mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7399 from gdicristofaro/8144-communicationsCounts

Browse Source 
8144 communication counts
This commit is contained in:
Ann Priestman 2021-11-08 08:20:33 -05:00 committed by GitHub
commit 4884247552
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
Core/src/org/sleuthkit/autopsy/datamodel/accounts/Accounts.java
View File

@ -267,30 +267,32 @@ final public class Accounts implements AutopsyVisitableItem {
@Override
protected long fetchChildCount(SleuthkitCase skCase) throws TskCoreException {
long count = 0;
String dataSourceFilterClause = (filteringDSObjId > 0)
? " AND " + filteringDSObjId + " IN (SELECT art.data_source_obj_id FROM blackboard_artifacts art WHERE art.artifact_id = attr.artifact_id)"
: "";
String accountTypesInUseQuery
= "SELECT COUNT(attr.value_text) AS count"
+ " FROM blackboard_attributes attr"
+ " WHERE attr.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE.getTypeID()
+ " AND attr.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID()
+ dataSourceFilterClause
+ " GROUP BY attr.value_text";
= "SELECT COUNT(*) AS count\n"
+ "FROM (\n"
+ " SELECT MIN(blackboard_attributes.value_text) AS account_type\n"
+ " FROM blackboard_artifacts\n"
+ " LEFT JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id\n"
+ " WHERE blackboard_artifacts.artifact_type_id = " + TSK_ACCOUNT.getTypeID() + "\n"
+ " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.Type.TSK_ACCOUNT_TYPE.getTypeID() + "\n"
+ " AND blackboard_attributes.value_text IS NOT NULL\n"
+ getFilterByDataSourceClause() + "\n"
+ " -- group by artifact_id to ensure only one account type per artifact\n"
+ " GROUP BY blackboard_artifacts.artifact_id\n"
+ ") res\n";
try (SleuthkitCase.CaseDbQuery executeQuery = skCase.executeQuery(accountTypesInUseQuery);
ResultSet resultSet = executeQuery.getResultSet()) {
if (resultSet.next()) {
count = resultSet.getLong("count");
return resultSet.getLong("count");
}
} catch (TskCoreException | SQLException ex) {
LOGGER.log(Level.SEVERE, "Error querying for count of all account types", ex);
}
return count;
return 0;
}
}
@ -334,13 +336,18 @@ final public class Accounts implements AutopsyVisitableItem {
*/
private void update() {
String accountTypesInUseQuery
= "SELECT blackboard_attributes.value_text as account_type, COUNT(*) as count "
+ " FROM blackboard_artifacts " //NON-NLS
+ " JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id " //NON-NLS
+ " WHERE blackboard_artifacts.artifact_type_id = " + TSK_ACCOUNT.getTypeID() //NON-NLS
+ " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE.getTypeID() //NON-NLS
+ getFilterByDataSourceClause()
+ " GROUP BY blackboard_attributes.value_text ";
= "SELECT res.account_type, COUNT(*) AS count\n"
+ "FROM (\n"
+ " SELECT MIN(blackboard_attributes.value_text) AS account_type\n"
+ " FROM blackboard_artifacts\n"
+ " LEFT JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id\n"
+ " WHERE blackboard_artifacts.artifact_type_id = " + TSK_ACCOUNT.getTypeID() + "\n"
+ " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.Type.TSK_ACCOUNT_TYPE.getTypeID() + "\n"
+ getFilterByDataSourceClause() + "\n"
+ " -- group by artifact_id to ensure only one account type per artifact\n"
+ " GROUP BY blackboard_artifacts.artifact_id\n"
+ ") res\n"
+ "GROUP BY res.account_type";
try (SleuthkitCase.CaseDbQuery executeQuery = skCase.executeQuery(accountTypesInUseQuery);
ResultSet resultSet = executeQuery.getResultSet()) {
@ -404,6 +411,7 @@ final public class Accounts implements AutopsyVisitableItem {
*/
try {
Case.getCurrentCaseThrows();
accountTypeResults.update();
refresh(true);
} catch (NoCurrentCaseException notUsed) {
// Case is closed, do nothing.
@ -1466,7 +1474,7 @@ final public class Accounts implements AutopsyVisitableItem {
@Override
public Action[] getActions(boolean context) {
Action[] actions = super.getActions(context);
ArrayList<Action> arrayList = new ArrayList<>();
ArrayList<Action> arrayList = new ArrayList<>();
try {
arrayList.addAll(DataModelActionsFactory.getActions(Accounts.this.skCase.getContentById(fileKey.getObjID()), false));
} catch (TskCoreException ex) {