mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-17 18:17:43 +00:00
cleanup and commenting
This commit is contained in:
parent
f3cb08ed8e
commit
42d99e31d6
@ -80,6 +80,11 @@ public class Accounts extends Observable implements AutopsyVisitableItem {
|
|||||||
@NbBundle.Messages("AccountsRootNode.name=Accounts")
|
@NbBundle.Messages("AccountsRootNode.name=Accounts")
|
||||||
final public static String NAME = Bundle.AccountsRootNode_name();
|
final public static String NAME = Bundle.AccountsRootNode_name();
|
||||||
|
|
||||||
|
/**
|
||||||
|
* This is a secret handshake with
|
||||||
|
* org.sleuthkit.autopsy.keywordsearch.TermComponentQuery
|
||||||
|
*/
|
||||||
|
private static final String CREDIT_CARD_NUMBER_ACCOUNT_TYPE = "Credit Card Number";
|
||||||
/**
|
/**
|
||||||
* Range Map from a (ranges of) B/IINs to data model object with details of
|
* Range Map from a (ranges of) B/IINs to data model object with details of
|
||||||
* the B/IIN, ie, bank name, phone, url, visa/amex/mastercard/...,
|
* the B/IIN, ie, bank name, phone, url, visa/amex/mastercard/...,
|
||||||
@ -771,7 +776,7 @@ public class Accounts extends Observable implements AutopsyVisitableItem {
|
|||||||
+ " AND solr_attribute.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SOLR_DOCUMENT_ID.getTypeID() //NON-NLS
|
+ " AND solr_attribute.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SOLR_DOCUMENT_ID.getTypeID() //NON-NLS
|
||||||
+ " LEFT JOIN blackboard_attributes as account_type ON blackboard_artifacts.artifact_id = account_type.artifact_id " //NON-NLS
|
+ " LEFT JOIN blackboard_attributes as account_type ON blackboard_artifacts.artifact_id = account_type.artifact_id " //NON-NLS
|
||||||
+ " AND account_type.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE.getTypeID() //NON-NLS
|
+ " AND account_type.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE.getTypeID() //NON-NLS
|
||||||
+ " AND account_type.value_text = 'credit_card'" //NON-NLS
|
+ " AND account_type.value_text = '" + CREDIT_CARD_NUMBER_ACCOUNT_TYPE + "'" //NON-NLS
|
||||||
+ " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS
|
+ " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS
|
||||||
+ getRejectedArtifactFilterClause()
|
+ getRejectedArtifactFilterClause()
|
||||||
+ " GROUP BY blackboard_artifacts.obj_id, solr_document_id " //NON-NLS
|
+ " GROUP BY blackboard_artifacts.obj_id, solr_document_id " //NON-NLS
|
||||||
|
@ -265,6 +265,12 @@ class ReportHTML implements TableReportModule {
|
|||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
} else if (dataType.startsWith(ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName())) {
|
} else if (dataType.startsWith(ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName())) {
|
||||||
|
/* TSK_ACCOUNT artifacts get separated by their TSK_ACCOUNT_TYPE
|
||||||
|
* attribute, with a compund dataType name, so they are not caught
|
||||||
|
* by the switch statement above. For now we just give them all the
|
||||||
|
* general account icon, but we could do soemthing else in the
|
||||||
|
* future.
|
||||||
|
*/
|
||||||
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/account_menu.png"); //NON-NLS
|
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/account_menu.png"); //NON-NLS
|
||||||
iconFileName = "account_menu.png"; //NON-NLS
|
iconFileName = "account_menu.png"; //NON-NLS
|
||||||
iconFilePath = path + File.separator + iconFileName;
|
iconFilePath = path + File.separator + iconFileName;
|
||||||
|
@ -18,12 +18,14 @@
|
|||||||
*/
|
*/
|
||||||
package org.sleuthkit.autopsy.report;
|
package org.sleuthkit.autopsy.report;
|
||||||
|
|
||||||
|
import com.google.common.collect.Lists;
|
||||||
import java.sql.ResultSet;
|
import java.sql.ResultSet;
|
||||||
import java.sql.SQLException;
|
import java.sql.SQLException;
|
||||||
import java.util.ArrayList;
|
import java.util.ArrayList;
|
||||||
import java.util.Arrays;
|
import java.util.Arrays;
|
||||||
import java.util.Collection;
|
import java.util.Collection;
|
||||||
import java.util.Collections;
|
import java.util.Collections;
|
||||||
|
import java.util.Comparator;
|
||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
import java.util.HashSet;
|
import java.util.HashSet;
|
||||||
import java.util.Iterator;
|
import java.util.Iterator;
|
||||||
@ -121,10 +123,10 @@ class TableReportGenerator {
|
|||||||
*/
|
*/
|
||||||
private void makeBlackboardArtifactTables() {
|
private void makeBlackboardArtifactTables() {
|
||||||
// Make a comment string describing the tag names filter in effect.
