mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 18:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Cleanup.

Browse Source
This commit is contained in:
U-BASIS\dgrove 2018-11-15 00:49:53 -05:00
parent e20466bc28
commit 1da24f1aec
24 changed files with 884 additions and 1066 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
Core/src/org/sleuthkit/autopsy/core/layer.xml
View File

@ -78,7 +78,6 @@
<folder name="Tools"> <folder name="Tools">
<file name="org-sleuthkit-autopsy-filesearch-FileSearchAction.instance"/> <file name="org-sleuthkit-autopsy-filesearch-FileSearchAction.instance"/>
<file name="org-sleuthkit-autopsy-commonfilesearch-CommonAttributeSearchAction.instance"/> <file name="org-sleuthkit-autopsy-commonfilesearch-CommonAttributeSearchAction.instance"/>
<file name="org-sleuthkit-autopsy-md5search-Md5SearchAction.instance"/>
<file name="org-sleuthkit-autopsy-ingest-IngestMessagesAction.instance"> <file name="org-sleuthkit-autopsy-ingest-IngestMessagesAction.instance">
<attr name="delegate" newvalue="org.sleuthkit.autopsy.ingest.IngestMessagesAction"/> <attr name="delegate" newvalue="org.sleuthkit.autopsy.ingest.IngestMessagesAction"/>
</file> </file>
@ -202,10 +201,6 @@
<attr name="originalFile" stringvalue="Actions/Tools/org-sleuthkit-autopsy-commonfilesearch-CommonAttributeSearchAction.instance"/> <attr name="originalFile" stringvalue="Actions/Tools/org-sleuthkit-autopsy-commonfilesearch-CommonAttributeSearchAction.instance"/>
<attr name="position" intvalue="103"/> <attr name="position" intvalue="103"/>
</file> </file>
<file name="org-sleuthkit-autopsy-md5search-Md5SearchAction.shadow">
<attr name="originalFile" stringvalue="Actions/Tools/org-sleuthkit-autopsy-md5search-Md5SearchAction.instance"/>
<attr name="position" intvalue="104"/>
</file>
<file name="org-sleuthkit-autopsy-filesearch-FileSearchAction.shadow"> <file name="org-sleuthkit-autopsy-filesearch-FileSearchAction.shadow">
<attr name="originalFile" stringvalue="Actions/Tools/org-sleuthkit-autopsy-filesearch-FileSearchAction.instance"/> <attr name="originalFile" stringvalue="Actions/Tools/org-sleuthkit-autopsy-filesearch-FileSearchAction.instance"/>
<attr name="position" intvalue="200"/> <attr name="position" intvalue="200"/>

7
Core/src/org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties Executable file
View File

@ -0,0 +1,7 @@
CorrelationPropertySearchDialog.errorLabel.text=
CorrelationPropertySearchDialog.correlationValueTextField.text=
CorrelationPropertySearchDialog.correlationTypeLabel.text=Correlation Property Type:
CorrelationPropertySearchDialog.correlationValueLabel.text=Correlation Property Value:
CorrelationPropertySearchDialog.searchButton.text=Search
CorrelationPropertySearchDialog.searchButton.AccessibleContext.accessibleName=Search
CorrelationPropertySearchDialog.searchButton.AccessibleContext.accessibleDescription=

110
Core/src/org/sleuthkit/autopsy/md5search/CorrelationAttributeInstanceRootNode.java → Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationAttributeInstanceNode.java
View File

@ -1,5 +1,4 @@
/* /*
*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2018 Basis Technology Corp. * Copyright 2018 Basis Technology Corp.
@ -17,43 +16,45 @@
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.md5search; package org.sleuthkit.autopsy.correlationpropertysearch;
import org.sleuthkit.autopsy.commonfilesearch.*;
import java.io.File; import java.io.File;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Arrays; import java.util.Arrays;
import java.util.List; import java.util.List;
import javax.swing.Action; import javax.swing.Action;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children; import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet; import org.openide.nodes.Sheet;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor; import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor;
import org.sleuthkit.autopsy.datamodel.NodeProperty; import org.sleuthkit.autopsy.datamodel.NodeProperty;
/** /**
* Used by the Common Files search feature to encapsulate instances of a given * Used by the Correlation Property Search feature to encapsulate instances of a
* MD5s matched in the search. These nodes will be children of <code>Md5Node</code>s. * given search match.
*
* Use this type for files which are not in the current case, but from the
* Central Repo. Contrast with <code>SleuthkitCase</code> which should be used
* when the FileInstance was found in the case presently open in Autopsy.
*/ */
final class CorrelationAttributeInstanceRootNode extends DisplayableItemNode { public class CorrelationAttributeInstanceNode extends DisplayableItemNode {
public CorrelationAttributeInstanceRootNode(Children children) { private final CorrelationAttributeInstance instance;
super(children);
}
//private final CorrelationAttributeInstance crFile;
//CorrelationAttributeInstanceRootNode(CorrelationAttributeSearchResults data) { CorrelationAttributeInstanceNode(CorrelationAttributeInstance content) {
//super(Children.create(new FileInstanceNodeFactory(data), true)); super(Children.LEAF, Lookups.fixed(content));
//} this.instance = content;
this.setDisplayName(new File(this.instance.getFilePath()).getName());
}
/**
* Get the CorrelationAttributeInstance attached to the node.
*
* @return The CorrelationAttributeInstance object.
*/
public CorrelationAttributeInstance getCorrelationAttributeInstance(){
return this.instance;
}
@Override @Override
public Action[] getActions(boolean context){ public Action[] getActions(boolean context){
@ -66,8 +67,7 @@ final class CorrelationAttributeInstanceRootNode extends DisplayableItemNode {
@Override @Override
public <T> T accept(DisplayableItemNodeVisitor<T> visitor) { public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
return null; return visitor.visit(this);
//return visitor.visit(this);
} }
@Override @Override
@ -77,12 +77,11 @@ final class CorrelationAttributeInstanceRootNode extends DisplayableItemNode {
@Override @Override
public String getItemType() { public String getItemType() {
//objects of type FileNode will co-occur in the treetable with objects return CorrelationAttributeInstanceNode.class.getName();
// of this type and they will need to provide the same key
return CaseDBCommonAttributeInstanceNode.class.getName();
} }
@NbBundle.Messages({ @NbBundle.Messages({
"CorrelationAttributeInstanceNode.columnName.name=Name",
"CorrelationAttributeInstanceNode.columnName.case=Case", "CorrelationAttributeInstanceNode.columnName.case=Case",
"CorrelationAttributeInstanceNode.columnName.dataSource=Data Source", "CorrelationAttributeInstanceNode.columnName.dataSource=Data Source",
"CorrelationAttributeInstanceNode.columnName.known=Known", "CorrelationAttributeInstanceNode.columnName.known=Known",
@ -93,7 +92,7 @@ final class CorrelationAttributeInstanceRootNode extends DisplayableItemNode {
@Override @Override
protected Sheet createSheet(){ protected Sheet createSheet(){
Sheet sheet = new Sheet(); Sheet sheet = new Sheet();
/*Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES); Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
if(sheetSet == null){ if(sheetSet == null){
sheetSet = Sheet.createPropertiesSet(); sheetSet = Sheet.createPropertiesSet();
@ -102,61 +101,40 @@ final class CorrelationAttributeInstanceRootNode extends DisplayableItemNode {
final CorrelationAttributeInstance centralRepoFile = this.getCorrelationAttributeInstance(); final CorrelationAttributeInstance centralRepoFile = this.getCorrelationAttributeInstance();
final String caseName = centralRepoFile.getCorrelationCase().getDisplayName(); final String path = centralRepoFile.getFilePath();
final String dataSourceName = centralRepoFile.getCorrelationDataSource().getName(); final File file = new File(path);
//DLG: final ? knownStatus
final String fullPath = centralRepoFile.getFilePath();
//DLG: final String comment
//DLG: final String deviceId
final File file = new File(fullPath);
final String name = file.getName(); final String name = file.getName();
final String parent = file.getParent(); final String caseName = centralRepoFile.getCorrelationCase().getDisplayName();
final CorrelationDataSource dataSource = centralRepoFile.getCorrelationDataSource();
final String dataSourceName = dataSource.getName();
final String known = centralRepoFile.getKnownStatus().getName();
final String comment = centralRepoFile.getComment();
final String device = dataSource.getDeviceID();
final String NO_DESCR = "";
sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_name(),
Bundle.CorrelationAttributeInstanceNode_columnName_name(), NO_DESCR, name));
sheetSet.put(new NodeProperty<>( sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_case(), Bundle.CorrelationAttributeInstanceNode_columnName_case(),
Bundle.CorrelationAttributeInstanceNode_columnName_case(), "", name)); Bundle.CorrelationAttributeInstanceNode_columnName_case(), NO_DESCR, caseName));
sheetSet.put(new NodeProperty<>( sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_dataSource(), Bundle.CorrelationAttributeInstanceNode_columnName_dataSource(),
Bundle.CorrelationAttributeInstanceNode_columnName_dataSource(), "", parent)); Bundle.CorrelationAttributeInstanceNode_columnName_dataSource(), NO_DESCR, dataSourceName));
sheetSet.put(new NodeProperty<>( sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_known(), Bundle.CorrelationAttributeInstanceNode_columnName_known(),
Bundle.CorrelationAttributeInstanceNode_columnName_known(), "", "")); Bundle.CorrelationAttributeInstanceNode_columnName_known(), NO_DESCR, known));
sheetSet.put(new NodeProperty<>( sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_path(), Bundle.CorrelationAttributeInstanceNode_columnName_path(),
Bundle.CorrelationAttributeInstanceNode_columnName_path(), "", dataSourceName)); Bundle.CorrelationAttributeInstanceNode_columnName_path(), NO_DESCR, path));
sheetSet.put(new NodeProperty<>( sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_comment(), Bundle.CorrelationAttributeInstanceNode_columnName_comment(),
Bundle.CorrelationAttributeInstanceNode_columnName_comment(), "", "")); Bundle.CorrelationAttributeInstanceNode_columnName_comment(), NO_DESCR, comment));
sheetSet.put(new NodeProperty<>( sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_device(), Bundle.CorrelationAttributeInstanceNode_columnName_device(),
Bundle.CorrelationAttributeInstanceNode_columnName_device(), "", caseName));*/ Bundle.CorrelationAttributeInstanceNode_columnName_device(), NO_DESCR, device));
return sheet; return sheet;
} }
/**
* Child generator for <code>SleuthkitCaseFileInstanceNode</code> of
* <code>CommonAttributeValueNode</code>.
*/
static class FileInstanceNodeFactory extends ChildFactory<CorrelationAttributeSearchResults> {
private final CommonAttributeValue descendants;
FileInstanceNodeFactory(CommonAttributeValue descendants) {
this.descendants = descendants;
}
@Override
protected boolean createKeys(List<CorrelationAttributeSearchResults> list) {
return true;
}
/*@Override
protected Node[] createNodesForKey(AbstractCommonAttributeInstance searchResult) {
return null;
//return searchResult.generateNodes();
}*/
}
} }

