From 80bb1c109880cfbf6c1014058b12e7e0b6fdecc8 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Thu, 3 Jan 2019 02:27:38 -0500 Subject: [PATCH 01/12] Add hashes to CR database. --- .../datamodel/AbstractSqlEamDb.java | 9 +- .../datamodel/CorrelationDataSource.java | 91 ++++++++++++++++++- 2 files changed, 97 insertions(+), 3 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index 3a2b477017..55c370c0eb 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -622,7 +622,7 @@ abstract class AbstractSqlEamDb implements EamDb { PreparedStatement preparedStatement = null; - String sql = "INSERT INTO data_sources(device_id, case_id, name, datasource_obj_id) VALUES (?, ?, ?, ?) " + String sql = "INSERT INTO data_sources(device_id, case_id, name, datasource_obj_id) VALUES (?, ?, ?, ?, ?, ?, ?) " + getConflictClause(); ResultSet resultSet = null; try { @@ -632,6 +632,9 @@ abstract class AbstractSqlEamDb implements EamDb { preparedStatement.setInt(2, eamDataSource.getCaseID()); preparedStatement.setString(3, eamDataSource.getName()); preparedStatement.setLong(4, eamDataSource.getDataSourceObjectID()); + preparedStatement.setString(5, eamDataSource.getMd5Hash()); + preparedStatement.setString(6, eamDataSource.getSha1Hash()); + preparedStatement.setString(7, eamDataSource.getSha256Hash()); preparedStatement.executeUpdate(); resultSet = preparedStatement.getGeneratedKeys(); @@ -639,7 +642,9 @@ abstract class AbstractSqlEamDb implements EamDb { throw new EamDbException(String.format("Failed to INSERT data source %s in central repo", eamDataSource.getName())); } int dataSourceId = resultSet.getInt(1); //last_insert_rowid() - CorrelationDataSource dataSource = new CorrelationDataSource(eamDataSource.getCaseID(), dataSourceId, eamDataSource.getDeviceID(), eamDataSource.getName(), eamDataSource.getDataSourceObjectID()); + CorrelationDataSource dataSource = new CorrelationDataSource( + eamDataSource.getCaseID(), dataSourceId, eamDataSource.getDeviceID(), eamDataSource.getName(), eamDataSource.getDataSourceObjectID(), + eamDataSource.getMd5Hash(), eamDataSource.getSha1Hash(), eamDataSource.getSha256Hash()); dataSourceCacheByDsObjectId.put(getDataSourceByDSObjectIdCacheKey(dataSource.getCaseID(), dataSource.getDataSourceObjectID()), dataSource); dataSourceCacheById.put(getDataSourceByIdCacheKey(dataSource.getCaseID(), dataSource.getID()), dataSource); return dataSource; diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java index 5b38c8a39e..b53dff446d 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java @@ -19,9 +19,11 @@ package org.sleuthkit.autopsy.centralrepository.datamodel; import java.io.Serializable; +import org.openide.util.Exceptions; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.datamodel.Content; +import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskDataException; @@ -39,6 +41,9 @@ public class CorrelationDataSource implements Serializable { private final Long dataSourceObjectID; //< Id for data source in the caseDB private final String deviceID; //< Unique to its associated case (not necessarily globally unique) private final String name; + private final String md5Hash; + private final String sha1Hash; + private final String sha256Hash; /** * Create a CorrelationDataSource object, the object will not have the data @@ -69,11 +74,60 @@ public class CorrelationDataSource implements Serializable { String deviceId, String name, Long dataSourceObjectId) { + this(caseId, dataSourceId, deviceId, name, dataSourceObjectId, null, null, null); + } + + /** + * Create a CorrelationDataSource object. + * + * @param correlationCase CorrelationCase object data source is + * associated with. Must have been created by + * EamDB and have a valid ID. + * @param deviceId User specified ID for device (unique per case) + * @param name User specified name + * @param dataSourceObjectId The object ID for the datasource + * @param md5Hash The MD5 hash value + * @param sha1Hash The SHA-1 hash value + * @param sha256Hash The SHA-256 hash value + */ + CorrelationDataSource(CorrelationCase correlationCase, + String deviceId, + String name, + Long dataSourceObjectId, + String md5Hash, + String sha1Hash, + String sha256Hash) { + this(correlationCase.getID(), -1, deviceId, name, dataSourceObjectId, md5Hash, sha1Hash, sha256Hash); + } + + /** + * Create a CorrelationDataSource object. + * + * @param caseId Row ID for Case in DB + * @param dataSourceId Row ID for this data source in DB (or -1) + * @param deviceId User specified ID for device (unique per case) + * @param name User specified name + * @param dataSourceObjectId The object ID for the datasource + * @param md5Hash The MD5 hash value + * @param sha1Hash The SHA-1 hash value + * @param sha256Hash The SHA-256 hash value + */ + CorrelationDataSource(int caseId, + int dataSourceId, + String deviceId, + String name, + Long dataSourceObjectId, + String md5Hash, + String sha1Hash, + String sha256Hash) { this.caseID = caseId; this.dataSourceID = dataSourceId; this.deviceID = deviceId; this.name = name; this.dataSourceObjectID = dataSourceObjectId; + this.md5Hash = md5Hash; + this.sha1Hash = sha1Hash; + this.sha256Hash = sha256Hash; } /** @@ -110,7 +164,21 @@ public class CorrelationDataSource implements Serializable { } catch (TskDataException | TskCoreException ex) { throw new EamDbException("Error getting data source info: " + ex.getMessage()); } - correlationDataSource = new CorrelationDataSource(correlationCase, deviceId, dataSource.getName(), dataSource.getId()); + String md5 = null; + String sha1 = null; + String sha256 = null; + if (dataSource instanceof Image) { + try { + Image image = (Image) dataSource; + //DLG: These need to be stored in a CorrelationDataSource instance. + md5 = image.getMd5(); + sha1 = image.getSha1(); + sha256 = image.getSha256(); + } catch (TskCoreException ex) { + Exceptions.printStackTrace(ex); //DLG: Replace this with something meaningful! + } + } + correlationDataSource = new CorrelationDataSource(correlationCase, deviceId, dataSource.getName(), dataSource.getId(), md5, sha1, sha256); if (useCR) { //add the correlation data source to the central repository and fill in the Central repository data source id in the object correlationDataSource = EamDb.getInstance().newDataSource(correlationDataSource); @@ -173,4 +241,25 @@ public class CorrelationDataSource implements Serializable { public String getName() { return name; } + + /** + * @return the MD5 hash value + */ + String getMd5Hash() { + return md5Hash; + } + + /** + * @return the SHA-1 hash value + */ + String getSha1Hash() { + return sha1Hash; + } + + /** + * @return the SHA-256 hash value + */ + String getSha256Hash() { + return sha256Hash; + } } From bca30c33fbfe8e9bed6ac564d7af332526693580 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Thu, 3 Jan 2019 13:08:27 -0500 Subject: [PATCH 02/12] Partial updates to DataSourceIntegrityIngestModule. --- .../datamodel/AbstractSqlEamDb.java | 2 +- .../datamodel/CorrelationDataSource.java | 19 +++++------- .../DataSourceIntegrityIngestModule.java | 29 +++++++++++++++++++ 3 files changed, 38 insertions(+), 12 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index 55c370c0eb..a401923148 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -622,7 +622,7 @@ abstract class AbstractSqlEamDb implements EamDb { PreparedStatement preparedStatement = null; - String sql = "INSERT INTO data_sources(device_id, case_id, name, datasource_obj_id) VALUES (?, ?, ?, ?, ?, ?, ?) " + String sql = "INSERT INTO data_sources(device_id, case_id, name, datasource_obj_id, md5, sha1, sha256) VALUES (?, ?, ?, ?, ?, ?, ?) " + getConflictClause(); ResultSet resultSet = null; try { diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java index b53dff446d..3bd91c4102 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java @@ -57,7 +57,7 @@ public class CorrelationDataSource implements Serializable { * @param dataSourceObjectId The object ID for the datasource */ public CorrelationDataSource(CorrelationCase correlationCase, String deviceId, String name, long dataSourceObjectId) { - this(correlationCase.getID(), -1, deviceId, name, dataSourceObjectId); + this(correlationCase.getID(), -1, deviceId, name, dataSourceObjectId, null, null, null); } /** @@ -159,25 +159,22 @@ public class CorrelationDataSource implements Serializable { if (correlationDataSource == null) { String deviceId; - try { - deviceId = curCase.getSleuthkitCase().getDataSource(dataSource.getId()).getDeviceId(); - } catch (TskDataException | TskCoreException ex) { - throw new EamDbException("Error getting data source info: " + ex.getMessage()); - } String md5 = null; String sha1 = null; String sha256 = null; - if (dataSource instanceof Image) { - try { + try { + deviceId = curCase.getSleuthkitCase().getDataSource(dataSource.getId()).getDeviceId(); + + if (dataSource instanceof Image) { Image image = (Image) dataSource; - //DLG: These need to be stored in a CorrelationDataSource instance. md5 = image.getMd5(); sha1 = image.getSha1(); sha256 = image.getSha256(); - } catch (TskCoreException ex) { - Exceptions.printStackTrace(ex); //DLG: Replace this with something meaningful! } + } catch (TskDataException | TskCoreException ex) { + throw new EamDbException("Error getting data source info: " + ex.getMessage()); } + correlationDataSource = new CorrelationDataSource(correlationCase, deviceId, dataSource.getName(), dataSource.getId(), md5, sha1, sha256); if (useCR) { //add the correlation data source to the central repository and fill in the Central repository data source id in the object diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java index 4389fe5bb7..0a595a05ee 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java @@ -25,6 +25,7 @@ import java.util.List; import java.util.logging.Level; import javax.xml.bind.DatatypeConverter; import java.util.Arrays; +import