|
// Make a comment string describing the tag names filter in effect.
|
||||||
StringBuilder comment = new StringBuilder();
|
String comment = "";
|
||||||
if (!tagNamesFilter.isEmpty()) {
|
if (!tagNamesFilter.isEmpty()) {
|
||||||
comment.append(NbBundle.getMessage(this.getClass(), "ReportGenerator.artifactTable.taggedResults.text"));
|
comment += NbBundle.getMessage(this.getClass(), "ReportGenerator.artifactTable.taggedResults.text");
|
||||||
comment.append(makeCommaSeparatedList(tagNamesFilter));
|
comment += makeCommaSeparatedList(tagNamesFilter);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Add a table to the report for every enabled blackboard artifact type.
|
// Add a table to the report for every enabled blackboard artifact type.
|
||||||
@ -141,10 +143,10 @@ class TableReportGenerator {
|
|||||||
|
|
||||||
// Keyword hits and hashset hit artifacts get special handling.
|
// Keyword hits and hashset hit artifacts get special handling.
|
||||||
if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
|
if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
|
||||||
writeKeywordHits(tableReport, comment.toString(), tagNamesFilter);
|
writeKeywordHits(tableReport, comment, tagNamesFilter);
|
||||||
continue;
|
continue;
|
||||||
} else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
|
} else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
|
||||||
writeHashsetHits(tableReport, comment.toString(), tagNamesFilter);
|
writeHashsetHits(tableReport, comment, tagNamesFilter);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -154,54 +156,67 @@ class TableReportGenerator {
|
|||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* TSK_ACCOUNT artifacts get grouped by their TSK_ACCOUNT_TYPE
|
||||||
|
* attribute, and then handed off the default method for writing
|
||||||
|
* tables. */
|
||||||
if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
|
if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
|
||||||
Map<String, List<ArtifactData>> collect = artifactList.stream().collect(Collectors.groupingBy((ArtifactData t) -> {
|
Map<String, List<ArtifactData>> collect = artifactList.stream().collect(Collectors.groupingBy((ArtifactData artifactData) -> {
|
||||||
try {
|
try {
|
||||||
return t.getArtifact().getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
|
return artifactData.getArtifact().getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
|
||||||
} catch (TskCoreException ex) {
|
} catch (TskCoreException ex) {
|
||||||
logger.log(Level.SEVERE, "Unable to get value of TSK_ACCOUNT_TYPE attribute.", ex);
|
logger.log(Level.SEVERE, "Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
|
||||||
return "";
|
return "unknown";
|
||||||
}
|
}
|
||||||
}));
|
}));
|
||||||
for (Map.Entry<String, List<ArtifactData>> x : collect.entrySet()) {
|
for (Map.Entry<String, List<ArtifactData>> x : collect.entrySet()) {
|
||||||
writeDataType(x.getValue(), type, BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() + ": " + x.getKey(), comment);
|
writeTableForDataType(x.getValue(), type, BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() + ": " + x.getKey(), comment);
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
writeDataType(artifactList, type, type.getDisplayName(), comment);
|
writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
private void writeDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String dataType, StringBuilder comment) {
|
/**
|
||||||
/*
|
*
|
||||||
* Gets all of the attribute types of this artifact type by adding all
|
* Write the given list of artifacts to the table for the given type.
|
||||||
* of the types to a set
|
*
|
||||||
|
* @param artifactList The List of artifacts to include in the table.
|
||||||
|
* @param type The Type of artifacts included in the table. All the
|
||||||
|
* artifacts in artifactList should be of this type.
|
||||||
|
* @param tableName The name of the table.
|
||||||
|
* @param comment A comment to put in the header.
|
||||||
*/
|
*/
|
||||||
Set<BlackboardAttribute.Type> attrTypeSet = new TreeSet<>((BlackboardAttribute.Type o1, BlackboardAttribute.Type o2) -> o1.getDisplayName().compareTo(o2.getDisplayName()));
|
private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
|
||||||
|
/*
|
||||||
|
* Make a sorted set of all of the attribute types that are on any of
|
||||||
|
* the given artifacts.
|
||||||
|
*/
|
||||||
|
Set<BlackboardAttribute.Type> attrTypeSet = new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
|
||||||
for (ArtifactData data : artifactList) {
|
for (ArtifactData data : artifactList) {
|
||||||
List<BlackboardAttribute> attributes = data.getAttributes();
|
List<BlackboardAttribute> attributes = data.getAttributes();
|
||||||
for (BlackboardAttribute attribute : attributes) {
|
for (BlackboardAttribute attribute : attributes) {
|
||||||
attrTypeSet.add(attribute.getAttributeType());
|
attrTypeSet.add(attribute.getAttributeType());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
// Get the columns appropriate for the artifact type. This is
|
/* Get the columns appropriate for the artifact type. This is used to
|
||||||
// used to get the data that will be in the cells below based on
|
* get the data that will be in the cells below based on type, and
|
||||||
// type, and display the column headers.