84
Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationPropertyFilterChildren.java Executable file
View File

@ -0,0 +1,84 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.correlationpropertysearch;
import org.openide.nodes.Children;
import org.openide.nodes.FilterNode;
import org.openide.nodes.Node;
/**
* A <code>Children</code> implementation for a
* <code>CorrelationPropertyFilterNode</code>.
*/
class CorrelationPropertyFilterChildren extends FilterNode.Children {
/**
* Create a new Children instance.
*
* @param wrappedNode The node to be wrapped.
* @param createChildren If false, return LEAF. Otherwise, return a new
* CorrelationPropertyFilterChildren instance.
*
* @return A Children instance.
*/
public static Children createInstance(Node wrappedNode, boolean createChildren) {
if (createChildren) {
return new CorrelationPropertyFilterChildren(wrappedNode);
} else {
return Children.LEAF;
}
}
/**
* Constructs a children (child factory) implementation for a
* <code>CorrelationPropertyFilterNode</code>.
*
* @param wrappedNode The node wrapped by CorrelationPropertyFilterNode.
*/
CorrelationPropertyFilterChildren(Node wrappedNode) {
super(wrappedNode);
}
/**
* Copies a CorrelationPropertyFilterNode, with the children (child factory)
* flag set to false.
*
* @param nodeToCopy The CorrelationPropertyFilterNode to copy.
*
* @return A copy of a CorrelationPropertyFilterNode.
*/
@Override
protected Node copyNode(Node nodeToCopy) {
return new CorrelationPropertyFilterNode(nodeToCopy, false);
}
/**
* Creates the child nodes represented by this children (child factory)
* object.
*
* @param key The key, i.e., the node, for which to create the child nodes.
*
* @return A single-element node array.
*/
@Override
protected Node[] createNodes(Node key) {
return new Node[]{this.copyNode(key)};
}
}

134
Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationPropertyFilterNode.java Executable file
View File

@ -0,0 +1,134 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.correlationpropertysearch;
import org.openide.nodes.FilterNode;
import org.openide.nodes.Node;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.datamodel.NodeSelectionInfo;
import org.sleuthkit.autopsy.directorytree.DataResultFilterNode;
/**
* FilterNode containing properties and actions for Correlation Property Search.
*/
public class CorrelationPropertyFilterNode extends FilterNode {
private final boolean createChildren;
private final boolean forceUseWrappedDisplayName;
private String columnOrderKey = "NONE";
/**
* Constructs a filter node that creates at most one layer of child nodes
* for the node it wraps. It is designed to be used in the results view to
* ensure the individual viewers display only the first layer of child
* nodes.
*
* @param node The node to wrap in the filter node.
* @param createChildren True if a Children object should be created for the
* wrapped node.
*/
public CorrelationPropertyFilterNode(Node node, boolean createChildren) {
super(node, CorrelationPropertyFilterChildren.createInstance(node, createChildren), Lookups.proxy(node));
this.forceUseWrappedDisplayName = false;
this.createChildren = createChildren;
}
/**
* Constructs a filter node that creates at most one layer of child nodes
* for the node it wraps. It is designed to be used in the results view to
* ensure the individual viewers display only the first layer of child
* nodes.
*
* @param node The node to wrap in the filter node.
* @param createChildren True if a Children object should be created for the
* wrapped node.
* @param columnOrderKey A key that represents the type of the original
* wrapped node and what is being displayed under that node.
*/
public CorrelationPropertyFilterNode(Node node, boolean createChildren, String columnOrderKey) {
super(node, CorrelationPropertyFilterChildren.createInstance(node, createChildren), Lookups.proxy(node));
this.forceUseWrappedDisplayName = false;
this.createChildren = createChildren;
this.columnOrderKey = columnOrderKey;
}
/**
* Gets the display name for the wrapped node, for use in the first column
* of an Autopsy table view.
*
* @return The display name.
*/
@Override
public String getDisplayName() {
if (this.forceUseWrappedDisplayName) {
return super.getDisplayName();
} else if (createChildren) {
return NbBundle.getMessage(this.getClass(), "TableFilterNode.displayName.text");
} else {
return super.getDisplayName();
}
}
/**
* Adds information about which child node of this node, if any, should be
* selected. Can be null.
*
* @param selectedChildNodeInfo The child node selection information.
*/
public void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo) {
/*
* Currently, child selection is only supported for nodes selected in
* the tree view and decorated with a DataResultFilterNode.
*/
if (getOriginal() instanceof DataResultFilterNode) {
((DataResultFilterNode) getOriginal()).setChildNodeSelectionInfo(selectedChildNodeInfo);
}
}
/**
* Gets information about which child node of this node, if any, should be
* selected.
*
* @return The child node selection information, or null if no child should
* be selected.
*/
public NodeSelectionInfo getChildNodeSelectionInfo() {
/*
* Currently, child selection is only supported for nodes selected in
* the tree view and decorated with a DataResultFilterNode.
*/
if (getOriginal() instanceof DataResultFilterNode) {
return ((DataResultFilterNode) getOriginal()).getChildNodeSelectionInfo();
} else {
return null;
}
}
/**
* @return the column order key, which allows custom column ordering to be
* written into a properties file and be reloaded for future use in a table
* with the same root node or for different cases. This is done by
* DataResultViewerTable. The key should represent what kinds of items the
* table is showing.
*/
public String getColumnOrderKey() {
return columnOrderKey;
}
}

22
Core/src/org/sleuthkit/autopsy/md5search/Md5SearchAction.java → Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationPropertySearchAction.java
View File

