mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-14 08:56:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #711 from bcarrier/develop

Browse Source 
Tree automatically refreshes results area.
This commit is contained in:
Brian Carrier 2014-05-09 00:24:49 -04:00
commit 20b59e23f4
31 changed files with 2150 additions and 2125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
Core/src/org/sleuthkit/autopsy/actions/TagAction.java
View File

@ -20,7 +20,8 @@ package org.sleuthkit.autopsy.actions;
import java.awt.event.ActionEvent;
import javax.swing.AbstractAction;
import org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
/**
@ -48,15 +49,11 @@ import org.sleuthkit.datamodel.BlackboardArtifact;
* or deleted outside of an actionPerformed() call.
*/
protected void refreshDirectoryTree() {
// The way the "directory tree" currently works, a new tags sub-tree
// needs to be made to reflect the results of invoking tag Actions. The
// way to do this is to call DirectoryTreeTopComponent.refreshTree(),
// which calls RootContentChildren.refreshKeys(BlackboardArtifact.ARTIFACT_TYPE... types)
// for the RootContentChildren object that is the child factory for the
// ResultsNode that is the root of the tags sub-tree. There is a switch
// statement in RootContentChildren.refreshKeys() that maps both
// BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE and BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT
// to making a call to refreshKey(TagsNodeKey).
DirectoryTreeTopComponent.findInstance().refreshTree(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE);
/* Note: this is a hack. In an ideal world, TagsManager would fire events so
* that the directory tree would refresh. But, we haven't had a chance to add
* that so, we fire these events and the tree refreshes based on them.
*/
IngestServices.getInstance().fireModuleDataEvent(new ModuleDataEvent("TagAction", BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE));
}
}

17
Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java
View File

@ -22,7 +22,6 @@ import org.openide.nodes.AbstractNode;
import org.openide.nodes.Children.Keys;
import org.openide.nodes.Node;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsRootNode;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.DerivedFile;
import org.sleuthkit.datamodel.Directory;
@ -119,8 +118,8 @@ abstract class AbstractContentChildren<T> extends Keys<T> {
static class CreateAutopsyNodeVisitor extends AutopsyItemVisitor.Default<AbstractNode> {
@Override
public ExtractedContentNode visit(ExtractedContent ec) {
return new ExtractedContentNode(ec.getSleuthkitCase());
public ExtractedContent.RootNode visit(ExtractedContent ec) {
return ec.new RootNode(ec.getSleuthkitCase());
}
@Override
@ -145,27 +144,27 @@ abstract class AbstractContentChildren<T> extends Keys<T> {
@Override
public AbstractNode visit(KeywordHits kh) {
return kh.new KeywordHitsRootNode();
return kh.new RootNode();
}
@Override
public AbstractNode visit(HashsetHits hh) {
return hh.new HashsetHitsRootNode();
return hh.new RootNode();
}
@Override
public AbstractNode visit(InterestingHits ih) {
return ih.new InterestingHitsRootNode();
return ih.new RootNode();
}
@Override
public AbstractNode visit(EmailExtracted ee) {
return ee.new EmailExtractedRootNode();
return ee.new RootNode();
}
@Override
public AbstractNode visit(TagsNodeKey tagsNodeKey) {
return new TagsNode();
public AbstractNode visit(Tags tagsNodeKey) {
return tagsNodeKey.new RootNode();
}
@Override

75
Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeChildren.java
View File

@ -1,75 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.util.List;
import java.util.logging.Level;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Node;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskException;
/**
*
* @author dfickling
*/
class ArtifactTypeChildren extends ChildFactory<BlackboardArtifact>{
private SleuthkitCase skCase;
private BlackboardArtifact.ARTIFACT_TYPE type;
public ArtifactTypeChildren(BlackboardArtifact.ARTIFACT_TYPE type, SleuthkitCase skCase) {
this.skCase = skCase;
this.type = type;
}
@Override
protected boolean createKeys(List<BlackboardArtifact> list) {
try {
List<BlackboardArtifact> arts = skCase.getBlackboardArtifacts(type.getTypeID());
//list.addAll(arts.subList(0, Math.min(arts.size(), getTypeLimit(type))));
list.addAll(arts);
} catch (TskException ex) {
Logger.getLogger(ArtifactTypeChildren.class.getName())
.log(Level.SEVERE, "Couldn't get blackboard artifacts from database", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact key){
return new BlackboardArtifactNode(key);
}
/**
private static int getTypeLimit(BlackboardArtifact.ARTIFACT_TYPE type) {
switch(type) {
case TSK_WEB_HISTORY:
return 1000000;
case TSK_WEB_COOKIE:
return 1000000;
default:
return 1000000;
}
}
*/
}

140
Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java
View File

@ -1,140 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.util.logging.Level;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.openide.nodes.Children;
import org.openide.nodes.Sheet;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskException;
/**
* Node encapsulating blackboard artifact type. This is used on the left-hand
* navigation side of the Autopsy UI as the parent node for all of the artifacts
* of a given type. Its children will be BlackboardArtifactNode objects.
*/
public class ArtifactTypeNode extends DisplayableItemNode {
private BlackboardArtifact.ARTIFACT_TYPE type;
private long childCount = 0;
ArtifactTypeNode(BlackboardArtifact.ARTIFACT_TYPE type, SleuthkitCase skCase) {
super(Children.create(new ArtifactTypeChildren(type, skCase), true), Lookups.singleton(type.getDisplayName()));
super.setName(type.getLabel());
// NOTE: This completely destroys our lazy-loading ideal
// a performance increase might be had by adding a
// "getBlackboardArtifactCount()" method to skCase
try {
this.childCount = skCase.getBlackboardArtifactsTypeCount(type.getTypeID());
} catch (TskException ex) {
Logger.getLogger(ArtifactTypeNode.class.getName())
.log(Level.WARNING, "Error getting child count", ex); //NON-NLS
}
super.setDisplayName(type.getDisplayName() + " (" + childCount + ")");
this.type = type;
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/" + getIcon(type)); //NON-NLS
}
@Override
protected Sheet createSheet() {
Sheet s = super.createSheet();
Sheet.Set ss = s.get(Sheet.PROPERTIES);
if (ss == null) {
ss = Sheet.createPropertiesSet();
s.put(ss);
}
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.name"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.displayName"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.desc"),
type.getDisplayName()));
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.name"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.displayName"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.desc"),
childCount));
return s;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
// @@@ TODO: Merge with BlackboartArtifactNode.getIcon()
private String getIcon(BlackboardArtifact.ARTIFACT_TYPE type) {
switch (type) {
case TSK_WEB_BOOKMARK:
return "bookmarks.png"; //NON-NLS
case TSK_WEB_COOKIE:
return "cookies.png"; //NON-NLS
case TSK_WEB_HISTORY:
return "history.png"; //NON-NLS
case TSK_WEB_DOWNLOAD:
return "downloads.png"; //NON-NLS
case TSK_INSTALLED_PROG:
return "programs.png"; //NON-NLS
case TSK_RECENT_OBJECT:
return "recent_docs.png"; //NON-NLS
case TSK_DEVICE_ATTACHED:
return "usb_devices.png"; //NON-NLS
case TSK_WEB_SEARCH_QUERY:
return "searchquery.png"; //NON-NLS
case TSK_METADATA_EXIF:
return "camera-icon-16.png"; //NON-NLS
case TSK_CONTACT:
return "contact.png"; //NON-NLS
case TSK_MESSAGE:
return "message.png"; //NON-NLS
case TSK_CALLLOG:
return "calllog.png"; //NON-NLS
case TSK_CALENDAR_ENTRY:
return "calendar.png"; //NON-NLS
case TSK_SPEED_DIAL_ENTRY:
return "speeddialentry.png"; //NON-NLS
case TSK_BLUETOOTH_PAIRING:
return "bluetooth.png"; //NON-NLS
case TSK_GPS_BOOKMARK:
return "gpsfav.png"; //NON-NLS
case TSK_GPS_LAST_KNOWN_LOCATION:
return "gps-lastlocation.png"; //NON-NLS
case TSK_GPS_SEARCH:
return "gps-search.png"; //NON-NLS
case TSK_SERVICE_ACCOUNT:
return "account-icon-16.png"; //NON-NLS
case TSK_ENCRYPTION_DETECTED:
return "encrypted-file.png"; //NON-NLS
case TSK_EXT_MISMATCH_DETECTED:
return "mismatch-16.png"; //NON-NLS
}
return "artifact-icon.png"; //NON-NLS
}
@Override
public boolean isLeafTypeNode() {
return true;
}
}

6
Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java
View File

@ -19,8 +19,6 @@
package org.sleuthkit.autopsy.datamodel;
/**
*
* @author dfickling
*/
interface AutopsyItemVisitor<T> {
@ -52,7 +50,7 @@ package org.sleuthkit.autopsy.datamodel;
T visit(EmailExtracted ee);
T visit(TagsNodeKey tagsNodeKey);
T visit(Tags tagsNodeKey);
T visit(InterestingHits ih);
@ -141,7 +139,7 @@ package org.sleuthkit.autopsy.datamodel;
}
@Override
public T visit(TagsNodeKey tagsNodeKey) {
public T visit(Tags tagsNodeKey) {
return defaultVisit(tagsNodeKey);
}

4
Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java
View File

@ -41,8 +41,8 @@ import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskException;
/**
* Node wrapping a blackboard artifact object. This represents a single artifact.
* Its parent is typically an ArtifactTypeNode.
* Node wrapping a blackboard artifact object. This is generated from several
* places in the tree.
*/
public class BlackboardArtifactNode extends DisplayableItemNode {

3
Core/src/org/sleuthkit/autopsy/datamodel/Bundle.properties
View File

@ -48,6 +48,9 @@ BlackboardArtifactTagNode.createSheet.unavail.text=Unavailable
BlackboardArtifactTagNode.createSheet.srcFilePath.text=Source File Path
BlackboardArtifactTagNode.createSheet.resultType.text=Result Type
BlackboardArtifactTagNode.createSheet.comment.text=Comment
BlackboardArtifactTagTypeNode.displayName.text=Result Tags
BlackboardArtifactTagTypeNode.createSheet.name.name=Name
BlackboardArtifactTagTypeNode.createSheet.name.displayName=Name
ContentTagNode.createSheet.file.name=File
ContentTagNode.createSheet.file.displayName=File
ContentTagNode.createSheet.unavail.path=Unavailable