org.openide.util.Exceptions; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.ingest.DataSourceIngestModule; import org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress; @@ -37,6 +38,11 @@ import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.TskCoreException; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; +import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; +import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; +import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; +import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskDataException; @@ -339,6 +345,29 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { default: break; } + //DLG: This needs to update the hash values in the Central Repository. + if (EamDb.isEnabled()) { + try { + EamDb dbManager = EamDb.getInstance(); + Case openCase = Case.getCurrentCaseThrows(); + + CorrelationCase correlationCase = dbManager.getCase(openCase); + if (null == correlationCase) { + correlationCase = dbManager.newCase(openCase); + } + + CorrelationDataSource correlationDataSource = dbManager.getDataSource(correlationCase, dataSource.getId()); + if (correlationDataSource == null) { + CorrelationDataSource.fromTSKDataSource(correlationCase, dataSource); + } else { + //DLG: Set hash values. Then update. + } + } catch (EamDbException ex) { + Exceptions.printStackTrace(ex); //DLG: + } catch (NoCurrentCaseException ex) { + Exceptions.printStackTrace(ex); //DLG: + } + } results += Bundle.DataSourceIntegrityIngestModule_process_calcHashWithType(hashData.type.name, hashData.calculatedHash); } From e496d01aead51c82e9672f49c0c7bcf6af336c57 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Fri, 4 Jan 2019 02:35:56 -0500 Subject: [PATCH 03/12] Data Source Integrity hash value sync added. --- .../datamodel/AbstractSqlEamDb.java | 55 +++++++++++-- .../datamodel/CorrelationDataSource.java | 53 +++++++------ .../centralrepository/datamodel/EamDb.java | 7 ++ .../datamodel/SqliteEamDb.java | 15 ++++ .../eventlisteners/IngestEventsListener.java | 78 ++++++++++++++++++- .../ingest/events/ContentChangedEvent.java | 19 ++++- .../DataSourceIntegrityIngestModule.java | 35 ++------- 7 files changed, 201 insertions(+), 61 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index a401923148..effaf4f049 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -825,6 +825,44 @@ abstract class AbstractSqlEamDb implements EamDb { return dataSources; } + /** + * Updates an existing data source in the database + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSource(CorrelationDataSource eamDataSource) throws EamDbException { + if (eamDataSource == null) { + throw new EamDbException("Correlation data source is null"); + } + + Connection conn = connect(); + + PreparedStatement preparedStatement = null; + String sql = "UPDATE data_sources " + + "SET md5=?, sha1=?, sha256=? " + + "WHERE id=?"; + + try { + preparedStatement = conn.prepareStatement(sql); + + preparedStatement.setString(1, eamDataSource.getMd5Hash()); + preparedStatement.setString(2, eamDataSource.getSha1Hash()); + preparedStatement.setString(3, eamDataSource.getSha256Hash()); + preparedStatement.setInt(4, eamDataSource.getID()); + + preparedStatement.executeUpdate(); + //update the case in the cache + dataSourceCacheByDsObjectId.put(getDataSourceByDSObjectIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getDataSourceObjectID()), eamDataSource); + dataSourceCacheById.put(getDataSourceByIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getID()), eamDataSource); + } catch (SQLException ex) { + throw new EamDbException("Error updating data source.", ex); // NON-NLS + } finally { + EamDbUtil.closeStatement(preparedStatement); + EamDbUtil.closeConnection(conn); + } + } + /** * Inserts new Artifact(s) into the database. Should add associated Case and * Data Source first. @@ -937,7 +975,7 @@ abstract class AbstractSqlEamDb implements EamDb { + ".value," + tableName + ".file_obj_id," - + " cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id FROM " + + " cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " + tableName + " LEFT JOIN cases ON " + tableName @@ -1002,7 +1040,7 @@ abstract class AbstractSqlEamDb implements EamDb { + ".value," + tableName + ".file_obj_id," - + " cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id FROM " + + " cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " + tableName + " LEFT JOIN cases ON " + tableName @@ -1730,7 +1768,7 @@ abstract class AbstractSqlEamDb implements EamDb { + ".value, " + tableName + ".file_obj_id," - + "cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id FROM " + + "cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " + tableName + " LEFT JOIN cases ON " + tableName @@ -1787,7 +1825,7 @@ abstract class AbstractSqlEamDb implements EamDb { String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType); String sql - = "SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, id, value, file_obj_id, data_sources.datasource_obj_id FROM " + = "SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, id, value, file_obj_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " + tableName + " LEFT JOIN cases ON " + tableName @@ -3070,7 +3108,10 @@ abstract class AbstractSqlEamDb implements EamDb { resultSet.getInt("id"), resultSet.getString("device_id"), resultSet.getString("name"), - resultSet.getLong("datasource_obj_id") + resultSet.getLong("datasource_obj_id"), + resultSet.getString("md5"), + resultSet.getString("sha1"), + resultSet.getString("sha256") ); return eamDataSource; @@ -3111,7 +3152,9 @@ abstract class AbstractSqlEamDb implements EamDb { resultSet.getString("value"), resultSet.getInt("id"), new CorrelationCase(resultSet.getInt("case_id"), resultSet.getString("case_uid"), resultSet.getString("case_name")), - new CorrelationDataSource(resultSet.getInt("case_id"), resultSet.getInt("data_source_id"), resultSet.getString("device_id"), resultSet.getString("name"), resultSet.getLong("datasource_obj_id")), + new CorrelationDataSource( + resultSet.getInt("case_id"), resultSet.getInt("data_source_id"), resultSet.getString("device_id"), resultSet.getString("name"), + resultSet.getLong("datasource_obj_id"), resultSet.getString("md5"), resultSet.getString("sha1"), resultSet.getString("sha256")), resultSet.getString("file_path"), resultSet.getString("comment"), TskData.FileKnown.valueOf(resultSet.getByte("known_status")), diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java index 3bd91c4102..d1f596107c 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java @@ -1,7 +1,7 @@ /* * Central Repository * - * Copyright 2015-2018 Basis Technology Corp. + * Copyright 2015-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -19,7 +19,6 @@ package org.sleuthkit.autopsy.centralrepository.datamodel; import java.io.Serializable; -import org.openide.util.Exceptions; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.datamodel.Content; @@ -41,9 +40,9 @@ public class CorrelationDataSource implements Serializable { private final Long dataSourceObjectID; //< Id for data source in the caseDB private final String deviceID; //< Unique to its associated case (not necessarily globally unique) private final String name; - private final String md5Hash; - private final String sha1Hash; - private final String sha256Hash; + private String md5Hash; + private String sha1Hash; + private String sha256Hash; /** * Create a CorrelationDataSource object, the object will not have the data @@ -60,23 +59,6 @@ public class CorrelationDataSource implements Serializable { this(correlationCase.getID(), -1, deviceId, name, dataSourceObjectId, null, null, null); } - /** - * Create a CorrelationDataSource object. - * - * @param caseId Row ID for Case in DB - * @param dataSourceId Row ID for this data source in DB (or -1) - * @param deviceId User specified ID for device (unique per case) - * @param name User specified name - * @param dataSourceObjectId The object ID for the datasource - */ - CorrelationDataSource(int caseId, - int dataSourceId, - String deviceId, - String name, - Long dataSourceObjectId) { - this(caseId, dataSourceId, deviceId, name, dataSourceObjectId, null, null, null); - } - /** * Create a CorrelationDataSource object. * @@ -246,6 +228,15 @@ public class CorrelationDataSource implements Serializable { return md5Hash; } + /** + * Set the MD5 hash value. + * + * @param md5Hash The MD5 hash value. + */ + public void setMd5Hash(String md5Hash) { + this.md5Hash = md5Hash; + } + /** * @return the SHA-1 hash value */ @@ -253,10 +244,28 @@ public class CorrelationDataSource implements Serializable { return sha1Hash; } + /** + * Set the SHA-1 hash value. + * + * @param sha1Hash The SHA-1 hash value. + */ + public void setSha1Hash(String sha1Hash) { + this.sha1Hash = sha1Hash; + } + /** * @return the SHA-256 hash value */ String getSha256Hash() { return sha256Hash; } + + /** + * Set the SHA-256 hash value. + * + * @param sha256Hash The SHA-256 hash value. + */ + public void setSha256Hash(String sha256Hash) { + this.sha256Hash = sha256Hash; + } } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java index c633dc5adc..49ea73dff8 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java @@ -204,6 +204,13 @@ public interface EamDb { * @return - A CorrelationDataSource object with data source's central repository id */ CorrelationDataSource newDataSource(CorrelationDataSource eamDataSource) throws EamDbException; + + /** + * Updates an existing data source in the database + * + * @param eamDataSource The data source to update + */ + void updateDataSource(CorrelationDataSource eamDataSource) throws EamDbException; /** * Retrieves Data Source details based on data source device ID diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java index 69826a3355..3eae4409fd 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java @@ -434,6 +434,21 @@ final class SqliteEamDb extends