mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-19 11:07:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow events to be associated with data source

Browse Source
This commit is contained in:
Brian Carrier 2018-09-19 12:45:07 -04:00
parent bb8ed180f9
commit 547a3da74c
4 changed files with 39 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventNode.java
View File

@ -47,6 +47,7 @@ import org.sleuthkit.autopsy.timeline.ui.EventTypeUtils;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.timeline.TimelineEvent; import org.sleuthkit.datamodel.timeline.TimelineEvent;
@ -62,13 +63,13 @@ public class EventNode extends DisplayableItemNode {
private final TimelineEvent event; private final TimelineEvent event;
EventNode(TimelineEvent event, AbstractFile file, BlackboardArtifact artifact) { EventNode(TimelineEvent event, Content file, BlackboardArtifact artifact) {
super(Children.LEAF, Lookups.fixed(event, file, artifact)); super(Children.LEAF, Lookups.fixed(event, file, artifact));
this.event = event; this.event = event;
this.setIconBaseWithExtension(EventTypeUtils.getImagePath(event.getEventType())); // NON-NLS this.setIconBaseWithExtension(EventTypeUtils.getImagePath(event.getEventType())); // NON-NLS
} }
EventNode(TimelineEvent event, AbstractFile file) { EventNode(TimelineEvent event, Content file) {
super(Children.LEAF, Lookups.fixed(event, file)); super(Children.LEAF, Lookups.fixed(event, file));
this.event = event; this.event = event;
this.setIconBaseWithExtension(EventTypeUtils.getImagePath(event.getEventType())); // NON-NLS this.setIconBaseWithExtension(EventTypeUtils.getImagePath(event.getEventType())); // NON-NLS
@ -227,7 +228,7 @@ public class EventNode extends DisplayableItemNode {
*/ */
final TimelineEvent eventById = eventsModel.getEventById(eventID); final TimelineEvent eventById = eventsModel.getEventById(eventID);
AbstractFile file = sleuthkitCase.getAbstractFileById(eventById.getFileID()); Content file = sleuthkitCase.getContentById(eventById.getFileObjID());
if (eventById.getArtifactID().isPresent()) { if (eventById.getArtifactID().isPresent()) {
BlackboardArtifact blackboardArtifact = sleuthkitCase.getBlackboardArtifact(eventById.getArtifactID().get()); BlackboardArtifact blackboardArtifact = sleuthkitCase.getBlackboardArtifact(eventById.getArtifactID().get());

2
Core/src/org/sleuthkit/autopsy/timeline/ui/detailview/EventNodeBase.java
View File

@ -298,7 +298,7 @@ public abstract class EventNodeBase<Type extends DetailViewEvent> extends StackP
try { try {
//TODO:push this to DB //TODO:push this to DB
for (TimelineEvent tle : eventsModel.getEventsById(tlEvent.getEventIDsWithHashHits())) { for (TimelineEvent tle : eventsModel.getEventsById(tlEvent.getEventIDsWithHashHits())) {
Set<String> hashSetNames = sleuthkitCase.getAbstractFileById(tle.getFileID()).getHashSetNames(); Set<String> hashSetNames = sleuthkitCase.getContentById(tle.getFileObjID()).getHashSetNames();
for (String hashSetName : hashSetNames) { for (String hashSetName : hashSetNames) {
hashSetCounts.merge(hashSetName, 1L, Long::sum); hashSetCounts.merge(hashSetName, 1L, Long::sum);
} }