491
Core/src/org/sleuthkit/autopsy/datamodel/Bundle_ja.properties
View File

@ -1,250 +1,253 @@
OpenIDE-Module-Name=\u30C7\u30FC\u30BF\u30E2\u30C7\u30EB
AbstractAbstractFileNode.nameColLbl=\u540D\u524D
AbstractAbstractFileNode.locationColLbl=\u30ED\u30B1\u30FC\u30B7\u30E7\u30F3
AbstractAbstractFileNode.modifiedTimeColLbl=\u4FEE\u6B63\u65E5\u6642
AbstractAbstractFileNode.changeTimeColLbl=\u5909\u66F4\u65E5\u6642
AbstractAbstractFileNode.accessTimeColLbl=\u30A2\u30AF\u30BB\u30B9\u65E5\u6642
AbstractAbstractFileNode.createdTimeColLbl=\u4F5C\u6210\u65E5\u6642
AbstractAbstractFileNode.sizeColLbl=\u30B5\u30A4\u30BA
AbstractAbstractFileNode.modeColLbl=\u30E2\u30FC\u30C9
AbstractAbstractFileNode.useridColLbl=\u30E6\u30FC\u30B6ID
AbstractAbstractFileNode.groupidColLbl=\u30B0\u30EB\u30FC\u30D7ID
AbstractAbstractFileNode.knownColLbl=\u65E2\u77E5
AbstractAbstractFileNode.inHashsetsColLbl=HashSet\u306B\u5B58\u5728
AbstractAbstractFileNode.md5HashColLbl=MD5\u30CF\u30C3\u30B7\u30E5
AbstractContentChildren.CreateTSKNodeVisitor.exception.noNodeMsg=\u6307\u5B9A\u3055\u308C\u305FSleuthkitItem\u306E\u30CE\u30FC\u30C9\u304C\u5B9A\u7FA9\u3055\u308C\u3066\u3044\u307E\u305B\u3093
AbstractContentChildren.createAutopsyNodeVisitor.exception.noNodeMsg=\u6307\u5B9A\u3055\u308C\u305F\u8868\u793A\u53EF\u80FD\u306A\u30A2\u30A4\u30C6\u30E0\u306E\u30CE\u30FC\u30C9\u304C\u5B9A\u7FA9\u3055\u308C\u3066\u3044\u307E\u305B\u3093
AbstractContentNode.exception.cannotChangeSysName.msg=\u30B7\u30B9\u30C6\u30E0\u540D\u3092\u5909\u66F4\u3067\u304D\u307E\u305B\u3093\u3002
AbstractFsContentNode.noDesc.text=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
ArtifactStringContent.getStr.srcFilePath.text=\u30BD\u30FC\u30B9\u30D5\u30A1\u30A4\u30EB\u30D1\u30B9
ArtifactStringContent.getStr.err=\u30B3\u30F3\u30C6\u30F3\u30C4\u53D6\u5F97\u30A8\u30E9\u30FC
ArtifactStringContent.exception.msg=\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u304B\u3089\u30D5\u30A1\u30A4\u30EB\u3092\u53D6\u5F97\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F
ArtifactTypeNode.createSheet.artType.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
ArtifactTypeNode.createSheet.childCnt.name=\u30C1\u30E3\u30A4\u30EB\u30C9\u6570
ArtifactTypeNode.createSheet.childCnt.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
BlackboardArtifactNode.noDesc.text=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
BlackboardArtifactNode.createSheet.srcFile.name=\u30BD\u30FC\u30B9\u30D5\u30A1\u30A4\u30EB
BlackboardArtifactNode.createSheet.srcFile.displayName=\u30BD\u30FC\u30B9\u30D5\u30A1\u30A4\u30EB
BlackboardArtifactNode.createSheet.ext.name=\u62E1\u5F35\u5B50
BlackboardArtifactNode.createSheet.ext.displayName=\u62E1\u5F35\u5B50
BlackboardArtifactNode.createSheet.mimeType.name=MIME\u30BF\u30A4\u30D7
BlackboardArtifactNode.createSheet.mimeType.displayName=MIME\u30BF\u30A4\u30D7
BlackboardArtifactNode.createSheet.filePath.name=\u30D5\u30A1\u30A4\u30EB\u30D1\u30B9
BlackboardArtifactNode.createSheet.filePath.displayName=\u30D5\u30A1\u30A4\u30EB\u30D1\u30B9
BlackboardArtifactNode.createSheet.dataSrc.name=\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9
BlackboardArtifactNode.createSheet.dataSrc.displayName=\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9
BlackboardArtifactNode.getAssocCont.exception.msg=\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u304B\u3089\u30D5\u30A1\u30A4\u30EB\u3092\u53D6\u5F97\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F
BlackboardArtifactTagNode.createSheet.srcFile.text=\u30BD\u30FC\u30B9\u30D5\u30A1\u30A4\u30EB
BlackboardArtifactTagNode.createSheet.unavail.text=\u4F7F\u7528\u3067\u304D\u307E\u305B\u3093
BlackboardArtifactTagNode.createSheet.srcFilePath.text=\u30BD\u30FC\u30B9\u30D5\u30A1\u30A4\u30EB\u30D1\u30B9
BlackboardArtifactTagNode.createSheet.resultType.text=\u7D50\u679C\u30BF\u30A4\u30D7
BlackboardArtifactTagNode.createSheet.comment.text=\u30B3\u30E1\u30F3\u30C8
ContentTagNode.createSheet.file.name=\u30D5\u30A1\u30A4\u30EB
ContentTagNode.createSheet.file.displayName=\u30D5\u30A1\u30A4\u30EB
ContentTagNode.createSheet.unavail.path=\u4F7F\u7528\u3067\u304D\u307E\u305B\u3093
ContentTagNode.createSheet.filePath.name=\u30D5\u30A1\u30A4\u30EB\u30D1\u30B9
ContentTagNode.createSheet.filePath.displayName=\u30D5\u30A1\u30A4\u30EB\u30D1\u30B9
ContentTagNode.createSheet.comment.name=\u30B3\u30E1\u30F3\u30C8
ContentTagNode.createSheet.comment.displayName=\u30B3\u30E1\u30F3\u30C8
ContentTagTypeNode.displayName.text=\u30D5\u30A1\u30A4\u30EB\u30BF\u30B0
ContentTagTypeNode.createSheet.name.name=\u540D\u524D
ContentTagTypeNode.createSheet.name.displayName=\u540D\u524D
ContentUtils.exception.msg={0}\u3092\u62BD\u51FA\u3067\u304D\u307E\u305B\u3093
DataModelActionsFactory.srcFileInDir.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5185\u306E\u30BD\u30FC\u30B9\u30D5\u30A1\u30A4\u30EB\u3092\u8868\u793A
DataModelActionsFactory.fileInDir.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5185\u306E\u30D5\u30A1\u30A4\u30EB\u3092\u8868\u793A
DataModelActionsFactory.viewNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
DataModelActionsFactory.openExtViewer.text=\u5916\u90E8\u30D3\u30E5\u30FC\u30A2\u306B\u8868\u793A
DataModelActionsFactory.srfFileSameMD5.text=\u540C\u3058MD5\u30CF\u30C3\u30B7\u30E5\u3092\u6301\u3064\u30D5\u30A1\u30A4\u30EB\u3092\u691C\u7D22
DataSourcesNode.name=\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9
DataSourcesNode.createSheet.name.name=\u540D\u524D
DataSourcesNode.createSheet.name.displayName=\u540D\u524D
DataSourcesNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
DeletedContent.fsDelFilter.text=\u30D5\u30A1\u30A4\u30EB\u30B7\u30B9\u30C6\u30E0
OpenIDE-Module-Name=\u30c7\u30fc\u30bf\u30e2\u30c7\u30eb
AbstractAbstractFileNode.nameColLbl=\u540d\u524d
AbstractAbstractFileNode.locationColLbl=\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3
AbstractAbstractFileNode.modifiedTimeColLbl=\u4fee\u6b63\u65e5\u6642
AbstractAbstractFileNode.changeTimeColLbl=\u5909\u66f4\u65e5\u6642
AbstractAbstractFileNode.accessTimeColLbl=\u30a2\u30af\u30bb\u30b9\u65e5\u6642
AbstractAbstractFileNode.createdTimeColLbl=\u4f5c\u6210\u65e5\u6642
AbstractAbstractFileNode.sizeColLbl=\u30b5\u30a4\u30ba
AbstractAbstractFileNode.modeColLbl=\u30e2\u30fc\u30c9
AbstractAbstractFileNode.useridColLbl=\u30e6\u30fc\u30b6ID
AbstractAbstractFileNode.groupidColLbl=\u30b0\u30eb\u30fc\u30d7ID
AbstractAbstractFileNode.knownColLbl=\u65e2\u77e5
AbstractAbstractFileNode.inHashsetsColLbl=HashSet\u306b\u5b58\u5728
AbstractAbstractFileNode.md5HashColLbl=MD5\u30cf\u30c3\u30b7\u30e5
AbstractContentChildren.CreateTSKNodeVisitor.exception.noNodeMsg=\u6307\u5b9a\u3055\u308c\u305fSleuthkitItem\u306e\u30ce\u30fc\u30c9\u304c\u5b9a\u7fa9\u3055\u308c\u3066\u3044\u307e\u305b\u3093
AbstractContentChildren.createAutopsyNodeVisitor.exception.noNodeMsg=\u6307\u5b9a\u3055\u308c\u305f\u8868\u793a\u53ef\u80fd\u306a\u30a2\u30a4\u30c6\u30e0\u306e\u30ce\u30fc\u30c9\u304c\u5b9a\u7fa9\u3055\u308c\u3066\u3044\u307e\u305b\u3093
AbstractContentNode.exception.cannotChangeSysName.msg=\u30b7\u30b9\u30c6\u30e0\u540d\u3092\u5909\u66f4\u3067\u304d\u307e\u305b\u3093\u3002
AbstractFsContentNode.noDesc.text=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
ArtifactStringContent.getStr.srcFilePath.text=\u30bd\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9
ArtifactStringContent.getStr.err=\u30b3\u30f3\u30c6\u30f3\u30c4\u53d6\u5f97\u30a8\u30e9\u30fc
ArtifactStringContent.exception.msg=\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f
ArtifactTypeNode.createSheet.artType.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
ArtifactTypeNode.createSheet.childCnt.name=\u30c1\u30e3\u30a4\u30eb\u30c9\u6570
ArtifactTypeNode.createSheet.childCnt.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
BlackboardArtifactNode.noDesc.text=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
BlackboardArtifactNode.createSheet.srcFile.name=\u30bd\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb
BlackboardArtifactNode.createSheet.srcFile.displayName=\u30bd\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb
BlackboardArtifactNode.createSheet.ext.name=\u62e1\u5f35\u5b50
BlackboardArtifactNode.createSheet.ext.displayName=\u62e1\u5f35\u5b50
BlackboardArtifactNode.createSheet.mimeType.name=MIME\u30bf\u30a4\u30d7
BlackboardArtifactNode.createSheet.mimeType.displayName=MIME\u30bf\u30a4\u30d7
BlackboardArtifactNode.createSheet.filePath.name=\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9
BlackboardArtifactNode.createSheet.filePath.displayName=\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9
BlackboardArtifactNode.createSheet.dataSrc.name=\u30c7\u30fc\u30bf\u30bd\u30fc\u30b9
BlackboardArtifactNode.createSheet.dataSrc.displayName=\u30c7\u30fc\u30bf\u30bd\u30fc\u30b9
BlackboardArtifactNode.getAssocCont.exception.msg=\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f
BlackboardArtifactTagNode.createSheet.srcFile.text=\u30bd\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb
BlackboardArtifactTagNode.createSheet.unavail.text=\u4f7f\u7528\u3067\u304d\u307e\u305b\u3093
BlackboardArtifactTagNode.createSheet.srcFilePath.text=\u30bd\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9
BlackboardArtifactTagNode.createSheet.resultType.text=\u7d50\u679c\u30bf\u30a4\u30d7
BlackboardArtifactTagNode.createSheet.comment.text=\u30b3\u30e1\u30f3\u30c8
BlackboardArtifactTagTypeNode.displayName.text=\u7d50\u679c\u30bf\u30b0
BlackboardArtifactTagTypeNode.createSheet.name.name=\u540d\u524d
BlackboardArtifactTagTypeNode.createSheet.name.displayName=\u540d\u524d
ContentTagNode.createSheet.file.name=\u30d5\u30a1\u30a4\u30eb
ContentTagNode.createSheet.file.displayName=\u30d5\u30a1\u30a4\u30eb
ContentTagNode.createSheet.unavail.path=\u4f7f\u7528\u3067\u304d\u307e\u305b\u3093
ContentTagNode.createSheet.filePath.name=\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9
ContentTagNode.createSheet.filePath.displayName=\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9
ContentTagNode.createSheet.comment.name=\u30b3\u30e1\u30f3\u30c8
ContentTagNode.createSheet.comment.displayName=\u30b3\u30e1\u30f3\u30c8
ContentTagTypeNode.displayName.text=\u30d5\u30a1\u30a4\u30eb\u30bf\u30b0
ContentTagTypeNode.createSheet.name.name=\u540d\u524d
ContentTagTypeNode.createSheet.name.displayName=\u540d\u524d
ContentUtils.exception.msg={0}\u3092\u62bd\u51fa\u3067\u304d\u307e\u305b\u3093
DataModelActionsFactory.srcFileInDir.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306e\u30bd\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a
DataModelActionsFactory.fileInDir.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a
DataModelActionsFactory.viewNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
DataModelActionsFactory.openExtViewer.text=\u5916\u90e8\u30d3\u30e5\u30fc\u30a2\u306b\u8868\u793a
DataModelActionsFactory.srfFileSameMD5.text=\u540c\u3058MD5\u30cf\u30c3\u30b7\u30e5\u3092\u6301\u3064\u30d5\u30a1\u30a4\u30eb\u3092\u691c\u7d22
DataSourcesNode.name=\u30c7\u30fc\u30bf\u30bd\u30fc\u30b9
DataSourcesNode.createSheet.name.name=\u540d\u524d
DataSourcesNode.createSheet.name.displayName=\u540d\u524d
DataSourcesNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
DeletedContent.fsDelFilter.text=\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0
DeletedContent.allDelFilter.text=\u3059\u3079\u3066
DeletedContent.deletedContentsNode.name=\u524A\u9664\u3055\u308C\u305F\u30D5\u30A1\u30A4\u30EB
DeletedContent.createSheet.name.name=\u540D\u524D
DeletedContent.createSheet.name.displayName=\u540D\u524D
DeletedContent.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
DeletedContent.createSheet.filterType.name=\u30D5\u30A1\u30A4\u30EB\u30BF\u30BF\u30A4\u30D7
DeletedContent.createSheet.filterType.displayName=\u30D5\u30A3\u30EB\u30BF\u30BF\u30A4\u30D7
DeletedContent.createSheet.filterType.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
DeletedContent.createKeys.maxObjects.msg=\u8868\u793A\u53EF\u80FD\u306A\u6570\u3088\u308A\u3082\u591A\u304F\u306E\u524A\u9664\u3055\u308C\u305F\u30D5\u30A1\u30A4\u30EB\u304C\u5B58\u5728\u3057\u307E\u3059\u3002\u6700\u521D\u306E{0}\u306E\u524A\u9664\u3055\u308C\u305F\u30D5\u30A1\u30A4\u30EB\u304C\u8868\u793A\u3055\u308C\u307E\u3059\u3002
DeletedContent.createNodeForKey.typeNotSupported.msg=\u3053\u306E\u30BF\u30A4\u30D7\u306E\u8868\u793A\u53EF\u80FD\u306A\u30A2\u30A4\u30C6\u30E0\u306F\u30B5\u30DD\u30FC\u30C8\u3055\u308C\u3066\u3044\u307E\u305B\u3093\uFF1A{0}
DirectoryNode.parFolder.text=[\u30DA\u30A2\u30EC\u30F3\u30C8\u30D5\u30A9\u30EB\u30C0]
DirectoryNode.curFolder.text=[\u73FE\u5728\u306E\u30D5\u30A9\u30EB\u30C0]
DirectoryNode.getActions.viewFileInDir.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5185\u306E\u30D5\u30A1\u30A4\u30EB\u3092\u8868\u793A
DirectoryNode.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
EmailExtracted.mailAccount.text=\u30A2\u30AB\u30A6\u30F3\u30C8
EmailExtracted.mailFolder.text=\u30D5\u30A9\u30EB\u30C0
EmailExtracted.defaultAcct.text=\u30C7\u30D5\u30A9\u30EB\u30C8
EmailExtracted.defaultFolder.text=\u30C7\u30D5\u30A9\u30EB\u30C8
EmailExtracted.createSheet.name.name=\u540D\u524D
EmailExtracted.createSheet.name.displayName=\u540D\u524D
EmailExtracted.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
ExtractedContentNode.name.text=\u62BD\u51FA\u3055\u308C\u305F\u30B3\u30F3\u30C6\u30F3\u30C4
ExtractedContentNode.createSheet.name.name=\u540D\u524D
ExtractedContentNode.createSheet.name.displayName=\u540D\u524D
ExtractedContentNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
FileNode.viewFileInDir.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5185\u306E\u30D5\u30A1\u30A4\u30EB\u3092\u8868\u793A
FileNode.getActions.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
FileNode.getActions.openInExtViewer.text=\u5916\u90E8\u30D3\u30E5\u30FC\u30A2\u3067\u958B\u304F
FileNode.getActions.searchFilesSameMD5.text=\u540C\u3058MD5\u30CF\u30C3\u30B7\u30E5\u3092\u6301\u3064\u30D5\u30A1\u30A4\u30EB\u3092\u691C\u7D22
FileSize.fileSizeRootNode.name=\u30D5\u30A1\u30A4\u30EB\u30B5\u30A4\u30BA
FileSize.createSheet.name.name=\u540D\u524D
FileSize.createSheet.name.displayName=\u540D\u524D
FileSize.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
FileSize.createSheet.filterType.name=\u30D5\u30A3\u30EB\u30BF\u30BF\u30A4\u30D7
FileSize.createSheet.filterType.displayName=\u30D5\u30A3\u30EB\u30BF\u30BF\u30A4\u30D7
FileSize.createSheet.filterType.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
FileSize.exception.notSupported.msg=\u3053\u306E\u30BF\u30A4\u30D7\u306E\u8868\u793A\u53EF\u80FD\u306A\u30A2\u30A4\u30C6\u30E0\u306F\u30B5\u30DD\u30FC\u30C8\u3055\u308C\u3066\u3044\u307E\u305B\u3093\uFF1A{0}
FileTypeChildren.exception.notSupported.msg=\u3053\u306E\u30BF\u30A4\u30D7\u306E\u8868\u793A\u53EF\u80FD\u306A\u30A2\u30A4\u30C6\u30E0\u306F\u30B5\u30DD\u30FC\u30C8\u3055\u308C\u3066\u3044\u307E\u305B\u3093\uFF1A{0}
FileTypeExtensionFilters.tskImgFilter.text=\u30A4\u30E1\u30FC\u30B8
FileTypeExtensionFilters.tskVideoFilter.text=\u30D3\u30C7\u30AA
FileTypeExtensionFilters.tskAudioFilter.text=\u30AA\u30FC\u30C7\u30A3\u30AA
FileTypeExtensionFilters.tskArchiveFilter.text=\u30A2\u30FC\u30AB\u30A4\u30D6
FileTypeExtensionFilters.tskDocumentFilter.text=\u30C9\u30AD\u30E5\u30E1\u30F3\u30C8
FileTypeExtensionFilters.tskExecFilter.text=\u5B9F\u884C\u53EF\u80FD
DeletedContent.deletedContentsNode.name=\u524a\u9664\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb
DeletedContent.createSheet.name.name=\u540d\u524d
DeletedContent.createSheet.name.displayName=\u540d\u524d
DeletedContent.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
DeletedContent.createSheet.filterType.name=\u30d5\u30a1\u30a4\u30eb\u30bf\u30bf\u30a4\u30d7
DeletedContent.createSheet.filterType.displayName=\u30d5\u30a3\u30eb\u30bf\u30bf\u30a4\u30d7
DeletedContent.createSheet.filterType.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
DeletedContent.createKeys.maxObjects.msg=\u8868\u793a\u53ef\u80fd\u306a\u6570\u3088\u308a\u3082\u591a\u304f\u306e\u524a\u9664\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u304c\u5b58\u5728\u3057\u307e\u3059\u3002\u6700\u521d\u306e{0}\u306e\u524a\u9664\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002
DeletedContent.createNodeForKey.typeNotSupported.msg=\u3053\u306e\u30bf\u30a4\u30d7\u306e\u8868\u793a\u53ef\u80fd\u306a\u30a2\u30a4\u30c6\u30e0\u306f\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u307e\u305b\u3093\uff1a{0}
DirectoryNode.parFolder.text=[\u30da\u30a2\u30ec\u30f3\u30c8\u30d5\u30a9\u30eb\u30c0]
DirectoryNode.curFolder.text=[\u73fe\u5728\u306e\u30d5\u30a9\u30eb\u30c0]
DirectoryNode.getActions.viewFileInDir.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a
DirectoryNode.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
EmailExtracted.mailAccount.text=\u30a2\u30ab\u30a6\u30f3\u30c8
EmailExtracted.mailFolder.text=\u30d5\u30a9\u30eb\u30c0
EmailExtracted.defaultAcct.text=\u30c7\u30d5\u30a9\u30eb\u30c8
EmailExtracted.defaultFolder.text=\u30c7\u30d5\u30a9\u30eb\u30c8
EmailExtracted.createSheet.name.name=\u540d\u524d
EmailExtracted.createSheet.name.displayName=\u540d\u524d
EmailExtracted.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
ExtractedContentNode.name.text=\u62bd\u51fa\u3055\u308c\u305f\u30b3\u30f3\u30c6\u30f3\u30c4
ExtractedContentNode.createSheet.name.name=\u540d\u524d
ExtractedContentNode.createSheet.name.displayName=\u540d\u524d
ExtractedContentNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
FileNode.viewFileInDir.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a
FileNode.getActions.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
FileNode.getActions.openInExtViewer.text=\u5916\u90e8\u30d3\u30e5\u30fc\u30a2\u3067\u958b\u304f
FileNode.getActions.searchFilesSameMD5.text=\u540c\u3058MD5\u30cf\u30c3\u30b7\u30e5\u3092\u6301\u3064\u30d5\u30a1\u30a4\u30eb\u3092\u691c\u7d22
FileSize.fileSizeRootNode.name=\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba
FileSize.createSheet.name.name=\u540d\u524d
FileSize.createSheet.name.displayName=\u540d\u524d
FileSize.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
FileSize.createSheet.filterType.name=\u30d5\u30a3\u30eb\u30bf\u30bf\u30a4\u30d7
FileSize.createSheet.filterType.displayName=\u30d5\u30a3\u30eb\u30bf\u30bf\u30a4\u30d7
FileSize.createSheet.filterType.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
FileSize.exception.notSupported.msg=\u3053\u306e\u30bf\u30a4\u30d7\u306e\u8868\u793a\u53ef\u80fd\u306a\u30a2\u30a4\u30c6\u30e0\u306f\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u307e\u305b\u3093\uff1a{0}
FileTypeChildren.exception.notSupported.msg=\u3053\u306e\u30bf\u30a4\u30d7\u306e\u8868\u793a\u53ef\u80fd\u306a\u30a2\u30a4\u30c6\u30e0\u306f\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u307e\u305b\u3093\uff1a{0}
FileTypeExtensionFilters.tskImgFilter.text=\u30a4\u30e1\u30fc\u30b8
FileTypeExtensionFilters.tskVideoFilter.text=\u30d3\u30c7\u30aa
FileTypeExtensionFilters.tskAudioFilter.text=\u30aa\u30fc\u30c7\u30a3\u30aa
FileTypeExtensionFilters.tskArchiveFilter.text=\u30a2\u30fc\u30ab\u30a4\u30d6
FileTypeExtensionFilters.tskDocumentFilter.text=\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8
FileTypeExtensionFilters.tskExecFilter.text=\u5b9f\u884c\u53ef\u80fd
FileTypeExtensionFilters.autDocHtmlFilter.text=HTML
FileTypeExtensionFilters.autDocOfficeFilter.text=\u30AA\u30D5\u30A3\u30B9
FileTypeExtensionFilters.autDocOfficeFilter.text=\u30aa\u30d5\u30a3\u30b9
FileTypeExtensionFilters.autoDocPdfFilter.text=PDF
FileTypeExtensionFilters.autDocTxtFilter.text=\u30D7\u30EC\u30FC\u30F3\u30C6\u30AD\u30B9\u30C8
FileTypeExtensionFilters.autDocRtfFilter.text=\u30EA\u30C3\u30C1\u30C6\u30AD\u30B9\u30C8
FileTypeNode.createSheet.filterType.name=\u30D5\u30A3\u30EB\u30BF\u30BF\u30A4\u30D7
FileTypeNode.createSheet.filterType.displayName=\u30D5\u30A3\u30EB\u30BF\u30BF\u30A4\u30D7
FileTypeNode.createSheet.filterType.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
FileTypeNode.createSheet.fileExt.name=\u30D5\u30A1\u30A4\u30EB\u62E1\u5F35\u5B50
FileTypeNode.createSheet.fileExt.displayName=\u30D5\u30A1\u30A4\u30EB\u62E1\u5F35\u5B50
FileTypeNode.createSheet.fileExt.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
FileTypesNode.fname.text=\u30D5\u30A1\u30A4\u30EB\u30BF\u30A4\u30D7
FileTypesNode.createSheet.name.name=\u540D\u524D
FileTypesNode.createSheet.name.displayName=\u540D\u524D
FileTypesNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
HashsetHits.createSheet.name.name=\u540D\u524D
HashsetHits.createSheet.name.displayName=\u540D\u524D
HashsetHits.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
ImageNode.getActions.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
ImageNode.getActions.openFileSearchByAttr.text=\u5C5E\u6027\u306B\u3088\u308B\u30D5\u30A1\u30A4\u30EB\u691C\u7D22\u3092\u958B\u304F
ImageNode.createSheet.name.name=\u540D\u524D
ImageNode.createSheet.name.displayName=\u540D\u524D
ImageNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
Installer.exception.tskVerStringNull.msg=Sleuth Kit JNI\u30C6\u30B9\u30C8\u30B3\u30FC\u30EB\u3067\u306F\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u305B\u3093\u3067\u3057\u305F\u304C\u3001\u30D0\u30FC\u30B8\u30E7\u30F3\u30B9\u30C8\u30EA\u30F3\u30B0\u306F\u30CC\u30EB\u3067\u3057\u305F\uFF01
Installer.tskLibErr.msg=Sleuth Kit JNI\u306B\u554F\u984C\u304C\u767A\u751F\u3057\u307E\u3057\u305F\u3002\u30C6\u30B9\u30C8\u30B3\u30FC\u30EB\u304C\u5931\u6557\u3057\u307E\u3057\u305F\uFF1A\
FileTypeExtensionFilters.autDocTxtFilter.text=\u30d7\u30ec\u30fc\u30f3\u30c6\u30ad\u30b9\u30c8
FileTypeExtensionFilters.autDocRtfFilter.text=\u30ea\u30c3\u30c1\u30c6\u30ad\u30b9\u30c8
FileTypeNode.createSheet.filterType.name=\u30d5\u30a3\u30eb\u30bf\u30bf\u30a4\u30d7
FileTypeNode.createSheet.filterType.displayName=\u30d5\u30a3\u30eb\u30bf\u30bf\u30a4\u30d7
FileTypeNode.createSheet.filterType.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
FileTypeNode.createSheet.fileExt.name=\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50
FileTypeNode.createSheet.fileExt.displayName=\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50
FileTypeNode.createSheet.fileExt.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
FileTypesNode.fname.text=\u30d5\u30a1\u30a4\u30eb\u30bf\u30a4\u30d7
FileTypesNode.createSheet.name.name=\u540d\u524d
FileTypesNode.createSheet.name.displayName=\u540d\u524d
FileTypesNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
HashsetHits.createSheet.name.name=\u540d\u524d
HashsetHits.createSheet.name.displayName=\u540d\u524d
HashsetHits.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
ImageNode.getActions.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
ImageNode.getActions.openFileSearchByAttr.text=\u5c5e\u6027\u306b\u3088\u308b\u30d5\u30a1\u30a4\u30eb\u691c\u7d22\u3092\u958b\u304f
ImageNode.createSheet.name.name=\u540d\u524d
ImageNode.createSheet.name.displayName=\u540d\u524d
ImageNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
Installer.exception.tskVerStringNull.msg=Sleuth Kit JNI\u30c6\u30b9\u30c8\u30b3\u30fc\u30eb\u3067\u306f\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u305b\u3093\u3067\u3057\u305f\u304c\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u30b9\u30c8\u30ea\u30f3\u30b0\u306f\u30cc\u30eb\u3067\u3057\u305f\uff01
Installer.tskLibErr.msg=Sleuth Kit JNI\u306b\u554f\u984c\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u30c6\u30b9\u30c8\u30b3\u30fc\u30eb\u304c\u5931\u6557\u3057\u307e\u3057\u305f\uff1a\
\
\u8A73\u7D30\uFF1A {0}
Installer.tskLibErr.err=\u81F4\u547D\u7684\u30A8\u30E9\u30FC\uFF1A
InterestingHits.interestingItems.text=\u7591\u308F\u3057\u3044\u30A2\u30A4\u30C6\u30E0
InterestingHits.displayName.text=\u7591\u308F\u3057\u3044\u30A2\u30A4\u30C6\u30E0
InterestingHits.createSheet.name.name=\u540D\u524D
InterestingHits.createSheet.name.displayName=\u540D\u524D
InterestingHits.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
KeyValueNode.createSheet.name.name=\u540D\u524D
KeyValueNode.createSheet.name.displayName=\u540D\u524D
KeyValueNode.createSheet.name.desc=\u8A72\u5F53\u306A\u3057
KeyValueNode.createSheet.map.desc=\u8A72\u5F53\u306A\u3057
KeywordHits.kwHits.text=\u30AD\u30FC\u30EF\u30FC\u30C9\u30D2\u30C3\u30C8
KeywordHits.createSheet.name.name=\u540D\u524D
KeywordHits.createSheet.name.displayName=\u540D\u524D
KeywordHits.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
KeywordHits.createSheet.listName.name=\u30EA\u30B9\u30C8\u540D
KeywordHits.createSheet.listName.displayName=\u30EA\u30B9\u30C8\u540D
KeywordHits.createSheet.listName.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
KeywordHits.createSheet.numChildren.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
KeywordHits.createSheet.filesWithHits.name=\u30D2\u30C3\u30C8\u3057\u305F\u30D5\u30A1\u30A4\u30EB
KeywordHits.createSheet.filesWithHits.displayName=\u30D2\u30C3\u30C8\u3057\u305F\u30D5\u30A1\u30A4\u30EB
KeywordHits.createSheet.filesWithHits.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
KeywordHits.createNodeForKey.modTime.displayName=\u4FEE\u6B63\u65E5\u6642
KeywordHits.createNodeForKey.modTime.desc=\u4FEE\u6B63\u65E5\u6642
KeywordHits.createNodeForKey.accessTime.displayName=\u30A2\u30AF\u30BB\u30B9\u65E5\u6642
KeywordHits.createNodeForKey.accessTime.desc=\u30A2\u30AF\u30BB\u30B9\u65E5\u6642
KeywordHits.createNodeForKey.chgTime.displayName=\u5909\u66F4\u65E5\u6642
KeywordHits.createNodeForKey.chgTime.desc=\u5909\u66F4\u65E5\u6642
KeywordHits.createNodeForKey.chgTime.name=\u5909\u66F4\u65E5\u6642
KeywordHits.createNodeForKey.accessTime.name=\u30A2\u30AF\u30BB\u30B9\u65E5\u6642
KeywordHits.createNodeForKey.modTime.name=\u4FEE\u6B63\u65E5\u6642
KnownFileFilterNode.selectionContext.dataSources=\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9
KnownFileFilterNode.selectionContext.views=\u30D3\u30E5\u30FC
LayoutFileNode.propertyType.parts=\u30D1\u30FC\u30C4
LayoutFileNode.createSheet.name.name=\u540D\u524D
LayoutFileNode.createSheet.name.displayName=\u540D\u524D
LayoutFileNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
LayoutFileNode.createSheet.noDescr.text=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
LayoutFileNode.getActions.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u3067\u8868\u793A
LayoutFileNode.getActions.openInExtViewer.text=\u5916\u90E8\u30D3\u30E5\u30FC\u30A2\u3067\u958B\u304F
LocalFileNode.createSheet.name.name=\u540D\u524D
LocalFileNode.createSheet.name.displayName=\u540D\u524D
LocalFileNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
LocalFileNode.createSheet.noDescr.text=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
LocalFileNode.getActions.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
LocalFileNode.getActions.openInExtViewer.text=\u5916\u90E8\u30D3\u30E5\u30FC\u30A2\u3067\u958B\u304F
LocalFileNode.getActions.searchFilesSameMd5.text=\u540C\u3058MD5\u30CF\u30C3\u30B7\u30E5\u3092\u6301\u3064\u30D5\u30A1\u30A4\u30EB\u3092\u691C\u7D22
RecentFiles.aut0DayFilter.displayName.text=\u6700\u7D42\u65E5
RecentFiles.aut1dayFilter.displayName.text=\u6700\u7D42\u65E5 - 1
RecentFiles.aut2dayFilter.displayName.text=\u6700\u7D42\u65E5 - \uFF12
RecentFiles.aut3dayFilter.displayName.text=\u6700\u7D42\u65E5 - \uFF13
RecentFiles.aut4dayFilter.displayName.text=\u6700\u7D42\u65E5 - \uFF14
RecentFiles.aut5dayFilter.displayName.text=\u6700\u7D42\u65E5 - \uFF15
RecentFiles.aut6dayFilter.displayName.text=\u6700\u7D42\u65E5 - \uFF16
RecentFilesFilterChildren.exception.defaultVisit.msg=\u3053\u306E\u30BF\u30A4\u30D7\u306E\u8868\u793A\u3067\u304D\u308B\u30A2\u30A4\u30C6\u30E0
Installer.exception.taskVerStringBang.msg=Sleuth Kit JNI\u30C6\u30B9\u30C8\u30B3\u30FC\u30EB\u3067\u306F\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u305B\u3093\u3067\u3057\u305F\u304C\u3001\u30D0\u30FC\u30B8\u30E7\u30F3\u30B9\u30C8\u30EA\u30F3\u30B0\u306F""\u3067\u3057\u305F\uFF01
RecentFilesFilterNode.createSheet.filterType.name=\u30D5\u30A3\u30EB\u30BF\u30BF\u30A4\u30D7
RecentFilesFilterNode.createSheet.filterType.displayName=\u30D5\u30A3\u30EB\u30BF\u30BF\u30A4\u30D7
RecentFilesFilterNode.createSheet.filterType.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
RecentFilesNode.createSheet.name.name=\u540D\u524D
RecentFilesNode.createSheet.name.displayName=\u540D\u524D
RecentFilesNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
RecentFilesNode.name.text=\u6700\u8FD1\u4F7F\u7528\u3055\u308C\u305F\u30D5\u30A1\u30A4\u30EB
ResultsNode.name.text=\u7D50\u679C
ResultsNode.createSheet.name.name=\u540D\u524D
ResultsNode.createSheet.name.displayName=\u540D\u524D
ResultsNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
TagNameNode.namePlusTags.text={0}\u30BF\u30B0
TagNameNode.contentTagTypeNodeKey.text=\u30B3\u30F3\u30C6\u30F3\u30C4\u30BF\u30B0
TagNameNode.bbArtTagTypeNodeKey.text=\u7D50\u679C\u30BF\u30B0
TagNameNode.bookmark.text=\u30D6\u30C3\u30AF\u30DE\u30FC\u30AF
TagNameNode.createSheet.name.name=\u540D\u524D
TagNameNode.createSheet.name.displayName=\u540D\u524D
TagsNode.displayName.text=\u30BF\u30B0
TagsNode.createSheet.name.name=\u540D\u524D
AbstractAbstractFileNode.flagsDirColLbl=\u30D5\u30E9\u30B0\uFF08\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\uFF09
AbstractAbstractFileNode.flagsMetaColLbl=\u30D5\u30E9\u30B0\uFF08\u30E1\u30BF\u30C7\u30FC\u30BF\uFF09
AbstractAbstractFileNode.metaAddrColLbl=\u30E1\u30BF\u30C7\u30FC\u30BF\u30A2\u30C9\u30EC\u30B9
AbstractAbstractFileNode.attrAddrColLbl=\u5C5E\u6027\u30A2\u30C9\u30EC\u30B9
AbstractAbstractFileNode.typeDirColLbl=\u30BF\u30A4\u30D7\uFF08\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\uFF09
AbstractAbstractFileNode.typeMetaColLbl=\u30BF\u30A4\u30D7\uFF08\u30E1\u30BF\u30C7\u30FC\u30BF\uFF09
ArtifactTypeNode.createSheet.childCnt.displayName=\u30C1\u30E3\u30A4\u30EB\u30C9\u6570
TagsNode.createSheet.name.displayName=\u540D\u524D
ViewsNode.name.text=\u30D3\u30E5\u30FC
ViewsNode.createSheet.name.name=\u540D\u524D
ViewsNode.createSheet.name.displayName=\u540D\u524D
ViewsNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
VirtualDirectoryNode.getActions.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
VirtualDirectoryNode.createSheet.name.name=\u540D\u524D
VirtualDirectoryNode.createSheet.name.displayName=\u540D\u524D
VirtualDirectoryNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
VirtualDirectoryNode.createSheet.noDesc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
VolumeNode.getActions.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
VolumeNode.createSheet.name.name=\u540D\u524D
VolumeNode.createSheet.name.displayName=\u540D\u524D
VolumeNode.createSheet.name.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
\u8a73\u7d30\uff1a {0}
Installer.tskLibErr.err=\u81f4\u547d\u7684\u30a8\u30e9\u30fc\uff1a
InterestingHits.interestingItems.text=\u7591\u308f\u3057\u3044\u30a2\u30a4\u30c6\u30e0
InterestingHits.displayName.text=\u7591\u308f\u3057\u3044\u30a2\u30a4\u30c6\u30e0
InterestingHits.createSheet.name.name=\u540d\u524d
InterestingHits.createSheet.name.displayName=\u540d\u524d
InterestingHits.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
KeyValueNode.createSheet.name.name=\u540d\u524d
KeyValueNode.createSheet.name.displayName=\u540d\u524d
KeyValueNode.createSheet.name.desc=\u8a72\u5f53\u306a\u3057
KeyValueNode.createSheet.map.desc=\u8a72\u5f53\u306a\u3057
KeywordHits.kwHits.text=\u30ad\u30fc\u30ef\u30fc\u30c9\u30d2\u30c3\u30c8
KeywordHits.createSheet.name.name=\u540d\u524d
KeywordHits.createSheet.name.displayName=\u540d\u524d
KeywordHits.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
KeywordHits.createSheet.listName.name=\u30ea\u30b9\u30c8\u540d
KeywordHits.createSheet.listName.displayName=\u30ea\u30b9\u30c8\u540d
KeywordHits.createSheet.listName.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
KeywordHits.createSheet.numChildren.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
KeywordHits.createSheet.filesWithHits.name=\u30d2\u30c3\u30c8\u3057\u305f\u30d5\u30a1\u30a4\u30eb
KeywordHits.createSheet.filesWithHits.displayName=\u30d2\u30c3\u30c8\u3057\u305f\u30d5\u30a1\u30a4\u30eb
KeywordHits.createSheet.filesWithHits.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
KeywordHits.createNodeForKey.modTime.displayName=\u4fee\u6b63\u65e5\u6642
KeywordHits.createNodeForKey.modTime.desc=\u4fee\u6b63\u65e5\u6642
KeywordHits.createNodeForKey.accessTime.displayName=\u30a2\u30af\u30bb\u30b9\u65e5\u6642
KeywordHits.createNodeForKey.accessTime.desc=\u30a2\u30af\u30bb\u30b9\u65e5\u6642
KeywordHits.createNodeForKey.chgTime.displayName=\u5909\u66f4\u65e5\u6642
KeywordHits.createNodeForKey.chgTime.desc=\u5909\u66f4\u65e5\u6642
KeywordHits.createNodeForKey.chgTime.name=\u5909\u66f4\u65e5\u6642
KeywordHits.createNodeForKey.accessTime.name=\u30a2\u30af\u30bb\u30b9\u65e5\u6642
KeywordHits.createNodeForKey.modTime.name=\u4fee\u6b63\u65e5\u6642
KnownFileFilterNode.selectionContext.dataSources=\u30c7\u30fc\u30bf\u30bd\u30fc\u30b9
KnownFileFilterNode.selectionContext.views=\u30d3\u30e5\u30fc
LayoutFileNode.propertyType.parts=\u30d1\u30fc\u30c4
LayoutFileNode.createSheet.name.name=\u540d\u524d
LayoutFileNode.createSheet.name.displayName=\u540d\u524d
LayoutFileNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
LayoutFileNode.createSheet.noDescr.text=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
LayoutFileNode.getActions.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u8868\u793a
LayoutFileNode.getActions.openInExtViewer.text=\u5916\u90e8\u30d3\u30e5\u30fc\u30a2\u3067\u958b\u304f
LocalFileNode.createSheet.name.name=\u540d\u524d
LocalFileNode.createSheet.name.displayName=\u540d\u524d
LocalFileNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
LocalFileNode.createSheet.noDescr.text=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
LocalFileNode.getActions.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
LocalFileNode.getActions.openInExtViewer.text=\u5916\u90e8\u30d3\u30e5\u30fc\u30a2\u3067\u958b\u304f
LocalFileNode.getActions.searchFilesSameMd5.text=\u540c\u3058MD5\u30cf\u30c3\u30b7\u30e5\u3092\u6301\u3064\u30d5\u30a1\u30a4\u30eb\u3092\u691c\u7d22
RecentFiles.aut0DayFilter.displayName.text=\u6700\u7d42\u65e5
RecentFiles.aut1dayFilter.displayName.text=\u6700\u7d42\u65e5 - 1
RecentFiles.aut2dayFilter.displayName.text=\u6700\u7d42\u65e5 - \uff12
RecentFiles.aut3dayFilter.displayName.text=\u6700\u7d42\u65e5 - \uff13
RecentFiles.aut4dayFilter.displayName.text=\u6700\u7d42\u65e5 - \uff14
RecentFiles.aut5dayFilter.displayName.text=\u6700\u7d42\u65e5 - \uff15
RecentFiles.aut6dayFilter.displayName.text=\u6700\u7d42\u65e5 - \uff16
RecentFilesFilterChildren.exception.defaultVisit.msg=\u3053\u306e\u30bf\u30a4\u30d7\u306e\u8868\u793a\u3067\u304d\u308b\u30a2\u30a4\u30c6\u30e0
Installer.exception.taskVerStringBang.msg=Sleuth Kit JNI\u30c6\u30b9\u30c8\u30b3\u30fc\u30eb\u3067\u306f\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u305b\u3093\u3067\u3057\u305f\u304c\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u30b9\u30c8\u30ea\u30f3\u30b0\u306f""\u3067\u3057\u305f\uff01
RecentFilesFilterNode.createSheet.filterType.name=\u30d5\u30a3\u30eb\u30bf\u30bf\u30a4\u30d7
RecentFilesFilterNode.createSheet.filterType.displayName=\u30d5\u30a3\u30eb\u30bf\u30bf\u30a4\u30d7
RecentFilesFilterNode.createSheet.filterType.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
RecentFilesNode.createSheet.name.name=\u540d\u524d
RecentFilesNode.createSheet.name.displayName=\u540d\u524d
RecentFilesNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
RecentFilesNode.name.text=\u6700\u8fd1\u4f7f\u7528\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb
ResultsNode.name.text=\u7d50\u679c
ResultsNode.createSheet.name.name=\u540d\u524d
ResultsNode.createSheet.name.displayName=\u540d\u524d
ResultsNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
TagNameNode.namePlusTags.text={0}\u30bf\u30b0
TagNameNode.contentTagTypeNodeKey.text=\u30b3\u30f3\u30c6\u30f3\u30c4\u30bf\u30b0
TagNameNode.bbArtTagTypeNodeKey.text=\u7d50\u679c\u30bf\u30b0
TagNameNode.bookmark.text=\u30d6\u30c3\u30af\u30de\u30fc\u30af
TagNameNode.createSheet.name.name=\u540d\u524d
TagNameNode.createSheet.name.displayName=\u540d\u524d
TagsNode.displayName.text=\u30bf\u30b0
TagsNode.createSheet.name.name=\u540d\u524d
AbstractAbstractFileNode.flagsDirColLbl=\u30d5\u30e9\u30b0\uff08\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\uff09
AbstractAbstractFileNode.flagsMetaColLbl=\u30d5\u30e9\u30b0\uff08\u30e1\u30bf\u30c7\u30fc\u30bf\uff09
AbstractAbstractFileNode.metaAddrColLbl=\u30e1\u30bf\u30c7\u30fc\u30bf\u30a2\u30c9\u30ec\u30b9
AbstractAbstractFileNode.attrAddrColLbl=\u5c5e\u6027\u30a2\u30c9\u30ec\u30b9
AbstractAbstractFileNode.typeDirColLbl=\u30bf\u30a4\u30d7\uff08\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\uff09
AbstractAbstractFileNode.typeMetaColLbl=\u30bf\u30a4\u30d7\uff08\u30e1\u30bf\u30c7\u30fc\u30bf\uff09
ArtifactTypeNode.createSheet.childCnt.displayName=\u30c1\u30e3\u30a4\u30eb\u30c9\u6570
TagsNode.createSheet.name.displayName=\u540d\u524d
ViewsNode.name.text=\u30d3\u30e5\u30fc
ViewsNode.createSheet.name.name=\u540d\u524d
ViewsNode.createSheet.name.displayName=\u540d\u524d
ViewsNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VirtualDirectoryNode.getActions.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
VirtualDirectoryNode.createSheet.name.name=\u540d\u524d
VirtualDirectoryNode.createSheet.name.displayName=\u540d\u524d
VirtualDirectoryNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VirtualDirectoryNode.createSheet.noDesc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VolumeNode.getActions.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
VolumeNode.createSheet.name.name=\u540d\u524d
VolumeNode.createSheet.name.displayName=\u540d\u524d
VolumeNode.createSheet.name.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VolumeNode.createSheet.id.name=ID
VolumeNode.createSheet.id.displayName=ID
VolumeNode.createSheet.id.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
VolumeNode.createSheet.startSector.name=\u6700\u521D\u306E\u30BB\u30AF\u30BF\u30FC
VolumeNode.createSheet.startSector.displayName=\u6700\u521D\u306E\u30BB\u30AF\u30BF\u30FC
VolumeNode.createSheet.startSector.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
VolumeNode.createSheet.lenSectors.name=\u30BB\u30AF\u30BF\u30FC\u306E\u9577\u3055
VolumeNode.createSheet.lenSectors.displayName=\u30BB\u30AF\u30BF\u30FC\u306E\u9577\u3055
VolumeNode.createSheet.lenSectors.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
VolumeNode.createSheet.description.name=\u8AAC\u660E
VolumeNode.createSheet.description.displayName=\u8AAC\u660E
VolumeNode.createSheet.description.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
VolumeNode.createSheet.flags.name=\u30D5\u30E9\u30B0
VolumeNode.createSheet.flags.displayName=\u30D5\u30E9\u30B0
VolumeNode.createSheet.flags.desc=\u8AAC\u660E\u304C\u3042\u308A\u307E\u305B\u3093
ArtifactTypeNode.createSheet.artType.name=\u30A2\u30FC\u30C6\u30A3\u30D5\u30A1\u30AF\u30C8\u30BF\u30A4\u30D7
ArtifactTypeNode.createSheet.artType.displayName=\u30A2\u30FC\u30C6\u30A3\u30D5\u30A1\u30AF\u30C8\u30BF\u30A4\u30D7
KeywordHits.createSheet.numChildren.name=\u30C1\u30E3\u30A4\u30EB\u30C9\u6570
KeywordHits.createSheet.numChildren.displayName=\u30C1\u30E3\u30A4\u30EB\u30C9\u6570
KeywordHits.simpleLiteralSearch.text=\u30B7\u30F3\u30B0\u30EB\u30EA\u30C6\u30E9\u30EB\u691C\u7D22
KeywordHits.singleRegexSearch.text=\u30B7\u30F3\u30B0\u30EB\u6B63\u898F\u8868\u73FE\u691C\u7D22
AbstractAbstractFileNode.objectId=\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8ID
VolumeNode.createSheet.id.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VolumeNode.createSheet.startSector.name=\u6700\u521d\u306e\u30bb\u30af\u30bf\u30fc
VolumeNode.createSheet.startSector.displayName=\u6700\u521d\u306e\u30bb\u30af\u30bf\u30fc
VolumeNode.createSheet.startSector.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VolumeNode.createSheet.lenSectors.name=\u30bb\u30af\u30bf\u30fc\u306e\u9577\u3055
VolumeNode.createSheet.lenSectors.displayName=\u30bb\u30af\u30bf\u30fc\u306e\u9577\u3055
VolumeNode.createSheet.lenSectors.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VolumeNode.createSheet.description.name=\u8aac\u660e
VolumeNode.createSheet.description.displayName=\u8aac\u660e
VolumeNode.createSheet.description.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
VolumeNode.createSheet.flags.name=\u30d5\u30e9\u30b0
VolumeNode.createSheet.flags.displayName=\u30d5\u30e9\u30b0
VolumeNode.createSheet.flags.desc=\u8aac\u660e\u304c\u3042\u308a\u307e\u305b\u3093
ArtifactTypeNode.createSheet.artType.name=\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u30bf\u30a4\u30d7
ArtifactTypeNode.createSheet.artType.displayName=\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u30bf\u30a4\u30d7
KeywordHits.createSheet.numChildren.name=\u30c1\u30e3\u30a4\u30eb\u30c9\u6570
KeywordHits.createSheet.numChildren.displayName=\u30c1\u30e3\u30a4\u30eb\u30c9\u6570
KeywordHits.simpleLiteralSearch.text=\u30b7\u30f3\u30b0\u30eb\u30ea\u30c6\u30e9\u30eb\u691c\u7d22
KeywordHits.singleRegexSearch.text=\u30b7\u30f3\u30b0\u30eb\u6b63\u898f\u8868\u73fe\u691c\u7d22
AbstractAbstractFileNode.objectId=\u30aa\u30d6\u30b8\u30a7\u30af\u30c8ID

