Partial changes.

This commit is contained in:
U-BASIS\dgrove 2018-02-09 14:23:39 -05:00
parent d8aaf83685
commit 1621cd5d43
4 changed files with 106 additions and 132 deletions

View File

@ -27,13 +27,14 @@ import java.util.Collection;
import java.util.List; import java.util.List;
import java.util.logging.Level; import java.util.logging.Level;
import org.openide.nodes.Node; import org.openide.nodes.Node;
import org.openide.util.Exceptions;
import org.openide.util.Lookup; import org.openide.util.Lookup;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.openide.util.lookup.ServiceProvider; import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer; import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.keywordsearch.KeywordSearchResultFactory.QueryContent; import org.sleuthkit.autopsy.keywordsearch.KeywordSearchResultFactory.AdHocQueryResult;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Account; import org.sleuthkit.datamodel.Account;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
@ -51,7 +52,7 @@ import org.sleuthkit.datamodel.TskCoreException;
@ServiceProvider(service = DataContentViewer.class, position = 4) @ServiceProvider(service = DataContentViewer.class, position = 4)
public class ExtractedContentViewer implements DataContentViewer { public class ExtractedContentViewer implements DataContentViewer {
private static final Logger LOGGER = Logger.getLogger(ExtractedContentViewer.class.getName()); private static final Logger logger = Logger.getLogger(ExtractedContentViewer.class.getName());
private static final long INVALID_DOCUMENT_ID = 0L; private static final long INVALID_DOCUMENT_ID = 0L;
private static final BlackboardAttribute.Type TSK_ASSOCIATED_ARTIFACT_TYPE = new BlackboardAttribute.Type(TSK_ASSOCIATED_ARTIFACT); private static final BlackboardAttribute.Type TSK_ASSOCIATED_ARTIFACT_TYPE = new BlackboardAttribute.Type(TSK_ASSOCIATED_ARTIFACT);
@ -93,9 +94,6 @@ public class ExtractedContentViewer implements DataContentViewer {
currentNode = node; currentNode = node;
} }
Lookup nodeLookup = node.getLookup();
AbstractFile content = nodeLookup.lookup(AbstractFile.class);
/* /*
* Assemble a collection of all of the indexed text "sources" for the * Assemble a collection of all of the indexed text "sources" for the
* node. * node.
@ -104,44 +102,37 @@ public class ExtractedContentViewer implements DataContentViewer {
IndexedText highlightedHitText = null; IndexedText highlightedHitText = null;
IndexedText rawContentText = null; IndexedText rawContentText = null;
if (null != content && solrHasContent(content.getId())) { Lookup nodeLookup = node.getLookup();
/*
* Results for Keyword Hits. AdHocQueryResult adHocQueryResult = nodeLookup.lookup(AdHocQueryResult.class);
*/ BlackboardArtifact artifact = nodeLookup.lookup(BlackboardArtifact.class);
BlackboardArtifact artifact = nodeLookup.lookup(BlackboardArtifact.class); AbstractFile content = nodeLookup.lookup(AbstractFile.class);
if (artifact != null) {
if (artifact.getArtifactTypeID() == TSK_ACCOUNT.getTypeID()) { if (adHocQueryResult != null) {
try { highlightedHitText = new HighlightedText(adHocQueryResult.getSolrObjectId(), adHocQueryResult.getResults());
/* } else if (artifact != null) {
* Generate AccountsText for the account artifact. if (artifact.getArtifactTypeID() == TSK_KEYWORD_HIT.getTypeID()) {
*/ try {
highlightedHitText = getAccountsText(content, nodeLookup); highlightedHitText = new HighlightedText(artifact);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Failed to create AccountsText for " + content, ex); //NON-NLS Exceptions.printStackTrace(ex);
} }
} else if (artifact.getArtifactTypeID() == TSK_KEYWORD_HIT.getTypeID()) { } else if (artifact.getArtifactTypeID() == TSK_ACCOUNT.getTypeID() && content != null) {
try { try {
/* highlightedHitText = getAccountsText(content, nodeLookup);
* Generate HighlightedText for the keyword hit artifact. } catch (TskCoreException ex) {
*/ Exceptions.printStackTrace(ex);
highlightedHitText = new HighlightedText(artifact);
} catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Failed to create HighlightedText for " + artifact, ex); //NON-NLS
}
} }
} }
} else { }
/*
* Results for ad-hoc search. if (content != null) {
*/ rawContentText = new RawText(content, content.getId());
QueryContent queryContent = nodeLookup.lookup(QueryContent.class); } else if (artifact != null) {
content = (AbstractFile) queryContent.getContent(); try {
rawContentText = getRawArtifactText(nodeLookup);
if (null != content && solrHasContent(content.getId())) { } catch (TskCoreException ex) {
QueryResults queryResults = queryContent.getResults(); Exceptions.printStackTrace(ex);
if (queryResults != null) {
highlightedHitText = new HighlightedText(queryContent.getSolrObjectId(), queryResults);
}
} }
} }
@ -150,11 +141,10 @@ public class ExtractedContentViewer implements DataContentViewer {
} }
/* /*
* Next, add the "raw" (not highlighted) text, if any, for any * Next, add the "raw" (not highlighted) text, if any, for any content
* content associated with the node. * associated with the node.
*/ */
if (content != null) { if (rawContentText != null) {
rawContentText = new RawText(content, content.getId());
sources.add(rawContentText); sources.add(rawContentText);
} }
@ -166,7 +156,7 @@ public class ExtractedContentViewer implements DataContentViewer {
try { try {
rawArtifactText = getRawArtifactText(nodeLookup); rawArtifactText = getRawArtifactText(nodeLookup);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error creating RawText for " + content, ex); //NON-NLS logger.log(Level.SEVERE, "Error creating RawText for " + content, ex); //NON-NLS
} }
if (rawArtifactText != null) { if (rawArtifactText != null) {