AbstractSqlEamDb { } } + /** + * Updates an existing data source in the database + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSource(CorrelationDataSource eamDataSource) throws EamDbException { + try { + acquireExclusiveLock(); + super.updateDataSource(eamDataSource); + } finally { + releaseExclusiveLock(); + } + } + /** * Inserts new Artifact(s) into the database. Should add associated Case and * Data Source first. diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 1dc66b0bf6..428b7594c6 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -1,7 +1,7 @@ /* * Central Repository * - * Copyright 2015-2018 Basis Technology Corp. + * Copyright 2015-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -40,6 +40,8 @@ import org.sleuthkit.autopsy.ingest.IngestManager; import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; +import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; +import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; import org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.datamodel.AbstractFile; @@ -48,6 +50,9 @@ import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.coreutils.ThreadUtils; +import org.sleuthkit.autopsy.ingest.events.ContentChangedEvent; +import org.sleuthkit.datamodel.Content; +import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.SleuthkitCase; /** @@ -294,6 +299,12 @@ public class IngestEventsListener { jobProcessingExecutor.submit(new DataAddedTask(dbManager, evt, flagNotable, flagPrevious, createAttributes)); break; } + case CONTENT_CHANGED: { + jobProcessingExecutor.submit(new ContentChangedTask(dbManager, evt)); + break; + } + default: + break; } } } @@ -411,4 +422,69 @@ public class IngestEventsListener { } // DATA_ADDED } } + + private final class ContentChangedTask implements Runnable { + + private final EamDb dbManager; + private final PropertyChangeEvent event; + + private ContentChangedTask(EamDb db, PropertyChangeEvent evt) { + dbManager = db; + event = evt; + } + + @Override + public void run() { + if (!EamDb.isEnabled()) { + return; + } + + Content dataSource; + String dataSourceName = ""; + long dataSourceId = -1; + try { + dataSource = ((ContentChangedEvent) event).getAssociatedContent(); + + /* + * We only care about Images for the purpose of + * updating hash values. + */ + if (!(dataSource instanceof Image)) { + return; + } + + dataSourceName = dataSource.getName(); + dataSourceId = dataSource.getId(); + + Case openCase = Case.getCurrentCaseThrows(); + + CorrelationCase correlationCase = dbManager.getCase(openCase); + if (null == correlationCase) { + correlationCase = dbManager.newCase(openCase); + } + + CorrelationDataSource correlationDataSource = dbManager.getDataSource(correlationCase, dataSource.getId()); + if (correlationDataSource == null) { + CorrelationDataSource.fromTSKDataSource(correlationCase, dataSource); + } else { + // Update the hash values for the existing data source. + Image image = (Image) dataSource; + correlationDataSource.setMd5Hash(image.getMd5()); + correlationDataSource.setSha1Hash(image.getSha1()); + correlationDataSource.setSha256Hash(image.getSha256()); + dbManager.updateDataSource(correlationDataSource); + } + } catch (EamDbException ex) { + LOGGER.log(Level.SEVERE, String.format( + "Unable to fetch data from the Central Repository for data source '%s' (id=%d)", + dataSourceName, dataSourceId), ex); + } catch (NoCurrentCaseException ex) { + LOGGER.log(Level.SEVERE, "No current case opened."); + } catch (TskCoreException ex) { + LOGGER.log(Level.SEVERE, String.format( + "Unable to fetch data from the case database for data source '%s' (id=%d)", + dataSourceName, dataSourceId), ex); + } // CONTENT_CHANGED + } + } } diff --git a/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java b/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java index fbb842d9d2..5f3987ec51 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2011-2018 Basis Technology Corp. + * Copyright 2011-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -84,9 +84,10 @@ public final class ContentChangedEvent extends AutopsyEvent implements Serializa if (null != eventData) { return eventData; } + try { + Content content = getAssociatedContent(); SerializableEventData data = (SerializableEventData) super.getOldValue(); - Content content = Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(data.contentId); eventData = new ModuleContentEvent(data.moduleName, content); return eventData; } catch (NoCurrentCaseException | TskCoreException ex) { @@ -94,6 +95,20 @@ public final class ContentChangedEvent extends AutopsyEvent implements Serializa return null; } } + + /** + * Get the Content object associated with the event. + * + * @return The Content object. + * + * @throws NoCurrentCaseException if no case is open. + * @throws TskCoreException if there was an issue retrieving the + * Content from the case database. + */ + public Content getAssociatedContent() throws NoCurrentCaseException, TskCoreException { + SerializableEventData data = (SerializableEventData) super.getOldValue(); + return Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(data.contentId); + } /** * Data holder class. diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java index 0a595a05ee..0d81079142 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2013-2018 Basis Technology Corp. + * Copyright 2013-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -25,7 +25,6 @@ import java.util.List; import java.util.logging.Level; import javax.xml.bind.DatatypeConverter; import java.util.Arrays; -import org.openide.util.Exceptions; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.ingest.DataSourceIngestModule; import org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress; @@ -38,11 +37,7 @@ import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.TskCoreException; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; -import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; -import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; -import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; -import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; -import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; +import org.sleuthkit.autopsy.ingest.ModuleContentEvent; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskDataException; @@ -345,32 +340,12 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { default: break; } - //DLG: This needs to update the hash values in the Central Repository. - if (EamDb.isEnabled()) { - try { - EamDb dbManager = EamDb.getInstance(); - Case openCase = Case.getCurrentCaseThrows(); - - CorrelationCase correlationCase = dbManager.getCase(openCase); - if (null == correlationCase) { - correlationCase = dbManager.newCase(openCase); - } - - CorrelationDataSource correlationDataSource = dbManager.getDataSource(correlationCase, dataSource.getId()); - if (correlationDataSource == null) { - CorrelationDataSource.fromTSKDataSource(correlationCase, dataSource); - } else { - //DLG: Set hash values. Then update. - } - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); //DLG: - } catch (NoCurrentCaseException ex) { - Exceptions.printStackTrace(ex); //DLG: - } - } results += Bundle.DataSourceIntegrityIngestModule_process_calcHashWithType(hashData.type.name, hashData.calculatedHash); } + // Fire an event to signal the hash values have been updated. + services.fireModuleContentEvent(new ModuleContentEvent(dataSource)); + // Write the inbox message services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), imgName + Bundle.DataSourceIntegrityIngestModule_process_hashesCalculated(), results)); From a98dd5d6d5e796c4939c9a0a063d769ef913d2da Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Fri, 4 Jan 2019 12:32:06 -0500 Subject: [PATCH 04/12] DataSourceUpdateService now checks for hash changes. --- .../datamodel/AbstractSqlEamDb.java | 14 +++--- .../datamodel/CorrelationDataSource.java | 12 ++--- .../datamodel/DataSourceUpdateService.java | 48 +++++++++++++++---- .../eventlisteners/IngestEventsListener.java | 6 +-- 4 files changed, 54 insertions(+), 26 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index effaf4f049..20f695d519 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -632,9 +632,9 @@ abstract class AbstractSqlEamDb implements EamDb { preparedStatement.setInt(2, eamDataSource.getCaseID()); preparedStatement.setString(3, eamDataSource.getName()); preparedStatement.setLong(4, eamDataSource.getDataSourceObjectID()); - preparedStatement.setString(5, eamDataSource.getMd5Hash()); - preparedStatement.setString(6, eamDataSource.getSha1Hash()); - preparedStatement.setString(7, eamDataSource.getSha256Hash()); + preparedStatement.setString(5, eamDataSource.getMd5()); + preparedStatement.setString(6, eamDataSource.getSha1()); + preparedStatement.setString(7, eamDataSource.getSha256()); preparedStatement.executeUpdate(); resultSet = preparedStatement.getGeneratedKeys(); @@ -644,7 +644,7 @@ abstract class AbstractSqlEamDb implements EamDb { int dataSourceId = resultSet.getInt(1); //last_insert_rowid() CorrelationDataSource dataSource = new CorrelationDataSource( eamDataSource.getCaseID(), dataSourceId, eamDataSource.getDeviceID(), eamDataSource.getName(), eamDataSource.getDataSourceObjectID(), - eamDataSource.getMd5Hash(), eamDataSource.getSha1Hash(), eamDataSource.getSha256Hash()); + eamDataSource.getMd5(), eamDataSource.getSha1(), eamDataSource.getSha256()); dataSourceCacheByDsObjectId.put(getDataSourceByDSObjectIdCacheKey(dataSource.getCaseID(), dataSource.getDataSourceObjectID()), dataSource); dataSourceCacheById.put(getDataSourceByIdCacheKey(dataSource.getCaseID(), dataSource.getID()), dataSource); return dataSource; @@ -846,9 +846,9 @@ abstract class AbstractSqlEamDb implements EamDb { try { preparedStatement = conn.prepareStatement(sql); - preparedStatement.setString(1, eamDataSource.getMd5Hash()); - preparedStatement.setString(2, eamDataSource.getSha1Hash()); - preparedStatement.setString(3, eamDataSource.getSha256Hash()); + preparedStatement.setString(1, eamDataSource.getMd5()); + preparedStatement.setString(2, eamDataSource.getSha1()); + preparedStatement.setString(3, eamDataSource.getSha256()); preparedStatement.setInt(4, eamDataSource.getID()); preparedStatement.executeUpdate(); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java index d1f596107c..ec13170d1b 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java @@ -224,7 +224,7 @@ public class CorrelationDataSource implements Serializable { /** * @return the MD5 hash value */ - String getMd5Hash() { + String getMd5() { return md5Hash; } @@ -233,14 +233,14 @@ public class CorrelationDataSource implements Serializable { * * @param md5Hash The MD5 hash value. */ - public void setMd5Hash(String md5Hash) { + public void setMd5(String md5Hash) { this.md5Hash = md5Hash; } /** * @return the SHA-1 hash value */ - String getSha1Hash() { + String getSha1() { return sha1Hash; } @@ -249,14 +249,14 @@ public class CorrelationDataSource implements Serializable { * * @param sha1Hash The SHA-1 hash value. */ - public void setSha1Hash(String sha1Hash) { + public void setSha1(String sha1Hash) { this.sha1Hash = sha1Hash; } /** * @return the SHA-256 hash value */ - String getSha256Hash() { + String getSha256() { return sha256Hash; } @@ -265,7 +265,7 @@ public class CorrelationDataSource implements Serializable { * * @param sha256Hash The SHA-256 hash value. */ - public void setSha256Hash(String sha256Hash) { + public void setSha256(String sha256Hash) { this.sha256Hash = sha256Hash; } } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java index 46696bad94..5fe61b4603 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java @@ -1,7 +1,7 @@ /* * Central Repository * - * Copyright 2018 Basis Technology Corp. + * Copyright 2018-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -18,17 +18,18 @@ */ package org.sleuthkit.autopsy.centralrepository.datamodel; +import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; import org.openide.util.lookup.ServiceProvider; import org.sleuthkit.autopsy.appservices.AutopsyService; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.DataSource; +import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.TskCoreException; /** * Class which updates the data sources in the central repository to include the - * object id which ties them to the current case. - * + * object ID which ties them to the current case, as well as the hash values. */ @ServiceProvider(service = AutopsyService.class) public class DataSourceUpdateService implements AutopsyService { @@ -45,16 +46,43 @@ public class DataSourceUpdateService implements AutopsyService { try { EamDb centralRepository = EamDb.getInstance(); CorrelationCase correlationCase = centralRepository.getCase(context.getCase()); + //if the case isn't in the central repository yet there won't be data sources in it to update - if (correlationCase != null) { - for (CorrelationDataSource correlationDataSource : centralRepository.getDataSources()) { - //ResultSet.getLong has a value of 0 when the value is null - if (correlationDataSource.getCaseID() == correlationCase.getID() && correlationDataSource.getDataSourceObjectID() == 0) { - for (Content dataSource : context.getCase().getDataSources()) { - if (((DataSource) dataSource).getDeviceId().equals(correlationDataSource.getDeviceID()) && dataSource.getName().equals(correlationDataSource.getName())) { + if (correlationCase == null) { + return; + } + + for (CorrelationDataSource correlationDataSource : centralRepository.getDataSources()) { + //ResultSet.getLong has a value of 0 when the value is null + if (correlationDataSource.getCaseID() == correlationCase.getID()) { + for (Content dataSource : context.getCase().getDataSources()) { + if (((DataSource) dataSource).getDeviceId().equals(correlationDataSource.getDeviceID()) && dataSource.getName().equals(correlationDataSource.getName())) { + // Add the object ID to the data source if it doesn't exist. + if (correlationDataSource.getDataSourceObjectID() == 0) { centralRepository.addDataSourceObjectId(correlationDataSource.getID(), dataSource.getId()); - break; } + + // Sync the data source hash values if necessary. + if (dataSource instanceof Image) { + Image image = (Image) dataSource; + String imageMd5Hash = image.getMd5(); + String imageSha1Hash = image.getSha1(); + String imageSha256Hash = image.getSha256(); + + String crMd5Hash = correlationDataSource.getMd5(); + String crSha1Hash = correlationDataSource.getSha1(); + String crSha256Hash = correlationDataSource.getSha256(); + + if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false || StringUtils.equals(imageSha1Hash, crSha1Hash) == false + || StringUtils.equals(imageSha256Hash, crSha256Hash) == false) { + correlationDataSource.setMd5(imageMd5Hash); + correlationDataSource.setSha1(imageSha1Hash); + correlationDataSource.setSha256(imageSha256Hash); + centralRepository.updateDataSource(correlationDataSource); + } + } + + break; } } } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 428b7594c6..3bbf8d459b 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -469,9 +469,9 @@ public class IngestEventsListener { } else { // Update the hash values for the existing data source. Image image = (Image) dataSource; - correlationDataSource.setMd5Hash(image.getMd5()); - correlationDataSource.setSha1Hash(image.getSha1()); - correlationDataSource.setSha256Hash(image.getSha256()); + correlationDataSource.setMd5(image.getMd5()); + correlationDataSource.setSha1(image.getSha1()); + correlationDataSource.setSha256(image.getSha256()); dbManager.updateDataSource(correlationDataSource); } } catch (EamDbException ex) { From e8936378137330e67b399e02e9cf0225a7473963 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Fri, 4 Jan 2019 12:45:18 -0500 Subject: [PATCH 05/12] Cleanup. --- .../autopsy/centralrepository/datamodel/AbstractSqlEamDb.java | 2 +- .../sleuthkit/autopsy/centralrepository/datamodel/EamDb.java | 2 +- .../autopsy/centralrepository/datamodel/SqliteEamDb.java | 2 +- .../centralrepository/eventlisteners/IngestEventsListener.java | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index 20f695d519..cb5255deeb 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -1,7 +1,7 @@ /* * Central Repository * - * Copyright 2015-2018 Basis Technology Corp. + * Copyright 2015-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java index 49ea73dff8..a9e7685d14 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java @@ -1,7 +1,7 @@ /* * Central Repository * - * Copyright 2015-2018 Basis Technology Corp. + * Copyright 2015-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java index 3eae4409fd..f82a3bdc26 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java @@ -1,7 +1,7 @@ /* * Central Repository * - * Copyright 2015-2018 Basis Technology Corp. + * Copyright 2015-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 3bbf8d459b..90919c343a 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -479,7 +479,7 @@ public class IngestEventsListener { "Unable to fetch data from the Central Repository for data source '%s' (id=%d)", dataSourceName, dataSourceId), ex); } catch (NoCurrentCaseException ex) { - LOGGER.log(Level.SEVERE, "No current case opened."); + LOGGER.log(Level.SEVERE, "No current case opened.", ex); } catch (TskCoreException ex) { LOGGER.log(Level.SEVERE, String.format( "Unable to fetch data from the case database for data source '%s' (id=%d)", From 22e347ba016a594f3e5f807d4c82fa08255cc06f Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Mon, 7 Jan 2019 14:28:24 -0500 Subject: [PATCH 06/12] Using DATA_SOURCE_ANALYSIS_COMPLETED. --- .../datamodel/CorrelationDataSource.java | 15 +- .../eventlisteners/IngestEventsListener.java | 159 ++++++++++-------- .../ingest/events/ContentChangedEvent.java | 21 +-- .../DataSourceIntegrityIngestModule.java | 3 - 4 files changed, 103 insertions(+), 95 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java index ec13170d1b..c634f10639 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java @@ -224,13 +224,16 @@ public class CorrelationDataSource implements Serializable { /** * @return the MD5 hash value */ - String getMd5() { + public String getMd5() { return md5Hash; } /** * Set the MD5 hash value. * + * Note: This does not add the hash value to Central Repository. A method, + * such as EamDb.updateDataSource(), can be called to persist hash values. + * * @param md5Hash The MD5 hash value. */ public void setMd5(String md5Hash) { @@ -240,13 +243,16 @@ public class CorrelationDataSource implements Serializable { /** * @return the SHA-1 hash value */ - String getSha1() { + public String getSha1() { return sha1Hash; } /** * Set the SHA-1 hash value. * + * Note: This does not add the hash value to Central Repository. A method, + * such as EamDb.updateDataSource(), can be called to persist hash values. + * * @param sha1Hash The SHA-1 hash value. */ public void setSha1(String sha1Hash) { @@ -256,13 +262,16 @@ public class CorrelationDataSource implements Serializable { /** * @return the SHA-256 hash value */ - String getSha256() { + public String getSha256() { return sha256Hash; } /** * Set the SHA-256 hash value. * + * Note: This does not add the hash value to Central Repository. A method, + * such as EamDb.updateDataSource(), can be called to persist hash values. + * * @param sha256Hash The SHA-256 hash value. */ public void setSha256(String sha256Hash) { diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 90919c343a..c258ea3ca3 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -30,6 +30,7 @@ import java.util.concurrent.ExecutorService; import java.util.concurrent.Executors; import java.util.logging.Level; import java.util.stream.Collectors; +import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -51,6 +52,7 @@ import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.coreutils.ThreadUtils; import org.sleuthkit.autopsy.ingest.events.ContentChangedEvent; +import org.sleuthkit.autopsy.ingest.events.DataSourceAnalysisCompletedEvent; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.SleuthkitCase; @@ -299,10 +301,6 @@ public class IngestEventsListener { jobProcessingExecutor.submit(new DataAddedTask(dbManager, evt, flagNotable, flagPrevious, createAttributes)); break; } - case CONTENT_CHANGED: { - jobProcessingExecutor.submit(new ContentChangedTask(dbManager, evt)); - break; - } default: break; } @@ -314,9 +312,17 @@ public class IngestEventsListener { @Override public void propertyChange(PropertyChangeEvent evt) { + EamDb dbManager; + try { + dbManager = EamDb.getInstance(); + } catch (EamDbException ex) { + LOGGER.log(Level.SEVERE, "Failed to connect to Central Repository database.", ex); + return; + } + switch (IngestManager.IngestJobEvent.valueOf(evt.getPropertyName())) { case DATA_SOURCE_ANALYSIS_COMPLETED: { - jobProcessingExecutor.submit(new AnalysisCompleteTask()); + jobProcessingExecutor.submit(new AnalysisCompleteTask(dbManager, evt)); break; } } @@ -325,6 +331,14 @@ public class IngestEventsListener { } private final class AnalysisCompleteTask implements Runnable { + + private final EamDb dbManager; + private final PropertyChangeEvent event; + + private AnalysisCompleteTask(EamDb db, PropertyChangeEvent evt) { + dbManager = db; + event = evt; + } @Override public void run() { @@ -333,6 +347,74 @@ public class IngestEventsListener { recentlyAddedCeArtifacts.clear(); } //else another instance of the Correlation Engine Module is still being run. + + /* + * Ensure the data source in the Central Repository has hash values + * that match those in the case database. + */ + if (!EamDb.isEnabled()) { + return; + } + Content dataSource; + String dataSourceName = ""; + long dataSourceId = -1; + try { + dataSource = ((DataSourceAnalysisCompletedEvent) event).getDataSource(); + + /* + * We only care about Images for the purpose of + * updating hash values. + */ + if (!(dataSource instanceof Image)) { + return; + } + + dataSourceName = dataSource.getName(); + dataSourceId = dataSource.getId(); + + Case openCase = Case.getCurrentCaseThrows(); + + CorrelationCase correlationCase = dbManager.getCase(openCase); + if (null == correlationCase) { + correlationCase = dbManager.newCase(openCase); + } + + CorrelationDataSource correlationDataSource = dbManager.getDataSource(correlationCase, dataSource.getId()); + if (correlationDataSource == null) { + // Add the data source. + CorrelationDataSource.fromTSKDataSource(correlationCase, dataSource); + } else { + // Sync the data source hash values if necessary. + if (dataSource instanceof Image) { + Image image = (Image) dataSource; + String imageMd5Hash = image.getMd5(); + String imageSha1Hash = image.getSha1(); + String imageSha256Hash = image.getSha256(); + + String crMd5Hash = correlationDataSource.getMd5(); + String crSha1Hash = correlationDataSource.getSha1(); + String crSha256Hash = correlationDataSource.getSha256(); + + if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false || StringUtils.equals(imageSha1Hash, crSha1Hash) == false + || StringUtils.equals(imageSha256Hash, crSha256Hash) == false) { + correlationDataSource.setMd5(imageMd5Hash); + correlationDataSource.setSha1(imageSha1Hash); + correlationDataSource.setSha256(imageSha256Hash); + dbManager.updateDataSource(correlationDataSource); + } + } + } + } catch (EamDbException ex) { + LOGGER.log(Level.SEVERE, String.format( + "Unable to fetch data from the Central Repository for data source '%s' (id=%d)", + dataSourceName, dataSourceId), ex); + } catch (NoCurrentCaseException ex) { + LOGGER.log(Level.SEVERE, "No current case opened.", ex); + } catch (TskCoreException ex) { + LOGGER.log(Level.SEVERE, String.format( + "Unable to fetch data from the case database for data source '%s' (id=%d)", + dataSourceName, dataSourceId), ex); + } } // DATA_SOURCE_ANALYSIS_COMPLETED } @@ -422,69 +504,4 @@ public class IngestEventsListener { } // DATA_ADDED } } - - private final class ContentChangedTask implements Runnable { - - private final EamDb dbManager; - private final PropertyChangeEvent event; - - private ContentChangedTask(EamDb db, PropertyChangeEvent evt) { - dbManager = db; - event = evt; - } - - @Override - public void run() { - if (!EamDb.isEnabled()) { - return; - } - - Content dataSource; - String dataSourceName = ""; - long dataSourceId = -1; - try { - dataSource = ((ContentChangedEvent) event).getAssociatedContent(); - - /* - * We only care about Images for the purpose of - * updating hash values. - */ - if (!(dataSource instanceof Image)) { - return; - } - - dataSourceName = dataSource.getName(); - dataSourceId = dataSource.getId(); - - Case openCase = Case.getCurrentCaseThrows(); - - CorrelationCase correlationCase = dbManager.getCase(openCase); - if (null == correlationCase) { - correlationCase = dbManager.newCase(openCase); - } - - CorrelationDataSource correlationDataSource = dbManager.getDataSource(correlationCase, dataSource.getId()); - if (correlationDataSource == null) { - CorrelationDataSource.fromTSKDataSource(correlationCase, dataSource); - } else { - // Update the hash values for the existing data source. - Image image = (Image) dataSource; - correlationDataSource.setMd5(image.getMd5()); - correlationDataSource.setSha1(image.getSha1()); - correlationDataSource.setSha256(image.getSha256()); - dbManager.updateDataSource(correlationDataSource); - } - } catch (EamDbException ex) { - LOGGER.log(Level.SEVERE, String.format( - "Unable to fetch data from the Central Repository for data source '%s' (id=%d)", - dataSourceName, dataSourceId), ex); - } catch (NoCurrentCaseException ex) { - LOGGER.log(Level.SEVERE, "No current case opened.", ex); - } catch (TskCoreException ex) { - LOGGER.log(Level.SEVERE, String.format( - "Unable to fetch data from the case database for data source '%s' (id=%d)", - dataSourceName, dataSourceId), ex); - } // CONTENT_CHANGED - } - } -} +} \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java b/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java index 5f3987ec51..4095f69cea 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2011-2019 Basis Technology Corp. + * Copyright 2011-2018 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -84,10 +84,9 @@ public final class ContentChangedEvent extends AutopsyEvent implements Serializa if (null != eventData) { return eventData; } - try { - Content content = getAssociatedContent(); SerializableEventData data = (SerializableEventData) super.getOldValue(); + Content content = Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(data.contentId); eventData = new ModuleContentEvent(data.moduleName, content); return eventData; } catch (NoCurrentCaseException | TskCoreException ex) { @@ -95,20 +94,6 @@ public final class ContentChangedEvent extends AutopsyEvent implements Serializa return null; } } - - /** - * Get the Content object associated with the event. - * - * @return The Content object. - * - * @throws NoCurrentCaseException if no case is open. - * @throws TskCoreException if there was an issue retrieving the - * Content from the case database. - */ - public Content getAssociatedContent() throws NoCurrentCaseException, TskCoreException { - SerializableEventData data = (SerializableEventData) super.getOldValue(); - return Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(data.contentId); - } /** * Data holder class. @@ -126,4 +111,4 @@ public final class ContentChangedEvent extends AutopsyEvent implements Serializa } -} +} \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java index 0d81079142..09ee853773 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java @@ -343,9 +343,6 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { results += Bundle.DataSourceIntegrityIngestModule_process_calcHashWithType(hashData.type.name, hashData.calculatedHash); } - // Fire an event to signal the hash values have been updated. - services.fireModuleContentEvent(new ModuleContentEvent(dataSource)); - // Write the inbox message services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), imgName + Bundle.DataSourceIntegrityIngestModule_process_hashesCalculated(), results)); From a197036db557b2f521a5a3deb136d24575c771d9 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Mon, 7 Jan 2019 14:58:14 -0500 Subject: [PATCH 07/12] Cleanup. --- .../eventlisteners/IngestEventsListener.java | 5 +++-- .../sleuthkit/autopsy/ingest/events/ContentChangedEvent.java | 2 +- .../dataSourceIntegrity/DataSourceIntegrityIngestModule.java | 3 +-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index c258ea3ca3..a7da840f95 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -51,7 +51,6 @@ import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.coreutils.ThreadUtils; -import org.sleuthkit.autopsy.ingest.events.ContentChangedEvent; import org.sleuthkit.autopsy.ingest.events.DataSourceAnalysisCompletedEvent; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Image; @@ -325,6 +324,8 @@ public class IngestEventsListener { jobProcessingExecutor.submit(new AnalysisCompleteTask(dbManager, evt)); break; } + default: + break; } } @@ -504,4 +505,4 @@ public class IngestEventsListener { } // DATA_ADDED } } -} \ No newline at end of file +} diff --git a/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java b/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java index 4095f69cea..fbb842d9d2 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/events/ContentChangedEvent.java @@ -111,4 +111,4 @@ public final class ContentChangedEvent extends AutopsyEvent implements Serializa } -} \ No newline at end of file +} diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java index 09ee853773..4389fe5bb7 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2013-2019 Basis Technology Corp. + * Copyright 2013-2018 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -37,7 +37,6 @@ import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.TskCoreException; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; -import org.sleuthkit.autopsy.ingest.ModuleContentEvent; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskDataException; From 40a2909a0e133d6c7fc06fc89b850bf247e49c91 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Mon, 7 Jan 2019 15:16:41 -0500 Subject: [PATCH 08/12] Updated comment for 'fireModuleContentEvent()'. --- Core/src/org/sleuthkit/autopsy/ingest/IngestServices.