112
Core/src/org/sleuthkit/autopsy/datamodel/ContentTagTypeNode.java
View File

@ -1,112 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.util.List;
import java.util.logging.Level;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.ContentTag;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Instances of this class are are elements of a directory tree sub-tree
* consisting of content and blackboard artifact tags, grouped first by tag
* type, then by tag name.
*/
public class ContentTagTypeNode extends DisplayableItemNode {
private static final String DISPLAY_NAME = NbBundle.getMessage(ContentTagTypeNode.class, "ContentTagTypeNode.displayName.text");
private static final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
public ContentTagTypeNode(TagName tagName) {
super(Children.create(new ContentTagNodeFactory(tagName), true), Lookups.singleton(tagName.getDisplayName() + " " + DISPLAY_NAME));
long tagsCount = 0;
try {
tagsCount = Case.getCurrentCase().getServices().getTagsManager().getContentTagsCountByTagName(tagName);
} catch (TskCoreException ex) {
Logger.getLogger(ContentTagTypeNode.class.getName()).log(Level.SEVERE, "Failed to get content tags count for " + tagName.getDisplayName() + " tag name", ex); //NON-NLS
}
super.setName(DISPLAY_NAME);
super.setDisplayName(DISPLAY_NAME + " (" + tagsCount + ")");
this.setIconBaseWithExtension(ICON_PATH);
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ContentTagTypeNode.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "ContentTagTypeNode.createSheet.name.displayName"),
"",
getName()));
return propertySheet;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public boolean isLeafTypeNode() {
return true;
}
private static class ContentTagNodeFactory extends ChildFactory<ContentTag> {
private final TagName tagName;
ContentTagNodeFactory(TagName tagName) {
this.tagName = tagName;
}
@Override
protected boolean createKeys(List<ContentTag> keys) {
// Use the content tags bearing the specified tag name as the keys.
try {
keys.addAll(Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tagName));
} catch (TskCoreException ex) {
Logger.getLogger(ContentTagTypeNode.ContentTagNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(ContentTag key) {
// The content tags to be wrapped are used as the keys.
return new ContentTagNode(key);
}
}
}

75
Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java
View File

@ -20,19 +20,8 @@ package org.sleuthkit.autopsy.datamodel;
import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsChildren.DeletedContentNode;
import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedAccountNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedFolderNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedRootNode;
import org.sleuthkit.autopsy.datamodel.FileSize.FileSizeRootChildren.FileSizeNode;
import org.sleuthkit.autopsy.datamodel.FileSize.FileSizeRootNode;
import org.sleuthkit.autopsy.datamodel.HashsetHits.HashsetHitsRootNode;
import org.sleuthkit.autopsy.datamodel.HashsetHits.HashsetHitsSetNode;
import org.sleuthkit.autopsy.datamodel.InterestingHits.InterestingHitsRootNode;
import org.sleuthkit.autopsy.datamodel.InterestingHits.InterestingHitsSetNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsKeywordNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsListNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsRootNode;
import org.sleuthkit.autopsy.directorytree.BlackboardArtifactTagTypeNode;
/**
* Visitor pattern implementation for DisplayableItemNodes
@ -49,9 +38,9 @@ public interface DisplayableItemNodeVisitor<T> {
T visit(BlackboardArtifactNode ban);
T visit(ArtifactTypeNode atn);
T visit(ExtractedContent.TypeNode atn);
T visit(ExtractedContentNode ecn);
T visit(ExtractedContent.RootNode ecn);
T visit(FileTypeNode fsfn);
@ -69,35 +58,35 @@ public interface DisplayableItemNodeVisitor<T> {
T visit(RecentFilesFilterNode rffn);
T visit(KeywordHitsRootNode khrn);
T visit(KeywordHits.RootNode khrn);
T visit(KeywordHitsListNode khsn);
T visit(KeywordHits.ListNode khsn);
T visit(KeywordHitsKeywordNode khmln);
T visit(KeywordHits.TermNode khmln);
T visit(HashsetHitsRootNode hhrn);
T visit(HashsetHits.RootNode hhrn);
T visit(HashsetHitsSetNode hhsn);
T visit(HashsetHits.HashsetNameNode hhsn);
T visit(EmailExtractedRootNode eern);
T visit(EmailExtracted.RootNode eern);
T visit(EmailExtractedAccountNode eean);
T visit(EmailExtracted.AccountNode eean);
T visit(EmailExtractedFolderNode eefn);
T visit(EmailExtracted.FolderNode eefn);
T visit(TagsNode node);
T visit(Tags.RootNode node);
T visit(InterestingHitsRootNode ihrn);
T visit(InterestingHits.RootNode ihrn);
T visit(InterestingHitsSetNode ihsn);
T visit(InterestingHits.SetNameNode ihsn);
T visit(TagNameNode node);
T visit(Tags.TagNameNode node);
T visit(ContentTagTypeNode node);
T visit(Tags.ContentTagTypeNode node);
T visit(ContentTagNode node);
T visit(BlackboardArtifactTagTypeNode node);
T visit(Tags.BlackboardArtifactTagTypeNode node);
T visit(BlackboardArtifactTagNode node);
@ -155,12 +144,12 @@ public interface DisplayableItemNodeVisitor<T> {
}
@Override
public T visit(ArtifactTypeNode atn) {
public T visit(ExtractedContent.TypeNode atn) {
return defaultVisit(atn);
}
@Override
public T visit(ExtractedContentNode ecn) {
public T visit(ExtractedContent.RootNode ecn) {
return defaultVisit(ecn);
}
@ -205,17 +194,17 @@ public interface DisplayableItemNodeVisitor<T> {
}
@Override
public T visit(KeywordHitsRootNode khrn) {
public T visit(KeywordHits.RootNode khrn) {
return defaultVisit(khrn);
}
@Override
public T visit(KeywordHitsListNode khsn) {
public T visit(KeywordHits.ListNode khsn) {
return defaultVisit(khsn);
}
@Override
public T visit(KeywordHitsKeywordNode khmln) {
public T visit(KeywordHits.TermNode khmln) {
return defaultVisit(khmln);
}
@ -235,37 +224,37 @@ public interface DisplayableItemNodeVisitor<T> {
}
@Override
public T visit(HashsetHitsRootNode hhrn) {
public T visit(HashsetHits.RootNode hhrn) {
return defaultVisit(hhrn);
}
@Override
public T visit(HashsetHitsSetNode hhsn) {
public T visit(HashsetHits.HashsetNameNode hhsn) {
return defaultVisit(hhsn);
}
@Override
public T visit(InterestingHitsRootNode ihrn) {
public T visit(InterestingHits.RootNode ihrn) {
return defaultVisit(ihrn);
}
@Override
public T visit(InterestingHitsSetNode ihsn) {
public T visit(InterestingHits.SetNameNode ihsn) {
return defaultVisit(ihsn);
}
@Override
public T visit(EmailExtractedRootNode eern) {
public T visit(EmailExtracted.RootNode eern) {
return defaultVisit(eern);
}
@Override
public T visit(EmailExtractedAccountNode eean) {
public T visit(EmailExtracted.AccountNode eean) {
return defaultVisit(eean);
}
@Override
public T visit(EmailExtractedFolderNode eefn) {
public T visit(EmailExtracted.FolderNode eefn) {
return defaultVisit(eefn);
}
@ -285,17 +274,17 @@ public interface DisplayableItemNodeVisitor<T> {
}
@Override
public T visit(TagsNode node) {
public T visit(Tags.RootNode node) {
return defaultVisit(node);
}
@Override
public T visit(TagNameNode node) {
public T visit(Tags.TagNameNode node) {
return defaultVisit(node);
}
@Override
public T visit(ContentTagTypeNode node) {
public T visit(Tags.ContentTagTypeNode node) {
return defaultVisit(node);
}
@ -305,7 +294,7 @@ public interface DisplayableItemNodeVisitor<T> {
}
@Override
public T visit(BlackboardArtifactTagTypeNode node) {
public T visit(Tags.BlackboardArtifactTagTypeNode node) {
return defaultVisit(node);
}

