19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.EnumSet;
26 import java.util.List;
27 import java.util.Objects;
28 import java.util.Observable;
29 import java.util.Observer;
31 import java.util.logging.Level;
32 import org.openide.nodes.AbstractNode;
33 import org.openide.nodes.ChildFactory;
34 import org.openide.nodes.Children;
35 import org.openide.nodes.Node;
36 import org.openide.nodes.Sheet;
37 import org.openide.util.NbBundle;
38 import org.openide.util.lookup.Lookups;
80 this.displayName = displayName;
93 return this.displayName;
98 return visitor.
visit(
this);
106 public FileSize(SleuthkitCase skCase,
long dsObjId) {
108 this.datasourceObjId = dsObjId;
113 return visitor.
visit(
this);
120 long filteringDataSourceObjId() {
128 private static final String
NAME = NbBundle.getMessage(
FileSize.class,
"FileSize.fileSizeRootNode.name");
131 super(Children.create(
new FileSizeRootChildren(skCase, datasourceObjId),
true), Lookups.singleton(NAME));
133 super.setDisplayName(NAME);
134 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/file-size-16.png");
144 return visitor.
visit(
this);
149 Sheet sheet = super.createSheet();
150 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
151 if (sheetSet == null) {
152 sheetSet = Sheet.createPropertiesSet();
156 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.name.name"),
157 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.name.displayName"),
158 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.name.desc"),
165 return getClass().getName();
172 public static class FileSizeRootChildren extends ChildFactory<org.sleuthkit.autopsy.datamodel.FileSize.FileSizeFilter> {
205 private final PropertyChangeListener
pcl = (PropertyChangeEvent evt) -> {
206 String eventType = evt.getPropertyName();
244 if (evt.getNewValue() == null) {
264 return new FileSizeNode(skCase, key, notifier, datasourceObjId);
278 super(Children.create(
new FileSizeChildren(filter, skCase, null, datasourceObjId),
true), Lookups.singleton(filter.
getDisplayName()));
293 super(Children.create(
new FileSizeChildren(filter, skCase, o, datasourceObjId),
true), Lookups.singleton(filter.
getDisplayName()));
297 o.addObserver(
new FileSizeNodeObserver());
301 super.setName(filter.
getName());
304 this.setShortDescription(tooltip);
305 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/file-size-16.png");
323 public void update(Observable o, Object arg) {
329 final long numVisibleChildren = FileSizeChildren.calculateItems(skCase, filter, datasourceObjId);
330 super.setDisplayName(filter.
getDisplayName() +
" (" + numVisibleChildren +
")");
335 return visitor.
visit(
this);
340 Sheet sheet = super.createSheet();
341 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
342 if (sheetSet == null) {
343 sheetSet = Sheet.createPropertiesSet();
347 sheetSet.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.filterType.name"),
348 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.filterType.displayName"),
349 NbBundle.getMessage(
this.getClass(),
"FileSize.createSheet.filterType.desc"),
364 static class FileSizeChildren
extends ChildFactory.Detachable<AbstractFile> {
366 private final SleuthkitCase
skCase;
379 FileSizeChildren(
FileSizeFilter filter, SleuthkitCase skCase, Observable o,
long dsObjId) {
381 this.filter = filter;
383 this.datasourceObjId = dsObjId;
388 protected void addNotify() {
389 if (notifier != null) {
390 notifier.addObserver(observer);
395 protected void removeNotify() {
396 if (notifier != null) {
397 notifier.deleteObserver(observer);
401 private final Observer observer =
new FileSizeChildrenObserver();
407 public void update(Observable o, Object arg) {
413 protected boolean createKeys(List<AbstractFile> list) {
414 list.addAll(runFsQuery());
418 private static String makeQuery(
FileSizeFilter filter,
long filteringDSObjId) {
422 query =
"(size >= 50000000 AND size < 200000000)";
425 query =
"(size >= 200000000 AND size < 1000000000)";
429 query =
"(size >= 1000000000)";
433 throw new IllegalArgumentException(
"Unsupported filter type to get files by size: " + filter);
437 query = query +
" AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType() +
")";
441 query +=
" AND (known != " + TskData.FileKnown.KNOWN.getFileKnownValue()
442 +
" OR known IS NULL)";
446 if(UserPreferences.hideSlackFilesInViewsTree()) {
447 query +=
" AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType() +
")";
451 if (Objects.equals(CasePreferences.getGroupItemsInTreeByDataSource(),
true)) {
452 query +=
" AND data_source_obj_id = " + filteringDSObjId;
458 private List<AbstractFile> runFsQuery() {
459 List<AbstractFile> ret =
new ArrayList<>();
462 String query = makeQuery(filter, datasourceObjId);
464 ret = skCase.findAllFilesWhere(query);
465 }
catch (Exception e) {
466 logger.log(Level.SEVERE,
"Error getting files for the file size view: " + e.getMessage());
477 static long calculateItems(SleuthkitCase sleuthkitCase, FileSizeFilter filter,
long datasourceObjId) {
479 return sleuthkitCase.countFilesWhere(makeQuery(filter, datasourceObjId));
480 }
catch (TskCoreException ex) {
481 logger.log(Level.SEVERE,
"Error getting files by size search view count", ex);
488 return key.accept(
new ContentVisitor.Default<AbstractNode>() {
489 public FileNode visit(AbstractFile f) {
490 return new FileNode(f, false);
493 public FileNode visit(FsContent f) {
494 return new FileNode(f,
false);
498 public FileNode visit(LayoutFile f) {
499 return new FileNode(f,
false);
503 public FileNode visit(File f) {
504 return new FileNode(f,
false);
508 public FileNode visit(Directory f) {
509 return new FileNode(f,
false);
513 public FileNode visit(LocalFile f) {
514 return new FileNode(f,
false);
518 public FileNode visit(DerivedFile f) {
519 return new FileNode(f,
false);
523 public FileNode visit(VirtualDirectory f) {
524 return new FileNode(f,
false);
528 public FileNode visit(SlackFile f) {
529 return new FileNode(f,
false);
533 protected AbstractNode defaultVisit(Content di) {
534 throw new UnsupportedOperationException(
535 NbBundle.getMessage(
this.getClass(),
536 "FileSize.exception.notSupported.msg",
void update(Observable o, Object arg)
FileSize(SleuthkitCase skCase)
void removeIngestModuleEventListener(final PropertyChangeListener listener)
SleuthkitCase getSleuthkitCase()
static synchronized IngestManager getInstance()
FileSizeRootChildren(SleuthkitCase skCase, long datasourceObjId)
static boolean hideKnownFilesInViewsTree()
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
boolean createKeys(List< FileSizeFilter > list)
Node createNodeForKey(FileSizeFilter key)
final PropertyChangeListener pcl
void addIngestJobEventListener(final PropertyChangeListener listener)
final long datasourceObjId
final long datasourceObjId
FileSize(SleuthkitCase skCase, long dsObjId)
FileSizeFilter(int id, String name, String displayName)
final long datasourceObjId
void addIngestModuleEventListener(final PropertyChangeListener listener)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
void update(Observable o, Object arg)
public< T > T accept(AutopsyItemVisitor< T > visitor)
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
static final Set< Case.Events > CASE_EVENTS_OF_INTEREST