Autopsy  4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | Protected Member Functions | Static Private Attributes | List of all members
org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher Class Reference

Inherits org.sleuthkit.autopsy.commonfilesearch.IntraCaseCommonAttributeSearcher.

Public Member Functions

 AllIntraCaseCommonAttributeSearcher (Map< Long, String > dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType, int percentageThreshold)
 
CommonAttributeCaseSearchResults findMatchesByCase () throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException
 
CommonAttributeCountSearchResults findMatchesByCount () throws TskCoreException, NoCurrentCaseException, SQLException
 

Protected Member Functions

String buildSqlSelectStatement ()
 

Static Private Attributes

static final String WHERE_CLAUSE = "%s md5 in (select md5 from tsk_files where (known != " + FileKnown.KNOWN.getFileKnownValue() + " OR known IS NULL)%s GROUP BY md5 HAVING COUNT(DISTINCT data_source_obj_id) > 1) order by md5"
 

Detailed Description

Provides logic for selecting common files from all data sources.

Definition at line 29 of file AllIntraCaseCommonAttributeSearcher.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher.AllIntraCaseCommonAttributeSearcher ( Map< Long, String >  dataSourceIdMap,
boolean  filterByMediaMimeType,
boolean  filterByDocMimeType,
int  percentageThreshold 
)

Implements the algorithm for getting common files across all data sources.

Parameters
dataSourceIdMapa map of obj_id to datasource name
filterByMediaMimeTypematch only on files whose mime types can be broadly categorized as media types
filterByDocMimeTypematch only on files whose mime types can be broadly categorized as document types
percentageThresholdomit any matches with frequency above this threshold

Definition at line 44 of file AllIntraCaseCommonAttributeSearcher.java.

Member Function Documentation

String org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher.buildSqlSelectStatement ( )
protected

Definition at line 50 of file AllIntraCaseCommonAttributeSearcher.java.

CommonAttributeCaseSearchResults org.sleuthkit.autopsy.commonfilesearch.IntraCaseCommonAttributeSearcher.findMatchesByCase ( ) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException
inherited

Definition at line 146 of file IntraCaseCommonAttributeSearcher.java.

CommonAttributeCountSearchResults org.sleuthkit.autopsy.commonfilesearch.IntraCaseCommonAttributeSearcher.findMatchesByCount ( ) throws TskCoreException, NoCurrentCaseException, SQLException
inherited

Generate a meta data object which encapsulates everything need to add the tree table tab to the top component.

Returns
a data object with all of the matched files in a hierarchical format
Exceptions
TskCoreException
NoCurrentCaseException
SQLException

Definition at line 105 of file IntraCaseCommonAttributeSearcher.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getDisplayName().

Member Data Documentation

final String org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher.WHERE_CLAUSE = "%s md5 in (select md5 from tsk_files where (known != " + FileKnown.KNOWN.getFileKnownValue() + " OR known IS NULL)%s GROUP BY md5 HAVING COUNT(DISTINCT data_source_obj_id) > 1) order by md5"
staticprivate

Definition at line 31 of file AllIntraCaseCommonAttributeSearcher.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2018 Basis Technology. Generated on: Tue Dec 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.