@ -16,22 +16,30 @@
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.md5search; package org.sleuthkit.autopsy.correlationpropertysearch;
import java.awt.event.ActionEvent; import java.awt.event.ActionEvent;
import org.openide.awt.ActionID;
import org.openide.awt.ActionReference;
import org.openide.awt.ActionRegistration;
import org.openide.util.HelpCtx; import org.openide.util.HelpCtx;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.openide.util.actions.CallableSystemAction; import org.openide.util.actions.CallableSystemAction;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb;
/** /**
* //DLG: * Action for accessing the Correlation Property Search dialog.
*/ */
public class Md5SearchAction extends CallableSystemAction { @ActionID(category = "Tools", id = "org.sleuthkit.autopsy.correlationpropertysearch.CorrelationPropertySearchAction")
@ActionRegistration(displayName = "#CTL_CorrelationPropertySearchAction=Correlation Property Search", lazy = false)
@ActionReference(path = "Menu/Tools", position = 104)
@NbBundle.Messages({"CTL_CorrelationPropertySearchAction=Correlation Property Search"})
public class CorrelationPropertySearchAction extends CallableSystemAction {
@Override @Override
public boolean isEnabled() { public boolean isEnabled() {
return super.isEnabled() && Case.isCaseOpen(); return EamDb.isEnabled() && Case.isCaseOpen();
} }
@Override @Override
@ -41,15 +49,15 @@ public class Md5SearchAction extends CallableSystemAction {
@Override @Override
public void performAction() { public void performAction() {
Md5SearchDialog dialog = new Md5SearchDialog(); CorrelationPropertySearchDialog dialog = new CorrelationPropertySearchDialog();
dialog.display(); dialog.display();
} }
@NbBundle.Messages({ @NbBundle.Messages({
"Md5SearchAction.getName.text=Correlation Attribute Search"}) "CorrelationPropertySearchAction.getName.text=Correlation Property Search"})
@Override @Override
public String getName() { public String getName() {
return Bundle.Md5SearchAction_getName_text(); return Bundle.CorrelationPropertySearchAction_getName_text();
} }
@Override @Override

49
Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationPropertySearchChildren.java Executable file
View File

@ -0,0 +1,49 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.correlationpropertysearch;
import java.util.List;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
/**
* Creates CorrelationAttributeInstanceNodes from a collection of
* CorrelationAttributeInstances.
*/
class CorrelationPropertySearchChildren extends Children.Keys<CorrelationAttributeInstance> {
/**
* Create an instance of CorrelationPropertySearchChildren.
*
* @param lazy Lazy load?
* @param fileList List of CorrelationAttributeInstances.
*/
CorrelationPropertySearchChildren(boolean lazy, List<CorrelationAttributeInstance> instances) {
super(lazy);
this.setKeys(instances);
}
@Override
protected Node[] createNodes(CorrelationAttributeInstance t) {
Node[] node = new Node[1];
node[0] = new CorrelationAttributeInstanceNode(t);
return node;
}
}

135
Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationPropertySearchDialog.form Executable file
View File

@ -0,0 +1,135 @@
<?xml version="1.0" encoding="UTF-8" ?>
<Form version="1.5" maxVersion="1.9" type="org.netbeans.modules.form.forminfo.JDialogFormInfo">
<Properties>
<Property name="defaultCloseOperation" type="int" value="2"/>
<Property name="resizable" type="boolean" value="false"/>
</Properties>
<SyntheticProperties>
<SyntheticProperty name="formSizePolicy" type="int" value="1"/>
<SyntheticProperty name="generateCenter" type="boolean" value="false"/>
</SyntheticProperties>
<AuxValues>
<AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/>
<AuxValue name="FormSettings_autoSetComponentName" type="java.lang.Boolean" value="false"/>
<AuxValue name="FormSettings_generateFQN" type="java.lang.Boolean" value="true"/>
<AuxValue name="FormSettings_generateMnemonicsCode" type="java.lang.Boolean" value="true"/>
<AuxValue name="FormSettings_i18nAutoMode" type="java.lang.Boolean" value="true"/>
<AuxValue name="FormSettings_layoutCodeTarget" type="java.lang.Integer" value="1"/>
<AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
<AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
<AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
</AuxValues>
<Layout>
<DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="1" attributes="0">
<Component id="errorLabel" max="32767" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/>
<Component id="searchButton" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="correlationValueLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="correlationTypeLabel" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="correlationTypeComboBox" pref="289" max="32767" attributes="0"/>
<Component id="correlationValueTextField" max="32767" attributes="0"/>
</Group>
</Group>
</Group>
<EmptySpace max="-2" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="correlationTypeComboBox" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="correlationTypeLabel" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="correlationValueLabel" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="correlationValueTextField" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="searchButton" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="errorLabel" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
</Layout>
<SubComponents>
<Component class="javax.swing.JLabel" name="correlationValueLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties" key="CorrelationPropertySearchDialog.correlationValueLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JTextField" name="correlationValueTextField">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties" key="CorrelationPropertySearchDialog.correlationValueTextField.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JButton" name="searchButton">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties" key="CorrelationPropertySearchDialog.searchButton.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<AccessibilityProperties>
<Property name="AccessibleContext.accessibleName" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties" key="CorrelationPropertySearchDialog.searchButton.AccessibleContext.accessibleName" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
<Property name="AccessibleContext.accessibleDescription" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties" key="CorrelationPropertySearchDialog.searchButton.AccessibleContext.accessibleDescription" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</AccessibilityProperties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="searchButtonActionPerformed"/>
</Events>
</Component>
<Component class="javax.swing.JComboBox" name="correlationTypeComboBox">
<Properties>
<Property name="model" type="javax.swing.ComboBoxModel" editor="org.netbeans.modules.form.editors2.ComboBoxModelEditor">
<StringArray count="0"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_TypeParameters" type="java.lang.String" value="&lt;String&gt;"/>
</AuxValues>
</Component>
<Component class="javax.swing.JLabel" name="correlationTypeLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties" key="CorrelationPropertySearchDialog.correlationTypeLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JLabel" name="errorLabel">
<Properties>
<Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
<Color blue="0" green="0" red="ff" type="rgb"/>
</Property>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/correlationpropertysearch/Bundle.properties" key="CorrelationPropertySearchDialog.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
</SubComponents>
</Form>

359
Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationPropertySearchDialog.java Executable file
View File