@ -289,6 +279,11 @@ public class ExtractedContentViewer implements DataContentViewer {
return false; return false;
} }
AdHocQueryResult adHocQueryResult = node.getLookup().lookup(AdHocQueryResult.class);
if (adHocQueryResult != null) {
return true;
}
/* /*
* Is there a credit card or keyword hit artifact in the lookup * Is there a credit card or keyword hit artifact in the lookup
*/ */
@ -296,26 +291,63 @@ public class ExtractedContentViewer implements DataContentViewer {
if (artifacts != null) { if (artifacts != null) {
for (BlackboardArtifact art : artifacts) { for (BlackboardArtifact art : artifacts) {
final int artifactTypeID = art.getArtifactTypeID(); final int artifactTypeID = art.getArtifactTypeID();
if (artifactTypeID == TSK_ACCOUNT.getTypeID()) { if (artifactTypeID == TSK_KEYWORD_HIT.getTypeID()) {
return true;
} else if (artifactTypeID == TSK_ACCOUNT.getTypeID()) {
try { try {
BlackboardAttribute attribute = art.getAttribute(TSK_ACCOUNT_TYPE); BlackboardAttribute attribute = art.getAttribute(TSK_ACCOUNT_TYPE);
if (attribute != null && Account.Type.CREDIT_CARD.getTypeName().equals(attribute.getValueString())) { if (attribute != null && Account.Type.CREDIT_CARD.getTypeName().equals(attribute.getValueString())) {
return true; return true;
} }
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error getting TSK_ACCOUNT_TYPE attribute from artifact " + art.getArtifactID(), ex); logger.log(Level.SEVERE, "Error getting TSK_ACCOUNT_TYPE attribute from artifact " + art.getArtifactID(), ex);
return true;
} }
} else if (artifactTypeID == TSK_KEYWORD_HIT.getTypeID()) {
return true;
} }
} }
} }
/**
* If the node is a Blackboard artifact node for anything other than a
* keyword hit, the document ID for the text extracted from the artifact
* (the concatenation of its attributes) is the artifact ID, a large,
* negative integer. If it is a keyword hit, see if there is an
* associated artifact. If there is, get the associated artifact's ID
* and return it.
*/
long documentID = INVALID_DOCUMENT_ID;
BlackboardArtifact artifact = node.getLookup().lookup(BlackboardArtifact.class);
if (null != artifact) {
if (artifact.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
documentID = artifact.getArtifactID();
} else {
try {
// Get the associated artifact attribute and return its value as the ID
BlackboardAttribute blackboardAttribute = artifact.getAttribute(TSK_ASSOCIATED_ARTIFACT_TYPE);
if (blackboardAttribute != null) {
documentID = blackboardAttribute.getValueLong();
}
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error getting associated artifact attributes", ex); //NON-NLS
}
}
}
/*
* For keyword search hit artifact nodes and all other nodes, the
* document ID for the extracted text is the ID of the associated
* content, if any, unless there is an associated artifact, which is
* handled above.
*/
Content content = node.getLookup().lookup(Content.class);
if (content != null) {
documentID = content.getId();
}
/* /*
* No highlighted text for a keyword hit, so is there any indexed text * No highlighted text for a keyword hit, so is there any indexed text
* at all for this node? * at all for this node?
*/ */
long documentID = getDocumentId(node);
if (INVALID_DOCUMENT_ID == documentID) { if (INVALID_DOCUMENT_ID == documentID) {
return false; return false;
} }
@ -367,69 +399,11 @@ public class ExtractedContentViewer implements DataContentViewer {
try { try {
return solrServer.queryIsIndexed(objectId); return solrServer.queryIsIndexed(objectId);
} catch (NoOpenCoreException | KeywordSearchModuleException ex) { } catch (NoOpenCoreException | KeywordSearchModuleException ex) {
LOGGER.log(Level.SEVERE, "Error querying Solr server", ex); //NON-NLS logger.log(Level.SEVERE, "Error querying Solr server", ex); //NON-NLS
return false; return false;
} }
} }
/**
* Gets the object ID to use as the document ID for accessing any indexed
* text for the given node.
*
* @param node The node.
*
* @return The document ID or zero, which is an invalid document ID.
*/
private Long getDocumentId(Node node) {
/**
* If the node is a Blackboard artifact node for anything other than a
* keyword hit, the document ID for the text extracted from the artifact
* (the concatenation of its attributes) is the artifact ID, a large,
* negative integer. If it is a keyword hit, see if there is an
* associated artifact. If there is, get the associated artifact's ID
* and return it.
*/
BlackboardArtifact artifact = node.getLookup().lookup(BlackboardArtifact.class);
if (null != artifact) {
if (artifact.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
return artifact.getArtifactID();
} else {
try {
// Get the associated artifact attribute and return its value as the ID
BlackboardAttribute blackboardAttribute = artifact.getAttribute(TSK_ASSOCIATED_ARTIFACT_TYPE);
if (blackboardAttribute != null) {
return blackboardAttribute.getValueLong();
}
} catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error getting associated artifact attributes", ex); //NON-NLS
}
}
}
/*
* For keyword search hit artifact nodes and all other nodes, the
* document ID for the extracted text is the ID of the associated
* content, if any, unless there is an associated artifact, which is
* handled above.
*/
Content content = node.getLookup().lookup(Content.class);
if (content == null) {
QueryContent queryContent = node.getLookup().lookup(QueryContent.class);
if (queryContent != null) {
content = queryContent.getContent();
}
}
if (content != null) {
return content.getId();
}
/*
* No extracted text, return an invalid docuemnt ID.
*/
return 0L;
}
private class NextFindActionListener implements ActionListener { private class NextFindActionListener implements ActionListener {
@Override @Override