441
Core/src/org/sleuthkit/autopsy/datamodel/EmailExtracted.java
View File

@ -18,6 +18,8 @@
*/
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
@ -25,6 +27,9 @@ import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Observable;
import java.util.Observer;
import java.util.Set;
import java.util.logging.Level;
import org.openide.util.NbBundle;
@ -34,11 +39,14 @@ import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskException;
/**
* Support for TSK_EMAIL_MSG nodes and displaying emails in the directory tree
* Email messages are grouped into parent folders, and the folders are grouped
@ -54,64 +62,85 @@ public class EmailExtracted implements AutopsyVisitableItem {
private static final String MAIL_FOLDER = NbBundle.getMessage(EmailExtracted.class, "EmailExtracted.mailFolder.text");
private static final String MAIL_PATH_SEPARATOR = "/";
private SleuthkitCase skCase;
private Map<String, Map<String, List<Long>>> accounts;
private EmailResults emailResults;
public EmailExtracted(SleuthkitCase skCase) {
this.skCase = skCase;
accounts = new LinkedHashMap<>();
emailResults = new EmailResults();
}
@SuppressWarnings("deprecation")
private void initArtifacts() {
accounts.clear();
try {
int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID();
int pathAttrId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID();
String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
+ "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "attribute_type_id=" + pathAttrId //NON-NLS
+ " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
+ " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
ResultSet rs = skCase.runQuery(query);
while (rs.next()) {
final String path = rs.getString("value_text"); //NON-NLS
final long artifactId = rs.getLong("artifact_id"); //NON-NLS
final Map<String, String> parsedPath = parsePath(path);
final String account = parsedPath.get(MAIL_ACCOUNT);
final String folder = parsedPath.get(MAIL_FOLDER);
Map<String, List<Long>> folders = accounts.get(account);
if (folders == null) {
folders = new LinkedHashMap<>();
accounts.put(account, folders);
}
List<Long> messages = folders.get(folder);
if (messages == null) {
messages = new ArrayList<>();
folders.put(folder, messages);
}
messages.add(artifactId);
}
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Cannot initialize email extraction", ex); //NON-NLS
private final class EmailResults extends Observable {
private Map<String, Map<String, List<Long>>> accounts = new LinkedHashMap<>();
EmailResults() {
update();
}
}
public Set<String> getAccounts() {
return accounts.keySet();
}
public Set<String> getFolders(String account) {
return accounts.get(account).keySet();
}
public List<Long> getArtifactIds(String account, String folder) {
return accounts.get(account).get(folder);
}
public void update() {
accounts.clear();
try {
int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID();
int pathAttrId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID();
String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
+ "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "attribute_type_id=" + pathAttrId //NON-NLS
+ " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
+ " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
ResultSet rs = skCase.runQuery(query);
while (rs.next()) {
final String path = rs.getString("value_text"); //NON-NLS
final long artifactId = rs.getLong("artifact_id"); //NON-NLS
final Map<String, String> parsedPath = parsePath(path);
final String account = parsedPath.get(MAIL_ACCOUNT);
final String folder = parsedPath.get(MAIL_FOLDER);
private static Map<String, String> parsePath(String path) {
Map<String, String> parsed = new HashMap<>();
String[] split = path.split(MAIL_PATH_SEPARATOR);
if (split.length < 4) {
logger.log(Level.WARNING, "Unexpected number of tokens when parsing email PATH: {0}, will use defaults", split.length); //NON-NLS
parsed.put(MAIL_ACCOUNT, NbBundle.getMessage(EmailExtracted.class, "EmailExtracted.defaultAcct.text"));
parsed.put(MAIL_FOLDER, NbBundle.getMessage(EmailExtracted.class, "EmailExtracted.defaultFolder.text"));
Map<String, List<Long>> folders = accounts.get(account);
if (folders == null) {
folders = new LinkedHashMap<>();
accounts.put(account, folders);
}
List<Long> messages = folders.get(folder);
if (messages == null) {
messages = new ArrayList<>();
folders.put(folder, messages);
}
messages.add(artifactId);
}
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Cannot initialize email extraction", ex); //NON-NLS
}
}
private Map<String, String> parsePath(String path) {
Map<String, String> parsed = new HashMap<>();
String[] split = path.split(MAIL_PATH_SEPARATOR);
if (split.length < 4) {
logger.log(Level.WARNING, "Unexpected number of tokens when parsing email PATH: {0}, will use defaults", split.length); //NON-NLS
parsed.put(MAIL_ACCOUNT, NbBundle.getMessage(EmailExtracted.class, "EmailExtracted.defaultAcct.text"));
parsed.put(MAIL_FOLDER, NbBundle.getMessage(EmailExtracted.class, "EmailExtracted.defaultFolder.text"));
return parsed;
}
parsed.put(MAIL_ACCOUNT, split[2]);
parsed.put(MAIL_FOLDER, split[3]);
return parsed;
}
parsed.put(MAIL_ACCOUNT, split[2]);
parsed.put(MAIL_FOLDER, split[3]);
return parsed;
}
@Override
@ -122,94 +151,94 @@ public class EmailExtracted implements AutopsyVisitableItem {
/**
* Mail root node showing all emails
*/
public class EmailExtractedRootNodeFlat extends DisplayableItemNode {
public EmailExtractedRootNodeFlat() {
super(Children.create(new EmailExtractedRootChildrenFlat(), true), Lookups.singleton(DISPLAY_NAME));
super.setName(LABEL_NAME);
super.setDisplayName(DISPLAY_NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/mail-icon-16.png"); //NON-NLS
initArtifacts();
}
@Override
public boolean isLeafTypeNode() {
return false;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
//return v.visit(this);
return null;
}
@Override
protected Sheet createSheet() {
Sheet s = super.createSheet();
Sheet.Set ss = s.get(Sheet.PROPERTIES);
if (ss == null) {
ss = Sheet.createPropertiesSet();
s.put(ss);
}
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "EmailExtracted.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "EmailExtracted.createSheet.name.displayName"),
NbBundle.getMessage(this.getClass(), "EmailExtracted.createSheet.name.desc"),
getName()));
return s;
}
}
/**
* Mail root child node showing flattened emails
*/
private class EmailExtractedRootChildrenFlat extends ChildFactory<BlackboardArtifact> {
private EmailExtractedRootChildrenFlat() {
super();
}
@Override
protected boolean createKeys(List<BlackboardArtifact> list) {
//flatten all emails
List<BlackboardArtifact> tempList = new ArrayList<>();
for (String account : accounts.keySet()) {
Map<String, List<Long>> folders = accounts.get(account);
for (String folder : folders.keySet()) {
List<Long> messages = folders.get(folder);
for (long l : messages) {
try {
//TODO: bulk artifact gettings
tempList.add(skCase.getBlackboardArtifact(l));
} catch (TskException ex) {
logger.log(Level.WARNING, "Error creating mail messages nodes", ex); //NON-NLS
}
}
}
}
list.addAll(tempList);
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact artifact) {
return new BlackboardArtifactNode(artifact);
}
}
// public class FlatRootNode extends DisplayableItemNode {
//
// public FlatRootNode() {
// super(Children.create(new FlatRootFactory(), true), Lookups.singleton(DISPLAY_NAME));
// super.setName(LABEL_NAME);
// super.setDisplayName(DISPLAY_NAME);
// this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/mail-icon-16.png"); //NON-NLS
// initArtifacts();
// }
//
// @Override
// public boolean isLeafTypeNode() {
// return false;
// }
//
// @Override
// public <T> T accept(DisplayableItemNodeVisitor<T> v) {
// //return v.visit(this);
// return null;
// }
//
// @Override
// protected Sheet createSheet() {
// Sheet s = super.createSheet();
// Sheet.Set ss = s.get(Sheet.PROPERTIES);
// if (ss == null) {
// ss = Sheet.createPropertiesSet();
// s.put(ss);
// }
//
// ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "EmailExtracted.createSheet.name.name"),
// NbBundle.getMessage(this.getClass(), "EmailExtracted.createSheet.name.displayName"),
// NbBundle.getMessage(this.getClass(), "EmailExtracted.createSheet.name.desc"),
// getName()));
// return s;
// }
// }
//
// /**
// * Mail root child node showing flattened emails
// */
// private class FlatRootFactory extends ChildFactory<BlackboardArtifact> {
//
// private FlatRootFactory() {
// super();
// }
//
// @Override
// protected boolean createKeys(List<BlackboardArtifact> list) {
// //flatten all emails
// List<BlackboardArtifact> tempList = new ArrayList<>();
// for (String account : accounts.keySet()) {
// Map<String, List<Long>> folders = accounts.get(account);
// for (String folder : folders.keySet()) {
// List<Long> messages = folders.get(folder);
// for (long l : messages) {
// try {
// //TODO: bulk artifact gettings
// tempList.add(skCase.getBlackboardArtifact(l));
// } catch (TskException ex) {
// logger.log(Level.WARNING, "Error creating mail messages nodes", ex); //NON-NLS
// }
// }
// }
// }
//
// list.addAll(tempList);
// return true;
// }
//
// @Override
// protected Node createNodeForKey(BlackboardArtifact artifact) {
// return new BlackboardArtifactNode(artifact);
// }
// }
/**
* Mail root node grouping all mail accounts, supports account-> folder
* structure
*/
public class EmailExtractedRootNode extends DisplayableItemNode {
public class RootNode extends DisplayableItemNode {
public EmailExtractedRootNode() {
super(Children.create(new EmailExtractedRootChildren(), true), Lookups.singleton(DISPLAY_NAME));
public RootNode() {
super(Children.create(new AccountFactory(), true), Lookups.singleton(DISPLAY_NAME));
super.setName(LABEL_NAME);
super.setDisplayName(DISPLAY_NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/mail-icon-16.png"); //NON-NLS
initArtifacts();
emailResults.update();
}
@Override
@ -220,7 +249,6 @@ public class EmailExtracted implements AutopsyVisitableItem {
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
//return null;
}
@Override
@ -244,30 +272,75 @@ public class EmailExtracted implements AutopsyVisitableItem {
/**
* Mail root child node creating each account node
*/
private class EmailExtractedRootChildren extends ChildFactory<String> {
private class AccountFactory extends ChildFactory.Detachable<String> implements Observer {
/* The pcl is in the class because it has the easiest mechanisms to add and remove itself
* during its life cycles.
*/
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestEvent.DATA.toString())) {
if (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG) {
emailResults.update();
}
}
else if (eventType.equals(IngestManager.IngestEvent.INGEST_JOB_COMPLETED.toString())
|| eventType.equals(IngestManager.IngestEvent.INGEST_JOB_CANCELLED.toString())) {
emailResults.update();
}
}
};
@Override
protected void addNotify() {
IngestManager.addPropertyChangeListener(pcl);
emailResults.update();
emailResults.addObserver(this);
}
@Override
protected void removeNotify() {
IngestManager.removePropertyChangeListener(pcl);
emailResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<String> list) {
list.addAll(accounts.keySet());
list.addAll(emailResults.getAccounts());
return true;
}
@Override
protected Node createNodeForKey(String key) {
return new EmailExtractedAccountNode(key, accounts.get(key));
return new AccountNode(key);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
/**
* Account node representation
*/
public class EmailExtractedAccountNode extends DisplayableItemNode {
public EmailExtractedAccountNode(String name, Map<String, List<Long>> children) {
super(Children.create(new EmailExtractedAccountChildrenNode(children), true), Lookups.singleton(name));
super.setName(name);
super.setDisplayName(name + " (" + children.size() + ")");
public class AccountNode extends DisplayableItemNode implements Observer {
private String accountName;
public AccountNode(String accountName) {
super(Children.create(new FolderFactory(accountName), true), Lookups.singleton(accountName));
super.setName(accountName);
this.accountName = accountName;
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/account-icon-16.png"); //NON-NLS
updateDisplayName();
emailResults.addObserver(this);
}
private void updateDisplayName() {
super.setDisplayName(accountName + " (" + emailResults.getFolders(accountName) + ")");
}
@Override
@ -296,43 +369,61 @@ public class EmailExtracted implements AutopsyVisitableItem {
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
/**
* Account node child creating sub nodes for every folder
*/
private class EmailExtractedAccountChildrenNode extends ChildFactory<String> {
private class FolderFactory extends ChildFactory<String> implements Observer {
private Map<String, List<Long>> folders;
private String accountName;
private EmailExtractedAccountChildrenNode(Map<String, List<Long>> folders) {
private FolderFactory(String accountName) {
super();
this.folders = folders;
this.accountName = accountName;
emailResults.addObserver(this);
}
@Override
protected boolean createKeys(List<String> list) {
list.addAll(folders.keySet());
list.addAll(emailResults.getFolders(accountName));
return true;
}
@Override
protected Node createNodeForKey(String key) {
return new EmailExtractedFolderNode(key, folders.get(key));
protected Node createNodeForKey(String folderName) {
return new FolderNode(accountName, folderName);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
/**
* Node representing mail folder
*/
public class EmailExtractedFolderNode extends DisplayableItemNode {
public EmailExtractedFolderNode(String name, List<Long> children) {
super(Children.create(new EmailExtractedFolderChildrenNode(children), true), Lookups.singleton(name));
super.setName(name);
super.setDisplayName(name + " (" + children.size() + ")");
public class FolderNode extends DisplayableItemNode implements Observer {
private String accountName;
private String folderName;
public FolderNode(String accountName, String folderName) {
super(Children.create(new MessageFactory(accountName, folderName), true), Lookups.singleton(accountName));
super.setName(folderName);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/folder-icon-16.png"); //NON-NLS
updateDisplayName();
emailResults.addObserver(this);
}
private void updateDisplayName() {
super.setDisplayName(folderName + " (" + emailResults.getArtifactIds(accountName, folderName).size() + ")");
}
@Override
@ -361,38 +452,48 @@ public class EmailExtracted implements AutopsyVisitableItem {
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
/**
* Node representing mail folder content (mail messages)
*/
private class EmailExtractedFolderChildrenNode extends ChildFactory<BlackboardArtifact> {
private class MessageFactory extends ChildFactory<Long> implements Observer {
private List<Long> messages;
private String accountName;
private String folderName;
private EmailExtractedFolderChildrenNode(List<Long> messages) {
private MessageFactory(String accountName, String folderName) {
super();
this.messages = messages;
this.accountName = accountName;
this.folderName = folderName;
emailResults.addObserver(this);
}
@Override
protected boolean createKeys(List<BlackboardArtifact> list) {
List<BlackboardArtifact> tempList = new ArrayList<>();
for (long l : messages) {
try {
//TODO: bulk artifact gettings
tempList.add(skCase.getBlackboardArtifact(l));
} catch (TskException ex) {
logger.log(Level.WARNING, "Error creating mail messages nodes", ex); //NON-NLS
}
}
list.addAll(tempList);
protected boolean createKeys(List<Long> list) {
list.addAll(emailResults.getArtifactIds(accountName, folderName));
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact artifact) {
return new BlackboardArtifactNode(artifact);
protected Node createNodeForKey(Long artifactId) {
try {
BlackboardArtifact artifact = skCase.getBlackboardArtifact(artifactId);
return new BlackboardArtifactNode(artifact);
} catch (TskException ex) {
logger.log(Level.WARNING, "Error creating mail messages nodes", ex); //NON-NLS
}
return null;
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
}

359
Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011 Basis Technology Corp.
* Copyright 2011-2014 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -18,17 +18,59 @@
*/
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Comparator;
import java.util.HashMap;
import java.util.List;
import java.util.logging.Level;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskException;
/**
* Parent of the "extracted content" artifacts to be displayed in the tree. Other
* artifacts are displayed under other more specific parents.
* Parent of the "extracted content" artifacts to be displayed in the tree.
* Other artifacts are displayed under other more specific parents.
*/
class ExtractedContent implements AutopsyVisitableItem{
public class ExtractedContent implements AutopsyVisitableItem {
SleuthkitCase skCase;
private SleuthkitCase skCase;
public static final String NAME = NbBundle.getMessage(RootNode.class, "ExtractedContentNode.name.text");
public ExtractedContent(SleuthkitCase skCase){
public ExtractedContent(SleuthkitCase skCase) {
this.skCase = skCase;
}
@ -37,7 +79,310 @@ import org.sleuthkit.datamodel.SleuthkitCase;
return v.visit(this);
}
public SleuthkitCase getSleuthkitCase(){
public SleuthkitCase getSleuthkitCase() {
return skCase;
}
public class RootNode extends DisplayableItemNode {
public RootNode(SleuthkitCase skCase) {
super(Children.create(new TypeFactory(skCase), true), Lookups.singleton(NAME));
super.setName(NAME);
super.setDisplayName(NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/extracted_content.png"); //NON-NLS
}
@Override
public boolean isLeafTypeNode() {
return false;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
protected Sheet createSheet() {
Sheet s = super.createSheet();
Sheet.Set ss = s.get(Sheet.PROPERTIES);
if (ss == null) {
ss = Sheet.createPropertiesSet();
s.put(ss);
}
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.displayName"),
NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.desc"),
NAME));
return s;
}
}
/**
* Creates the children for the ExtractedContent area of the results tree.
* This area has all of the blackboard artifacts that are not displayed in a
* more specific form elsewhere in the tree.
*/
private class TypeFactory extends ChildFactory.Detachable<BlackboardArtifact.ARTIFACT_TYPE> {
private SleuthkitCase skCase;
private final ArrayList<BlackboardArtifact.ARTIFACT_TYPE> doNotShow;
// maps the artifact type to its child node
private HashMap<BlackboardArtifact.ARTIFACT_TYPE, TypeNode> typeNodeList = new HashMap<>();
public TypeFactory(SleuthkitCase skCase) {
super();
this.skCase = skCase;
// these are shown in other parts of the UI tree
doNotShow = new ArrayList<>();
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
}
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestEvent.DATA.toString())) {
final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
if (doNotShow.contains(event.getArtifactType()) == false) {
refresh(true);
}
} else if (eventType.equals(IngestManager.IngestEvent.INGEST_JOB_COMPLETED.toString())
|| eventType.equals(IngestManager.IngestEvent.INGEST_JOB_CANCELLED.toString())) {
refresh(true);
}
}
};
@Override
protected void addNotify() {
IngestManager.addPropertyChangeListener(pcl);
}
@Override
protected void removeNotify() {
IngestManager.removePropertyChangeListener(pcl);
typeNodeList.clear();
}
@Override
protected boolean createKeys(List<BlackboardArtifact.ARTIFACT_TYPE> list) {
try {
List<BlackboardArtifact.ARTIFACT_TYPE> inUse = skCase.getBlackboardArtifactTypesInUse();
inUse.removeAll(doNotShow);
Collections.sort(inUse,
new Comparator<BlackboardArtifact.ARTIFACT_TYPE>() {
@Override
public int compare(BlackboardArtifact.ARTIFACT_TYPE a, BlackboardArtifact.ARTIFACT_TYPE b) {
return a.getDisplayName().compareTo(b.getDisplayName());
}
});
list.addAll(inUse);
// the create node method will get called only for new types
// refresh the counts if we already created them from a previous update
for (BlackboardArtifact.ARTIFACT_TYPE art : inUse) {
TypeNode node = typeNodeList.get(art);
if (node != null) {
node.updateDisplayName();
}
}
} catch (TskCoreException ex) {
Logger.getLogger(TypeFactory.class.getName()).log(Level.SEVERE, "Error getting list of artifacts in use: " + ex.getLocalizedMessage()); //NON-NLS
return false;
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact.ARTIFACT_TYPE key) {
TypeNode node = new TypeNode(key, skCase);
typeNodeList.put(key, node);
return node;
}
}
/**
* Node encapsulating blackboard artifact type. This is used on the
* left-hand navigation side of the Autopsy UI as the parent node for all of
* the artifacts of a given type. Its children will be
* BlackboardArtifactNode objects.
*/
public class TypeNode extends DisplayableItemNode {
private BlackboardArtifact.ARTIFACT_TYPE type;
private long childCount = 0;
private SleuthkitCase skCase;
TypeNode(BlackboardArtifact.ARTIFACT_TYPE type, SleuthkitCase skCase) {
super(Children.create(new ArtifactFactory(type, skCase), true), Lookups.singleton(type.getDisplayName()));
super.setName(type.getLabel());
this.skCase = skCase;
this.type = type;
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/" + getIcon(type)); //NON-NLS
updateDisplayName();
}
final void updateDisplayName() {
// NOTE: This completely destroys our lazy-loading ideal
// a performance increase might be had by adding a
// "getBlackboardArtifactCount()" method to skCase
try {
this.childCount = skCase.getBlackboardArtifactsTypeCount(type.getTypeID());
} catch (TskException ex) {
Logger.getLogger(TypeNode.class.getName())
.log(Level.WARNING, "Error getting child count", ex); //NON-NLS
}
super.setDisplayName(type.getDisplayName() + " (" + childCount + ")");
}
@Override
protected Sheet createSheet() {
Sheet s = super.createSheet();
Sheet.Set ss = s.get(Sheet.PROPERTIES);
if (ss == null) {
ss = Sheet.createPropertiesSet();
s.put(ss);
}
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.name"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.displayName"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.artType.desc"),
type.getDisplayName()));
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.name"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.displayName"),
NbBundle.getMessage(this.getClass(), "ArtifactTypeNode.createSheet.childCnt.desc"),
childCount));
return s;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
// @@@ TODO: Merge with BlackboartArtifactNode.getIcon()
private String getIcon(BlackboardArtifact.ARTIFACT_TYPE type) {
switch (type) {
case TSK_WEB_BOOKMARK:
return "bookmarks.png"; //NON-NLS
case TSK_WEB_COOKIE:
return "cookies.png"; //NON-NLS
case TSK_WEB_HISTORY:
return "history.png"; //NON-NLS
case TSK_WEB_DOWNLOAD:
return "downloads.png"; //NON-NLS
case TSK_INSTALLED_PROG:
return "programs.png"; //NON-NLS
case TSK_RECENT_OBJECT:
return "recent_docs.png"; //NON-NLS
case TSK_DEVICE_ATTACHED:
return "usb_devices.png"; //NON-NLS
case TSK_WEB_SEARCH_QUERY:
return "searchquery.png"; //NON-NLS
case TSK_METADATA_EXIF:
return "camera-icon-16.png"; //NON-NLS
case TSK_CONTACT:
return "contact.png"; //NON-NLS
case TSK_MESSAGE:
return "message.png"; //NON-NLS
case TSK_CALLLOG:
return "calllog.png"; //NON-NLS
case TSK_CALENDAR_ENTRY:
return "calendar.png"; //NON-NLS
case TSK_SPEED_DIAL_ENTRY:
return "speeddialentry.png"; //NON-NLS
case TSK_BLUETOOTH_PAIRING:
return "bluetooth.png"; //NON-NLS
case TSK_GPS_BOOKMARK:
return "gpsfav.png"; //NON-NLS
case TSK_GPS_LAST_KNOWN_LOCATION:
return "gps-lastlocation.png"; //NON-NLS
case TSK_GPS_SEARCH:
return "gps-search.png"; //NON-NLS
case TSK_SERVICE_ACCOUNT:
return "account-icon-16.png"; //NON-NLS
case TSK_ENCRYPTION_DETECTED:
return "encrypted-file.png"; //NON-NLS
case TSK_EXT_MISMATCH_DETECTED:
return "mismatch-16.png"; //NON-NLS
}
return "artifact-icon.png"; //NON-NLS
}
@Override
public boolean isLeafTypeNode() {
return true;
}
}
/**
* Creates children for a given artifact type
*/
private static class ArtifactFactory extends ChildFactory.Detachable<BlackboardArtifact> {
private SleuthkitCase skCase;
private BlackboardArtifact.ARTIFACT_TYPE type;
public ArtifactFactory(BlackboardArtifact.ARTIFACT_TYPE type, SleuthkitCase skCase) {
super();
this.skCase = skCase;
this.type = type;
}
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestEvent.DATA.toString())) {
final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
if (event.getArtifactType() == type) {
refresh(true);
}
} else if (eventType.equals(IngestManager.IngestEvent.INGEST_JOB_COMPLETED.toString())
|| eventType.equals(IngestManager.IngestEvent.INGEST_JOB_CANCELLED.toString())) {
refresh(true);
}
}
};
@Override
protected void addNotify() {
IngestManager.addPropertyChangeListener(pcl);
}
@Override
protected void removeNotify() {
IngestManager.removePropertyChangeListener(pcl);
}
@Override
protected boolean createKeys(List<BlackboardArtifact> list) {
try {
List<BlackboardArtifact> arts = skCase.getBlackboardArtifacts(type.getTypeID());
list.addAll(arts);
} catch (TskException ex) {
Logger.getLogger(ArtifactFactory.class.getName()).log(Level.SEVERE, "Couldn't get blackboard artifacts from database", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact key) {
return new BlackboardArtifactNode(key);
}
}
}

86
Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContentChildren.java
View File

@ -1,86 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.Comparator;
import java.util.List;
import java.util.logging.Level;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Node;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Creates the children for the ExtractedContent area of the results tree. This area
* has all of the blackboard artifacts that are not displayed in a more specific form elsewhere
* in the tree.
*/
class ExtractedContentChildren extends ChildFactory<BlackboardArtifact.ARTIFACT_TYPE> {
private SleuthkitCase skCase;
private final ArrayList<BlackboardArtifact.ARTIFACT_TYPE> doNotShow;
public ExtractedContentChildren(SleuthkitCase skCase) {
super();
this.skCase = skCase;
// these are shown in other parts of the UI tree
doNotShow = new ArrayList<>();
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
}
@Override
protected boolean createKeys(List<BlackboardArtifact.ARTIFACT_TYPE> list) {
try {
List<BlackboardArtifact.ARTIFACT_TYPE> inUse = skCase.getBlackboardArtifactTypesInUse();
inUse.removeAll(doNotShow);
Collections.sort(inUse,
new Comparator<BlackboardArtifact.ARTIFACT_TYPE>() {
@Override
public int compare(BlackboardArtifact.ARTIFACT_TYPE a, BlackboardArtifact.ARTIFACT_TYPE b) {
return a.getDisplayName().compareTo(b.getDisplayName());
}
});
list.addAll(inUse);
} catch (TskCoreException ex) {
Logger.getLogger(ExtractedContentChildren.class.getName()).log(Level.SEVERE, "Error getting list of artifacts in use: " + ex.getLocalizedMessage()); //NON-NLS
return false;
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact.ARTIFACT_TYPE key){
return new ArtifactTypeNode(key, skCase);
}
}

67
Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContentNode.java
View File

@ -1,67 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import org.openide.nodes.Children;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.datamodel.SleuthkitCase;
/**
* Node for the extracted content artifacts (artifacts that are not shown in
* more specific areas of the tree)
*/
public class ExtractedContentNode extends DisplayableItemNode {
public static final String NAME = NbBundle.getMessage(ExtractedContentNode.class, "ExtractedContentNode.name.text");
public ExtractedContentNode(SleuthkitCase skCase) {
super(Children.create(new ExtractedContentChildren(skCase), true), Lookups.singleton(NAME));
super.setName(NAME);
super.setDisplayName(NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/extracted_content.png"); //NON-NLS
}
@Override
public boolean isLeafTypeNode() {
return false;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
protected Sheet createSheet() {
Sheet s = super.createSheet();
Sheet.Set ss = s.get(Sheet.PROPERTIES);
if (ss == null) {
ss = Sheet.createPropertiesSet();
s.put(ss);
}
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.displayName"),
NbBundle.getMessage(this.getClass(), "ExtractedContentNode.createSheet.name.desc"),
NAME));
return s;
}
}