@ -0,0 +1,359 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.correlationpropertysearch;
import java.awt.Color;
import java.awt.event.ItemEvent;
import java.awt.event.ItemListener;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.concurrent.ExecutionException;
import java.util.logging.Level;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.swing.JFrame;
import javax.swing.SwingWorker;
import javax.swing.event.DocumentEvent;
import javax.swing.event.DocumentListener;
import org.openide.nodes.Node;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle;
import org.openide.util.NbBundle.Messages;
import org.openide.windows.TopComponent;
import org.openide.windows.WindowManager;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.autopsy.commonfilesearch.CommonAttributesSearchResultsViewerTable;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer;
import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent;
import org.sleuthkit.autopsy.corecomponents.DataResultViewerTable;
import org.sleuthkit.autopsy.corecomponents.TableFilterNode;
import org.sleuthkit.autopsy.corecomponents.TextPrompt;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.EmptyNode;
@Messages({
"CorrelationPropertySearchDialog.title.text=Correlation Property Search",
"CorrelationPropertySearchDialog.results.text=Correlation Properties",
"CorrelationPropertySearchDialog.emptyNode.text=No results found.",
"CorrelationPropertySearchDialog.validation.invalidHash=The supplied value is not a valid MD5 hash."
})
/**
* The Correlation Property Search dialog allows users to search for specific
* types of correlation properties in the Central Repository.
*/
public class CorrelationPropertySearchDialog extends javax.swing.JDialog {
private static final Logger logger = Logger.getLogger(CorrelationPropertySearchDialog.class.getName());
private static final String FILES_CORRELATION_TYPE = "Files";
private final List<CorrelationAttributeInstance.Type> correlationTypes;
private TextPrompt correlationValueTextFieldPrompt;
/**
* Creates a new instance of the Correlation Property Search dialog.
*/
public CorrelationPropertySearchDialog() {
super((JFrame) WindowManager.getDefault().getMainWindow(), Bundle.CorrelationPropertySearchDialog_title_text(), true);
this.correlationTypes = new ArrayList<>();
initComponents();
customizeComponents();
}
/**
* Perform the correlation property search.
*/
private void search() {
new SwingWorker<List<CorrelationAttributeInstance>, Void>() {
@Override
protected List<CorrelationAttributeInstance> doInBackground() {
List<CorrelationAttributeInstance.Type> correlationTypes;
List<CorrelationAttributeInstance> correlationInstances = new ArrayList<>();
try {
correlationTypes = EamDb.getInstance().getDefinedCorrelationTypes();
for (CorrelationAttributeInstance.Type type : correlationTypes) {
if (type.getDisplayName().equals((String) correlationTypeComboBox.getSelectedItem())) {
correlationInstances = EamDb.getInstance().getArtifactInstancesByTypeValue(type, correlationValueTextField.getText());
break;
}
}
} catch (EamDbException ex) {
logger.log(Level.SEVERE, "Unable to connect to the Central Repository database.", ex);
} catch (CorrelationAttributeNormalizationException ex) {
logger.log(Level.SEVERE, "Unable to retrieve data from the Central Repository.", ex);
}
return correlationInstances;
}
@Override
protected void done() {
try {
super.done();
List<CorrelationAttributeInstance> correlationInstances = this.get();
DataResultViewerTable table = new CommonAttributesSearchResultsViewerTable();
Collection<DataResultViewer> viewers = new ArrayList<>(1);
viewers.add(table);
CorrelationPropertySearchNode searchNode = new CorrelationPropertySearchNode(correlationInstances);
CorrelationPropertyFilterNode tableFilterNode = new CorrelationPropertyFilterNode(searchNode, true, searchNode.getName());
String resultsText = String.format("%s (%s; \"%s\")",
Bundle.CorrelationPropertySearchDialog_results_text(),
(String) correlationTypeComboBox.getSelectedItem(),
correlationValueTextField.getText());
final TopComponent searchResultWin;
if (correlationInstances.isEmpty()) {
Node emptyNode = new TableFilterNode(
new EmptyNode(Bundle.CorrelationPropertySearchDialog_emptyNode_text()), true);
searchResultWin = DataResultTopComponent.createInstance(
resultsText, Bundle.CorrelationPropertySearchDialog_title_text(), emptyNode, 0);
} else {
searchResultWin = DataResultTopComponent.createInstance(
resultsText, Bundle.CorrelationPropertySearchDialog_title_text(), tableFilterNode, HIDE_ON_CLOSE, viewers);
}
searchResultWin.requestActive(); // make it the active top component
} catch (ExecutionException | InterruptedException ex) {
logger.log(Level.SEVERE, "Unable to get CorrelationAttributeInstances.", ex);
}
}
}.execute();
}
/**
* This method is called from within the constructor to initialize the form.
* WARNING: Do NOT modify this code. The content of this method is always
* regenerated by the Form Editor.
*/
@SuppressWarnings("unchecked")
// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
private void initComponents() {
correlationValueLabel = new javax.swing.JLabel();
correlationValueTextField = new javax.swing.JTextField();
searchButton = new javax.swing.JButton();
correlationTypeComboBox = new javax.swing.JComboBox<>();
correlationTypeLabel = new javax.swing.JLabel();
errorLabel = new javax.swing.JLabel();
setDefaultCloseOperation(javax.swing.WindowConstants.DISPOSE_ON_CLOSE);
setResizable(false);
org.openide.awt.Mnemonics.setLocalizedText(correlationValueLabel, org.openide.util.NbBundle.getMessage(CorrelationPropertySearchDialog.class, "CorrelationPropertySearchDialog.correlationValueLabel.text")); // NOI18N
correlationValueTextField.setText(org.openide.util.NbBundle.getMessage(CorrelationPropertySearchDialog.class, "CorrelationPropertySearchDialog.correlationValueTextField.text")); // NOI18N
org.openide.awt.Mnemonics.setLocalizedText(searchButton, org.openide.util.NbBundle.getMessage(CorrelationPropertySearchDialog.class, "CorrelationPropertySearchDialog.searchButton.text")); // NOI18N
searchButton.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
searchButtonActionPerformed(evt);
}
});
org.openide.awt.Mnemonics.setLocalizedText(correlationTypeLabel, org.openide.util.NbBundle.getMessage(CorrelationPropertySearchDialog.class, "CorrelationPropertySearchDialog.correlationTypeLabel.text")); // NOI18N
errorLabel.setForeground(new java.awt.Color(255, 0, 0));
org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(CorrelationPropertySearchDialog.class, "CorrelationPropertySearchDialog.errorLabel.text")); // NOI18N
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(getContentPane());
getContentPane().setLayout(layout);
layout.setHorizontalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(javax.swing.GroupLayout.Alignment.TRAILING, layout.createSequentialGroup()
.addComponent(errorLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addGap(18, 18, 18)
.addComponent(searchButton))
.addGroup(layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(correlationValueLabel)
.addComponent(correlationTypeLabel))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(correlationTypeComboBox, 0, 289, Short.MAX_VALUE)
.addComponent(correlationValueTextField))))
.addContainerGap())
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(correlationTypeComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(correlationTypeLabel))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(correlationValueLabel)
.addComponent(correlationValueTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(searchButton)
.addComponent(errorLabel))
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
);
searchButton.getAccessibleContext().setAccessibleName(org.openide.util.NbBundle.getMessage(CorrelationPropertySearchDialog.class, "CorrelationPropertySearchDialog.searchButton.AccessibleContext.accessibleName")); // NOI18N
searchButton.getAccessibleContext().setAccessibleDescription(org.openide.util.NbBundle.getMessage(CorrelationPropertySearchDialog.class, "CorrelationPropertySearchDialog.searchButton.AccessibleContext.accessibleDescription")); // NOI18N
pack();
}// </editor-fold>//GEN-END:initComponents
private void searchButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_searchButtonActionPerformed
if (validateInputs()) {
/*
* Just in case, we'll lock down the type and value components to
* avoid the possibly of a race condition.
*/
correlationTypeComboBox.setEnabled(false);
correlationValueTextField.setEnabled(false);
search();
dispose();
} else {
searchButton.setEnabled(false);
errorLabel.setText(Bundle.CorrelationPropertySearchDialog_validation_invalidHash());
correlationValueTextField.grabFocus();
}
}//GEN-LAST:event_searchButtonActionPerformed
/**
* Further customize the components beyond the standard initialization.
*/
private void customizeComponents() {
searchButton.setEnabled(false);
/*
* Add correlation types to the combo-box.
*/
try {
EamDb dbManager = EamDb.getInstance();
correlationTypes.clear();
correlationTypes.addAll(dbManager.getDefinedCorrelationTypes());
} catch (EamDbException ex) {
Exceptions.printStackTrace(ex);
}
for (CorrelationAttributeInstance.Type type : correlationTypes) {
// We only support the "Files" type for now.
if (type.getDisplayName().equals(FILES_CORRELATION_TYPE)) {
correlationTypeComboBox.addItem(type.getDisplayName());
}
}
correlationTypeComboBox.setSelectedIndex(0);
correlationTypeComboBox.addItemListener(new ItemListener() {
@Override
public void itemStateChanged(ItemEvent e) {
updateSearchButton();
}
});
/*
* Create listener for text input.
*/
correlationValueTextField.getDocument().addDocumentListener(new DocumentListener() {
@Override
public void changedUpdate(DocumentEvent e) {
updateSearchButton();
}
@Override
public void insertUpdate(DocumentEvent e) {
updateSearchButton();
}
@Override
public void removeUpdate(DocumentEvent e) {
updateSearchButton();
}
});
updateCorrelationValueTextFieldPrompt();
}
@Messages({
"CorrelationPropertySearchDialog.correlationValueTextField.filesExample=Example: \"f0e1d2c3b4a5968778695a4b3c2d1e0f\""
})
/**
* Update the text prompt of the name text field based on the input type
* selection.
*/
private void updateCorrelationValueTextFieldPrompt() {
/**
* Add text prompt to the text field.
*/
String text = Bundle.CorrelationPropertySearchDialog_correlationValueTextField_filesExample();
correlationValueTextFieldPrompt = new TextPrompt(text, correlationValueTextField);
/**
* Sets the foreground color and transparency of the text prompt.
*/
correlationValueTextFieldPrompt.setForeground(Color.LIGHT_GRAY);
correlationValueTextFieldPrompt.changeAlpha(0.9f); // Mostly opaque
validate();
repaint();
}
/**
* Enable or disable the Search button depending on whether or not text has
* been provided for the correlation property value.
*/
private void updateSearchButton() {
searchButton.setEnabled(correlationValueTextField.getText().isEmpty() == false);
}
/**
* Validate the value input.
*
* @return True if the input is valid for the selected type; otherwise false.
*/
private boolean validateInputs() {
Pattern md5Pattern = Pattern.compile("^[a-fA-F0-9]{32}$"); // NON-NLS
Matcher matcher = md5Pattern.matcher(correlationValueTextField.getText().trim());
if (matcher.find()) {
return true;
}
return false;
}
/**
* Display the Correlation Property Search dialog.
*/
public void display() {
this.setLocationRelativeTo(WindowManager.getDefault().getMainWindow());
setVisible(true);
}
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JComboBox<String> correlationTypeComboBox;
private javax.swing.JLabel correlationTypeLabel;
private javax.swing.JLabel correlationValueLabel;
private javax.swing.JTextField correlationValueTextField;
private javax.swing.JLabel errorLabel;
private javax.swing.JButton searchButton;
// End of variables declaration//GEN-END:variables
}