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestServices.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestServices.java index 01e86823c5..386326df10 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestServices.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestServices.java @@ -111,7 +111,8 @@ public final class IngestServices { /** * Fires an event to notify registered listeners that there is new content - * (e.g., files extracted from an archive file, carved files, etc.) + * added to the case. (e.g., files extracted from an archive file, carved + * files, etc.) * * @param moduleContentEvent A module content event, i.e., an event that * encapsulates new content data. From c6e73b31cc4cbf15711b0f3ea8668f22c684e3fc Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Mon, 7 Jan 2019 15:21:42 -0500 Subject: [PATCH 09/12] Cleanup. --- .../datamodel/DataSourceUpdateService.java | 50 ++++--------------- 1 file changed, 11 insertions(+), 39 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java index 5fe61b4603..f1e52b03e4 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/DataSourceUpdateService.java @@ -1,7 +1,7 @@ /* * Central Repository * - * Copyright 2018-2019 Basis Technology Corp. + * Copyright 2018 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -18,18 +18,17 @@ */ package org.sleuthkit.autopsy.centralrepository.datamodel; -import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; import org.openide.util.lookup.ServiceProvider; import org.sleuthkit.autopsy.appservices.AutopsyService; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.DataSource; -import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.TskCoreException; /** * Class which updates the data sources in the central repository to include the - * object ID which ties them to the current case, as well as the hash values. + * object id which ties them to the current case. + * */ @ServiceProvider(service = AutopsyService.class) public class DataSourceUpdateService implements AutopsyService { @@ -46,43 +45,16 @@ public class DataSourceUpdateService implements AutopsyService { try { EamDb centralRepository = EamDb.getInstance(); CorrelationCase correlationCase = centralRepository.getCase(context.getCase()); - //if the case isn't in the central repository yet there won't be data sources in it to update - if (correlationCase == null) { - return; - } - - for (CorrelationDataSource correlationDataSource : centralRepository.getDataSources()) { - //ResultSet.getLong has a value of 0 when the value is null - if (correlationDataSource.getCaseID() == correlationCase.getID()) { - for (Content dataSource : context.getCase().getDataSources()) { - if (((DataSource) dataSource).getDeviceId().equals(correlationDataSource.getDeviceID()) && dataSource.getName().equals(correlationDataSource.getName())) { - // Add the object ID to the data source if it doesn't exist. - if (correlationDataSource.getDataSourceObjectID() == 0) { + if (correlationCase != null) { + for (CorrelationDataSource correlationDataSource : centralRepository.getDataSources()) { + //ResultSet.getLong has a value of 0 when the value is null + if (correlationDataSource.getCaseID() == correlationCase.getID() && correlationDataSource.getDataSourceObjectID() == 0) { + for (Content dataSource : context.getCase().getDataSources()) { + if (((DataSource) dataSource).getDeviceId().equals(correlationDataSource.getDeviceID()) && dataSource.getName().equals(correlationDataSource.getName())) { centralRepository.addDataSourceObjectId(correlationDataSource.getID(), dataSource.getId()); + break; } - - // Sync the data source hash values if necessary. - if (dataSource instanceof Image) { - Image image = (Image) dataSource; - String imageMd5Hash = image.getMd5(); - String imageSha1Hash = image.getSha1(); - String imageSha256Hash = image.getSha256(); - - String crMd5Hash = correlationDataSource.getMd5(); - String crSha1Hash = correlationDataSource.getSha1(); - String crSha256Hash = correlationDataSource.getSha256(); - - if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false || StringUtils.equals(imageSha1Hash, crSha1Hash) == false - || StringUtils.equals(imageSha256Hash, crSha256Hash) == false) { - correlationDataSource.setMd5(imageMd5Hash); - correlationDataSource.setSha1(imageSha1Hash); - correlationDataSource.setSha256(imageSha256Hash); - centralRepository.updateDataSource(correlationDataSource); - } - } - - break; } } } @@ -93,4 +65,4 @@ public class DataSourceUpdateService implements AutopsyService { } } -} +} \ No newline at end of file From 61f2112bccef2cef1b430ff6b11a148dce17bf93 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Wed, 9 Jan 2019 00:14:53 -0500 Subject: [PATCH 10/12] Persist CR data on hash setters. --- .../datamodel/AbstractSqlEamDb.java | 69 ++++++++++++++++++- .../datamodel/CorrelationDataSource.java | 42 +++++++---- .../centralrepository/datamodel/EamDb.java | 21 ++++++ .../datamodel/SqliteEamDb.java | 45 ++++++++++++ .../eventlisteners/IngestEventsListener.java | 1 - 5 files changed, 161 insertions(+), 17 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index 1373431099..fc1ac13e3c 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -826,7 +826,7 @@ abstract class AbstractSqlEamDb implements EamDb { } /** - * Updates an existing data source in the database + * Updates an existing data source in the database. * * @param eamDataSource The data source to update */ @@ -862,6 +862,73 @@ abstract class AbstractSqlEamDb implements EamDb { EamDbUtil.closeConnection(conn); } } + + /** + * Updates the MD5 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSourceMd5Hash(CorrelationDataSource eamDataSource) throws EamDbException { + updateDataSourceStringValue(eamDataSource, "md5", eamDataSource.getMd5()); + } + + /** + * Updates the SHA-1 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSourceSha1Hash(CorrelationDataSource eamDataSource) throws EamDbException { + updateDataSourceStringValue(eamDataSource, "sha1", eamDataSource.getSha1()); + } + + /** + * Updates the SHA-256 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSourceSha256Hash(CorrelationDataSource eamDataSource) throws EamDbException { + updateDataSourceStringValue(eamDataSource, "sha256", eamDataSource.getSha256()); + } + + /** + * Updates the specified value in an existing data source in the database. + * + * @param eamDataSource The data source to update + * @param column The name of the column to be updated + * @param value The value to assign to the specified column + */ + private void updateDataSourceStringValue(CorrelationDataSource eamDataSource, String column, String value) throws EamDbException { + if (eamDataSource == null) { + throw new EamDbException("Correlation data source is null"); + } + + Connection conn = connect(); + + PreparedStatement preparedStatement = null; + String sql = "UPDATE data_sources " + + "SET " + column + "=? " + + "WHERE id=?"; + + try { + preparedStatement = conn.prepareStatement(sql); + + preparedStatement.setString(1, value); + preparedStatement.setInt(2, eamDataSource.getID()); + + preparedStatement.executeUpdate(); + //update the case in the cache + dataSourceCacheByDsObjectId.put(getDataSourceByDSObjectIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getDataSourceObjectID()), eamDataSource); + dataSourceCacheById.put(getDataSourceByIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getID()), eamDataSource); + } catch (SQLException ex) { + throw new EamDbException("Error updating data source.", ex); // NON-NLS + } finally { + EamDbUtil.closeStatement(preparedStatement); + EamDbUtil.closeConnection(conn); + } + } /** * Inserts new Artifact(s) into the database. Should add associated Case and diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java index c634f10639..3548d70192 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java @@ -19,6 +19,7 @@ package org.sleuthkit.autopsy.centralrepository.datamodel; import java.io.Serializable; +import org.openide.util.Exceptions; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.datamodel.Content; @@ -229,15 +230,20 @@ public class CorrelationDataSource implements Serializable { } /** - * Set the MD5 hash value. - * - * Note: This does not add the hash value to Central Repository. A method, - * such as EamDb.updateDataSource(), can be called to persist hash values. + * Set the MD5 hash value and persist to the Central Repository if available. * * @param md5Hash The MD5 hash value. + * + * @exception EamDbException If there's an issue updating the Central + * Repository. */ - public void setMd5(String md5Hash) { + public void setMd5(String md5Hash) throws EamDbException { this.md5Hash = md5Hash; + + boolean useCR = EamDb.isEnabled(); + if (useCR) { + EamDb.getInstance().updateDataSourceMd5Hash(this); + } } /** @@ -248,15 +254,18 @@ public class CorrelationDataSource implements Serializable { } /** - * Set the SHA-1 hash value. - * - * Note: This does not add the hash value to Central Repository. A method, - * such as EamDb.updateDataSource(), can be called to persist hash values. + * Set the SHA-1 hash value and persist to the Central Repository if + * available. * * @param sha1Hash The SHA-1 hash value. */ - public void setSha1(String