArtifact artifact = skCase.getBlackboardArtifact(artifactId);
523 }
catch (TskCoreException ex) {
524 logger.log(Level.WARNING,
"Error creating mail messages nodes", ex);
530 public void update(Observable o, Object arg) {
BlackboardArtifact.Type getBlackboardArtifactType()
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static Boolean getGroupItemsInTreeByDataSource()
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)