50
Core/src/org/sleuthkit/autopsy/correlationpropertysearch/CorrelationPropertySearchNode.java Executable file
View File

@ -0,0 +1,50 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.correlationpropertysearch;
import java.util.List;
import org.openide.nodes.AbstractNode;
import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
/**
* Parent node to CorrelationPropertySearchChildren.
*/
class CorrelationPropertySearchNode extends AbstractNode {
private CorrelationPropertySearchChildren children;
/**
* Create an instance of CorrelationPropertySearchNode.
*
* @param keys The list of CorrelationAttributeInstances.
*/
CorrelationPropertySearchNode(List<CorrelationAttributeInstance> keys) {
super(new CorrelationPropertySearchChildren(true, keys));
this.children = (CorrelationPropertySearchChildren) this.getChildren();
}
@Messages({
"CorrelationPropertySearchNode.getName.text=Correlation Property Search"
})
@Override
public String getName() {
return Bundle.CorrelationPropertySearchNode_getName_text();
}
}

14
Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java
View File

@ -29,8 +29,7 @@ import org.sleuthkit.autopsy.datamodel.FileSize.FileSizeRootChildren.FileSizeNod
import org.sleuthkit.autopsy.datamodel.FileSize.FileSizeRootNode; import org.sleuthkit.autopsy.datamodel.FileSize.FileSizeRootNode;
import org.sleuthkit.autopsy.datamodel.FileTypes.FileTypesNode; import org.sleuthkit.autopsy.datamodel.FileTypes.FileTypesNode;
import org.sleuthkit.autopsy.datamodel.accounts.Accounts; import org.sleuthkit.autopsy.datamodel.accounts.Accounts;
import org.sleuthkit.autopsy.md5search.CorrelationAttributeInstanceChildNode; import org.sleuthkit.autopsy.correlationpropertysearch.CorrelationAttributeInstanceNode;
import org.sleuthkit.autopsy.md5search.DlgCorrelationAttributeInstanceNode;
/** /**
* Visitor pattern that goes over all nodes in the directory tree. This includes * Visitor pattern that goes over all nodes in the directory tree. This includes
@ -128,9 +127,7 @@ public interface DisplayableItemNodeVisitor<T> {
T visit(InstanceCountNode icn); T visit(InstanceCountNode icn);
T visit(CorrelationAttributeInstanceChildNode caicn); T visit(CorrelationAttributeInstanceNode cain);
T visit(DlgCorrelationAttributeInstanceNode cain); //DLG:
/* /*
* Tags * Tags
@ -221,12 +218,7 @@ public interface DisplayableItemNodeVisitor<T> {
} }
@Override @Override
public T visit(CorrelationAttributeInstanceChildNode caicn){ public T visit(CorrelationAttributeInstanceNode cain) {
return defaultVisit(caicn);
}
@Override
public T visit(DlgCorrelationAttributeInstanceNode cain) {
return defaultVisit(cain); return defaultVisit(cain);
} }

6
Core/src/org/sleuthkit/autopsy/md5search/Bundle.properties
View File

@ -1,6 +0,0 @@
Md5SearchDialog.jButton1.text=Search
Md5SearchDialog.jTextField1.text=
Md5SearchDialog.jLabel1.text=Correlation Property Value:
Md5SearchDialog.jLabel2.text=Correlation Property Type:
Md5SearchDialog.jTextArea1.text=Type a value into the Correlation Property Value field. When the input type is detected, the Correlation Property Type field will become available and default to the detected input type.

123
Core/src/org/sleuthkit/autopsy/md5search/CorrelationAttributeInstanceChildNode.java
View File

@ -1,123 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import java.io.File;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.Map;
import javax.swing.Action;
import org.openide.nodes.Children;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.commonfilesearch.CaseDBCommonAttributeInstanceNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor;
import org.sleuthkit.autopsy.datamodel.NodeProperty;
/**
* //DLG:
*/
public final class CorrelationAttributeInstanceChildNode extends DisplayableItemNode {
private String caseName;
private String dataSourceName;
//DLG: final ? knownStatus
private String fullPath;
//DLG: final String comment
//DLG: final String deviceId
private String name;
private String parent;
public CorrelationAttributeInstanceChildNode(Children children) {
super(children);
}
//CorrelationAttributeInstanceChildNode(Children children) {
// init(null);
//}
private void init(Map<String, Object> map) {
caseName = (String)map.get("caseName");
dataSourceName = (String)map.get("dataSourceName");
fullPath = (String)map.get("fullPath");
name = (String)map.get("name");
parent = (String)map.get("parent");
}
@Override
public Action[] getActions(boolean context){
List<Action> actionsList = new ArrayList<>();
actionsList.addAll(Arrays.asList(super.getActions(true)));
return actionsList.toArray(new Action[actionsList.size()]);
}
/*@Override
public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
return visitor.visit(this);
}*/
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates.
}
@Override
public boolean isLeafTypeNode() {
return true;
}
@Override
public String getItemType() {
//objects of type FileNode will co-occur in the treetable with objects
// of this type and they will need to provide the same key
return CorrelationAttributeInstanceChildNode.class.getName();
}
@NbBundle.Messages({
"CorrelationAttributeInstanceChildNode.columnName.case=Case",
"CorrelationAttributeInstanceChildNode.columnName.dataSource=Data Source",
"CorrelationAttributeInstanceChildNode.columnName.known=Known",
"CorrelationAttributeInstanceChildNode.columnName.path=Path",
"CorrelationAttributeInstanceChildNode.columnName.comment=Comment",
"CorrelationAttributeInstanceChildNode.columnName.device=Device"
})
@Override
protected Sheet createSheet(){
Sheet sheet = new Sheet();
Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
if(sheetSet == null){
sheetSet = Sheet.createPropertiesSet();
sheet.put(sheetSet);
}
sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_case(),
Bundle.CorrelationAttributeInstanceNode_columnName_case(), "", name));
sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_dataSource(),
Bundle.CorrelationAttributeInstanceNode_columnName_dataSource(), "", parent));
sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_known(),
Bundle.CorrelationAttributeInstanceNode_columnName_known(), "", ""));
sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_path(),
Bundle.CorrelationAttributeInstanceNode_columnName_path(), "", dataSourceName));
sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_comment(),
Bundle.CorrelationAttributeInstanceNode_columnName_comment(), "", ""));
sheetSet.put(new NodeProperty<>(
Bundle.CorrelationAttributeInstanceNode_columnName_device(),
Bundle.CorrelationAttributeInstanceNode_columnName_device(), "", caseName));
return sheet;
}
}

68
Core/src/org/sleuthkit/autopsy/md5search/CorrelationAttributeInstanceChildNodeFactory.java
View File

@ -1,68 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import java.io.File;
import java.util.Collection;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.datamodel.KeyValue;
import org.sleuthkit.autopsy.datamodel.KeyValueNode;
/**
* //DLG:
*/
final class CorrelationAttributeInstanceChildNodeFactory extends ChildFactory<KeyValue> {
private final Collection<CorrelationAttributeInstance> correlationInstances;
CorrelationAttributeInstanceChildNodeFactory(Collection<CorrelationAttributeInstance> correlationInstances) {
this.correlationInstances = correlationInstances;
}
@Override
protected boolean createKeys(List<KeyValue> list) {
for (CorrelationAttributeInstance instance : correlationInstances) {
Map<String, Object> properties = new HashMap<>(); //DLG:
final String caseName = instance.getCorrelationCase().getDisplayName();
final String dataSourceName = instance.getCorrelationDataSource().getName();
//DLG: final ? knownStatus
final String fullPath = instance.getFilePath();
//DLG: final String comment
//DLG: final String deviceId
final File file = new File(fullPath);
final String name = file.getName();
final String parent = file.getParent();
properties.put("caseName", caseName);
properties.put("dataSourceName", dataSourceName);
properties.put("knownStatus", ""); //DLG:
properties.put("fullPath", fullPath);
properties.put("comment", ""); //DLG:
properties.put("deviceId", ""); //DLG:
properties.put("name", name);
properties.put("parent", parent);
list.add(new KeyValue(String.valueOf(instance.getID()), properties, instance.getID()));
}
return true;
}
@Override
protected Node createNodeForKey(KeyValue key) {
Map<String, Object> map = key.getMap();
Node kvNode = new KeyValueNode(key, Children.LEAF, Lookups.fixed(correlationInstances.toArray()));
//DLG: Node resultNode = new CorrelationAttributeInstanceChildNode(kvNode);
return null;
}
}

25
Core/src/org/sleuthkit/autopsy/md5search/CorrelationAttributeSearchResults.java
View File

@ -1,25 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import java.util.ArrayList;
import java.util.List;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
/**
* //DLG:
*/
public class CorrelationAttributeSearchResults {
List<CorrelationAttributeInstance> correlationInstances = new ArrayList<>();
CorrelationAttributeSearchResults(List<CorrelationAttributeInstance> correlationInstances) {
this.correlationInstances = correlationInstances;
}
List<CorrelationAttributeInstance> getCorrelationAttributeInstances() {
return correlationInstances;
}
}