sha1Hash) { + public void setSha1(String sha1Hash) throws EamDbException { this.sha1Hash = sha1Hash; + + boolean useCR = EamDb.isEnabled(); + if (useCR) { + EamDb.getInstance().updateDataSourceSha1Hash(this); + } } /** @@ -267,14 +276,17 @@ public class CorrelationDataSource implements Serializable { } /** - * Set the SHA-256 hash value. - * - * Note: This does not add the hash value to Central Repository. A method, - * such as EamDb.updateDataSource(), can be called to persist hash values. + * Set the SHA-256 hash value and persist to the Central Repository if + * available. * * @param sha256Hash The SHA-256 hash value. */ - public void setSha256(String sha256Hash) { + public void setSha256(String sha256Hash) throws EamDbException { this.sha256Hash = sha256Hash; + + boolean useCR = EamDb.isEnabled(); + if (useCR) { + EamDb.getInstance().updateDataSourceSha256Hash(this); + } } } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java index a9e7685d14..89b54022cf 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java @@ -211,6 +211,27 @@ public interface EamDb { * @param eamDataSource The data source to update */ void updateDataSource(CorrelationDataSource eamDataSource) throws EamDbException; + + /** + * Updates the MD5 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + void updateDataSourceMd5Hash(CorrelationDataSource eamDataSource) throws EamDbException; + + /** + * Updates the SHA-1 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + void updateDataSourceSha1Hash(CorrelationDataSource eamDataSource) throws EamDbException; + + /** + * Updates the SHA-256 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + void updateDataSourceSha256Hash(CorrelationDataSource eamDataSource) throws EamDbException; /** * Retrieves Data Source details based on data source device ID diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java index f82a3bdc26..d2ad38b5a0 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java @@ -448,6 +448,51 @@ final class SqliteEamDb extends AbstractSqlEamDb { releaseExclusiveLock(); } } + + /** + * Updates the MD5 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSourceMd5Hash(CorrelationDataSource eamDataSource) throws EamDbException { + try { + acquireExclusiveLock(); + super.updateDataSourceMd5Hash(eamDataSource); + } finally { + releaseExclusiveLock(); + } + } + + /** + * Updates the SHA-1 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSourceSha1Hash(CorrelationDataSource eamDataSource) throws EamDbException { + try { + acquireExclusiveLock(); + super.updateDataSourceSha1Hash(eamDataSource); + } finally { + releaseExclusiveLock(); + } + } + + /** + * Updates the SHA-256 hash value in an existing data source in the database. + * + * @param eamDataSource The data source to update + */ + @Override + public void updateDataSourceSha256Hash(CorrelationDataSource eamDataSource) throws EamDbException { + try { + acquireExclusiveLock(); + super.updateDataSourceSha256Hash(eamDataSource); + } finally { + releaseExclusiveLock(); + } + } /** * Inserts new Artifact(s) into the database. Should add associated Case and diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index a7da840f95..3aba207cd9 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -401,7 +401,6 @@ public class IngestEventsListener { correlationDataSource.setMd5(imageMd5Hash); correlationDataSource.setSha1(imageSha1Hash); correlationDataSource.setSha256(imageSha256Hash); - dbManager.updateDataSource(correlationDataSource); } } } From 110f8c024a574212ca88223bfa5f7a6ec4fc6a36 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Wed, 9 Jan 2019 23:18:35 -0500 Subject: [PATCH 11/12] Cleanup. --- .../datamodel/AbstractSqlEamDb.java | 40 +----------------- .../datamodel/CorrelationDataSource.java | 31 +++----------- .../centralrepository/datamodel/EamDb.java | 7 ---- .../datamodel/SqliteEamDb.java | 15 ------- .../eventlisteners/IngestEventsListener.java | 41 ++++++++++++------- .../autopsy/ingest/IngestManager.java | 5 +-- .../datamodel/CentralRepoDatamodelTest.java | 20 ++++----- 7 files changed, 46 insertions(+), 113 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index fc1ac13e3c..0b03064835 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -824,44 +824,6 @@ abstract class AbstractSqlEamDb implements EamDb { return dataSources; } - - /** - * Updates an existing data source in the database. - * - * @param eamDataSource The data source to update - */ - @Override - public void updateDataSource(CorrelationDataSource eamDataSource) throws EamDbException { - if (eamDataSource == null) { - throw new EamDbException("Correlation data source is null"); - } - - Connection conn = connect(); - - PreparedStatement preparedStatement = null; - String sql = "UPDATE data_sources " - + "SET md5=?, sha1=?, sha256=? " - + "WHERE id=?"; - - try { - preparedStatement = conn.prepareStatement(sql); - - preparedStatement.setString(1, eamDataSource.getMd5()); - preparedStatement.setString(2, eamDataSource.getSha1()); - preparedStatement.setString(3, eamDataSource.getSha256()); - preparedStatement.setInt(4, eamDataSource.getID()); - - preparedStatement.executeUpdate(); - //update the case in the cache - dataSourceCacheByDsObjectId.put(getDataSourceByDSObjectIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getDataSourceObjectID()), eamDataSource); - dataSourceCacheById.put(getDataSourceByIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getID()), eamDataSource); - } catch (SQLException ex) { - throw new EamDbException("Error updating data source.", ex); // NON-NLS - } finally { - EamDbUtil.closeStatement(preparedStatement); - EamDbUtil.closeConnection(conn); - } - } /** * Updates the MD5 hash value in an existing data source in the database. @@ -923,7 +885,7 @@ abstract class AbstractSqlEamDb implements EamDb { dataSourceCacheByDsObjectId.put(getDataSourceByDSObjectIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getDataSourceObjectID()), eamDataSource); dataSourceCacheById.put(getDataSourceByIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getID()), eamDataSource); } catch (SQLException ex) { - throw new EamDbException("Error updating data source.", ex); // NON-NLS + throw new EamDbException(String.format("Error updating data source (id=%d).", eamDataSource.getID()), ex); // NON-NLS } finally { EamDbUtil.closeStatement(preparedStatement); EamDbUtil.closeConnection(conn); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java index 3548d70192..b8d3c793cb 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationDataSource.java @@ -19,7 +19,6 @@ package org.sleuthkit.autopsy.centralrepository.datamodel; import java.io.Serializable; -import org.openide.util.Exceptions; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.datamodel.Content; @@ -45,21 +44,6 @@ public class CorrelationDataSource implements Serializable { private String sha1Hash; private String sha256Hash; - /** - * Create a CorrelationDataSource object, the object will not have the data - * source id for the row in the central repository. - * - * @param correlationCase CorrelationCase object data source is - * associated with. Must have been created by - * EamDB and have a valid ID. - * @param deviceId User specified case-specific ID - * @param name Display name of data source - * @param dataSourceObjectId The object ID for the datasource - */ - public CorrelationDataSource(CorrelationCase correlationCase, String deviceId, String name, long dataSourceObjectId) { - this(correlationCase.getID(), -1, deviceId, name, dataSourceObjectId, null, null, null); - } - /** * Create a CorrelationDataSource object. * @@ -226,7 +210,7 @@ public class CorrelationDataSource implements Serializable { * @return the MD5 hash value */ public String getMd5() { - return md5Hash; + return (md5Hash == null ? "" : md5Hash); } /** @@ -240,8 +224,7 @@ public class CorrelationDataSource implements Serializable { public void setMd5(String md5Hash) throws EamDbException { this.md5Hash = md5Hash; - boolean useCR = EamDb.isEnabled(); - if (useCR) { + if (dataSourceObjectID != -1) { EamDb.getInstance().updateDataSourceMd5Hash(this); } } @@ -250,7 +233,7 @@ public class CorrelationDataSource implements Serializable { * @return the SHA-1 hash value */ public String getSha1() { - return sha1Hash; + return (sha1Hash == null ? "" : sha1Hash); } /** @@ -262,8 +245,7 @@ public class CorrelationDataSource implements Serializable { public void setSha1(String sha1Hash) throws EamDbException { this.sha1Hash = sha1Hash; - boolean useCR = EamDb.isEnabled(); - if (useCR) { + if (dataSourceObjectID != -1) { EamDb.getInstance().updateDataSourceSha1Hash(this); } } @@ -272,7 +254,7 @@ public class CorrelationDataSource implements Serializable { * @return the SHA-256 hash value */ public String getSha256() { - return sha256Hash; + return (sha256Hash == null ? "" : sha256Hash); } /** @@ -284,8 +266,7 @@ public class CorrelationDataSource implements Serializable { public void setSha256(String sha256Hash) throws EamDbException { this.sha256Hash = sha256Hash; - boolean useCR = EamDb.isEnabled(); - if (useCR) { + if (dataSourceObjectID != -1) { EamDb.getInstance().updateDataSourceSha256Hash(this); } } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java index 89b54022cf..ddd10b2b0e 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java @@ -205,13 +205,6 @@ public interface EamDb { */ CorrelationDataSource newDataSource(CorrelationDataSource eamDataSource) throws EamDbException; - /** - * Updates an existing data source in the database - * - * @param eamDataSource The data source to update - */ - void updateDataSource(CorrelationDataSource eamDataSource) throws EamDbException; - /** * Updates the MD5 hash value in an existing data source in the database. * diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java index d2ad38b5a0..2996a5be15 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java @@ -433,21 +433,6 @@ final class SqliteEamDb extends AbstractSqlEamDb { releaseSharedLock(); } } - - /** - * Updates an existing data source in the database - * - * @param eamDataSource The data source to update - */ - @Override - public void updateDataSource(CorrelationDataSource eamDataSource) throws EamDbException { - try { - acquireExclusiveLock(); - super.updateDataSource(eamDataSource); - } finally { - releaseExclusiveLock(); - } - } /** * Updates the MD5 hash value in an existing data source in the database. diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 3aba207cd9..37f0f595cb 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -358,7 +358,7 @@ public class IngestEventsListener { } Content dataSource; String dataSourceName = ""; - long dataSourceId = -1; + long dataSourceObjectId = -1; try { dataSource = ((DataSourceAnalysisCompletedEvent) event).getDataSource(); @@ -371,7 +371,7 @@ public class IngestEventsListener { } dataSourceName = dataSource.getName(); - dataSourceId = dataSource.getId(); + dataSourceObjectId = dataSource.getId(); Case openCase = Case.getCurrentCaseThrows(); @@ -388,32 +388,45 @@ public class IngestEventsListener { // Sync the data source hash values if necessary. if (dataSource instanceof Image) { Image image = (Image) dataSource; + String imageMd5Hash = image.getMd5(); - String imageSha1Hash = image.getSha1(); - String imageSha256Hash = image.getSha256(); - + if (imageMd5Hash == null) { + imageMd5Hash = ""; + } String crMd5Hash = correlationDataSource.getMd5(); - String crSha1Hash = correlationDataSource.getSha1(); - String crSha256Hash = correlationDataSource.getSha256(); - - if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false || StringUtils.equals(imageSha1Hash, crSha1Hash) == false - || StringUtils.equals(imageSha256Hash, crSha256Hash) == false) { + if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false) { correlationDataSource.setMd5(imageMd5Hash); + } + + String imageSha1Hash = image.getSha1(); + if (imageSha1Hash == null) { + imageSha1Hash = ""; + } + String crSha1Hash = correlationDataSource.getSha1(); + if (StringUtils.equals(imageSha1Hash, crSha1Hash) == false) { correlationDataSource.setSha1(imageSha1Hash); + } + + String imageSha256Hash = image.getSha256(); + if (imageSha256Hash == null) { + imageSha256Hash = ""; + } + String crSha256Hash = correlationDataSource.getSha256(); + if (StringUtils.equals(imageSha256Hash, crSha256Hash) == false) { correlationDataSource.setSha256(imageSha256Hash); } } } } catch (EamDbException ex) { LOGGER.log(Level.SEVERE, String.format( - "Unable to fetch data from the Central Repository for data source '%s' (id=%d)", - dataSourceName, dataSourceId), ex); + "Unable to fetch data from the Central Repository for data source '%s' (obj_id=%d)", + dataSourceName, dataSourceObjectId), ex); } catch (NoCurrentCaseException ex) { LOGGER.log(Level.SEVERE, "No current case opened.", ex); } catch (TskCoreException ex) { LOGGER.log(Level.SEVERE, String.format( - "Unable to fetch data from the case database for data source '%s' (id=%d)", - dataSourceName, dataSourceId), ex); + "Unable to fetch data from the case database for data source '%s' (obj_id=%d)", + dataSourceName, dataSourceObjectId), ex); } } // DATA_SOURCE_ANALYSIS_COMPLETED } diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java index fabf317187..d5a2240ca5 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java @@ -1102,9 +1102,8 @@ public class IngestManager implements IngestProgressSnapshotProvider { DATA_ADDED, /** * Property change event fired when an ingest module adds new content to - * a case or changes a recorded attribute of existing content. For - * example, if a module adds an extracted or carved file to a case, the - * module should fire this event. The old value of the + * a case. For example, if a module adds an extracted or carved file to + * a case, the module should fire this event. The old value of the * PropertyChangeEvent is a ModuleContentEvent object, and the new value * is set to null. */ diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java index b61d82626b..a0608a3e9d 100755 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java @@ -150,17 +150,17 @@ public class CentralRepoDatamodelTest extends TestCase { case2 = EamDb.getInstance().newCase(case2); assertTrue("Failed to create test object case2", case2 != null); - dataSource1fromCase1 = new CorrelationDataSource(case1, "dataSource1_deviceID", "dataSource1", CASE_1_DATA_SOURCE_1_ID); + dataSource1fromCase1 = new CorrelationDataSource(case1, "dataSource1_deviceID", "dataSource1", CASE_1_DATA_SOURCE_1_ID, null, null, null); EamDb.getInstance().newDataSource(dataSource1fromCase1); dataSource1fromCase1 = EamDb.getInstance().getDataSource(case1, dataSource1fromCase1.getDataSourceObjectID()); assertTrue("Failed to create test object dataSource1fromCase1", dataSource1fromCase1 != null); - dataSource2fromCase1 = new CorrelationDataSource(case1, "dataSource2_deviceID", "dataSource2", CASE_1_DATA_SOURCE_2_ID); + dataSource2fromCase1 = new CorrelationDataSource(case1, "dataSource2_deviceID", "dataSource2", CASE_1_DATA_SOURCE_2_ID, null, null, null); EamDb.getInstance().newDataSource(dataSource2fromCase1); dataSource2fromCase1 = EamDb.getInstance().getDataSource(case1, dataSource2fromCase1.getDataSourceObjectID()); assertTrue("Failed to create test object dataSource2fromCase1", dataSource2fromCase1 != null); - dataSource1fromCase2 = new CorrelationDataSource(case2, "dataSource3_deviceID", "dataSource3", CASE_2_DATA_SOURCE_1_ID); + dataSource1fromCase2 = new CorrelationDataSource(case2, "dataSource3_deviceID", "dataSource3", CASE_2_DATA_SOURCE_1_ID, null, null, null); EamDb.getInstance().newDataSource(dataSource1fromCase2); dataSource1fromCase2 = EamDb.getInstance().getDataSource(case2, dataSource1fromCase2.getDataSourceObjectID()); assertTrue("Failed to create test object dataSource1fromCase2", dataSource1fromCase2 != null); @@ -866,7 +866,7 @@ public class CentralRepoDatamodelTest extends TestCase { // Test adding instance with invalid data source ID try { CorrelationDataSource badDS = new CorrelationDataSource(case1, "badDSUuid", "badDSName", - 0L); + 0L, null, null, null); CorrelationAttributeInstance failAttrInst4 = new CorrelationAttributeInstance(fileType, randomHash(), case1, badDS, BAD_PATH, null, TskData.FileKnown.UNKNOWN, 0L); EamDb.getInstance().addArtifactInstance(failAttrInst4); @@ -2348,7 +2348,7 @@ public class CentralRepoDatamodelTest extends TestCase { // Test creating a data source with valid case, name, and ID try { dataSourceA = new CorrelationDataSource(case2, dataSourceAid, dataSourceAname, - 0L); + 0L, null, null, null); EamDb.getInstance().newDataSource(dataSourceA); } catch (EamDbException ex) { Exceptions.printStackTrace(ex); @@ -2359,7 +2359,7 @@ public class CentralRepoDatamodelTest extends TestCase { // Test creating a data source with the same case, name, and ID try { CorrelationDataSource temp = new CorrelationDataSource(case2, dataSourceAid, dataSourceAname, - 0L); + 0L, null, null, null); EamDb.getInstance().newDataSource(temp); fail("newDataSource did not throw exception from duplicate data source"); } catch (EamDbException ex) { @@ -2369,7 +2369,7 @@ public class CentralRepoDatamodelTest extends TestCase { // Test creating a data source with the same name and ID but different case try { dataSourceB = new CorrelationDataSource(case1, dataSourceAid, dataSourceAname, - 0L); + 0L, null, null, null); EamDb.getInstance().newDataSource(dataSourceB); } catch (EamDbException ex) { Exceptions.printStackTrace(ex); @@ -2381,7 +2381,7 @@ public class CentralRepoDatamodelTest extends TestCase { try { CorrelationCase correlationCase = new CorrelationCase("1", "test"); CorrelationDataSource temp = new CorrelationDataSource(correlationCase, "tempID", "tempName", - 0L); + 0L, null, null, null); EamDb.getInstance().newDataSource(temp); fail("newDataSource did not throw exception from invalid case ID"); } catch (EamDbException ex) { @@ -2392,7 +2392,7 @@ public class CentralRepoDatamodelTest extends TestCase { // Test creating a data source with null device ID try { CorrelationDataSource temp = new CorrelationDataSource(case2, null, "tempName", - 0L); + 0L, null, null, null); EamDb.getInstance().newDataSource(temp); fail("newDataSource did not throw exception from null device ID"); } catch (EamDbException ex) { @@ -2403,7 +2403,7 @@ public class CentralRepoDatamodelTest extends TestCase { // Test creating a data source with null name try { CorrelationDataSource temp = new CorrelationDataSource(case2, "tempID", null, - 0L); + 0L, null, null, null); EamDb.getInstance().newDataSource(temp); fail("newDataSource did not throw exception from null name"); } catch (EamDbException ex) { From d6581e79c9cce74ffdec2cd7b339001eea4fc8cf Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Thu, 10 Jan 2019 10:06:47 -0500 Subject: [PATCH 12/12] Minor tweak to one exception message. --- .../autopsy/centralrepository/datamodel/AbstractSqlEamDb.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index 0b03064835..67c3e43fb2 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -885,7 +885,7 @@ abstract class AbstractSqlEamDb implements EamDb { dataSourceCacheByDsObjectId.put(getDataSourceByDSObjectIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getDataSourceObjectID()), eamDataSource); dataSourceCacheById.put(getDataSourceByIdCacheKey(eamDataSource.getCaseID(), eamDataSource.getID()), eamDataSource); } catch (SQLException ex) { - throw new EamDbException(String.format("Error updating data source (id=%d).", eamDataSource.getID()), ex); // NON-NLS + throw new EamDbException(String.format("Error updating data source (obj_id=%d).", eamDataSource.getDataSourceObjectID()), ex); // NON-NLS } finally { EamDbUtil.closeStatement(preparedStatement); EamDbUtil.closeConnection(conn);