41
Core/src/org/sleuthkit/autopsy/timeline/ui/detailview/datamodel/SingleDetailsViewEvent.java
View File

@ -38,9 +38,9 @@ public class SingleDetailsViewEvent implements DetailViewEvent {
private final long eventID; private final long eventID;
/** /**
* The TSK object ID of the file this event is derived from. * The TSK object ID of the file (could be data source) this event is derived from.
*/ */
private final long objID; private final long fileObjId;
/** /**
* The TSK artifact ID of the file this event is derived from. Null, if this * The TSK artifact ID of the file this event is derived from. Null, if this
@ -51,7 +51,7 @@ public class SingleDetailsViewEvent implements DetailViewEvent {
/** /**
* The TSK datasource ID of the datasource this event belongs to. * The TSK datasource ID of the datasource this event belongs to.
*/ */
private final long dataSourceID; private final long dataSourceObjId;
/** /**
* The time of this event in second from the Unix epoch. * The time of this event in second from the Unix epoch.
@ -90,10 +90,25 @@ public class SingleDetailsViewEvent implements DetailViewEvent {
*/ */
private MultiEvent<?> parent = null; private MultiEvent<?> parent = null;
public SingleDetailsViewEvent(long eventID, long dataSourceID, long objID, Long artifactID, long time, EventType type, String fullDescription, String medDescription, String shortDescription, TskData.FileKnown known, boolean hashHit, boolean tagged) { /**
*
* @param eventID
* @param dataSourceObjId
* @param fileObjId Object Id of file (could be a data source) that event is associated with
* @param artifactID
* @param time
* @param type
* @param fullDescription
* @param medDescription
* @param shortDescription
* @param known
* @param hashHit
* @param tagged
*/
public SingleDetailsViewEvent(long eventID, long dataSourceObjId, long fileObjId, Long artifactID, long time, EventType type, String fullDescription, String medDescription, String shortDescription, TskData.FileKnown known, boolean hashHit, boolean tagged) {
this.eventID = eventID; this.eventID = eventID;
this.dataSourceID = dataSourceID; this.dataSourceObjId = dataSourceObjId;
this.objID = objID; this.fileObjId = fileObjId;
this.artifactID = Long.valueOf(0).equals(artifactID) ? null : artifactID; this.artifactID = Long.valueOf(0).equals(artifactID) ? null : artifactID;
this.time = time; this.time = time;
this.type = type; this.type = type;
@ -107,8 +122,8 @@ public class SingleDetailsViewEvent implements DetailViewEvent {
public SingleDetailsViewEvent(TimelineEvent singleEvent) { public SingleDetailsViewEvent(TimelineEvent singleEvent) {
this(singleEvent.getEventID(), this(singleEvent.getEventID(),
singleEvent.getDataSourceID(), singleEvent.getDataSourceObjID(),
singleEvent.getFileID(), singleEvent.getFileObjID(),
singleEvent.getArtifactID().orElse(null), singleEvent.getArtifactID().orElse(null),
singleEvent.getTime(), singleEvent.getTime(),
singleEvent.getEventType(), singleEvent.getEventType(),
@ -130,7 +145,7 @@ public class SingleDetailsViewEvent implements DetailViewEvent {
* with the given parent. * with the given parent.
*/ */
public SingleDetailsViewEvent withParent(MultiEvent<?> newParent) { public SingleDetailsViewEvent withParent(MultiEvent<?> newParent) {
SingleDetailsViewEvent singleEvent = new SingleDetailsViewEvent(eventID, dataSourceID, objID, artifactID, time, type, descriptions.get(DescriptionLoD.FULL), descriptions.get(DescriptionLoD.MEDIUM), descriptions.get(DescriptionLoD.SHORT), known, hashHit, tagged); SingleDetailsViewEvent singleEvent = new SingleDetailsViewEvent(eventID, dataSourceObjId, fileObjId, artifactID, time, type, descriptions.get(DescriptionLoD.FULL), descriptions.get(DescriptionLoD.MEDIUM), descriptions.get(DescriptionLoD.SHORT), known, hashHit, tagged);
singleEvent.parent = newParent; singleEvent.parent = newParent;
return singleEvent; return singleEvent;
} }
@ -176,12 +191,12 @@ public class SingleDetailsViewEvent implements DetailViewEvent {
} }
/** /**
* Get the obj id of the file this event is derived from. * Get the obj id of the file (which could be a data source) this event is derived from.
* *
* @return the object id. * @return the object id.
*/ */
public long getFileID() { public long getFileID() {
return objID; return fileObjId;
} }
/** /**
@ -250,8 +265,8 @@ public class SingleDetailsViewEvent implements DetailViewEvent {
* *
* @return the datasource id. * @return the datasource id.
*/ */
public long getDataSourceID() { public long getDataSourceObjID() {
return dataSourceID; return dataSourceObjId;
} }
@Override @Override

11
Core/src/org/sleuthkit/autopsy/timeline/ui/listvew/ListTimeline.java
View File

@ -90,6 +90,7 @@ import static org.sleuthkit.autopsy.timeline.ui.EventTypeUtils.getImagePath;
import org.sleuthkit.autopsy.timeline.ui.listvew.datamodel.CombinedEvent; import org.sleuthkit.autopsy.timeline.ui.listvew.datamodel.CombinedEvent;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.DescriptionLoD; import org.sleuthkit.datamodel.DescriptionLoD;
@ -457,13 +458,13 @@ class ListTimeline extends BorderPane {
SortedSet<String> tagNames = new TreeSet<>(); SortedSet<String> tagNames = new TreeSet<>();
try { try {
//get file tags //get file tags
AbstractFile abstractFileById = sleuthkitCase.getAbstractFileById(getEvent().getFileID()); Content file = sleuthkitCase.getContentById(getEvent().getFileObjID());
tagsManager.getContentTagsByContent(abstractFileById).stream() tagsManager.getContentTagsByContent(file).stream()
.map(tag -> tag.getName().getDisplayName()) .map(tag -> tag.getName().getDisplayName())
.forEach(tagNames::add); .forEach(tagNames::add);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Failed to lookup tags for obj id " + getEvent().getFileID(), ex); //NON-NLS logger.log(Level.SEVERE, "Failed to lookup tags for obj id " + getEvent().getFileObjID(), ex); //NON-NLS
Platform.runLater(() -> { Platform.runLater(() -> {
Notifications.create() Notifications.create()
.owner(getScene().getWindow()) .owner(getScene().getWindow())
@ -527,12 +528,12 @@ class ListTimeline extends BorderPane {
*/ */
setGraphic(new ImageView(HASH_HIT)); setGraphic(new ImageView(HASH_HIT));
try { try {
Set<String> hashSetNames = new TreeSet<>(sleuthkitCase.getAbstractFileById(getEvent().getFileID()).getHashSetNames()); Set<String> hashSetNames = new TreeSet<>(sleuthkitCase.getContentById(getEvent().getFileObjID()).getHashSetNames());
Tooltip tooltip = new Tooltip(Bundle.ListTimeline_hashHitTooltip_text(String.join("\n", hashSetNames))); //NON-NLS Tooltip tooltip = new Tooltip(Bundle.ListTimeline_hashHitTooltip_text(String.join("\n", hashSetNames))); //NON-NLS
tooltip.setGraphic(new ImageView(HASH_HIT)); tooltip.setGraphic(new ImageView(HASH_HIT));
setTooltip(tooltip); setTooltip(tooltip);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Failed to lookup hash set names for obj id " + getEvent().getFileID(), ex); //NON-NLS logger.log(Level.SEVERE, "Failed to lookup hash set names for obj id " + getEvent().getFileObjID(), ex); //NON-NLS
Platform.runLater(() -> { Platform.runLater(() -> {
Notifications.create() Notifications.create()
.owner(getScene().getWindow()) .owner(getScene().getWindow())