143
Core/src/org/sleuthkit/autopsy/md5search/DlgCorrelationAttributeInstanceNode.java
View File

@ -1,143 +0,0 @@
/*
*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.md5search;
import java.io.File;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import javax.swing.Action;
import org.openide.nodes.Children;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor;
import org.sleuthkit.autopsy.datamodel.NodeProperty;
/**
* Used by the Common Files search feature to encapsulate instances of a given
* MD5s matched in the search. These nodes will be children of <code>Md5Node</code>s.
*
* Use this type for files which are not in the current case, but from the
* Central Repo. Contrast with <code>SleuthkitCase</code> which should be used
* when the FileInstance was found in the case presently open in Autopsy.
*/
public class DlgCorrelationAttributeInstanceNode extends DisplayableItemNode {
private final CorrelationAttributeInstance crFile;
DlgCorrelationAttributeInstanceNode(CorrelationAttributeInstance content) {
super(Children.LEAF, Lookups.fixed(content));
this.crFile = content;
this.setDisplayName(new File(this.crFile.getFilePath()).getName());
}
public CorrelationAttributeInstance getCorrelationAttributeInstance(){
return this.crFile;
}
@Override
public Action[] getActions(boolean context){
List<Action> actionsList = new ArrayList<>();
actionsList.addAll(Arrays.asList(super.getActions(true)));
return actionsList.toArray(new Action[actionsList.size()]);
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
return visitor.visit(this);
}
@Override
public boolean isLeafTypeNode() {
return true;
}
@Override
public String getItemType() {
//objects of type FileNode will co-occur in the treetable with objects
// of this type and they will need to provide the same key
return DlgCorrelationAttributeInstanceNode.class.getName();
}
@NbBundle.Messages({
"DlgCorrelationAttributeInstanceNode.columnName.name=Name",
"DlgCorrelationAttributeInstanceNode.columnName.case=Case",
"DlgCorrelationAttributeInstanceNode.columnName.dataSource=Data Source",
"DlgCorrelationAttributeInstanceNode.columnName.known=Known",
"DlgCorrelationAttributeInstanceNode.columnName.path=Path",
"DlgCorrelationAttributeInstanceNode.columnName.comment=Comment",
"DlgCorrelationAttributeInstanceNode.columnName.device=Device"
})
@Override
protected Sheet createSheet(){
Sheet sheet = new Sheet();
Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
if(sheetSet == null){
sheetSet = Sheet.createPropertiesSet();
sheet.put(sheetSet);
}
final CorrelationAttributeInstance centralRepoFile = this.getCorrelationAttributeInstance();
final String path = centralRepoFile.getFilePath();
final File file = new File(path);
final String name = file.getName();
//DLG: final String parent = file.getParent();
final String caseName = centralRepoFile.getCorrelationCase().getDisplayName();
final CorrelationDataSource dataSource = centralRepoFile.getCorrelationDataSource();
final String dataSourceName = dataSource.getName();
final String known = centralRepoFile.getKnownStatus().getName();
final String comment = centralRepoFile.getComment();
final String device = dataSource.getDeviceID();
final String NO_DESCR = "";
sheetSet.put(new NodeProperty<>(
Bundle.DlgCorrelationAttributeInstanceNode_columnName_name(),
Bundle.DlgCorrelationAttributeInstanceNode_columnName_name(), NO_DESCR, name));
sheetSet.put(new NodeProperty<>(
Bundle.DlgCorrelationAttributeInstanceNode_columnName_case(),
Bundle.DlgCorrelationAttributeInstanceNode_columnName_case(), NO_DESCR, caseName));
sheetSet.put(new NodeProperty<>(
Bundle.DlgCorrelationAttributeInstanceNode_columnName_dataSource(),
Bundle.DlgCorrelationAttributeInstanceNode_columnName_dataSource(), NO_DESCR, dataSourceName));
sheetSet.put(new NodeProperty<>(
Bundle.DlgCorrelationAttributeInstanceNode_columnName_known(),
Bundle.DlgCorrelationAttributeInstanceNode_columnName_known(), NO_DESCR, known));
sheetSet.put(new NodeProperty<>(
Bundle.DlgCorrelationAttributeInstanceNode_columnName_path(),
Bundle.DlgCorrelationAttributeInstanceNode_columnName_path(), NO_DESCR, path));
sheetSet.put(new NodeProperty<>(
Bundle.DlgCorrelationAttributeInstanceNode_columnName_comment(),
Bundle.DlgCorrelationAttributeInstanceNode_columnName_comment(), NO_DESCR, comment));
sheetSet.put(new NodeProperty<>(
Bundle.DlgCorrelationAttributeInstanceNode_columnName_device(),
Bundle.DlgCorrelationAttributeInstanceNode_columnName_device(), NO_DESCR, device));
return sheet;
}
}

39
Core/src/org/sleuthkit/autopsy/md5search/DlgFilterChildren.java
View File

@ -1,39 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import org.openide.nodes.Children;
import org.openide.nodes.FilterNode;
import org.openide.nodes.Node;
/**
* //DLG:
*/
class DlgFilterChildren extends FilterNode.Children {
public static Children createInstance(Node wrappedNode, boolean createChildren) {
if (createChildren) {
return new DlgFilterChildren(wrappedNode);
} else {
return Children.LEAF;
}
}
DlgFilterChildren(Node wrappedNode) {
super(wrappedNode);
}
@Override
protected Node copyNode(Node nodeToCopy) {
return new DlgFilterNode(nodeToCopy, false);
}
@Override
protected Node[] createNodes(Node key) {
return new Node[]{this.copyNode(key)};
}
}

79
Core/src/org/sleuthkit/autopsy/md5search/DlgFilterNode.java
View File

@ -1,79 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import org.openide.nodes.FilterNode;
import org.openide.nodes.Node;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.datamodel.NodeSelectionInfo;
import org.sleuthkit.autopsy.directorytree.DataResultFilterNode;
/**
* //DLG:
*/
public class DlgFilterNode extends FilterNode {
private final boolean createChildren;
private final boolean forceUseWrappedDisplayName;
private String columnOrderKey = "NONE";
public DlgFilterNode(Node node, boolean createChildren) {
super(node, DlgFilterChildren.createInstance(node, createChildren), Lookups.proxy(node));
this.forceUseWrappedDisplayName = false;
this.createChildren = createChildren;
}
public DlgFilterNode(Node node, boolean createChildren, String columnOrderKey) {
super(node, DlgFilterChildren.createInstance(node, createChildren), Lookups.proxy(node));
this.forceUseWrappedDisplayName = false;
this.createChildren = createChildren;
this.columnOrderKey = columnOrderKey;
}
/*public DlgFilterNode(Node node, int childLayerDepth) {
super(node, TableFilterChildrenWithDescendants.createInstance(node, childLayerDepth), Lookups.proxy(node));
this.createChildren = true;
this.forceUseWrappedDisplayName = true;
}*/
@Override
public String getDisplayName() {
if (this.forceUseWrappedDisplayName) {
return super.getDisplayName();
} else if (createChildren) {
return NbBundle.getMessage(this.getClass(), "TableFilterNode.displayName.text");
} else {
return super.getDisplayName();
}
}
public void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo) {
/*
* Currently, child selection is only supported for nodes selected in
* the tree view and decorated with a DataResultFilterNode.
*/
if (getOriginal() instanceof DataResultFilterNode) {
((DataResultFilterNode) getOriginal()).setChildNodeSelectionInfo(selectedChildNodeInfo);
}
}
public NodeSelectionInfo getChildNodeSelectionInfo() {
/*
* Currently, child selection is only supported for nodes selected in
* the tree view and decorated with a DataResultFilterNode.
*/
if (getOriginal() instanceof DataResultFilterNode) {
return ((DataResultFilterNode) getOriginal()).getChildNodeSelectionInfo();
} else {
return null;
}
}
public String getColumnOrderKey() {
return columnOrderKey;
}
}

34
Core/src/org/sleuthkit/autopsy/md5search/DlgSearchChildren.java
View File

@ -1,34 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import java.util.List;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.autopsy.directorytree.DataResultFilterNode;
import org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent;
/**
* //DLG:
*/
class DlgSearchChildren extends Children.Keys<CorrelationAttributeInstance> {
DlgSearchChildren(boolean lazy, List<CorrelationAttributeInstance> fileList) {
super(lazy);
this.setKeys(fileList);
}
@Override
protected Node[] createNodes(CorrelationAttributeInstance t) {
//DLG:
Node[] node = new Node[1];
//DLG:
node[0] = new DlgCorrelationAttributeInstanceNode(t);
return node;
}
}