View File

@ -54,7 +54,7 @@ import org.sleuthkit.datamodel.TskCoreException;
*/ */
class HighlightedText implements IndexedText { class HighlightedText implements IndexedText {
private static final Logger LOGGER = Logger.getLogger(HighlightedText.class.getName()); private static final Logger logger = Logger.getLogger(HighlightedText.class.getName());
private static final boolean DEBUG = (Version.getBuildType() == Version.Type.DEVELOPMENT); private static final boolean DEBUG = (Version.getBuildType() == Version.Type.DEVELOPMENT);
@ -400,7 +400,7 @@ class HighlightedText implements IndexedText {
// either be a single chunk containing hits or we narrow our // either be a single chunk containing hits or we narrow our
// query down to the current page/chunk. // query down to the current page/chunk.
if (response.getResults().size() > 1) { if (response.getResults().size() > 1) {
LOGGER.log(Level.WARNING, "Unexpected number of results for Solr highlighting query: {0}", q); //NON-NLS logger.log(Level.WARNING, "Unexpected number of results for Solr highlighting query: {0}", q); //NON-NLS
} }
String highlightedContent; String highlightedContent;
Map<String, Map<String, List<String>>> responseHighlight = response.getHighlighting(); Map<String, Map<String, List<String>>> responseHighlight = response.getHighlighting();
@ -426,7 +426,7 @@ class HighlightedText implements IndexedText {
return "<html><pre>" + highlightedContent + "</pre></html>"; //NON-NLS return "<html><pre>" + highlightedContent + "</pre></html>"; //NON-NLS
} catch (TskCoreException | KeywordSearchModuleException | NoOpenCoreException ex) { } catch (TskCoreException | KeywordSearchModuleException | NoOpenCoreException ex) {
LOGGER.log(Level.SEVERE, "Error getting highlighted text for Solr doc id " + solrObjectId + ", chunkID " + chunkID + ", highlight query: " + highlightField, ex); //NON-NLS logger.log(Level.SEVERE, "Error getting highlighted text for Solr doc id " + solrObjectId + ", chunkID " + chunkID + ", highlight query: " + highlightField, ex); //NON-NLS
return NbBundle.getMessage(this.getClass(), "HighlightedMatchesSource.getMarkup.queryFailedMsg"); return NbBundle.getMessage(this.getClass(), "HighlightedMatchesSource.getMarkup.queryFailedMsg");
} }
} }

