mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-09 14:49:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

logic overhaul to reduce manipulation and building of hashmaps.

Browse Source
This commit is contained in:
Andrew Ziehl 2018-07-31 11:46:44 -07:00
parent bbd7154153
commit 075b76e8bf
3 changed files with 48 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java
View File

@ -19,6 +19,7 @@
*/ */
package org.sleuthkit.autopsy.commonfilesearch; package org.sleuthkit.autopsy.commonfilesearch;
import java.util.HashMap;
import java.util.Map; import java.util.Map;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
@ -70,9 +71,9 @@ public abstract class AbstractCommonAttributeInstance {
* @param cachedFiles storage for abstract files which have been used * @param cachedFiles storage for abstract files which have been used
* already so we can avoid extra roundtrips to the case db * already so we can avoid extra roundtrips to the case db
*/ */
AbstractCommonAttributeInstance(Map<Long, AbstractFile> cachedFiles) { AbstractCommonAttributeInstance() {
this.abstractFileObjectId = -1L; this.abstractFileObjectId = -1L;
this.cachedFiles = cachedFiles; this.cachedFiles = new HashMap<>();
this.caseName = ""; this.caseName = "";
this.dataSource = ""; this.dataSource = "";
} }

4
Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java
View File

@ -45,8 +45,8 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
private final Integer crFileId; private final Integer crFileId;
private CorrelationAttributeInstance currentAttributeInstance; private CorrelationAttributeInstance currentAttributeInstance;
CentralRepoCommonAttributeInstance(Integer attrInstId, Map<Long, AbstractFile> cachedFiles) { CentralRepoCommonAttributeInstance(Integer attrInstId) {
super(cachedFiles); super();
this.crFileId = attrInstId; this.crFileId = attrInstId;
} }

45
Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java
View File

@ -20,8 +20,10 @@ package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.ResultSet; import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collections; import java.util.Collections;
import java.util.HashMap; import java.util.HashMap;
import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.logging.Level; import java.util.logging.Level;
import org.openide.util.Exceptions; import org.openide.util.Exceptions;
@ -32,7 +34,11 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.autopsy.centralrepository.datamodel.InstanceTableCallback; import org.sleuthkit.autopsy.centralrepository.datamodel.InstanceTableCallback;
import static org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher.collateMatchesByNumberOfInstances;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.LOGGER;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.HashUtility;
/** /**
* Used to process and return CorrelationCase md5s from the EamDB for * Used to process and return CorrelationCase md5s from the EamDB for
@ -123,14 +129,49 @@ final class InterCaseSearchResultsProcessor {
@Override @Override
public void process(ResultSet resultSet) { public void process(ResultSet resultSet) {
Map<Integer, List<CommonAttributeValue>> instanceCollatedCommonFiles = new HashMap<>();
try { try {
String previousRowMd5 = "";
EamDb dbManager = EamDb.getInstance();
CommonAttributeValue commonAttributeValue = null;
while (resultSet.next()) { while (resultSet.next()) {
int resultId = InstanceTableCallback.getId(resultSet); int resultId = InstanceTableCallback.getId(resultSet);
intercaseCommonValuesMap.put(resultId, InstanceTableCallback.getValue(resultSet)); String md5Value = InstanceTableCallback.getValue(resultSet);
intercaseCommonCasesMap.put(resultId, InstanceTableCallback.getCaseId(resultSet)); if (md5Value == null || HashUtility.isNoDataMd5(md5Value)) {
continue;
}
int caseId = InstanceTableCallback.getCaseId(resultSet);
CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId);
final String correlationCaseDisplayName = autopsyCrCase.getDisplayName();
if(commonAttributeValue == null) {
commonAttributeValue = new CommonAttributeValue(md5Value);
}
// we don't *have* all the information for the rows in the CR,
// so we need to consult the present case via the SleuthkitCase object
// Later, when the FileInstanceNodde is built. Therefore, build node generators for now.
if (!md5Value.equals(previousRowMd5)) {
int size = commonAttributeValue.getInstanceCount();
if (instanceCollatedCommonFiles.containsKey(size)) {
instanceCollatedCommonFiles.get(size).add(commonAttributeValue);
} else {
ArrayList<CommonAttributeValue> value = new ArrayList<>();
value.add(commonAttributeValue);
instanceCollatedCommonFiles.put(size, value);
}
commonAttributeValue = new CommonAttributeValue(md5Value);
previousRowMd5 = md5Value;
}
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(resultId);
commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName);
} }
} catch (SQLException ex) { } catch (SQLException ex) {
Exceptions.printStackTrace(ex); Exceptions.printStackTrace(ex);
} catch (EamDbException ex) {
LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS
} }
} }