29
Core/src/org/sleuthkit/autopsy/md5search/DlgSearchNode.java
View File

@ -1,29 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import java.util.List;
import org.openide.nodes.AbstractNode;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
/**
* //DLG:
*/
class DlgSearchNode extends AbstractNode {
private DlgSearchChildren children;
DlgSearchNode(List<CorrelationAttributeInstance> keys) {
super(new DlgSearchChildren(true, keys));
this.children = (DlgSearchChildren) this.getChildren();
}
@Override
public String getName() {
//DLG:
return /*NbBundle.getMessage(this.getClass(), */"SearchNode.getName.text"/*)*/;
}
}

145
Core/src/org/sleuthkit/autopsy/md5search/Md5SearchDialog.form
View File

@ -1,145 +0,0 @@
<?xml version="1.0" encoding="UTF-8" ?>
<Form version="1.5" maxVersion="1.9" type="org.netbeans.modules.form.forminfo.JDialogFormInfo">
<Properties>
<Property name="defaultCloseOperation" type="int" value="2"/>
<Property name="resizable" type="boolean" value="false"/>
</Properties>
<SyntheticProperties>
<SyntheticProperty name="formSizePolicy" type="int" value="1"/>
<SyntheticProperty name="generateCenter" type="boolean" value="false"/>
</SyntheticProperties>
<AuxValues>
<AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/>
<AuxValue name="FormSettings_autoSetComponentName" type="java.lang.Boolean" value="false"/>
<AuxValue name="FormSettings_generateFQN" type="java.lang.Boolean" value="true"/>
<AuxValue name="FormSettings_generateMnemonicsCode" type="java.lang.Boolean" value="true"/>
<AuxValue name="FormSettings_i18nAutoMode" type="java.lang.Boolean" value="true"/>
<AuxValue name="FormSettings_layoutCodeTarget" type="java.lang.Integer" value="1"/>
<AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
<AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
<AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
</AuxValues>
<Layout>
<DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<EmptySpace min="-2" pref="11" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jButton1" alignment="1" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="1" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel2" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jLabel1" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" max="-2" attributes="0">
<Component id="correlationTypeComboBox" alignment="0" max="32767" attributes="0"/>
<Component id="jTextField1" alignment="0" min="-2" pref="250" max="-2" attributes="0"/>
</Group>
</Group>
<Component id="jScrollPane1" alignment="1" max="32767" attributes="0"/>
</Group>
<EmptySpace min="-2" max="-2" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="1" attributes="0">
<EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="jScrollPane1" max="32767" attributes="0"/>
<EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="jLabel1" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="jTextField1" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="correlationTypeComboBox" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="jLabel2" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/>
<Component id="jButton1" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
</Layout>
<SubComponents>
<Component class="javax.swing.JLabel" name="jLabel1">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/md5search/Bundle.properties" key="Md5SearchDialog.jLabel1.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JTextField" name="jTextField1">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/md5search/Bundle.properties" key="Md5SearchDialog.jTextField1.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="inputMethodTextChanged" listener="java.awt.event.InputMethodListener" parameters="java.awt.event.InputMethodEvent" handler="jTextField1InputMethodTextChanged"/>
<EventHandler event="propertyChange" listener="java.beans.PropertyChangeListener" parameters="java.beans.PropertyChangeEvent" handler="jTextField1PropertyChange"/>
</Events>
</Component>
<Component class="javax.swing.JButton" name="jButton1">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/md5search/Bundle.properties" key="Md5SearchDialog.jButton1.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="jButton1ActionPerformed"/>
</Events>
</Component>
<Component class="javax.swing.JComboBox" name="correlationTypeComboBox">
<Properties>
<Property name="model" type="javax.swing.ComboBoxModel" editor="org.netbeans.modules.form.editors2.ComboBoxModelEditor">
<StringArray count="0"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_TypeParameters" type="java.lang.String" value="&lt;String&gt;"/>
</AuxValues>
</Component>
<Component class="javax.swing.JLabel" name="jLabel2">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/md5search/Bundle.properties" key="Md5SearchDialog.jLabel2.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Container class="javax.swing.JScrollPane" name="jScrollPane1">
<AuxValues>
<AuxValue name="autoScrollPane" type="java.lang.Boolean" value="true"/>
</AuxValues>
<Layout class="org.netbeans.modules.form.compat2.layouts.support.JScrollPaneSupportLayout"/>
<SubComponents>
<Component class="javax.swing.JTextArea" name="jTextArea1">
<Properties>
<Property name="editable" type="boolean" value="false"/>
<Property name="columns" type="int" value="20"/>
<Property name="font" type="java.awt.Font" editor="org.netbeans.beaninfo.editors.FontEditor">
<Font name="Tahoma" size="11" style="0"/>
</Property>
<Property name="lineWrap" type="boolean" value="true"/>
<Property name="rows" type="int" value="5"/>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/md5search/Bundle.properties" key="Md5SearchDialog.jTextArea1.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
<Property name="wrapStyleWord" type="boolean" value="true"/>
<Property name="border" type="javax.swing.border.Border" editor="org.netbeans.modules.form.editors2.BorderEditor">
<Border info="null"/>
</Property>
<Property name="opaque" type="boolean" value="false"/>
</Properties>
</Component>
</SubComponents>
</Container>
</SubComponents>
</Form>