255
Core/src/org/sleuthkit/autopsy/datamodel/HashsetHits.java
View File

@ -18,12 +18,19 @@
*/
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Observable;
import java.util.Observer;
import java.util.Set;
import java.util.logging.Level;
@ -34,13 +41,16 @@ import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskException;
/**
* Hash set hits node support
* Hash set hits node support. Inner classes have all of the nodes in the tree.
*/
public class HashsetHits implements AutopsyVisitableItem {
@ -48,65 +58,87 @@ public class HashsetHits implements AutopsyVisitableItem {
private static final String DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName();
private static final Logger logger = Logger.getLogger(HashsetHits.class.getName());
private SleuthkitCase skCase;
private Map<String, Set<Long>> hashSetHitsMap;
private HashsetResults hashsetResults;
public HashsetHits(SleuthkitCase skCase) {
this.skCase = skCase;
hashSetHitsMap = new LinkedHashMap<>();
}
@SuppressWarnings("deprecation")
private void initArtifacts() {
hashSetHitsMap.clear();
ResultSet rs = null;
try {
int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
+ "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "attribute_type_id=" + setNameId //NON-NLS
+ " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
+ " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
rs = skCase.runQuery(query);
while (rs.next()) {
String value = rs.getString("value_text"); //NON-NLS
long artifactId = rs.getLong("artifact_id"); //NON-NLS
if (!hashSetHitsMap.containsKey(value)) {
hashSetHitsMap.put(value, new HashSet<Long>());
}
hashSetHitsMap.get(value).add(artifactId);
}
} catch (SQLException ex) {
logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
} finally {
if (rs != null) {
try {
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Error closing result set after getting hashset hits", ex); //NON-NLS
}
}
}
hashsetResults = new HashsetResults();
}
@Override
public <T> T accept(AutopsyItemVisitor<T> v) {
return v.visit(this);
}
/**
* Stores all of the hashset results in a single class that is observable for the
* child nodes
*/
private class HashsetResults extends Observable {
// maps hashset name to list of artifacts for that set
private Map<String, Set<Long>> hashSetHitsMap = new LinkedHashMap<>();
HashsetResults() {
update();
}
List<String> getSetNames() {
List<String> names = new ArrayList<>(hashSetHitsMap.keySet());
Collections.sort(names);
return names;
}
Set<Long> getArtifactIds(String hashSetName) {
return hashSetHitsMap.get(hashSetName);
}
final void update() {
hashSetHitsMap.clear();
ResultSet rs = null;
try {
int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID();
String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
+ "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "attribute_type_id=" + setNameId //NON-NLS
+ " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
+ " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
rs = skCase.runQuery(query);
while (rs.next()) {
String setName = rs.getString("value_text"); //NON-NLS
long artifactId = rs.getLong("artifact_id"); //NON-NLS
if (!hashSetHitsMap.containsKey(setName)) {
hashSetHitsMap.put(setName, new HashSet<Long>());
}
hashSetHitsMap.get(setName).add(artifactId);
}
} catch (SQLException ex) {
logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
} finally {
if (rs != null) {
try {
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Error closing result set after getting hashset hits", ex); //NON-NLS
}
}
}
setChanged();
notifyObservers();
}
}
/**
* Node for the hash set hits
* Top-level node for all hash sets
*/
public class HashsetHitsRootNode extends DisplayableItemNode {
public class RootNode extends DisplayableItemNode {
public HashsetHitsRootNode() {
super(Children.create(new HashsetHitsRootChildren(), true), Lookups.singleton(DISPLAY_NAME));
public RootNode() {
super(Children.create(new HashsetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
super.setName(HASHSET_HITS);
super.setDisplayName(DISPLAY_NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
initArtifacts();
}
@Override
@ -137,27 +169,81 @@ public class HashsetHits implements AutopsyVisitableItem {
}
}
private class HashsetHitsRootChildren extends ChildFactory<String> {
/**
* Creates child nodes for each hashset name
*/
private class HashsetNameFactory extends ChildFactory.Detachable<String> implements Observer {
/* This should probably be in the HashsetHits class, but the factory has nice methods
* for its startup and shutdown, so it seemed like a cleaner place to register the
* property change listener.
*/
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestEvent.DATA.toString())) {
if (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == ARTIFACT_TYPE.TSK_HASHSET_HIT) {
hashsetResults.update();
}
}
else if (eventType.equals(IngestManager.IngestEvent.INGEST_JOB_COMPLETED.toString())
|| eventType.equals(IngestManager.IngestEvent.INGEST_JOB_CANCELLED.toString())) {
hashsetResults.update();
}
}
};
@Override
protected boolean createKeys(List<String> list) {
list.addAll(hashSetHitsMap.keySet());
protected void addNotify() {
IngestManager.addPropertyChangeListener(pcl);
hashsetResults.update();
hashsetResults.addObserver(this);
}
@Override
protected void removeNotify() {
IngestManager.removePropertyChangeListener(pcl);
hashsetResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<String> list) {
list.addAll(hashsetResults.getSetNames());
return true;
}
@Override
protected Node createNodeForKey(String key) {
return new HashsetHitsSetNode(key, hashSetHitsMap.get(key));
return new HashsetNameNode(key);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
public class HashsetHitsSetNode extends DisplayableItemNode {
public HashsetHitsSetNode(String name, Set<Long> children) {
super(Children.create(new HashsetHitsSetChildren(children), true), Lookups.singleton(name));
super.setName(name);
super.setDisplayName(name + " (" + children.size() + ")");
/**
* Node for a hash set name
*/
public class HashsetNameNode extends DisplayableItemNode implements Observer {
private String hashSetName;
public HashsetNameNode(String hashSetName) {
super(Children.create(new HitFactory(hashSetName), true), Lookups.singleton(hashSetName));
super.setName(hashSetName);
this.hashSetName = hashSetName;
updateDisplayName();
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hashset_hits.png"); //NON-NLS
hashsetResults.addObserver(this);
}
/**
* Update the count in the display name
*/
private void updateDisplayName() {
super.setDisplayName(hashSetName + " (" + hashsetResults.getArtifactIds(hashSetName).size() + ")");
}
@Override
@ -186,33 +272,54 @@ public class HashsetHits implements AutopsyVisitableItem {
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
private class HashsetHitsSetChildren extends ChildFactory<BlackboardArtifact> {
private Set<Long> children;
private HashsetHitsSetChildren(Set<Long> children) {
/**
* Creates the nodes for the hits in a given set.
*/
private class HitFactory extends ChildFactory.Detachable<Long> implements Observer {
private String hashsetName;
private HitFactory(String hashsetName) {
super();
this.children = children;
this.hashsetName = hashsetName;
}
@Override
protected void addNotify() {
hashsetResults.addObserver(this);
}
@Override
protected boolean createKeys(List<BlackboardArtifact> list) {
for (long l : children) {
try {
//TODO: bulk artifact gettings
list.add(skCase.getBlackboardArtifact(l));
} catch (TskException ex) {
logger.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
}
}
protected void removeNotify() {
hashsetResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<Long> list) {
list.addAll(hashsetResults.getArtifactIds(hashsetName));
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact artifact) {
return new BlackboardArtifactNode(artifact);
protected Node createNodeForKey(Long id) {
try {
BlackboardArtifact art = skCase.getBlackboardArtifact(id);
return new BlackboardArtifactNode(art);
} catch (TskException ex) {
logger.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
}
return null;
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
}
}

214
Core/src/org/sleuthkit/autopsy/datamodel/InterestingHits.java
View File

@ -19,12 +19,18 @@
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Observable;
import java.util.Observer;
import java.util.Set;
import java.util.logging.Level;
@ -34,11 +40,14 @@ import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.Exceptions;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskException;
import org.sleuthkit.datamodel.TskCoreException;
public class InterestingHits implements AutopsyVisitableItem {
@ -48,51 +57,66 @@ public class InterestingHits implements AutopsyVisitableItem {
private static final String DISPLAY_NAME = NbBundle.getMessage(InterestingHits.class, "InterestingHits.displayName.text");
private static final Logger logger = Logger.getLogger(InterestingHits.class.getName());
private SleuthkitCase skCase;
private Map<String, Set<Long>> interestingItemsMap;
private InterestingResults interestingResults = new InterestingResults();
public InterestingHits(SleuthkitCase skCase) {
this.skCase = skCase;
interestingItemsMap = new LinkedHashMap<>();
interestingResults.update();
}
@SuppressWarnings("deprecation")
private void initArtifacts() {
interestingItemsMap.clear();
loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
}
private class InterestingResults extends Observable {
private Map<String, Set<Long>> interestingItemsMap = new LinkedHashMap<>();
/*
* Reads the artifacts of specified type, grouped by Set, and loads into the interestingItemsMap
*/
private void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) {
ResultSet rs = null;
try {
int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
int artId = artType.getTypeID();
String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
+ "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "attribute_type_id=" + setNameId //NON-NLS
+ " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
+ " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
rs = skCase.runQuery(query);
while (rs.next()) {
String value = rs.getString("value_text"); //NON-NLS
long artifactId = rs.getLong("artifact_id"); //NON-NLS
if (!interestingItemsMap.containsKey(value)) {
interestingItemsMap.put(value, new HashSet<Long>());
}
interestingItemsMap.get(value).add(artifactId);
}
} catch (SQLException ex) {
logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
public List<String> getSetNames() {
List<String> setNames = new ArrayList<>(interestingItemsMap.keySet());
Collections.sort(setNames);
return setNames;
}
finally {
if (rs != null) {
try {
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Error closing result set after getting artifacts", ex); //NON-NLS
public Set<Long> getArtifactIds(String setName) {
return interestingItemsMap.get(setName);
}
public void update() {
interestingItemsMap.clear();
loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
setChanged();
notifyObservers();
}
/*
* Reads the artifacts of specified type, grouped by Set, and loads into the interestingItemsMap
*/
private void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) {
ResultSet rs = null;
try {
int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
int artId = artType.getTypeID();
String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
+ "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "attribute_type_id=" + setNameId //NON-NLS
+ " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
+ " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
rs = skCase.runQuery(query);
while (rs.next()) {
String value = rs.getString("value_text"); //NON-NLS
long artifactId = rs.getLong("artifact_id"); //NON-NLS
if (!interestingItemsMap.containsKey(value)) {
interestingItemsMap.put(value, new HashSet<Long>());
}
interestingItemsMap.get(value).add(artifactId);
}
} catch (SQLException ex) {
logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
}
finally {
if (rs != null) {
try {
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Error closing result set after getting artifacts", ex); //NON-NLS
}
}
}
}
@ -106,14 +130,13 @@ public class InterestingHits implements AutopsyVisitableItem {
/**
* Node for the interesting items
*/
public class InterestingHitsRootNode extends DisplayableItemNode {
public class RootNode extends DisplayableItemNode {
public InterestingHitsRootNode() {
super(Children.create(new InterestingHitsRootChildren(), true), Lookups.singleton(DISPLAY_NAME));
public RootNode() {
super(Children.create(new SetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
super.setName(INTERESTING_ITEMS);
super.setDisplayName(DISPLAY_NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
initArtifacts();
}
@Override
@ -144,27 +167,73 @@ public class InterestingHits implements AutopsyVisitableItem {
}
}
private class InterestingHitsRootChildren extends ChildFactory<String> {
private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
/* This should probably be in the top-level class, but the factory has nice methods
* for its startup and shutdown, so it seemed like a cleaner place to register the
* property change listener.
*/
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestEvent.DATA.toString())) {
if ((((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT) ||
(((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)) {
interestingResults.update();
}
}
else if (eventType.equals(IngestManager.IngestEvent.INGEST_JOB_COMPLETED.toString())
|| eventType.equals(IngestManager.IngestEvent.INGEST_JOB_CANCELLED.toString())) {
interestingResults.update();
}
}
};
@Override
protected void addNotify() {
IngestManager.addPropertyChangeListener(pcl);
interestingResults.update();
interestingResults.addObserver(this);
}
@Override
protected void removeNotify() {
IngestManager.removePropertyChangeListener(pcl);
interestingResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<String> list) {
list.addAll(interestingItemsMap.keySet());
list.addAll(interestingResults.getSetNames());
return true;
}
@Override
protected Node createNodeForKey(String key) {
return new InterestingHitsSetNode(key, interestingItemsMap.get(key));
return new SetNameNode(key);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
public class InterestingHitsSetNode extends DisplayableItemNode {
public InterestingHitsSetNode(String name, Set<Long> children) {
super(Children.create(new InterestingHitsSetChildren(children), true), Lookups.singleton(name));
super.setName(name);
super.setDisplayName(name + " (" + children.size() + ")");
public class SetNameNode extends DisplayableItemNode implements Observer {
private String setName;
public SetNameNode(String setName) {//, Set<Long> children) {
super(Children.create(new HitFactory(setName), true), Lookups.singleton(setName));
this.setName = setName;
super.setName(setName);
updateDisplayName();
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
interestingResults.addObserver(this);
}
private void updateDisplayName() {
super.setDisplayName(setName + " (" + interestingResults.getArtifactIds(setName).size() + ")");
}
@Override
@ -193,32 +262,43 @@ public class InterestingHits implements AutopsyVisitableItem {
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
private class InterestingHitsSetChildren extends ChildFactory<BlackboardArtifact> {
private class HitFactory extends ChildFactory<Long> implements Observer {
private String setName;
private Set<Long> children;
private InterestingHitsSetChildren(Set<Long> children) {
private HitFactory(String setName) {
super();
this.children = children;
this.setName = setName;
interestingResults.addObserver(this);
}
@Override
protected boolean createKeys(List<BlackboardArtifact> list) {
for (long l : children) {
try {
list.add(skCase.getBlackboardArtifact(l));
} catch (TskException ex) {
logger.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
}
protected boolean createKeys(List<Long> list) {
for (long l : interestingResults.getArtifactIds(setName)) {
list.add(l);
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact artifact) {
return new BlackboardArtifactNode(artifact);
protected Node createNodeForKey(Long l) {
try {
return new BlackboardArtifactNode(skCase.getBlackboardArtifact(l));
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
return null;
}
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
}

460
Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java
View File

@ -18,13 +18,18 @@
*/
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Observable;
import java.util.Observer;
import java.util.Set;
import java.util.logging.Level;
import org.openide.util.NbBundle;
@ -34,6 +39,8 @@ import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.SleuthkitCase;
@ -54,101 +61,128 @@ public class KeywordHits implements AutopsyVisitableItem {
.getMessage(KeywordHits.class, "KeywordHits.simpleLiteralSearch.text");
public static final String SIMPLE_REGEX_SEARCH = NbBundle
.getMessage(KeywordHits.class, "KeywordHits.singleRegexSearch.text");
// Map from String (list name) to Map from string (keyword) to set<long> (artifact ids)
private Map<String, Map<String, Set<Long>>> topLevelMap;
private Map<String, Map<String, Set<Long>>> listsMap;
// Map from String (literal keyword) to set<long> (artifact ids)
private Map<String, Set<Long>> literalMap;
// Map from String (regex keyword) to set<long> (artifact ids);
private Map<String, Set<Long>> regexMap;
Map<Long, Map<Long, String>> artifacts;
private KeywordResults keywordResults;
public KeywordHits(SleuthkitCase skCase) {
this.skCase = skCase;
artifacts = new LinkedHashMap<>();
listsMap = new LinkedHashMap<>();
literalMap = new LinkedHashMap<>();
regexMap = new LinkedHashMap<>();
topLevelMap = new LinkedHashMap<>();
keywordResults = new KeywordResults();
}
private void initMaps() {
topLevelMap.clear();
topLevelMap.put(SIMPLE_LITERAL_SEARCH, literalMap);
topLevelMap.put(SIMPLE_REGEX_SEARCH, regexMap);
listsMap.clear();
regexMap.clear();
literalMap.clear();
for (Map.Entry<Long, Map<Long, String>> art : artifacts.entrySet()) {
long id = art.getKey();
Map<Long, String> attributes = art.getValue();
// I think we can use attributes.remove(...) here?
String listName = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()));
String word = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()));
String reg = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID()));
if (listName != null) {
if (!listsMap.containsKey(listName)) {
listsMap.put(listName, new LinkedHashMap<String, Set<Long>>());
}
if (!listsMap.get(listName).containsKey(word)) {
listsMap.get(listName).put(word, new HashSet<Long>());
}
listsMap.get(listName).get(word).add(id);
} else if (reg != null) {
if (!regexMap.containsKey(reg)) {
regexMap.put(reg, new HashSet<Long>());
}
regexMap.get(reg).add(id);
} else {
if (!literalMap.containsKey(word)) {
literalMap.put(word, new HashSet<Long>());
}
literalMap.get(word).add(id);
}
topLevelMap.putAll(listsMap);
private final class KeywordResults extends Observable {
// Map from listName/Type to Map of keyword to set of artifact Ids
private Map<String, Map<String, Set<Long>>> topLevelMap;
KeywordResults() {
topLevelMap = new LinkedHashMap<>();
update();
}
List<String> getListNames() {
List <String> names = new ArrayList<>(topLevelMap.keySet());
// this causes the "Single ..." terms to be in the middle of the results,
// which is wierd. Make a custom comparator or do something else to maek them on top
//Collections.sort(names);
return names;
}
List<String> getKeywords(String listName) {
List <String> keywords = new ArrayList<>(topLevelMap.get(listName).keySet());
Collections.sort(keywords);
return keywords;
}
Set<Long> getArtifactIds(String listName, String keyword) {
return topLevelMap.get(listName).get(keyword);
}
}
@SuppressWarnings("deprecation")
private void initArtifacts() {
artifacts.clear();
ResultSet rs = null;
try {
int setId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
int wordId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID();
int regexId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID();
int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID();
String query = "SELECT blackboard_attributes.value_text,blackboard_attributes.artifact_id," //NON-NLS
+ "blackboard_attributes.attribute_type_id FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "(blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id AND " //NON-NLS
+ "blackboard_artifacts.artifact_type_id=" + artId //NON-NLS
+ ") AND (attribute_type_id=" + setId + " OR " //NON-NLS
+ "attribute_type_id=" + wordId + " OR " //NON-NLS
+ "attribute_type_id=" + regexId + ")"; //NON-NLS
rs = skCase.runQuery(query);
while (rs.next()) {
String value = rs.getString("value_text"); //NON-NLS
long artifactId = rs.getLong("artifact_id"); //NON-NLS
long typeId = rs.getLong("attribute_type_id"); //NON-NLS
if (!artifacts.containsKey(artifactId)) {
artifacts.put(artifactId, new LinkedHashMap<Long, String>());
// populate maps based on artifactIds
void populateMaps(Map<Long, Map<Long, String>> artifactIds) {
topLevelMap.clear();
Map<String, Map<String, Set<Long>>> listsMap = new LinkedHashMap<>();
// Map from String (literal keyword) to set<long> (artifact ids)
Map<String, Set<Long>> literalMap = new LinkedHashMap<>();
// Map from String (regex keyword) to set<long> (artifact ids);
Map<String, Set<Long>> regexMap = new LinkedHashMap<>();
// top-level nodes
topLevelMap.put(SIMPLE_LITERAL_SEARCH, literalMap);
topLevelMap.put(SIMPLE_REGEX_SEARCH, regexMap);
for (Map.Entry<Long, Map<Long, String>> art : artifactIds.entrySet()) {
long id = art.getKey();
Map<Long, String> attributes = art.getValue();
// I think we can use attributes.remove(...) here?
String listName = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()));
String word = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()));
String reg = attributes.get(Long.valueOf(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID()));
if (listName != null) {
if (!listsMap.containsKey(listName)) {
listsMap.put(listName, new LinkedHashMap<String, Set<Long>>());
}
if (!listsMap.get(listName).containsKey(word)) {
listsMap.get(listName).put(word, new HashSet<Long>());
}
listsMap.get(listName).get(word).add(id);
} else if (reg != null) {
if (!regexMap.containsKey(reg)) {
regexMap.put(reg, new HashSet<Long>());
}
regexMap.get(reg).add(id);
} else {
if (!literalMap.containsKey(word)) {
literalMap.put(word, new HashSet<Long>());
}
literalMap.get(word).add(id);
}
if (!value.equals("")) {
artifacts.get(artifactId).put(typeId, value);
}
topLevelMap.putAll(listsMap);
}
} catch (SQLException ex) {
logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
} finally {
if (rs != null) {
try {
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Error closing result set after getting keyword hits", ex); //NON-NLS
setChanged();
notifyObservers();
}
public void update() {
Map<Long, Map<Long, String>> artifactIds = new LinkedHashMap<>();
ResultSet rs = null;
try {
int setId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
int wordId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID();
int regexId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID();
int artId = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID();
String query = "SELECT blackboard_attributes.value_text,blackboard_attributes.artifact_id," //NON-NLS
+ "blackboard_attributes.attribute_type_id FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
+ "(blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id AND " //NON-NLS
+ "blackboard_artifacts.artifact_type_id=" + artId //NON-NLS
+ ") AND (attribute_type_id=" + setId + " OR " //NON-NLS
+ "attribute_type_id=" + wordId + " OR " //NON-NLS
+ "attribute_type_id=" + regexId + ")"; //NON-NLS
rs = skCase.runQuery(query);
while (rs.next()) {
String value = rs.getString("value_text"); //NON-NLS
long artifactId = rs.getLong("artifact_id"); //NON-NLS
long typeId = rs.getLong("attribute_type_id"); //NON-NLS
if (!artifactIds.containsKey(artifactId)) {
artifactIds.put(artifactId, new LinkedHashMap<Long, String>());
}
if (!value.equals("")) {
artifactIds.get(artifactId).put(typeId, value);
}
}
} catch (SQLException ex) {
logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
} finally {
if (rs != null) {
try {
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Error closing result set after getting keyword hits", ex); //NON-NLS
}
}
}
populateMaps(artifactIds);
}
}
@ -157,15 +191,14 @@ public class KeywordHits implements AutopsyVisitableItem {
return v.visit(this);
}
public class KeywordHitsRootNode extends DisplayableItemNode {
// Created by CreateAutopsyNodeVisitor
public class RootNode extends DisplayableItemNode {
public KeywordHitsRootNode() {
super(Children.create(new KeywordHitsRootChildren(), true), Lookups.singleton(KEYWORD_HITS));
public RootNode() {
super(Children.create(new ListFactory(), true), Lookups.singleton(KEYWORD_HITS));
super.setName(NAME);
super.setDisplayName(KEYWORD_HITS);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/keyword_hits.png"); //NON-NLS
initArtifacts();
initMaps();
}
@Override
@ -196,36 +229,74 @@ public class KeywordHits implements AutopsyVisitableItem {
}
}
private class KeywordHitsRootChildren extends ChildFactory<String> {
private class ListFactory extends ChildFactory.Detachable<String> implements Observer {
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestEvent.DATA.toString())) {
if (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT) {
keywordResults.update();
}
}
else if (eventType.equals(IngestManager.IngestEvent.INGEST_JOB_COMPLETED.toString())
|| eventType.equals(IngestManager.IngestEvent.INGEST_JOB_CANCELLED.toString())) {
keywordResults.update();
}
}
};
@Override
protected void addNotify() {
IngestManager.addPropertyChangeListener(pcl);
keywordResults.update();
keywordResults.addObserver(this);
}
@Override
protected void removeNotify() {
IngestManager.removePropertyChangeListener(pcl);
keywordResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<String> list) {
list.addAll(topLevelMap.keySet());
list.addAll(keywordResults.getListNames());
return true;
}
@Override
protected Node createNodeForKey(String key) {
return new KeywordHitsListNode(key, topLevelMap.get(key));
return new ListNode(key);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
public class KeywordHitsListNode extends DisplayableItemNode {
public class ListNode extends DisplayableItemNode implements Observer {
private String listName;
private String name;
private Map<String, Set<Long>> children;
public KeywordHitsListNode(String name, Map<String, Set<Long>> children) {
super(Children.create(new KeywordHitsListChildren(children), true), Lookups.singleton(name));
super.setName(name);
int totalDescendants = 0;
for (Set<Long> grandChildren : children.values()) {
totalDescendants += grandChildren.size();
}
super.setDisplayName(name + " (" + totalDescendants + ")");
public ListNode(String listName) {
super(Children.create(new TermFactory(listName), true), Lookups.singleton(listName));
super.setName(listName);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/keyword_hits.png"); //NON-NLS
this.name = name;
this.children = children;
this.listName = listName;
updateDisplayName();
keywordResults.addObserver(this);
}
private void updateDisplayName() {
int totalDescendants = 0;
for (String word : keywordResults.getKeywords(listName)) {
Set<Long> ids = keywordResults.getArtifactIds(listName, word);
totalDescendants += ids.size();
}
super.setDisplayName(listName + " (" + totalDescendants + ")");
}
@Override
@ -240,13 +311,13 @@ public class KeywordHits implements AutopsyVisitableItem {
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.listName.name"),
NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.listName.displayName"),
NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.listName.desc"),
name));
listName));
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.numChildren.name"),
NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.numChildren.displayName"),
NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.numChildren.desc"),
children.size()));
keywordResults.getKeywords(listName).size()));
return s;
}
@ -260,39 +331,71 @@ public class KeywordHits implements AutopsyVisitableItem {
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
private class KeywordHitsListChildren extends ChildFactory<String> {
private Map<String, Set<Long>> children;
private KeywordHitsListChildren(Map<String, Set<Long>> children) {
private class TermFactory extends ChildFactory.Detachable<String> implements Observer {
private String setName;
private TermFactory(String setName) {
super();
this.children = children;
this.setName = setName;
}
@Override
protected void addNotify() {
keywordResults.addObserver(this);
}
@Override
protected void removeNotify() {
keywordResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<String> list) {
list.addAll(children.keySet());
list.addAll(keywordResults.getKeywords(setName));
return true;
}
@Override
protected Node createNodeForKey(String key) {
return new KeywordHitsKeywordNode(key, children.get(key));
return new TermNode(setName, key);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
public class KeywordHitsKeywordNode extends DisplayableItemNode {
public class TermNode extends DisplayableItemNode implements Observer {
private Set<Long> children;
private String setName;
private String keyword;
public KeywordHitsKeywordNode(String name, Set<Long> children) {
super(Children.create(new KeywordHitsKeywordChildren(children), true), Lookups.singleton(name));
super.setName(name);
super.setDisplayName(name + " (" + children.size() + ")");
public TermNode(String setName, String keyword) {
super(Children.create(new HitsFactory (setName, keyword), true), Lookups.singleton(keyword));
super.setName(keyword);
this.setName = setName;
this.keyword = keyword;
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/keyword_hits.png"); //NON-NLS
this.children = children;
updateDisplayName();
keywordResults.addObserver(this);
}
private void updateDisplayName() {
super.setDisplayName(keyword + " (" + keywordResults.getArtifactIds(setName, keyword).size() + ")");
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
@Override
@ -322,70 +425,83 @@ public class KeywordHits implements AutopsyVisitableItem {
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.filesWithHits.name"),
NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.filesWithHits.displayName"),
NbBundle.getMessage(this.getClass(), "KeywordHits.createSheet.filesWithHits.desc"),
children.size()));
keywordResults.getArtifactIds(setName, keyword).size()));
return s;
}
}
private class KeywordHitsKeywordChildren extends ChildFactory<BlackboardArtifact> {
private Set<Long> children;
private KeywordHitsKeywordChildren(Set<Long> children) {
public class HitsFactory extends ChildFactory.Detachable<Long> implements Observer {
private String keyword;
private String setName;
public HitsFactory(String setName, String keyword) {
super();
this.children = children;
this.setName = setName;
this.keyword = keyword;
}
@Override
protected void addNotify() {
keywordResults.addObserver(this);
}
@Override
protected boolean createKeys(List<BlackboardArtifact> list) {
List<BlackboardArtifact> tempList = new ArrayList<>();
for (long l : children) {
try {
//TODO: bulk artifact gettings
tempList.add(skCase.getBlackboardArtifact(l));
} catch (TskException ex) {
logger.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
}
}
list.addAll(tempList);
protected void removeNotify() {
keywordResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<Long> list) {
list.addAll(keywordResults.getArtifactIds(setName, keyword));
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifact artifact) {
BlackboardArtifactNode n = new BlackboardArtifactNode(artifact);
AbstractFile file;
protected Node createNodeForKey(Long artifactId) {
try {
file = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID());
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "TskCoreException while constructing BlackboardArtifact Node from KeywordHitsKeywordChildren"); //NON-NLS
return n;
BlackboardArtifact art = skCase.getBlackboardArtifact(artifactId);
BlackboardArtifactNode n = new BlackboardArtifactNode(art);
AbstractFile file;
try {
file = art.getSleuthkitCase().getAbstractFileById(art.getObjectID());
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "TskCoreException while constructing BlackboardArtifact Node from KeywordHitsKeywordChildren"); //NON-NLS
return n;
}
n.addNodeProperty(new NodeProperty<>(
NbBundle.getMessage(this.getClass(), "KeywordHits.createNodeForKey.modTime.name"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.modTime.displayName"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.modTime.desc"),
ContentUtils.getStringTime(file.getMtime(), file)));
n.addNodeProperty(new NodeProperty<>(
NbBundle.getMessage(this.getClass(), "KeywordHits.createNodeForKey.accessTime.name"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.accessTime.displayName"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.accessTime.desc"),
ContentUtils.getStringTime(file.getAtime(), file)));
n.addNodeProperty(new NodeProperty<>(
NbBundle.getMessage(this.getClass(), "KeywordHits.createNodeForKey.chgTime.name"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.chgTime.displayName"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.chgTime.desc"),
ContentUtils.getStringTime(file.getCtime(), file)));
return n;
} catch (TskException ex) {
logger.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
}
return null;
}
n.addNodeProperty(new NodeProperty<>(
NbBundle.getMessage(this.getClass(), "KeywordHits.createNodeForKey.modTime.name"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.modTime.displayName"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.modTime.desc"),
ContentUtils.getStringTime(file.getMtime(), file)));
n.addNodeProperty(new NodeProperty<>(
NbBundle.getMessage(this.getClass(), "KeywordHits.createNodeForKey.accessTime.name"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.accessTime.displayName"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.accessTime.desc"),
ContentUtils.getStringTime(file.getAtime(), file)));
n.addNodeProperty(new NodeProperty<>(
NbBundle.getMessage(this.getClass(), "KeywordHits.createNodeForKey.chgTime.name"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.chgTime.displayName"),
NbBundle.getMessage(this.getClass(),
"KeywordHits.createNodeForKey.chgTime.desc"),
ContentUtils.getStringTime(file.getCtime(), file)));
return n;
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
}