|
* display the column headers.
|
||||||
|
*/
|
||||||
List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
|
List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
|
||||||
if (columns.isEmpty()) {
|
if (columns.isEmpty()) {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
columnHeaderMap.put(type.getTypeID(), columns);
|
columnHeaderMap.put(type.getTypeID(), columns);
|
||||||
// The artifact list is sorted now, as getting the row data is
|
|
||||||
// dependent on having the columns, which is necessary for
|
/* The artifact list is sorted now, as getting the row data is dependent
|
||||||
// sorting.
|
* on having the columns, which is necessary for sorting.
|
||||||
|
*/
|
||||||
Collections.sort(artifactList);
|
Collections.sort(artifactList);
|
||||||
List<String> columnHeaderNames = new ArrayList<>();
|
|
||||||
for (Column currColumn : columns) {
|
tableReport.startDataType(tableName, comment);
|
||||||
columnHeaderNames.add(currColumn.getColumnHeader());
|
tableReport.startTable(Lists.transform(columns, Column::getColumnHeader));
|
||||||
}
|
|
||||||
tableReport.startDataType(dataType, comment.toString());
|
|
||||||
tableReport.startTable(columnHeaderNames);
|
|
||||||
for (ArtifactData artifactData : artifactList) {
|
for (ArtifactData artifactData : artifactList) {
|
||||||
// Get the row data for this artifact, and has the
|
// Get the row data for this artifact, and has the
|
||||||
// module add it.
|
// module add it.
|
||||||
@ -1663,10 +1678,6 @@ class TableReportGenerator {
|
|||||||
@Override
|
@Override
|
||||||
public String getCellData(ArtifactData artData) {
|
public String getCellData(ArtifactData artData) {
|
||||||
return getFileUniquePath(artData.getContent());
|
return getFileUniquePath(artData.getContent());
|
||||||
/* else if
|
|
||||||
* (this.columnHeader.equals(NbBundle.getMessage(this.getClass(),
|
|
||||||
* "ReportGenerator.artTableColHdr.tags"))) { return
|
|
||||||
* makeCommaSeparatedList(artData.getTags()); } return ""; */
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
|
@ -55,7 +55,11 @@ final class TermComponentQuery implements KeywordSearchQuery {
|
|||||||
private static final BlackboardAttribute.Type SOLR_DOCUMENT_ID_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SOLR_DOCUMENT_ID);
|
private static final BlackboardAttribute.Type SOLR_DOCUMENT_ID_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SOLR_DOCUMENT_ID);
|
||||||
private static final BlackboardAttribute.Type ACCOUNT_NUMBER_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER);
|
private static final BlackboardAttribute.Type ACCOUNT_NUMBER_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER);
|
||||||
private static final BlackboardAttribute.Type ACOUNT_TYPE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE);
|
private static final BlackboardAttribute.Type ACOUNT_TYPE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE);
|
||||||
private static final String CREDIT_CARD_NUMBER = "Credit Card Number";
|
|
||||||
|
/**
|
||||||
|
* This is a secret handshake with org.sleuthkit.autopsy.datamodel.Accounts
|
||||||
|
*/
|
||||||
|
private static final String CREDIT_CARD_NUMBER_ACCOUNT_TYPE = "Credit Card Number";
|
||||||
|
|
||||||
//TODO: move these regex and the luhn check to a new class, something like: CreditCardNumberValidator
|
//TODO: move these regex and the luhn check to a new class, something like: CreditCardNumberValidator
|
||||||
/*
|
/*
|
||||||
@ -190,7 +194,7 @@ final class TermComponentQuery implements KeywordSearchQuery {
|
|||||||
//if the keyword hit matched the credit card number keyword/regex...
|
//if the keyword hit matched the credit card number keyword/regex...
|
||||||
if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER) {
|
if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER) {
|
||||||
newArtifact = hit.getContent().newArtifact(ARTIFACT_TYPE.TSK_ACCOUNT);
|
newArtifact = hit.getContent().newArtifact(ARTIFACT_TYPE.TSK_ACCOUNT);
|
||||||
newArtifact.addAttribute(new BlackboardAttribute(ACOUNT_TYPE_TYPE, MODULE_NAME, CREDIT_CARD_NUMBER));
|
newArtifact.addAttribute(new BlackboardAttribute(ACOUNT_TYPE_TYPE, MODULE_NAME, CREDIT_CARD_NUMBER_ACCOUNT_TYPE));
|
||||||
|
|
||||||
// make account artifact
|
// make account artifact
|
||||||
//try to match it against the track 1 regex
|
//try to match it against the track 1 regex
|
||||||
|
Loading…
x
Reference in New Issue
Block a user