282
Core/src/org/sleuthkit/autopsy/md5search/Md5SearchDialog.java
View File

@ -1,282 +0,0 @@
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.sleuthkit.autopsy.md5search;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.concurrent.ExecutionException;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.swing.JFrame;
import javax.swing.SwingWorker;
import javax.swing.event.DocumentEvent;
import javax.swing.event.DocumentListener;
import org.openide.explorer.ExplorerManager;
import org.openide.nodes.AbstractNode;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle;
import org.openide.windows.WindowManager;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults;
import org.sleuthkit.autopsy.commonfilesearch.CommonAttributesSearchResultsViewerTable;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer;
import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent;
import org.sleuthkit.autopsy.corecomponents.DataResultViewerTable;
import org.sleuthkit.autopsy.directorytree.DataResultFilterNode;
/**
*
* @author dgrove
*/
public class Md5SearchDialog extends javax.swing.JDialog {
private static final String FILES_CORRELATION_TYPE = "Files";
private final List<CorrelationAttributeInstance.Type> correlationTypes;
private final Pattern md5Pattern;
/**
* Creates new form Md5SearchDialog
*/
@NbBundle.Messages({"Md5SearchDialog.title=Correlation Property Search"})
public Md5SearchDialog() {
super((JFrame) WindowManager.getDefault().getMainWindow(), Bundle.Md5SearchDialog_title(), true);
this.correlationTypes = new ArrayList<>();
this.md5Pattern = Pattern.compile("^[a-fA-F0-9]{32}$"); // NON-NLS
initComponents();
customizeComponents();
}
private void search() {
new SwingWorker<List<CorrelationAttributeInstance>, Void>() {
@Override
protected List<CorrelationAttributeInstance> doInBackground() {
List<CorrelationAttributeInstance.Type> correlationTypes;
List<CorrelationAttributeInstance> correlationInstances = new ArrayList<>();
try {
correlationTypes = EamDb.getInstance().getDefinedCorrelationTypes();
for (CorrelationAttributeInstance.Type type : correlationTypes) {
if (type.getId() == CorrelationAttributeInstance.FILES_TYPE_ID) {
correlationInstances = EamDb.getInstance().getArtifactInstancesByTypeValue(type, jTextField1.getText());
break;
}
}
} catch (Exception ex) {
//DLG:
}
return correlationInstances;
}
@Override
protected void done() {
try {
super.done();
List<CorrelationAttributeInstance> correlationInstances = this.get();
//DLG: Node rootNode = new CorrelationAttributeInstanceRootNode(searchResults);
//DataResultFilterNode dataResultFilterNode = new DataResultFilterNode(rootNode, ExplorerManager.find(Md5SearchDialog.this));
//TableFilterNode tableFilterWithDescendantsNode = new TableFilterNode(dataResultFilterNode, 3);
DataResultViewerTable table = new CommonAttributesSearchResultsViewerTable();
Collection<DataResultViewer> viewers = new ArrayList<>(1);
viewers.add(table);
DlgSearchNode searchNode = new DlgSearchNode(correlationInstances);
DlgFilterNode tableFilterNode = new DlgFilterNode(searchNode, true, searchNode.getName());
//Node rootNode;
//Children childNodes = Children.create(new CorrelationAttributeInstanceChildNodeFactory(correlationInstances), true);
//rootNode = new AbstractNode(childNodes);
DataResultTopComponent results = DataResultTopComponent.createInstance(
"Files", "Correlation Property Search", tableFilterNode, HIDE_ON_CLOSE, viewers);
} catch (InterruptedException ex) {
Exceptions.printStackTrace(ex); //DLG:
} catch (ExecutionException ex) {
Exceptions.printStackTrace(ex); //DLG:
}
}
}.execute();
}
/**
* This method is called from within the constructor to initialize the form.
* WARNING: Do NOT modify this code. The content of this method is always
* regenerated by the Form Editor.
*/
@SuppressWarnings("unchecked")
// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
private void initComponents() {
jLabel1 = new javax.swing.JLabel();
jTextField1 = new javax.swing.JTextField();
jButton1 = new javax.swing.JButton();
correlationTypeComboBox = new javax.swing.JComboBox<>();
jLabel2 = new javax.swing.JLabel();
jScrollPane1 = new javax.swing.JScrollPane();
jTextArea1 = new javax.swing.JTextArea();
setDefaultCloseOperation(javax.swing.WindowConstants.DISPOSE_ON_CLOSE);
setResizable(false);
org.openide.awt.Mnemonics.setLocalizedText(jLabel1, org.openide.util.NbBundle.getMessage(Md5SearchDialog.class, "Md5SearchDialog.jLabel1.text")); // NOI18N
jTextField1.setText(org.openide.util.NbBundle.getMessage(Md5SearchDialog.class, "Md5SearchDialog.jTextField1.text")); // NOI18N
jTextField1.addInputMethodListener(new java.awt.event.InputMethodListener() {
public void caretPositionChanged(java.awt.event.InputMethodEvent evt) {
}
public void inputMethodTextChanged(java.awt.event.InputMethodEvent evt) {
jTextField1InputMethodTextChanged(evt);
}
});
jTextField1.addPropertyChangeListener(new java.beans.PropertyChangeListener() {
public void propertyChange(java.beans.PropertyChangeEvent evt) {
jTextField1PropertyChange(evt);
}
});
org.openide.awt.Mnemonics.setLocalizedText(jButton1, org.openide.util.NbBundle.getMessage(Md5SearchDialog.class, "Md5SearchDialog.jButton1.text")); // NOI18N
jButton1.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
jButton1ActionPerformed(evt);
}
});
org.openide.awt.Mnemonics.setLocalizedText(jLabel2, org.openide.util.NbBundle.getMessage(Md5SearchDialog.class, "Md5SearchDialog.jLabel2.text")); // NOI18N
jTextArea1.setEditable(false);
jTextArea1.setColumns(20);
jTextArea1.setFont(new java.awt.Font("Tahoma", 0, 11)); // NOI18N
jTextArea1.setLineWrap(true);
jTextArea1.setRows(5);
jTextArea1.setText(org.openide.util.NbBundle.getMessage(Md5SearchDialog.class, "Md5SearchDialog.jTextArea1.text")); // NOI18N
jTextArea1.setWrapStyleWord(true);
jTextArea1.setBorder(null);
jTextArea1.setOpaque(false);
jScrollPane1.setViewportView(jTextArea1);
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(getContentPane());
getContentPane().setLayout(layout);
layout.setHorizontalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addGap(11, 11, 11)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(jButton1, javax.swing.GroupLayout.Alignment.TRAILING)
.addGroup(javax.swing.GroupLayout.Alignment.TRAILING, layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(jLabel2)
.addComponent(jLabel1))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING, false)
.addComponent(correlationTypeComboBox, javax.swing.GroupLayout.Alignment.LEADING, 0, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(jTextField1, javax.swing.GroupLayout.Alignment.LEADING, javax.swing.GroupLayout.PREFERRED_SIZE, 250, javax.swing.GroupLayout.PREFERRED_SIZE)))
.addComponent(jScrollPane1, javax.swing.GroupLayout.Alignment.TRAILING))
.addContainerGap())
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(javax.swing.GroupLayout.Alignment.TRAILING, layout.createSequentialGroup()
.addContainerGap()
.addComponent(jScrollPane1)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(jLabel1)
.addComponent(jTextField1, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(correlationTypeComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(jLabel2))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(jButton1)
.addContainerGap())
);
pack();
}// </editor-fold>//GEN-END:initComponents
private void jTextField1PropertyChange(java.beans.PropertyChangeEvent evt) {//GEN-FIRST:event_jTextField1PropertyChange
//DLG:
}//GEN-LAST:event_jTextField1PropertyChange
private void jButton1ActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_jButton1ActionPerformed
search();
}//GEN-LAST:event_jButton1ActionPerformed
private void jTextField1InputMethodTextChanged(java.awt.event.InputMethodEvent evt) {//GEN-FIRST:event_jTextField1InputMethodTextChanged
//DLG:
}//GEN-LAST:event_jTextField1InputMethodTextChanged
private void customizeComponents() {
jButton1.setEnabled(false);
correlationTypeComboBox.setEnabled(false);
/*
* Add correlation types to the combo-box.
*/
try {
EamDb dbManager = EamDb.getInstance();
correlationTypes.clear();
correlationTypes.addAll(dbManager.getDefinedCorrelationTypes());
} catch (EamDbException ex) {
Exceptions.printStackTrace(ex);
}
for (CorrelationAttributeInstance.Type type : correlationTypes) {
correlationTypeComboBox.addItem(type.getDisplayName());
}
/*
* Create listener for text input.
*/
jTextField1.getDocument().addDocumentListener(new DocumentListener() {
@Override
public void changedUpdate(DocumentEvent e) {
validateInput();
}
@Override
public void insertUpdate(DocumentEvent e) {
validateInput();
}
@Override
public void removeUpdate(DocumentEvent e) {
validateInput();
}
private void validateInput() {
Matcher matcher = md5Pattern.matcher(jTextField1.getText().trim());
if (matcher.find()) {
jButton1.setEnabled(true);
correlationTypeComboBox.setEnabled(true);
correlationTypeComboBox.setSelectedItem(FILES_CORRELATION_TYPE);
} else {
jButton1.setEnabled(false);
correlationTypeComboBox.setEnabled(false);
}
}
});
}
public void display() {
this.setLocationRelativeTo(WindowManager.getDefault().getMainWindow());
setVisible(true);
}
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JComboBox<String> correlationTypeComboBox;
private javax.swing.JButton jButton1;
private javax.swing.JLabel jLabel1;
private javax.swing.JLabel jLabel2;
private javax.swing.JScrollPane jScrollPane1;
private javax.swing.JTextArea jTextArea1;
private javax.swing.JTextField jTextField1;
// End of variables declaration//GEN-END:variables
}

4
Core/src/org/sleuthkit/autopsy/report/ReportWizardAction.java
View File

@ -50,8 +50,8 @@ import org.sleuthkit.datamodel.BlackboardArtifact;
@ActionID(category = "Tools", id = "org.sleuthkit.autopsy.report.ReportWizardAction") @ActionID(category = "Tools", id = "org.sleuthkit.autopsy.report.ReportWizardAction")
@ActionRegistration(displayName = "#CTL_ReportWizardAction", lazy = false) @ActionRegistration(displayName = "#CTL_ReportWizardAction", lazy = false)
@ActionReferences(value = { @ActionReferences(value = {
@ActionReference(path = "Menu/Tools", position = 103), @ActionReference(path = "Menu/Tools", position = 105),
@ActionReference(path = "Toolbars/Case", position = 103)}) @ActionReference(path = "Toolbars/Case", position = 105)})
public final class ReportWizardAction extends CallableSystemAction implements Presenter.Toolbar, ActionListener { public final class ReportWizardAction extends CallableSystemAction implements Presenter.Toolbar, ActionListener {
private final JButton toolbarButton = new JButton(); private final JButton toolbarButton = new JButton();

4
Experimental/src/org/sleuthkit/autopsy/experimental/autoingest/AutoIngestDashboardOpenAction.java
View File

@ -1,7 +1,7 @@
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2017 Basis Technology Corp. * Copyright 2017-2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
@ -28,7 +28,7 @@ import org.sleuthkit.autopsy.core.UserPreferences;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
@ActionID(category = "Tools", id = "org.sleuthkit.autopsy.experimental.autoingest.AutoIngestDashboardOpenAction") @ActionID(category = "Tools", id = "org.sleuthkit.autopsy.experimental.autoingest.AutoIngestDashboardOpenAction")
@ActionReference(path = "Menu/Tools", position = 104) @ActionReference(path = "Menu/Tools", position = 106)
@ActionRegistration(displayName = "#CTL_AutoIngestDashboardOpenAction", lazy = false) @ActionRegistration(displayName = "#CTL_AutoIngestDashboardOpenAction", lazy = false)
@Messages({"CTL_AutoIngestDashboardOpenAction=Auto Ingest Dashboard"}) @Messages({"CTL_AutoIngestDashboardOpenAction=Auto Ingest Dashboard"})
public final class AutoIngestDashboardOpenAction extends CallableSystemAction { public final class AutoIngestDashboardOpenAction extends CallableSystemAction {