2
Core/src/org/sleuthkit/autopsy/datamodel/ResultsNode.java
View File

@ -37,7 +37,7 @@ public class ResultsNode extends DisplayableItemNode {
new HashsetHits(sleuthkitCase),
new EmailExtracted(sleuthkitCase),
new InterestingHits(sleuthkitCase),
new TagsNodeKey())), Lookups.singleton(NAME));
new Tags())), Lookups.singleton(NAME));
setName(NAME);
setDisplayName(NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/results.png"); //NON-NLS

52
Core/src/org/sleuthkit/autopsy/datamodel/RootContentChildren.java
View File

@ -60,56 +60,4 @@ public class RootContentChildren extends AbstractContentChildren<Object> {
refreshKey(key);
}
}
//TODO use visitor
//TODO this will be removed, Children should be listening for interesting
//events from datamodel and calling refresh / refreshKey() themselves
public void refreshKeys(BlackboardArtifact.ARTIFACT_TYPE... types) {
for (Object o : contentKeys) {
for (BlackboardArtifact.ARTIFACT_TYPE type : types) {
switch (type) {
case TSK_HASHSET_HIT:
if (o instanceof HashsetHits)
this.refreshKey(o);
break;
case TSK_KEYWORD_HIT:
if (o instanceof KeywordHits)
this.refreshKey(o);
break;
case TSK_EMAIL_MSG:
if (o instanceof EmailExtracted)
this.refreshKey(o);
break;
case TSK_TAG_FILE:
case TSK_TAG_ARTIFACT:
if (o instanceof TagsNodeKey)
this.refreshKey(o);
break;
case TSK_INTERESTING_FILE_HIT:
case TSK_INTERESTING_ARTIFACT_HIT:
if (o instanceof InterestingHits)
this.refreshKey(o);
break;
default:
if (o instanceof ExtractedContent)
this.refreshKey(o);
break;
}
}
if (types.length == 0) {
if (o instanceof HashsetHits)
this.refreshKey(o);
else if (o instanceof KeywordHits)
this.refreshKey(o);
else if (o instanceof TagsNodeKey)
this.refreshKey(o);
else if (o instanceof EmailExtracted)
this.refreshKey(o);
else if (o instanceof InterestingHits)
this.refreshKey(o);
else if (o instanceof ExtractedContent)
this.refreshKey(o);
}
}
}
}

138
Core/src/org/sleuthkit/autopsy/datamodel/TagNameNode.java
View File

@ -1,138 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.util.List;
import java.util.logging.Level;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.directorytree.BlackboardArtifactTagTypeNode;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Instances of this class are elements of Node hierarchies consisting of
* content and blackboard artifact tags, grouped first by tag type, then by tag
* name.
*/
public class TagNameNode extends DisplayableItemNode {
private static final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
private static final String BOOKMARK_TAG_ICON_PATH = "org/sleuthkit/autopsy/images/star-bookmark-icon-16.png"; //NON-NLS
private final TagName tagName;
private static final String CONTENT_TAG_TYPE_NODE_KEY = NbBundle.getMessage(TagNameNode.class,
"TagNameNode.contentTagTypeNodeKey.text");
private static final String BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY = NbBundle.getMessage(TagNameNode.class,
"TagNameNode.bbArtTagTypeNodeKey.text");
public TagNameNode(TagName tagName) {
super(Children.create(new TagTypeNodeFactory(tagName), true), Lookups.singleton(
NbBundle.getMessage(TagNameNode.class, "TagNameNode.namePlusTags.text", tagName.getDisplayName())));
this.tagName = tagName;
long tagsCount = 0;
try {
tagsCount = Case.getCurrentCase().getServices().getTagsManager().getContentTagsCountByTagName(tagName);
tagsCount += Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsCountByTagName(tagName);
} catch (TskCoreException ex) {
Logger.getLogger(TagNameNode.class.getName()).log(Level.SEVERE, "Failed to get tags count for " + tagName.getDisplayName() + " tag name", ex); //NON-NLS
}
super.setName(tagName.getDisplayName());
super.setDisplayName(tagName.getDisplayName() + " (" + tagsCount + ")");
if (tagName.getDisplayName().equals(NbBundle.getMessage(this.getClass(), "TagNameNode.bookmark.text"))) {
setIconBaseWithExtension(BOOKMARK_TAG_ICON_PATH);
} else {
setIconBaseWithExtension(ICON_PATH);
}
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "TagNameNode.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "TagNameNode.createSheet.name.displayName"),
tagName.getDescription(),
getName()));
return propertySheet;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
// See classes derived from DisplayableItemNodeVisitor<AbstractNode>
// for behavior added using the Visitor pattern.
return v.visit(this);
}
@Override
public boolean isLeafTypeNode() {
return false;
}
private static class TagTypeNodeFactory extends ChildFactory<String> {
private final TagName tagName;
TagTypeNodeFactory(TagName tagName) {
this.tagName = tagName;
}
@Override
protected boolean createKeys(List<String> keys) {
keys.add(CONTENT_TAG_TYPE_NODE_KEY);
keys.add(BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY);
return true;
}
@Override
protected Node createNodeForKey(String key) {
// switch (key) {
// case CONTENT_TAG_TYPE_NODE_KEY:
// return new ContentTagTypeNode(tagName);
// case BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY:
// return new BlackboardArtifactTagTypeNode(tagName);
// default:
// Logger.getLogger(TagNameNode.class.getName()).log(Level.SEVERE, "{0} not a recognized key", key);
// return null;
// }
// converted switch to if/else due to non-constant strings in case key
if (CONTENT_TAG_TYPE_NODE_KEY.equals(key)) {
return new ContentTagTypeNode(tagName);
} else if (BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY.equals(key)) {
return new BlackboardArtifactTagTypeNode(tagName);
} else {
Logger.getLogger(TagNameNode.class.getName()).log(Level.SEVERE, "{0} not a recognized key", key); //NON-NLS
return null;
}
}
}
}

446
Core/src/org/sleuthkit/autopsy/datamodel/Tags.java Executable file
View File

@ -0,0 +1,446 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.util.Collections;
import java.util.List;
import java.util.Observable;
import java.util.Observer;
import java.util.logging.Level;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.services.TagsManager;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardArtifactTag;
import org.sleuthkit.datamodel.ContentTag;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Instances of this class act as keys for use by instances of the
* RootContentChildren class. RootContentChildren is a NetBeans child node
* factory built on top of the NetBeans Children.Keys class.
*/
public class Tags implements AutopsyVisitableItem {
// Creation of a RootNode object corresponding to a Tags object is done
// by a CreateAutopsyNodeVisitor dispatched from the AbstractContentChildren
// override of Children.Keys<T>.createNodes().
private TagResults tagResults = new TagResults();
private final String DISPLAY_NAME = NbBundle.getMessage(RootNode.class, "TagsNode.displayName.text");
private final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
@Override
public <T> T accept(AutopsyItemVisitor<T> v) {
return v.visit(this);
}
/**
* This class largely does nothing except act as a top-level object that
* the other nodes can listen to. This mimics what other nodes have (keword search, etc.),
* but theirs stores data.
*/
private class TagResults extends Observable {
public void update() {
setChanged();
notifyObservers();
}
}
/**
* Instances of this class are the root nodes of tree that is a sub-tree of
* the Autopsy presentation of the SleuthKit data model. The sub-tree
* consists of content and blackboard artifact tags, grouped first by tag
* type, then by tag name.
*/
public class RootNode extends DisplayableItemNode {
public RootNode() {
super(Children.create(new TagNameNodeFactory(), true), Lookups.singleton(DISPLAY_NAME));
super.setName(DISPLAY_NAME);
super.setDisplayName(DISPLAY_NAME);
this.setIconBaseWithExtension(ICON_PATH);
}
@Override
public boolean isLeafTypeNode() {
return false;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "TagsNode.createSheet.name.name"), NbBundle.getMessage(this.getClass(), "TagsNode.createSheet.name.displayName"), "", getName()));
return propertySheet;
}
}
private class TagNameNodeFactory extends ChildFactory.Detachable<TagName> implements Observer {
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestEvent.DATA.toString())) {
if ((((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT) || ((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE) {
refresh(true);
tagResults.update();
}
} else if (eventType.equals(IngestManager.IngestEvent.INGEST_JOB_COMPLETED.toString()) || eventType.equals(IngestManager.IngestEvent.INGEST_JOB_CANCELLED.toString())) {
refresh(true);
tagResults.update();
}
}
};
@Override
protected void addNotify() {
IngestManager.addPropertyChangeListener(pcl);
tagResults.update();
tagResults.addObserver(this);
}
@Override
protected void removeNotify() {
IngestManager.removePropertyChangeListener(pcl);
tagResults.deleteObserver(this);
}
@Override
protected boolean createKeys(List<TagName> keys) {
try {
List<TagName> tagNamesInUse = Case.getCurrentCase().getServices().getTagsManager().getTagNamesInUse();
Collections.sort(tagNamesInUse);
keys.addAll(tagNamesInUse);
} catch (TskCoreException ex) {
Logger.getLogger(TagNameNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(TagName key) {
return new TagNameNode(key);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
/**
* Instances of this class are elements of Node hierarchies consisting of
* content and blackboard artifact tags, grouped first by tag type, then by tag
* name.
*/
public class TagNameNode extends DisplayableItemNode implements Observer {
private final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
private final String BOOKMARK_TAG_ICON_PATH = "org/sleuthkit/autopsy/images/star-bookmark-icon-16.png"; //NON-NLS
private final TagName tagName;
public TagNameNode(TagName tagName) {
super(Children.create(new TagTypeNodeFactory(tagName), true), Lookups.singleton(NbBundle.getMessage(TagNameNode.class, "TagNameNode.namePlusTags.text", tagName.getDisplayName())));
this.tagName = tagName;
setName(tagName.getDisplayName());
updateDisplayName();
if (tagName.getDisplayName().equals(NbBundle.getMessage(this.getClass(), "TagNameNode.bookmark.text"))) {
setIconBaseWithExtension(BOOKMARK_TAG_ICON_PATH);
} else {
setIconBaseWithExtension(ICON_PATH);
}
tagResults.addObserver(this);
}
private void updateDisplayName() {
long tagsCount = 0;
try {
TagsManager tm = Case.getCurrentCase().getServices().getTagsManager();
tagsCount = tm.getContentTagsCountByTagName(tagName);
tagsCount += tm.getBlackboardArtifactTagsCountByTagName(tagName);
} catch (TskCoreException ex) {
Logger.getLogger(TagNameNode.class.getName()).log(Level.SEVERE, "Failed to get tags count for " + tagName.getDisplayName() + " tag name", ex); //NON-NLS
}
setDisplayName(tagName.getDisplayName() + " (" + tagsCount + ")");
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "TagNameNode.createSheet.name.name"), NbBundle.getMessage(this.getClass(), "TagNameNode.createSheet.name.displayName"), tagName.getDescription(), getName()));
return propertySheet;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
// See classes derived from DisplayableItemNodeVisitor<AbstractNode>
// for behavior added using the Visitor pattern.
return v.visit(this);
}
@Override
public boolean isLeafTypeNode() {
return false;
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
/**
* Creates nodes for the two types of tags: file and artifact.
* Does not need observer / messages since it always has the same children
*/
private class TagTypeNodeFactory extends ChildFactory<String> {
private final TagName tagName;
private final String CONTENT_TAG_TYPE_NODE_KEY = NbBundle.getMessage(TagNameNode.class, "TagNameNode.contentTagTypeNodeKey.text");
private final String BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY = NbBundle.getMessage(TagNameNode.class, "TagNameNode.bbArtTagTypeNodeKey.text");
TagTypeNodeFactory(TagName tagName) {
super();
this.tagName = tagName;
}
@Override
protected boolean createKeys(List<String> keys) {
keys.add(CONTENT_TAG_TYPE_NODE_KEY);
keys.add(BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY);
return true;
}
@Override
protected Node createNodeForKey(String key) {
if (CONTENT_TAG_TYPE_NODE_KEY.equals(key)) {
return new ContentTagTypeNode(tagName);
} else if (BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY.equals(key)) {
return new BlackboardArtifactTagTypeNode(tagName);
} else {
Logger.getLogger(TagNameNode.class.getName()).log(Level.SEVERE, "{0} not a recognized key", key); //NON-NLS
return null;
}
}
}
private final String CONTENT_DISPLAY_NAME = NbBundle.getMessage(ContentTagTypeNode.class, "ContentTagTypeNode.displayName.text");
/**
* Node for the content tags. Children are specific tags.
* Instances of this class are are elements of a directory tree sub-tree
* consisting of content and blackboard artifact tags, grouped first by tag
* type, then by tag name.
*/
public class ContentTagTypeNode extends DisplayableItemNode implements Observer {
private final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
private TagName tagName;
public ContentTagTypeNode(TagName tagName) {
super(Children.create(new ContentTagNodeFactory(tagName), true), Lookups.singleton(tagName.getDisplayName() + " " + CONTENT_DISPLAY_NAME));
this.tagName = tagName;
super.setName(CONTENT_DISPLAY_NAME);
updateDisplayName();
this.setIconBaseWithExtension(ICON_PATH);
tagResults.addObserver(this);
}
private void updateDisplayName() {
long tagsCount = 0;
try {
tagsCount = Case.getCurrentCase().getServices().getTagsManager().getContentTagsCountByTagName(tagName);
} catch (TskCoreException ex) {
Logger.getLogger(ContentTagTypeNode.class.getName()).log(Level.SEVERE, "Failed to get content tags count for " + tagName.getDisplayName() + " tag name", ex); //NON-NLS
}
super.setDisplayName(CONTENT_DISPLAY_NAME + " (" + tagsCount + ")");
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "ContentTagTypeNode.createSheet.name.name"), NbBundle.getMessage(this.getClass(), "ContentTagTypeNode.createSheet.name.displayName"), "", getName()));
return propertySheet;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public boolean isLeafTypeNode() {
return true;
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
private class ContentTagNodeFactory extends ChildFactory<ContentTag> implements Observer {
private final TagName tagName;
ContentTagNodeFactory(TagName tagName) {
super();
this.tagName = tagName;
tagResults.addObserver(this);
}
@Override
protected boolean createKeys(List<ContentTag> keys) {
// Use the content tags bearing the specified tag name as the keys.
try {
keys.addAll(Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tagName));
} catch (TskCoreException ex) {
Logger.getLogger(ContentTagNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(ContentTag key) {
// The content tags to be wrapped are used as the keys.
return new ContentTagNode(key);
}
@Override
public void update(Observable o, Object arg) {
refresh(true);
}
}
private final String ARTIFACT_DISPLAY_NAME = NbBundle.getMessage(BlackboardArtifactTagTypeNode.class, "BlackboardArtifactTagTypeNode.displayName.text");
/**
* Instances of this class are elements in a sub-tree of the Autopsy
* presentation of the SleuthKit data model. The sub-tree consists of content
* and blackboard artifact tags, grouped first by tag type, then by tag name.
*/
public class BlackboardArtifactTagTypeNode extends DisplayableItemNode implements Observer {
private TagName tagName;
private final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
public BlackboardArtifactTagTypeNode(TagName tagName) {
super(Children.create(new BlackboardArtifactTagNodeFactory(tagName), true), Lookups.singleton(tagName.getDisplayName() + " " + ARTIFACT_DISPLAY_NAME));
this.tagName = tagName;
super.setName(ARTIFACT_DISPLAY_NAME);
this.setIconBaseWithExtension(ICON_PATH);
updateDisplayName();
tagResults.addObserver(this);
}
private void updateDisplayName() {
long tagsCount = 0;
try {
tagsCount = Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsCountByTagName(tagName);
} catch (TskCoreException ex) {
Logger.getLogger(BlackboardArtifactTagTypeNode.class.getName()).log(Level.SEVERE, "Failed to get blackboard artifact tags count for " + tagName.getDisplayName() + " tag name", ex); //NON-NLS
}
super.setDisplayName(ARTIFACT_DISPLAY_NAME + " (" + tagsCount + ")");
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "BlackboardArtifactTagTypeNode.createSheet.name.name"), NbBundle.getMessage(this.getClass(), "BlackboardArtifactTagTypeNode.createSheet.name.displayName"), "", getName()));
return propertySheet;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public boolean isLeafTypeNode() {
return true;
}
@Override
public void update(Observable o, Object arg) {
updateDisplayName();
}
}
private class BlackboardArtifactTagNodeFactory extends ChildFactory<BlackboardArtifactTag> {
private final TagName tagName;
BlackboardArtifactTagNodeFactory(TagName tagName) {
super();
this.tagName = tagName;
}
@Override
protected boolean createKeys(List<BlackboardArtifactTag> keys) {
try {
// Use the blackboard artifact tags bearing the specified tag name as the keys.
keys.addAll(Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsByTagName(tagName));
} catch (TskCoreException ex) {
Logger.getLogger(BlackboardArtifactTagNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifactTag key) {
// The blackboard artifact tags to be wrapped are used as the keys.
return new BlackboardArtifactTagNode(key);
}
}
}

96
Core/src/org/sleuthkit/autopsy/datamodel/TagsNode.java
View File

@ -1,96 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.util.List;
import java.util.logging.Level;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Instances of this class are the root nodes of tree that is a sub-tree of the
* Autopsy presentation of the SleuthKit data model. The sub-tree consists of
* content and blackboard artifact tags, grouped first by tag type, then by tag
* name.
*/
class TagsNode extends DisplayableItemNode {
private static final String DISPLAY_NAME = NbBundle.getMessage(TagsNode.class, "TagsNode.displayName.text");
private static final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
public TagsNode() {
super(Children.create(new TagNameNodeFactory(), true), Lookups.singleton(DISPLAY_NAME));
super.setName(DISPLAY_NAME);
super.setDisplayName(DISPLAY_NAME);
this.setIconBaseWithExtension(ICON_PATH);
}
@Override
public boolean isLeafTypeNode() {
return false;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "TagsNode.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "TagsNode.createSheet.name.displayName"),
"",
getName()));
return propertySheet;
}
private static class TagNameNodeFactory extends ChildFactory<TagName> {
@Override
protected boolean createKeys(List<TagName> keys) {
try {
keys.addAll(Case.getCurrentCase().getServices().getTagsManager().getTagNamesInUse());
} catch (TskCoreException ex) {
Logger.getLogger(TagNameNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(TagName key) {
return new TagNameNode(key);
}
}
}

34
Core/src/org/sleuthkit/autopsy/datamodel/TagsNodeKey.java
View File

@ -1,34 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
/**
* Instances of this class act as keys for use by instances of the
* RootContentChildren class. RootContentChildren is a NetBeans child node
* factory built on top of the NetBeans Children.Keys class.
*/
class TagsNodeKey implements AutopsyVisitableItem {
// Creation of a TagsNode object corresponding to a TagsNodeKey object is done
// by a CreateAutopsyNodeVisitor dispatched from the AbstractContentChildren
// override of Children.Keys<T>.createNodes().
@Override
public <T> T accept(AutopsyItemVisitor<T> v) {
return v.visit(this);
}
}

119
Core/src/org/sleuthkit/autopsy/directorytree/BlackboardArtifactTagTypeNode.java
View File

@ -1,119 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.directorytree;
import java.util.List;
import java.util.logging.Level;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactTagNode;
import org.sleuthkit.autopsy.datamodel.ContentTagTypeNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor;
import org.sleuthkit.autopsy.datamodel.NodeProperty;
import org.sleuthkit.datamodel.BlackboardArtifactTag;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Instances of this class are elements in a sub-tree of the Autopsy
* presentation of the SleuthKit data model. The sub-tree consists of content
* and blackboard artifact tags, grouped first by tag type, then by tag name.
*/
public class BlackboardArtifactTagTypeNode extends DisplayableItemNode {
private static final String DISPLAY_NAME = NbBundle.getMessage(BlackboardArtifactTagTypeNode.class,
"BlackboardArtifactTagTypeNode.displayName.text");
private static final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
public BlackboardArtifactTagTypeNode(TagName tagName) {
super(Children.create(new BlackboardArtifactTagNodeFactory(tagName), true), Lookups.singleton(tagName.getDisplayName() + " " + DISPLAY_NAME));
long tagsCount = 0;
try {
tagsCount = Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsCountByTagName(tagName);
}
catch (TskCoreException ex) {
Logger.getLogger(BlackboardArtifactTagTypeNode.class.getName()).log(Level.SEVERE, "Failed to get blackboard artifact tags count for " + tagName.getDisplayName() + " tag name", ex); //NON-NLS
}
super.setName(DISPLAY_NAME);
super.setDisplayName(DISPLAY_NAME + " (" + tagsCount + ")");
this.setIconBaseWithExtension(ICON_PATH);
}
@Override
protected Sheet createSheet() {
Sheet propertySheet = super.createSheet();
Sheet.Set properties = propertySheet.get(Sheet.PROPERTIES);
if (properties == null) {
properties = Sheet.createPropertiesSet();
propertySheet.put(properties);
}
properties.put(new NodeProperty<>(
NbBundle.getMessage(this.getClass(), "BlackboardArtifactTagTypeNode.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "BlackboardArtifactTagTypeNode.createSheet.name.displayName"),
"",
getName()));
return propertySheet;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
@Override
public boolean isLeafTypeNode() {
return true;
}
private static class BlackboardArtifactTagNodeFactory extends ChildFactory<BlackboardArtifactTag> {
private final TagName tagName;
BlackboardArtifactTagNodeFactory(TagName tagName) {
this.tagName = tagName;
}
@Override
protected boolean createKeys(List<BlackboardArtifactTag> keys) {
try {
// Use the blackboard artifact tags bearing the specified tag name as the keys.
keys.addAll(Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsByTagName(tagName));
}
catch (TskCoreException ex) {
Logger.getLogger(BlackboardArtifactTagTypeNode.BlackboardArtifactTagNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifactTag key) {
// The blackboard artifact tags to be wrapped are used as the keys.
return new BlackboardArtifactTagNode(key);
}
}
}