View File

@ -39,7 +39,7 @@ import org.sleuthkit.autopsy.actions.AddContentTagAction;
import org.sleuthkit.autopsy.actions.DeleteFileContentTagAction; import org.sleuthkit.autopsy.actions.DeleteFileContentTagAction;
import org.sleuthkit.autopsy.directorytree.HashSearchAction; import org.sleuthkit.autopsy.directorytree.HashSearchAction;
import org.sleuthkit.autopsy.directorytree.NewWindowViewAction; import org.sleuthkit.autopsy.directorytree.NewWindowViewAction;
import org.sleuthkit.autopsy.keywordsearch.KeywordSearchResultFactory.QueryContent; import org.sleuthkit.autopsy.keywordsearch.KeywordSearchResultFactory.AdHocQueryResult;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.ContentVisitor; import org.sleuthkit.datamodel.ContentVisitor;
@ -60,11 +60,11 @@ class KeywordSearchFilterNode extends FilterNode {
/** /**
* Instantiate a KeywordSearchFilterNode. * Instantiate a KeywordSearchFilterNode.
* *
* @param queryContent The query content. * @param adHocQueryResult The query content.
* @param original The original source node. * @param original The original source node.
*/ */
KeywordSearchFilterNode(QueryContent queryContent, Node original) { KeywordSearchFilterNode(AdHocQueryResult adHocQueryResult, Node original) {
super(original, null, new ProxyLookup(Lookups.singleton(queryContent), original.getLookup())); super(original, null, new ProxyLookup(Lookups.singleton(adHocQueryResult), original.getLookup()));
} }
@Override @Override