3
Core/src/org/sleuthkit/autopsy/directorytree/Bundle.properties
View File

@ -50,9 +50,6 @@ ImageDetailsPanel.imgTotalSizeValue.text=...
ImageDetailsPanel.imgTotalSizeLabel.text=Total Size:
ImageDetailsPanel.imgHashValue.text=...
ImageDetailsPanel.imgHashLabel.text=Hash Value:
BlackboardArtifactTagTypeNode.displayName.text=Result Tags
BlackboardArtifactTagTypeNode.createSheet.name.name=Name
BlackboardArtifactTagTypeNode.createSheet.name.displayName=Name
ChangeViewAction.menuItem.view=View
ChangeViewAction.menuItem.view.hex=Hex
ChangeViewAction.menuItem.view.string=String

151
Core/src/org/sleuthkit/autopsy/directorytree/Bundle_ja.properties
View File

@ -1,11 +1,11 @@
CTL_DirectoryTreeTopComponent=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30C4\u30EA\u30FC
HINT_DirectoryTreeTopComponent=\u3053\u308C\u306F\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30C4\u30EA\u30FC\u306E\u30A6\u30A3\u30F3\u30C9\u30A6\u3067\u3059
OpenIDE-Module-Name=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30C4\u30EA\u30FC
FileSystemDetailsPanel.imgOffsetLabel.text=\u30A4\u30E1\u30FC\u30B8\u30AA\u30D5\u30BB\u30C3\u30C8\uFF1A
FileSystemDetailsPanel.fsTypeLabel.text=\u30D5\u30A1\u30A4\u30EB\u30B7\u30B9\u30C6\u30E0\u30BF\u30A4\u30D7\uFF1A
FileSystemDetailsPanel.genInfoLabel.text=\u30D5\u30A1\u30A4\u30EB\u4E00\u822C\u60C5\u5831
FileSystemDetailsPanel.jLabel2.text=\u30D0\u30A4\u30C8
FileSystemDetailsPanel.jLabel3.text=\u30D0\u30A4\u30C8
CTL_DirectoryTreeTopComponent=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c4\u30ea\u30fc
HINT_DirectoryTreeTopComponent=\u3053\u308c\u306f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c4\u30ea\u30fc\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u3059
OpenIDE-Module-Name=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c4\u30ea\u30fc
FileSystemDetailsPanel.imgOffsetLabel.text=\u30a4\u30e1\u30fc\u30b8\u30aa\u30d5\u30bb\u30c3\u30c8\uff1a
FileSystemDetailsPanel.fsTypeLabel.text=\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u30bf\u30a4\u30d7\uff1a
FileSystemDetailsPanel.genInfoLabel.text=\u30d5\u30a1\u30a4\u30eb\u4e00\u822c\u60c5\u5831
FileSystemDetailsPanel.jLabel2.text=\u30d0\u30a4\u30c8
FileSystemDetailsPanel.jLabel3.text=\u30d0\u30a4\u30c8
FileSystemDetailsPanel.fsTypeValue.text=...
FileSystemDetailsPanel.imgOffsetValue.text=...
FileSystemDetailsPanel.volumeIDValue.text=...
@ -14,86 +14,83 @@ FileSystemDetailsPanel.blockCountValue.text=...
FileSystemDetailsPanel.rootInumValue.text=...
FileSystemDetailsPanel.firstInumValue.text=...
FileSystemDetailsPanel.lastInumValue.text=...
FileSystemDetailsPanel.jLabel1.text=\u30D5\u30A1\u30A4\u30EB\u8A73\u7D30\u60C5\u5831
FileSystemDetailsPanel.volumeIDLabel.text=\u30DC\u30EA\u30E5\u30FC\u30E0ID\uFF1A
FileSystemDetailsPanel.blockSizeLabel.text=\u30D6\u30ED\u30C3\u30AF\u30B5\u30A4\u30BA\uFF1A
FileSystemDetailsPanel.blockCountLabel.text=\u30D6\u30ED\u30C3\u30AF\u6570\uFF1A
FileSystemDetailsPanel.rootInumLabel.text=\u30EB\u30FC\u30C8\u30E1\u30BF\u30C7\u30FC\u30BF\u30A8\u30F3\u30C8\u30EA\u30FC\uFF1A
FileSystemDetailsPanel.firstInumLabel.text=\u6700\u521D\u306E\u30E1\u30BF\u30C7\u30FC\u30BF\u30A8\u30F3\u30C8\u30EA\u30FC\uFF1A
FileSystemDetailsPanel.lastInumLabel.text=\u6700\u5F8C\u306E\u30E1\u30BF\u30C7\u30FC\u30BF\u30A8\u30F3\u30C8\u30EA\u30FC\uFF1A
FileSystemDetailsPanel.jLabel1.text=\u30d5\u30a1\u30a4\u30eb\u8a73\u7d30\u60c5\u5831
FileSystemDetailsPanel.volumeIDLabel.text=\u30dc\u30ea\u30e5\u30fc\u30e0ID\uff1a
FileSystemDetailsPanel.blockSizeLabel.text=\u30d6\u30ed\u30c3\u30af\u30b5\u30a4\u30ba\uff1a
FileSystemDetailsPanel.blockCountLabel.text=\u30d6\u30ed\u30c3\u30af\u6570\uff1a
FileSystemDetailsPanel.rootInumLabel.text=\u30eb\u30fc\u30c8\u30e1\u30bf\u30c7\u30fc\u30bf\u30a8\u30f3\u30c8\u30ea\u30fc\uff1a
FileSystemDetailsPanel.firstInumLabel.text=\u6700\u521d\u306e\u30e1\u30bf\u30c7\u30fc\u30bf\u30a8\u30f3\u30c8\u30ea\u30fc\uff1a
FileSystemDetailsPanel.lastInumLabel.text=\u6700\u5f8c\u306e\u30e1\u30bf\u30c7\u30fc\u30bf\u30a8\u30f3\u30c8\u30ea\u30fc\uff1a
FileSystemDetailsPanel.OKButton.text=OK
VolumeDetailsPanel.volumeIDLabel.text=\u30DC\u30EA\u30E5\u30FC\u30E0ID\uFF1A
VolumeDetailsPanel.volumeIDLabel.text=\u30dc\u30ea\u30e5\u30fc\u30e0ID\uff1a
VolumeDetailsPanel.volumeIDValue.text=...
VolumeDetailsPanel.startValue.text=...
VolumeDetailsPanel.lengthValue.text=...
VolumeDetailsPanel.descValue.text=...
VolumeDetailsPanel.flagsValue.text=...
VolumeDetailsPanel.startLabel.text=\u6700\u521D\u306E\u30BB\u30AF\u30BF\u30FC\uFF1A
VolumeDetailsPanel.lengthLabel.text=\u30BB\u30AF\u30BF\u30FC\u306E\u9577\u3055\uFF1A
VolumeDetailsPanel.descLabel.text=\u8AAC\u660E\uFF1A
VolumeDetailsPanel.flagsLabel.text=\u30D5\u30E9\u30B0\uFF1A
VolumeDetailsPanel.jLabel1.text=\u30DC\u30EA\u30E5\u30FC\u30E0\u4E00\u822C\u60C5\u5831
VolumeDetailsPanel.startLabel.text=\u6700\u521d\u306e\u30bb\u30af\u30bf\u30fc\uff1a
VolumeDetailsPanel.lengthLabel.text=\u30bb\u30af\u30bf\u30fc\u306e\u9577\u3055\uff1a
VolumeDetailsPanel.descLabel.text=\u8aac\u660e\uff1a
VolumeDetailsPanel.flagsLabel.text=\u30d5\u30e9\u30b0\uff1a
VolumeDetailsPanel.jLabel1.text=\u30dc\u30ea\u30e5\u30fc\u30e0\u4e00\u822c\u60c5\u5831
VolumeDetailsPanel.OKButton.text=OK
ImageDetailsPanel.imageInfoLabel.text=\u30A4\u30E1\u30FC\u30B8\u60C5\u5831
ImageDetailsPanel.imgNameLabel.text=\u540D\u524D\uFF1A
ImageDetailsPanel.imageInfoLabel.text=\u30a4\u30e1\u30fc\u30b8\u60c5\u5831
ImageDetailsPanel.imgNameLabel.text=\u540d\u524d\uff1a
ImageDetailsPanel.imgNameValue.text=...
ImageDetailsPanel.imgTypeLabel.text=\u30BF\u30A4\u30D7\uFF1A
ImageDetailsPanel.imgTypeLabel.text=\u30bf\u30a4\u30d7\uff1a
ImageDetailsPanel.imgTypeValue.text=...
ImageDetailsPanel.OKButton.text=OK
ImageDetailsPanel.imgSectorSizeLabel.text=\u30BB\u30AF\u30BF\u30FC\u30B5\u30A4\u30BA\uFF1A
ImageDetailsPanel.imgSectorSizeLabel.text=\u30bb\u30af\u30bf\u30fc\u30b5\u30a4\u30ba\uff1a
ImageDetailsPanel.imgSectorSizeValue.text=...
ImageDetailsPanel.imgTotalSizeValue.text=...
ImageDetailsPanel.imgTotalSizeLabel.text=\u5408\u8A08\u30B5\u30A4\u30BA\uFF1A
ImageDetailsPanel.imgTotalSizeLabel.text=\u5408\u8a08\u30b5\u30a4\u30ba\uff1a
ImageDetailsPanel.imgHashValue.text=...
ImageDetailsPanel.imgHashLabel.text=\u30CF\u30C3\u30B7\u30E5\u5024\uFF1A
BlackboardArtifactTagTypeNode.displayName.text=\u7D50\u679C\u30BF\u30B0
BlackboardArtifactTagTypeNode.createSheet.name.name=\u540D\u524D
BlackboardArtifactTagTypeNode.createSheet.name.displayName=\u540D\u524D
ChangeViewAction.menuItem.view=\u30D3\u30E5\u30FC
ImageDetailsPanel.imgHashLabel.text=\u30cf\u30c3\u30b7\u30e5\u5024\uff1a
ChangeViewAction.menuItem.view=\u30d3\u30e5\u30fc
ChangeViewAction.menuItem.view.hex=HEX
ChangeViewAction.menuItem.view.string=\u30B9\u30C8\u30EA\u30F3\u30B0
DataResultFilterNode.action.viewFileInDir.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5185\u306E\u30D5\u30A1\u30A4\u30EB\u3092\u8868\u793A
DataResultFilterNode.action.viewSrcFileInDir.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5185\u306E\u30BD\u30FC\u30B9\u30D5\u30A1\u30A4\u30EB\u3092\u8868\u793A
DataResultFilterNode.action.viewInNewWin.text=\u65B0\u898F\u30A6\u30A3\u30F3\u30C9\u30A6\u306B\u8868\u793A
DataResultFilterNode.action.openInExtViewer.text=\u5916\u90E8\u30D3\u30E5\u30FC\u30A2\u3067\u958B\u304F
DataResultFilterNode.action.searchFilesSameMd5.text=\u540C\u3058MD5\u30CF\u30C3\u30B7\u30E5\u3092\u6301\u3064\u30D5\u30A1\u30A4\u30EB\u3092\u691C\u7D22
DataResultFilterNode.action.viewInDir.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30FC\u306B\u8868\u793A
DirectoryTreeFilterNode.action.openFileSrcByAttr.text=\u5C5E\u6027\u306B\u3088\u308B\u30D5\u30A1\u30A4\u30EB\u691C\u7D22\u3092\u958B\u304F
DirectoryTreeFilterNode.action.runIngestMods.text=\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u30E2\u30B8\u30E5\u30FC\u30EB\u3092\u5B9F\u884C
DirectoryTreeTopComponent.title.text=\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30EA\u30B9\u30C6\u30A3\u30F3\u30B0
DirectoryTreeTopComponent.action.viewArtContent.text=\u30A2\u30FC\u30C6\u30A3\u30D5\u30A1\u30AF\u30C8\u30B3\u30F3\u30C6\u30F3\u30C4\u3092\u8868\u793A
DirectoryTreeTopComponent.moduleErr=\u30E2\u30B8\u30E5\u30FC\u30EB\u30A8\u30E9\u30FC
DirectoryTreeTopComponent.moduleErr.msg=DirectoryTreeTopComponent\u30A2\u30C3\u30D7\u30C7\u30FC\u30C8\u3092\u78BA\u8A8D\u4E2D\u306B\u30E2\u30B8\u30E5\u30FC\u30EB\u304C\u30A8\u30E9\u30FC\u3092\u8D77\u3053\u3057\u307E\u3057\u305F\u3002\u3069\u306E\u30E2\u30B8\u30E5\u30FC\u30EB\u304B\u30ED\u30B0\u3067\u78BA\u8A8D\u3057\u3066\u4E0B\u3055\u3044\u3002\u4E00\u90E8\u306E\u30C7\u30FC\u30BF\u304C\u4E0D\u5B8C\u5168\u304B\u3082\u3057\u308C\u307E\u305B\u3093\u3002
ExplorerNodeActionVisitor.action.imgDetails.title=\u30A4\u30E1\u30FC\u30B8\u8A73\u7D30
ExplorerNodeActionVisitor.action.extUnallocToSingleFiles=\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u5185\u306E\u30C7\u30FC\u30BF\u3092\u8907\u6570\u306E\u30B7\u30F3\u30B0\u30EB\u30D5\u30A1\u30A4\u30EB\u306B\u62BD\u51FA
ExplorerNodeActionVisitor.action.fileSystemDetails.title=\u30D5\u30A1\u30A4\u30EB\u30B7\u30B9\u30C6\u30E0\u8A73\u7D30
ExplorerNodeActionVisitor.action.volumeDetails.title=\u30DC\u30EA\u30E5\u30FC\u30E0\u8A73\u7D30
ExplorerNodeActionVisitor.action.extUnallocToSingleFile=\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u5185\u306E\u30C7\u30FC\u30BF\u3092\u4E00\u3064\u306E\u30B7\u30F3\u30B0\u30EB\u30D5\u30A1\u30A4\u30EB\u306B\u62BD\u51FA
ExplorerNodeActionVisitor.volDetail.noVolMatchErr=\u30A8\u30E9\u30FC\uFF1A\u4E00\u81F4\u3059\u308B\u30DC\u30EA\u30E5\u30FC\u30E0\u304C\u3042\u308A\u307E\u305B\u3093\u3002
ExplorerNodeActionVisitor.imgDetail.noVolMatchesErr=\u30A8\u30E9\u30FC\uFF1A\u4E00\u81F4\u3059\u308B\u30DC\u30EA\u30E5\u30FC\u30E0\u304C\u3042\u308A\u307E\u305B\u3093\u3002
ExplorerNodeActionVisitor.exception.probGetParent.text={0}\: {1}\u304B\u3089\u30DA\u30A2\u30EC\u30F3\u30C8\u3092\u53D6\u5F97\u3059\u308B\u969B\u306B\u554F\u984C\u304C\u767A\u751F\u3057\u307E\u3057\u305F
ExtractAction.title.extractFiles.text=\u30D5\u30A1\u30A4\u30EB\u3092\u62BD\u51FA
ExtractAction.extractFiles.cantCreateFolderErr.msg=\u6307\u5B9A\u3055\u308C\u305F\u30D5\u30A9\u30EB\u30C0\u3092\u4F5C\u6210\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\u3002
ExtractAction.confDlg.destFileExist.msg=\u4FDD\u5B58\u5148\u306E\u30D5\u30A1\u30A4\u30EB{0}\u306F\u65E2\u306B\u5B58\u5728\u3057\u307E\u3059\u3001\u4E0A\u66F8\u304D\u3057\u307E\u3059\u304B\uFF1F
ExtractAction.confDlg.destFileExist.title=\u30D5\u30A1\u30A4\u30EB\u304C\u5B58\u5728\u3057\u307E\u3059
ExtractAction.msgDlg.cantOverwriteFile.msg=\u65E2\u5B58\u30D5\u30A1\u30A4\u30EB{0}\u3092\u4E0A\u66F8\u304D\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F
ExtractAction.notifyDlg.noFileToExtr.msg=\u62BD\u51FA\u3067\u304D\u308B\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u305B\u3093\u3002
ExtractAction.progress.extracting=\u62BD\u51FA\u4E2D
ExtractAction.progress.cancellingExtraction={0}\uFF08\u30AD\u30E3\u30F3\u30BB\u30EB\u4E2D\u2026\uFF09
ExtractAction.done.notifyMsg.fileExtr.text=\u30D5\u30A1\u30A4\u30EB\u304C\u62BD\u51FA\u3055\u308C\u307E\u3057\u305F\u3002
ExtractUnallocAction.notifyMsg.unallocAlreadyBeingExtr.msg=\u3053\u306E\u30A4\u30E1\u30FC\u30B8\u306E\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u306E\u30C7\u30FC\u30BF\u306F\u65E2\u306B\u62BD\u51FA\u4E2D\u3067\u3059\u3002\u5225\u306E\u30A4\u30E1\u30FC\u30B8\u3092\u9078\u629E\u3057\u3066\u4E0B\u3055\u3044\u3002
ExtractUnallocAction.msgDlg.folderDoesntExist.msg=\u30D5\u30A9\u30EB\u30C0\u306F\u5B58\u5728\u3057\u307E\u305B\u3093\u3002\u7D9A\u884C\u3059\u308B\u524D\u306B\u6709\u52B9\u306A\u30D5\u30A9\u30EB\u30C0\u3092\u9078\u629E\u3057\u3066\u4E0B\u3055\u3044\u3002
ExtractUnallocAction.dlgTitle.selectDirToSaveTo.msg=\u4FDD\u5B58\u5148\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u9078\u629E\u3057\u3066\u4E0B\u3055\u3044
ExtractUnallocAction.confDlg.unallocFileAlreadyExist.msg=\u3053\u306E\u30DC\u30EA\u30E5\u30FC\u30E0\u306E\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u306E\u30D5\u30A1\u30A4\u30EB{0}\u306F\u65E2\u306B\u5B58\u5728\u3057\u307E\u3059\u3002\u65E2\u5B58\u306E\u30D5\u30A1\u30A4\u30EB\u3092\u7F6E\u304D\u63DB\u3048\u307E\u3059\u304B\uFF1F
ExtractUnallocAction.progress.extractUnalloc.title=\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u306E\u30C7\u30FC\u30BF\u3092\u62BD\u51FA\u4E2D
ExtractUnallocAction.progress.displayName.cancelling.text=\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u306E\u30C7\u30FC\u30BF\u3092\u62BD\u51FA\u4E2D\uFF08\u30AD\u30E3\u30F3\u30BB\u30EB\u4E2D\u2026\uFF09
ExtractUnallocAction.processing.counter.msg=\u51E6\u7406\u4E2D\u3000{0}\uFF0F{1} MBs
ExtractUnallocAction.done.notifyMsg.completedExtract.title=\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u306E\u62BD\u51FA\u304C\u5B8C\u4E86\u3057\u307E\u3057\u305F\u3002
ExtractUnallocAction.done.notifyMsg.completedExtract.msg=\u30D5\u30A1\u30A4\u30EB\u306F{0}\u3078\u62BD\u51FA\u3055\u308C\u307E\u3057\u305F
ResultDeleteAction.actionPerf.confDlg.delAllResults.msg={0}\u306E\u7D50\u679C\u5168\u3066\u3092\u672C\u5F53\u306B\u524A\u9664\u3057\u307E\u3059\u304B\uFF1F
ResultDeleteAction.actoinPerf.confDlg.delAllresults.details={0}\u7D50\u679C\u524A\u9664
ResultDeleteAction.exception.invalidAction.msg=\u7121\u52B9\u306A\u30A2\u30AF\u30B7\u30E7\u30F3\u30BF\u30A4\u30D7\uFF1A{0}
ExtractUnallocAction.done.errMsg.title=\u62BD\u51FA\u30A8\u30E9\u30FC
ExtractUnallocAction.done.errMsg.msg=\u672A\u5272\u308A\u5F53\u3066\u9818\u57DF\u306E\u62BD\u51FA\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F\uFF1A{0}
DirectoryTreeFilterNode.action.collapseAll.text=\u3059\u3079\u3066\u30B3\u30E9\u30D7\u30B9
ExtractAction.done.notifyMsg.extractErr=\u4E0B\u8A18\u306E\u30D5\u30A1\u30A4\u30EB\u306E\u62BD\u51FA\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F\uFF1A {0}
ChangeViewAction.menuItem.view.string=\u30b9\u30c8\u30ea\u30f3\u30b0
DataResultFilterNode.action.viewFileInDir.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a
DataResultFilterNode.action.viewSrcFileInDir.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306e\u30bd\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a
DataResultFilterNode.action.viewInNewWin.text=\u65b0\u898f\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u8868\u793a
DataResultFilterNode.action.openInExtViewer.text=\u5916\u90e8\u30d3\u30e5\u30fc\u30a2\u3067\u958b\u304f
DataResultFilterNode.action.searchFilesSameMd5.text=\u540c\u3058MD5\u30cf\u30c3\u30b7\u30e5\u3092\u6301\u3064\u30d5\u30a1\u30a4\u30eb\u3092\u691c\u7d22
DataResultFilterNode.action.viewInDir.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30fc\u306b\u8868\u793a
DirectoryTreeFilterNode.action.openFileSrcByAttr.text=\u5c5e\u6027\u306b\u3088\u308b\u30d5\u30a1\u30a4\u30eb\u691c\u7d22\u3092\u958b\u304f
DirectoryTreeFilterNode.action.runIngestMods.text=\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u5b9f\u884c
DirectoryTreeTopComponent.title.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30ea\u30b9\u30c6\u30a3\u30f3\u30b0
DirectoryTreeTopComponent.action.viewArtContent.text=\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u8868\u793a
DirectoryTreeTopComponent.moduleErr=\u30e2\u30b8\u30e5\u30fc\u30eb\u30a8\u30e9\u30fc
DirectoryTreeTopComponent.moduleErr.msg=DirectoryTreeTopComponent\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u78ba\u8a8d\u4e2d\u306b\u30e2\u30b8\u30e5\u30fc\u30eb\u304c\u30a8\u30e9\u30fc\u3092\u8d77\u3053\u3057\u307e\u3057\u305f\u3002\u3069\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u304b\u30ed\u30b0\u3067\u78ba\u8a8d\u3057\u3066\u4e0b\u3055\u3044\u3002\u4e00\u90e8\u306e\u30c7\u30fc\u30bf\u304c\u4e0d\u5b8c\u5168\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002
ExplorerNodeActionVisitor.action.imgDetails.title=\u30a4\u30e1\u30fc\u30b8\u8a73\u7d30
ExplorerNodeActionVisitor.action.extUnallocToSingleFiles=\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u5185\u306e\u30c7\u30fc\u30bf\u3092\u8907\u6570\u306e\u30b7\u30f3\u30b0\u30eb\u30d5\u30a1\u30a4\u30eb\u306b\u62bd\u51fa
ExplorerNodeActionVisitor.action.fileSystemDetails.title=\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u8a73\u7d30
ExplorerNodeActionVisitor.action.volumeDetails.title=\u30dc\u30ea\u30e5\u30fc\u30e0\u8a73\u7d30
ExplorerNodeActionVisitor.action.extUnallocToSingleFile=\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u5185\u306e\u30c7\u30fc\u30bf\u3092\u4e00\u3064\u306e\u30b7\u30f3\u30b0\u30eb\u30d5\u30a1\u30a4\u30eb\u306b\u62bd\u51fa
ExplorerNodeActionVisitor.volDetail.noVolMatchErr=\u30a8\u30e9\u30fc\uff1a\u4e00\u81f4\u3059\u308b\u30dc\u30ea\u30e5\u30fc\u30e0\u304c\u3042\u308a\u307e\u305b\u3093\u3002
ExplorerNodeActionVisitor.imgDetail.noVolMatchesErr=\u30a8\u30e9\u30fc\uff1a\u4e00\u81f4\u3059\u308b\u30dc\u30ea\u30e5\u30fc\u30e0\u304c\u3042\u308a\u307e\u305b\u3093\u3002
ExplorerNodeActionVisitor.exception.probGetParent.text={0}\: {1}\u304b\u3089\u30da\u30a2\u30ec\u30f3\u30c8\u3092\u53d6\u5f97\u3059\u308b\u969b\u306b\u554f\u984c\u304c\u767a\u751f\u3057\u307e\u3057\u305f
ExtractAction.title.extractFiles.text=\u30d5\u30a1\u30a4\u30eb\u3092\u62bd\u51fa
ExtractAction.extractFiles.cantCreateFolderErr.msg=\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a9\u30eb\u30c0\u3092\u4f5c\u6210\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f\u3002
ExtractAction.confDlg.destFileExist.msg=\u4fdd\u5b58\u5148\u306e\u30d5\u30a1\u30a4\u30eb{0}\u306f\u65e2\u306b\u5b58\u5728\u3057\u307e\u3059\u3001\u4e0a\u66f8\u304d\u3057\u307e\u3059\u304b\uff1f
ExtractAction.confDlg.destFileExist.title=\u30d5\u30a1\u30a4\u30eb\u304c\u5b58\u5728\u3057\u307e\u3059
ExtractAction.msgDlg.cantOverwriteFile.msg=\u65e2\u5b58\u30d5\u30a1\u30a4\u30eb{0}\u3092\u4e0a\u66f8\u304d\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f
ExtractAction.notifyDlg.noFileToExtr.msg=\u62bd\u51fa\u3067\u304d\u308b\u30d5\u30a1\u30a4\u30eb\u304c\u3042\u308a\u307e\u305b\u3093\u3002
ExtractAction.progress.extracting=\u62bd\u51fa\u4e2d
ExtractAction.progress.cancellingExtraction={0}\uff08\u30ad\u30e3\u30f3\u30bb\u30eb\u4e2d\u2026\uff09
ExtractAction.done.notifyMsg.fileExtr.text=\u30d5\u30a1\u30a4\u30eb\u304c\u62bd\u51fa\u3055\u308c\u307e\u3057\u305f\u3002
ExtractUnallocAction.notifyMsg.unallocAlreadyBeingExtr.msg=\u3053\u306e\u30a4\u30e1\u30fc\u30b8\u306e\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u306e\u30c7\u30fc\u30bf\u306f\u65e2\u306b\u62bd\u51fa\u4e2d\u3067\u3059\u3002\u5225\u306e\u30a4\u30e1\u30fc\u30b8\u3092\u9078\u629e\u3057\u3066\u4e0b\u3055\u3044\u3002
ExtractUnallocAction.msgDlg.folderDoesntExist.msg=\u30d5\u30a9\u30eb\u30c0\u306f\u5b58\u5728\u3057\u307e\u305b\u3093\u3002\u7d9a\u884c\u3059\u308b\u524d\u306b\u6709\u52b9\u306a\u30d5\u30a9\u30eb\u30c0\u3092\u9078\u629e\u3057\u3066\u4e0b\u3055\u3044\u3002
ExtractUnallocAction.dlgTitle.selectDirToSaveTo.msg=\u4fdd\u5b58\u5148\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u9078\u629e\u3057\u3066\u4e0b\u3055\u3044
ExtractUnallocAction.confDlg.unallocFileAlreadyExist.msg=\u3053\u306e\u30dc\u30ea\u30e5\u30fc\u30e0\u306e\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u306e\u30d5\u30a1\u30a4\u30eb{0}\u306f\u65e2\u306b\u5b58\u5728\u3057\u307e\u3059\u3002\u65e2\u5b58\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u7f6e\u304d\u63db\u3048\u307e\u3059\u304b\uff1f
ExtractUnallocAction.progress.extractUnalloc.title=\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u306e\u30c7\u30fc\u30bf\u3092\u62bd\u51fa\u4e2d
ExtractUnallocAction.progress.displayName.cancelling.text=\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u306e\u30c7\u30fc\u30bf\u3092\u62bd\u51fa\u4e2d\uff08\u30ad\u30e3\u30f3\u30bb\u30eb\u4e2d\u2026\uff09
ExtractUnallocAction.processing.counter.msg=\u51e6\u7406\u4e2d\u3000{0}\uff0f{1} MBs
ExtractUnallocAction.done.notifyMsg.completedExtract.title=\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u306e\u62bd\u51fa\u304c\u5b8c\u4e86\u3057\u307e\u3057\u305f\u3002
ExtractUnallocAction.done.notifyMsg.completedExtract.msg=\u30d5\u30a1\u30a4\u30eb\u306f{0}\u3078\u62bd\u51fa\u3055\u308c\u307e\u3057\u305f
ResultDeleteAction.actionPerf.confDlg.delAllResults.msg={0}\u306e\u7d50\u679c\u5168\u3066\u3092\u672c\u5f53\u306b\u524a\u9664\u3057\u307e\u3059\u304b\uff1f
ResultDeleteAction.actoinPerf.confDlg.delAllresults.details={0}\u7d50\u679c\u524a\u9664
ResultDeleteAction.exception.invalidAction.msg=\u7121\u52b9\u306a\u30a2\u30af\u30b7\u30e7\u30f3\u30bf\u30a4\u30d7\uff1a{0}
ExtractUnallocAction.done.errMsg.title=\u62bd\u51fa\u30a8\u30e9\u30fc
ExtractUnallocAction.done.errMsg.msg=\u672a\u5272\u308a\u5f53\u3066\u9818\u57df\u306e\u62bd\u51fa\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\uff1a{0}
DirectoryTreeFilterNode.action.collapseAll.text=\u3059\u3079\u3066\u30b3\u30e9\u30d7\u30b9
ExtractAction.done.notifyMsg.extractErr=\u4e0b\u8a18\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u62bd\u51fa\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\uff1a {0}

57
Core/src/org/sleuthkit/autopsy/directorytree/DataResultFilterNode.java
View File

@ -33,43 +33,40 @@ import javax.swing.AbstractAction;
import javax.swing.Action;
import org.openide.explorer.ExplorerManager;
import org.openide.nodes.AbstractNode;
import org.openide.nodes.ChildFactory;
import org.openide.nodes.FilterNode;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.sleuthkit.autopsy.coreutils.ContextMenuExtensionPoint;
import org.sleuthkit.autopsy.datamodel.AbstractAbstractFileNode.AbstractFilePropertyType;
import org.sleuthkit.autopsy.datamodel.AbstractFsContentNode;
import org.sleuthkit.autopsy.datamodel.ArtifactTypeNode;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode;
import org.sleuthkit.autopsy.datamodel.ContentTagTypeNode;
import org.sleuthkit.autopsy.datamodel.LocalFileNode;
import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsChildren.DeletedContentNode;
import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedAccountNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedFolderNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedRootNode;
import org.sleuthkit.autopsy.datamodel.ExtractedContentNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.AccountNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted.FolderNode;
import org.sleuthkit.autopsy.datamodel.EmailExtracted;
import org.sleuthkit.autopsy.datamodel.ExtractedContent.TypeNode;
import org.sleuthkit.autopsy.datamodel.ExtractedContent;
import org.sleuthkit.autopsy.datamodel.FileNode;
import org.sleuthkit.autopsy.datamodel.FileTypeNode;
import org.sleuthkit.autopsy.datamodel.FileSize.FileSizeRootChildren.FileSizeNode;
import org.sleuthkit.autopsy.datamodel.FileSize.FileSizeRootNode;
import org.sleuthkit.autopsy.datamodel.HashsetHits.HashsetHitsRootNode;
import org.sleuthkit.autopsy.datamodel.HashsetHits.HashsetHitsSetNode;
import org.sleuthkit.autopsy.datamodel.InterestingHits.InterestingHitsRootNode;
import org.sleuthkit.autopsy.datamodel.InterestingHits.InterestingHitsSetNode;
import org.sleuthkit.autopsy.datamodel.HashsetHits;
import org.sleuthkit.autopsy.datamodel.HashsetHits.HashsetNameNode;
import org.sleuthkit.autopsy.datamodel.ImageNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsKeywordNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsListNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsRootNode;
import org.sleuthkit.autopsy.datamodel.InterestingHits;
import org.sleuthkit.autopsy.datamodel.KeywordHits.TermNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits.ListNode;
import org.sleuthkit.autopsy.datamodel.VirtualDirectoryNode;
import org.sleuthkit.autopsy.datamodel.LayoutFileNode;
import org.sleuthkit.autopsy.datamodel.RecentFilesFilterNode;
import org.sleuthkit.autopsy.datamodel.RecentFilesNode;
import org.sleuthkit.autopsy.datamodel.FileTypesNode;
import org.sleuthkit.autopsy.datamodel.TagNameNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits;
import org.sleuthkit.autopsy.datamodel.Tags;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
@ -367,47 +364,47 @@ public class DataResultFilterNode extends FilterNode {
}
@Override
public AbstractAction visit(ExtractedContentNode ecn) {
public AbstractAction visit(ExtractedContent.RootNode ecn) {
return openChild(ecn);
}
@Override
public AbstractAction visit(KeywordHitsRootNode khrn) {
public AbstractAction visit(KeywordHits.RootNode khrn) {
return openChild(khrn);
}
@Override
public AbstractAction visit(HashsetHitsRootNode hhrn) {
public AbstractAction visit(HashsetHits.RootNode hhrn) {
return openChild(hhrn);
}
@Override
public AbstractAction visit(HashsetHitsSetNode hhsn) {
public AbstractAction visit(HashsetNameNode hhsn) {
return openChild(hhsn);
}
@Override
public AbstractAction visit(InterestingHitsRootNode iarn) {
public AbstractAction visit(InterestingHits.RootNode iarn) {
return openChild(iarn);
}
@Override
public AbstractAction visit(InterestingHitsSetNode iasn) {
public AbstractAction visit(InterestingHits.SetNameNode iasn) {
return openChild(iasn);
}
@Override
public AbstractAction visit(EmailExtractedRootNode eern) {
public AbstractAction visit(EmailExtracted.RootNode eern) {
return openChild(eern);
}
@Override
public AbstractAction visit(EmailExtractedAccountNode eean) {
public AbstractAction visit(AccountNode eean) {
return openChild(eean);
}
@Override
public AbstractAction visit(EmailExtractedFolderNode eefn) {
public AbstractAction visit(FolderNode eefn) {
return openChild(eefn);
}
@ -443,22 +440,22 @@ public class DataResultFilterNode extends FilterNode {
}
@Override
public AbstractAction visit(ArtifactTypeNode atn) {
public AbstractAction visit(TypeNode atn) {
return openChild(atn);
}
@Override
public AbstractAction visit(TagNameNode node) {
public AbstractAction visit(Tags.TagNameNode node) {
return openChild(node);
}
@Override
public AbstractAction visit(ContentTagTypeNode node) {
public AbstractAction visit(Tags.ContentTagTypeNode node) {
return openChild(node);
}
@Override
public AbstractAction visit(BlackboardArtifactTagTypeNode node) {
public AbstractAction visit(Tags.BlackboardArtifactTagTypeNode node) {
return openChild(node);
}
@ -516,12 +513,12 @@ public class DataResultFilterNode extends FilterNode {
}
@Override
public AbstractAction visit(KeywordHitsListNode khsn) {
public AbstractAction visit(ListNode khsn) {
return openChild(khsn);
}
@Override
public AbstractAction visit(KeywordHitsKeywordNode khmln) {
public AbstractAction visit(TermNode khmln) {
return openChild(khmln);
}

156
Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java
View File

@ -56,7 +56,7 @@ import org.sleuthkit.autopsy.corecomponentinterfaces.BlackboardResultViewer;
import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent;
import org.sleuthkit.autopsy.corecomponents.TableFilterNode;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode;
import org.sleuthkit.autopsy.datamodel.ExtractedContentNode;
import org.sleuthkit.autopsy.datamodel.ExtractedContent.RootNode;
import org.sleuthkit.autopsy.datamodel.DataSources;
import org.sleuthkit.autopsy.datamodel.DataSourcesNode;
import org.sleuthkit.autopsy.datamodel.KeywordHits;
@ -76,6 +76,7 @@ import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskException;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.datamodel.ExtractedContent;
/**
* Top component which displays something.
@ -403,7 +404,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
Children resultsChilds = results.getChildren();
tree.expandNode(resultsChilds.findChild(KeywordHits.NAME));
tree.expandNode(resultsChilds.findChild(ExtractedContentNode.NAME));
tree.expandNode(resultsChilds.findChild(ExtractedContent.NAME));
Node views = childNodes.findChild(ViewsNode.NAME);
@ -572,62 +573,27 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
} // if the image is added to the case
else if (changed.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
componentOpened();
// Image img = (Image)newValue;
//
// int[] imageIDs = Case.getCurrentCase().getImageIDs();
//
// // add the first image
// if(imageIDs.length == 1){
//
// }
// else{
// // add the additional images
// ImageNode newNode = new ImageNode(img);
// ((ImageChildren)getOriginalRootContent().getChildren()).addNode(newNode);
//
// // expand the new added node
// int count = em.getRootContext().getChildren().getNodesCount();
// em.setExploredContext(em.getRootContext().getChildren().getNodeAt(count - 1));
// }
} // not supporting deleting images for now
// // if the image is removed from the case
// if(changed.equals(Case.CASE_DEL_IMAGE)){
// if(Case.getCurrentCase().getImageIDs().length > 0){
// // just remove the given image from the directory tree
// Image img = (Image)newValue;
// int ID = Integer.parseInt(oldValue.toString());
// ImageNode tempNode = new ImageNode(img);
// ((ImageChildren)getOriginalRootContent().getChildren()).removeNode(tempNode);
// }
// }
}
// change in node selection
else if (changed.equals(ExplorerManager.PROP_SELECTED_NODES)) {
respondSelection((Node[]) oldValue, (Node[]) newValue);
} else if (changed.equals(IngestEvent.DATA.toString())) {
final ModuleDataEvent event = (ModuleDataEvent) oldValue;
if (event.getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO) {
return;
}
SwingUtilities.invokeLater(new Runnable() {
@Override
public void run() {
refreshTree(event.getArtifactType());
}
});
}
else if (changed.equals(IngestEvent.DATA.toString())) {
// nothing to do here.
// all nodes should be listening for these events and update accordingly.
} else if (changed.equals(IngestEvent.INGEST_JOB_COMPLETED.toString())
|| changed.equals(IngestEvent.INGEST_JOB_CANCELLED.toString())) {
SwingUtilities.invokeLater(new Runnable() {
@Override
public void run() {
refreshContentTree();
refreshTree();
refreshDataSourceTree();
}
});
} else if (changed.equals(IngestEvent.CONTENT_CHANGED.toString())) {
SwingUtilities.invokeLater(new Runnable() {
@Override
public void run() {
refreshContentTree();
refreshDataSourceTree();
}
});
}
@ -784,7 +750,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
SwingUtilities.invokeLater(new Runnable() {
@Override
public void run() {
refreshContentTree();
refreshDataSourceTree();
}
});
}
@ -792,7 +758,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
/**
* Refreshes changed content nodes
*/
void refreshContentTree() {
private void refreshDataSourceTree() {
Node selectedNode = getSelectedNode();
final String[] selectedPath = NodeOp.createPath(selectedNode, em.getRootContext());
@ -825,56 +791,52 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
* Refreshes the nodes in the tree to reflect updates in the database should
* be called in the gui thread
*/
public void refreshTree(final BlackboardArtifact.ARTIFACT_TYPE... types) {
//save current selection
Node selectedNode = getSelectedNode();
final String[] selectedPath = NodeOp.createPath(selectedNode, em.getRootContext());
//TODO: instead, we should choose a specific key to refresh? Maybe?
//contentChildren.refreshKeys();
Children dirChilds = em.getRootContext().getChildren();
Node results = dirChilds.findChild(ResultsNode.NAME);
if (results == null) {
logger.log(Level.SEVERE, "Cannot find Results filter node, won't refresh the bb tree"); //NON-NLS
return;
}
OriginalNode original = results.getLookup().lookup(OriginalNode.class);
ResultsNode resultsNode = (ResultsNode) original.getNode();
RootContentChildren resultsNodeChilds = (RootContentChildren) resultsNode.getChildren();
resultsNodeChilds.refreshKeys(types);
final TreeView tree = getTree();
tree.expandNode(results);
Children resultsChilds = results.getChildren();
if (resultsChilds == null) //intermediate state check
{
return;
}
Node childNode = resultsChilds.findChild(KeywordHits.NAME);
if (childNode == null) //intermediate state check
{
return;
}
tree.expandNode(childNode);
childNode = resultsChilds.findChild(ExtractedContentNode.NAME);
if (childNode == null) //intermediate state check
{
return;
}
tree.expandNode(childNode);
//restores selection if it was under the Results node
setSelectedNode(selectedPath, ResultsNode.NAME);
}
// public void refreshResultsTree(final BlackboardArtifact.ARTIFACT_TYPE... types) {
// //save current selection
// Node selectedNode = getSelectedNode();
// final String[] selectedPath = NodeOp.createPath(selectedNode, em.getRootContext());
//
// //TODO: instead, we should choose a specific key to refresh? Maybe?
// //contentChildren.refreshKeys();
//
// Children dirChilds = em.getRootContext().getChildren();
//
// Node results = dirChilds.findChild(ResultsNode.NAME);
// if (results == null) {
// logger.log(Level.SEVERE, "Cannot find Results filter node, won't refresh the bb tree"); //NON-NLS
// return;
// }
//
// OriginalNode original = results.getLookup().lookup(OriginalNode.class);
// ResultsNode resultsNode = (ResultsNode) original.getNode();
// RootContentChildren resultsNodeChilds = (RootContentChildren) resultsNode.getChildren();
// resultsNodeChilds.refreshKeys(types);
//
//
// final TreeView tree = getTree();
// // @@@ tree.expandNode(results);
//
// Children resultsChilds = results.getChildren();
// if (resultsChilds == null) {
// return;
// }
//
// Node childNode = resultsChilds.findChild(KeywordHits.NAME);
// if (childNode == null) {
// return;
// }
// // @@@tree.expandNode(childNode);
//
// childNode = resultsChilds.findChild(ExtractedContent.NAME);
// if (childNode == null) {
// return;
// }
// tree.expandNode(childNode);
//
// //restores selection if it was under the Results node
// //@@@ setSelectedNode(selectedPath, ResultsNode.NAME);
//
// }
/**
* Set the selected node using a path to a previously selected node.
@ -999,7 +961,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
logger.log(Level.WARNING, "Error retrieving attributes", ex); //NON-NLS
}
} else {
Node extractedContent = resultsChilds.findChild(ExtractedContentNode.NAME);
Node extractedContent = resultsChilds.findChild(ExtractedContent.NAME);
Children extractedChilds = extractedContent.getChildren();
treeNode = extractedChilds.findChild(type.getLabel());
}

193
Core/src/org/sleuthkit/autopsy/directorytree/ResultDeleteAction.java
View File

@ -1,193 +0,0 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.directorytree;
import java.awt.event.ActionEvent;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.coreutils.Logger;
import javax.swing.AbstractAction;
import javax.swing.JOptionPane;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.SleuthkitCase;
/**
* Action that deletes blackboard artifacts requested and reloads the view
* @deprecated do not use, it is here in case we ever pick up on this work
*/
@Deprecated
class ResultDeleteAction extends AbstractAction {
private enum ActionType {
SINGLE_ARTIFACT ///< deletes individual artifacts and assoc. attributes
,
MULT_ARTIFACTS ///< deletes multiple artifacts and assoc. attributes
,
TYPE_ARTIFACTS ///< deletes all artifacts by type and assoc. attributes
}
private BlackboardArtifact art;
private BlackboardArtifact.ARTIFACT_TYPE artType;
private List<BlackboardArtifact> arts;
private ActionType actionType;
private static final Logger logger = Logger.getLogger(ResultDeleteAction.class.getName());
ResultDeleteAction(String title) {
super(title);
}
ResultDeleteAction(String title, BlackboardArtifact art) {
this(title);
this.art = art;
this.actionType = ActionType.SINGLE_ARTIFACT;
}
ResultDeleteAction(String title, List<BlackboardArtifact> arts) {
this(title);
this.arts = arts;
this.actionType = ActionType.MULT_ARTIFACTS;
}
ResultDeleteAction(String title, BlackboardArtifact.ARTIFACT_TYPE artType) {
this(title);
this.artType = artType;
this.actionType = ActionType.TYPE_ARTIFACTS;
}
@Override
public void actionPerformed(ActionEvent e) {
if (actionType == ActionType.SINGLE_ARTIFACT) {
deleteArtifact(art);
DirectoryTreeTopComponent viewer = DirectoryTreeTopComponent.findInstance();
viewer.refreshTree(BlackboardArtifact.ARTIFACT_TYPE.fromID(art.getArtifactTypeID()));
}
if (actionType == ActionType.MULT_ARTIFACTS) {
for (BlackboardArtifact art : arts) {
deleteArtifact(art);
}
DirectoryTreeTopComponent viewer = DirectoryTreeTopComponent.findInstance();
viewer.refreshTree(BlackboardArtifact.ARTIFACT_TYPE.fromID(art.getArtifactTypeID()));
} else if (this.actionType == ActionType.TYPE_ARTIFACTS) {
if (JOptionPane.showConfirmDialog(null,
NbBundle.getMessage(this.getClass(),
"ResultDeleteAction.actionPerf.confDlg.delAllResults.msg",
artType.getDisplayName()),
NbBundle.getMessage(this.getClass(),
"ResultDeleteAction.actoinPerf.confDlg.delAllresults.details",
artType.getDisplayName()), JOptionPane.YES_NO_OPTION,
JOptionPane.QUESTION_MESSAGE) == JOptionPane.YES_OPTION) {
deleteArtifacts(artType);
DirectoryTreeTopComponent viewer = DirectoryTreeTopComponent.findInstance();
viewer.refreshTree(artType);
}
} else {
throw new IllegalArgumentException(
NbBundle.getMessage(this.getClass(), "ResultDeleteAction.exception.invalidAction.msg",
this.actionType));
}
}
//TODO should be moved to SleuthkitCase and BlackboardArtifact API
@SuppressWarnings("deprecation")
private static void deleteArtifact(BlackboardArtifact art) {
final SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase();
final long artId = art.getArtifactID();
try {
ResultSet rs = skCase.runQuery("DELETE from blackboard_attributes where artifact_id = " + Long.toString(artId)); //NON-NLS
skCase.closeRunQuery(rs);
rs = skCase.runQuery("DELETE from blackboard_artifacts where artifact_id = " + Long.toString(artId)); //NON-NLS
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Could not delete artifact by id: " + artId, ex); //NON-NLS
}
}
@SuppressWarnings("deprecation")
private static void deleteArtifactsByAttributeValue(BlackboardArtifact.ARTIFACT_TYPE artType,
BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value) {
final SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase();
ResultSet rs = null;
try {
//first to select to get artifact ids to delete
//then join delete attrs
//then delete arts by id
rs = skCase.runQuery("DELETE FROM blackboard_attributes WHERE artifact_id IN " //NON-NLS
+ "(SELECT blackboard_artifacts.artifact_id FROM blackboard_artifacts " //NON-NLS
+ "INNER JOIN blackboard_attributes ON (blackboard_attributes.artifact_id = blackboard_artifacts.artifact_id) " //NON-NLS
+ "WHERE blackboard_artifacts.artifact_type_id = " //NON-NLS
+ Integer.toString(artType.getTypeID())
+ " AND blackboard_attributes.attribute_type_id = " + Integer.toString(attrType.getTypeID()) //NON-NLS
+ " AND blackboard_attributes.value_type = " + BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING.getType() //NON-NLS
+ " AND blackboard_attributes.value_text = '" + value + "'" //NON-NLS
+ ")");
//rs = skCase.runQuery("DELETE from blackboard_artifacts where artifact_type_id = "
// + Integer.toString(artType.getTypeID()));
//skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Could not delete artifacts by type id: " + artType.getTypeID(), ex); //NON-NLS
}
finally {
if (rs != null) {
try {
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Error closing result set after deleting", ex); //NON-NLS
}
}
}
}
//TODO should be moved to SleuthkitCase
@SuppressWarnings("deprecation")
private static void deleteArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) {
// SELECT * from blackboard_attributes INNER JOIN blackboard_artifacts ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_ID AND blackboard_artifacts.artifact_type_id = 9;
final SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase();
try {
ResultSet rs = skCase.runQuery("DELETE FROM blackboard_attributes WHERE artifact_id IN " //NON-NLS
+ "(SELECT blackboard_artifacts.artifact_id FROM blackboard_artifacts " //NON-NLS
+ "INNER JOIN blackboard_attributes ON (blackboard_attributes.artifact_id = blackboard_artifacts.artifact_id) " //NON-NLS
+ "WHERE blackboard_artifacts.artifact_type_id = " //NON-NLS
+ Integer.toString(artType.getTypeID())
+ ")");
skCase.closeRunQuery(rs);
rs = skCase.runQuery("DELETE from blackboard_artifacts where artifact_type_id = " //NON-NLS
+ Integer.toString(artType.getTypeID()));
skCase.closeRunQuery(rs);
} catch (SQLException ex) {
logger.log(Level.WARNING, "Could not delete artifacts by type id: " + artType.getTypeID(), ex); //NON-NLS
}
}
}

2
branding/core/core.jar/org/netbeans/core/startup/Bundle.properties
View File

@ -1,5 +1,5 @@
#Updated by build script
#Tue, 22 Apr 2014 16:06:14 -0400
#Sat, 03 May 2014 22:45:39 -0400
LBL_splash_window_title=Starting Autopsy
SPLASH_HEIGHT=288
SPLASH_WIDTH=538

2
branding/modules/org-netbeans-core-windows.jar/org/netbeans/core/windows/view/ui/Bundle.properties
View File

@ -1,5 +1,5 @@
#Updated by build script
#Tue, 22 Apr 2014 16:06:14 -0400
#Sat, 03 May 2014 22:45:39 -0400
CTL_MainWindow_Title=Autopsy 3.1.0_Beta
CTL_MainWindow_Title_No_Project=Autopsy 3.1.0_Beta