View File

@ -66,7 +66,7 @@ import org.sleuthkit.datamodel.TskCoreException;
*/ */
class KeywordSearchResultFactory extends ChildFactory<KeyValue> { class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
private static final Logger LOGGER = Logger.getLogger(KeywordSearchResultFactory.class.getName()); private static final Logger logger = Logger.getLogger(KeywordSearchResultFactory.class.getName());
//common properties (superset of all Node properties) to be displayed as columns //common properties (superset of all Node properties) to be displayed as columns
static final List<String> COMMON_PROPERTIES static final List<String> COMMON_PROPERTIES
@ -140,7 +140,7 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
try { try {
queryResults = queryRequest.performQuery(); queryResults = queryRequest.performQuery();
} catch (KeywordSearchModuleException | NoOpenCoreException ex) { } catch (KeywordSearchModuleException | NoOpenCoreException ex) {
LOGGER.log(Level.SEVERE, "Could not perform the query " + queryRequest.getQueryString(), ex); //NON-NLS logger.log(Level.SEVERE, "Could not perform the query " + queryRequest.getQueryString(), ex); //NON-NLS
MessageNotifyUtil.Notify.error(Bundle.KeywordSearchResultFactory_query_exception_msg() + queryRequest.getQueryString(), ex.getCause().getMessage()); MessageNotifyUtil.Notify.error(Bundle.KeywordSearchResultFactory_query_exception_msg() + queryRequest.getQueryString(), ex.getCause().getMessage());
return false; return false;
} }
@ -148,7 +148,7 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
try { try {
tskCase = Case.getCurrentCase().getSleuthkitCase(); tskCase = Case.getCurrentCase().getSleuthkitCase();
} catch (IllegalStateException ex) { } catch (IllegalStateException ex) {
LOGGER.log(Level.SEVERE, "There was no case open.", ex); //NON-NLS logger.log(Level.SEVERE, "There was no case open.", ex); //NON-NLS
return false; return false;
} }
@ -165,11 +165,11 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
try { try {
content = tskCase.getContentById(hit.getContentID()); content = tskCase.getContentById(hit.getContentID());
if (content == null) { if (content == null) {
LOGGER.log(Level.SEVERE, "There was a error getting content by id."); //NON-NLS logger.log(Level.SEVERE, "There was a error getting content by id."); //NON-NLS
return false; return false;
} }
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "There was a error getting content by id.", ex); //NON-NLS logger.log(Level.SEVERE, "There was a error getting content by id.", ex); //NON-NLS
return false; return false;
} }
@ -192,7 +192,7 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
try { try {
hitName = tskCase.getBlackboardArtifact(hit.getArtifactID().get()).getDisplayName() + " Artifact"; //NON-NLS hitName = tskCase.getBlackboardArtifact(hit.getArtifactID().get()).getDisplayName() + " Artifact"; //NON-NLS
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error getting blckboard artifact by id", ex); logger.log(Level.SEVERE, "Error getting blckboard artifact by id", ex);
return false; return false;
} }
} else { } else {
@ -250,12 +250,12 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
Node resultNode; Node resultNode;
if (key instanceof KeyValueQueryContent) { if (key instanceof KeyValueQueryContent) {
QueryContent queryContent = new QueryContent((KeyValueQueryContent) key); AdHocQueryResult adHocQueryResult = new AdHocQueryResult((KeyValueQueryContent) key);
Node kvNode = new KeyValueNode(key, Children.LEAF, Lookups.singleton(queryContent)); Node kvNode = new KeyValueNode(key, Children.LEAF);
//wrap in KeywordSearchFilterNode for the markup content, might need to override FilterNode for more customization //wrap in KeywordSearchFilterNode for the markup content, might need to override FilterNode for more customization
resultNode = new KeywordSearchFilterNode(queryContent, kvNode); resultNode = new KeywordSearchFilterNode(adHocQueryResult, kvNode);
} else { } else {
resultNode = new EmptyNode("This Node Is Empty"); resultNode = new EmptyNode("This Node Is Empty");
resultNode.setDisplayName(NbBundle.getMessage(this.getClass(), "KeywordSearchResultFactory.createNodeForKey.noResultsFound.text")); resultNode.setDisplayName(NbBundle.getMessage(this.getClass(), "KeywordSearchResultFactory.createNodeForKey.noResultsFound.text"));
@ -269,19 +269,19 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
* This class encapsulates content, query results, and an associated Solr * This class encapsulates content, query results, and an associated Solr
* object ID for storing in the Lookup to be read later. * object ID for storing in the Lookup to be read later.
*/ */
class QueryContent { final class AdHocQueryResult {
private final long solrObjectId; private final long solrObjectId;
private final Content content; private final Content content;
private final QueryResults results; private final QueryResults results;
/** /**
* Instantiate a QueryContent object. * Instantiate a AdHocQueryResult object.
* *
* @param solrObjectId The Solr object ID associated with the content. * @param solrObjectId The Solr object ID associated with the content.
* @param content The content for the query result. * @param content The content for the query result.
* @param results The query results. * @param results The query results.
*/ */
QueryContent(KeyValueQueryContent key) { AdHocQueryResult(KeyValueQueryContent key) {
this.solrObjectId = key.getSolrObjectId(); this.solrObjectId = key.getSolrObjectId();
this.content = key.getContent(); this.content = key.getContent();
this.results = key.getHits(); this.results = key.getHits();
@ -407,9 +407,9 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValue> {
try { try {
get(); get();
} catch (InterruptedException | CancellationException ex) { } catch (InterruptedException | CancellationException ex) {
LOGGER.log(Level.WARNING, "User cancelled writing of ad hoc search query results for '{0}' to the blackboard", query.getQueryString()); //NON-NLS logger.log(Level.WARNING, "User cancelled writing of ad hoc search query results for '{0}' to the blackboard", query.getQueryString()); //NON-NLS
} catch (ExecutionException ex) { } catch (ExecutionException ex) {
LOGGER.log(Level.SEVERE, "Error writing of ad hoc search query results for " + query.getQueryString() + " to the blackboard", ex); //NON-NLS logger.log(Level.SEVERE, "Error writing of ad hoc search query results for " + query.getQueryString() + " to the blackboard", ex); //NON-NLS
} }
} }