From 58ff53dbfa91e759dfc5dd6211d5200a49814bbe Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 27 Jan 2022 15:21:58 -0500 Subject: [PATCH] gather different data --- .../datamodel/PastCasesSummary.java | 118 ++++++++++++------ .../datasourcesummary/ui/Bundle.properties | 6 +- .../ui/Bundle.properties-MERGED | 6 +- .../datasourcesummary/ui/Bundle_ja.properties | 4 +- .../datasourcesummary/ui/PastCasesPanel.form | 103 +++++++++++++-- .../datasourcesummary/ui/PastCasesPanel.java | 57 ++++++--- .../Bundle.properties-MERGED | 5 +- .../ExportPastCases.java | 12 +- 8 files changed, 238 insertions(+), 73 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java index 07918f1f88..c49d5e6d8d 100755 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java @@ -24,14 +24,15 @@ import java.util.Collection; import java.util.Collections; import java.util.HashSet; import java.util.List; +import java.util.Map; import java.util.Set; import java.util.stream.Collectors; import java.util.stream.Stream; import org.apache.commons.lang3.tuple.Pair; -import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory; import org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException; +import org.sleuthkit.datamodel.Blackboard; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardAttribute; @@ -70,42 +71,51 @@ public class PastCasesSummary { */ public static class PastCasesResult { - private final List> sameIdsResults; - private final List> taggedNotable; + private final List> previouslyNotable; + private final List> previouslySeenDevices; + private final List> previouslySeenResults; /** * Main constructor. * - * @param sameIdsResults Data for the cases with same id table. - * @param taggedNotable Data for the tagged notable table. + * @param previouslyNotable TSK_PREVIOUSLY_NOTABLE results. + * @param previouslySeenDevices TSK_PREVIOUSLY_SEEN device results. + * @param previouslySeenResults TSK_PREVIOUSLY_SEEN non-device results. */ - public PastCasesResult(List> sameIdsResults, List> taggedNotable) { - this.sameIdsResults = sameIdsResults; - this.taggedNotable = taggedNotable; + public PastCasesResult(List> previouslyNotable, List> previouslySeenDevices, List> previouslySeenResults) { + this.previouslyNotable = Collections.unmodifiableList(previouslyNotable); + this.previouslySeenDevices = Collections.unmodifiableList(previouslySeenDevices); + this.previouslySeenResults = Collections.unmodifiableList(previouslySeenResults); } /** - * @return Data for the cases with same id table. + * @return TSK_PREVIOUSLY_NOTABLE results. */ - public List> getSameIdsResults() { - return Collections.unmodifiableList(sameIdsResults); + public List> getPreviouslyNotable() { + return previouslyNotable; } /** - * @return Data for the tagged notable table. + * @return TSK_PREVIOUSLY_SEEN device results. */ - public List> getTaggedNotable() { - return Collections.unmodifiableList(taggedNotable); + public List> getPreviouslySeenDevices() { + return previouslySeenDevices; + } + + /** + * @return TSK_PREVIOUSLY_SEEN non-device results. + */ + public List> getPreviouslySeenResults() { + return previouslySeenResults; } } private static final Set ARTIFACT_UPDATE_TYPE_IDS = new HashSet<>(Arrays.asList( - ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID(), + ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID(), ARTIFACT_TYPE.TSK_PREVIOUSLY_NOTABLE.getTypeID() )); private static final String CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim(); - private static final BlackboardAttribute.Type TYPE_COMMENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_OTHER_CASES); private static final Set CR_DEVICE_TYPE_IDS = new HashSet<>(Arrays.asList( ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID(), @@ -180,11 +190,24 @@ public class PastCasesSummary { BlackboardAttribute commentAttr = null; try { - commentAttr = artifact.getAttribute(TYPE_COMMENT); + commentAttr = artifact.getAttribute(BlackboardAttribute.Type.TSK_OTHER_CASES); } catch (TskCoreException ignored) { // ignore if no attribute can be found } + return getCasesFromAttr(commentAttr); + + } + + /** + * Gets a list of cases from the TSK_OTHER_CASES attribute. The cases + * string is expected to be of a form of "case1,case2...caseN". + * + * @param artifact The attribute. + * + * @return The list of cases if found or empty list if not. + */ + private static List getCasesFromAttr(BlackboardAttribute commentAttr) { if (commentAttr == null) { return Collections.emptyList(); } @@ -197,7 +220,6 @@ public class PastCasesSummary { return Stream.of(justCasesStr.split(CASE_SEPARATOR)) .map(String::trim) .collect(Collectors.toList()); - } /** @@ -226,9 +248,28 @@ public class PastCasesSummary { .sorted((a, b) -> -Long.compare(a.getValue(), b.getValue())) .collect(Collectors.toList()); } + + + /** + * Determines a list of counts for most populated cases based on comment + * attribute. + * + * @param artifacts The list of artifacts. + * + * @return The key value pairs mapping case to counts. + */ + private static List> getCaseCountsFromArtifacts(List artifacts) { + List cases = new ArrayList<>(); + for (BlackboardArtifact art : artifacts) { + cases.addAll(getCasesFromArtifact(art)); + } + + return getCaseCounts(cases.stream()); + } /** - * Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves it's parent artifact. + * Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves + * it's parent artifact. * * @param artifact The input artifact. * @@ -241,7 +282,7 @@ public class PastCasesSummary { BlackboardArtifact sourceArtifact = null; SleuthkitCase skCase = caseProvider.get(); - Content content = skCase.getContentById(artifact.getObjectID()); + Content content = skCase.getContentById(artifact.getObjectID()); if (content instanceof BlackboardArtifact) { sourceArtifact = (BlackboardArtifact) content; } @@ -285,28 +326,31 @@ public class PastCasesSummary { return null; } - SleuthkitCase skCase = caseProvider.get(); + long dataSourceId = dataSource.getId(); - List deviceArtifactCases = new ArrayList<>(); - List nonDeviceArtifactCases = new ArrayList<>(); - for (Integer typeId : ARTIFACT_UPDATE_TYPE_IDS) { - for (BlackboardArtifact artifact : skCase.getBlackboard().getArtifacts(typeId, dataSource.getId())) { - List cases = getCasesFromArtifact(artifact); - if (cases == null || cases.isEmpty()) { - continue; - } + Blackboard blackboard = caseProvider.get().getBlackboard(); - if (hasDeviceAssociatedArtifact(artifact)) { - deviceArtifactCases.addAll(cases); - } else { - nonDeviceArtifactCases.addAll(cases); - } + List previouslyNotableArtifacts + = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_NOTABLE.getTypeID(), dataSourceId); + + List previouslySeenArtifacts + = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_SEEN.getTypeID(), dataSourceId); + + List previouslySeenDevice = new ArrayList<>(); + List previouslySeenNoDevice = new ArrayList<>(); + + for (BlackboardArtifact art : previouslySeenArtifacts) { + if (hasDeviceAssociatedArtifact(art)) { + previouslySeenDevice.add(art); + } else { + previouslySeenNoDevice.add(art); } - } + } return new PastCasesResult( - getCaseCounts(deviceArtifactCases.stream()), - getCaseCounts(nonDeviceArtifactCases.stream()) + getCaseCountsFromArtifacts(previouslyNotableArtifacts), + getCaseCountsFromArtifacts(previouslySeenDevice), + getCaseCountsFromArtifacts(previouslySeenNoDevice) ); } } diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties index 8f2a48ffc7..b4f6ebcf70 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties @@ -39,7 +39,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.attachmentLabel.text=Recent Attachments -PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. TimelinePanel.activityRangeLabel.text=Activity Range GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown' @@ -62,4 +61,7 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest +PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable +PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.) +PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.) +PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates. diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED index 93f335a294..8f4ac61f86 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED @@ -116,7 +116,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.attachmentLabel.text=Recent Attachments -PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. TimelinePanel.activityRangeLabel.text=Activity Range GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown' @@ -139,7 +138,10 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest +PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable +PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.) +PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.) +PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates. UserActivityPanel_noDataExists=No communication data exists UserActivityPanel_tab_title=User Activity UserActivityPanel_TopAccountTableModel_accountType_header=Account Type diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties index 36de499d45..3e93a0ddfc 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties @@ -121,7 +121,6 @@ IngestJobExcelExport_moduleNameTimeColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u540d IngestJobExcelExport_sheetName=\u53d6\u8fbc\u307f\u6b74\u53f2 IngestJobExcelExport_startTimeColumn=\u30b9\u30bf\u30fc\u30c8\u6642\u9593 IngestJobExcelExport_versionColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3 -PastCasesPanel.sameIdLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 PastCasesPanel_caseColumn_title=\u30b1\u30fc\u30b9 PastCasesPanel_countColumn_title=\u30ab\u30a6\u30f3\u30c8 PastCasesPanel_notableFileTable_tabName=\u300c\u6ce8\u76ee\u300d\u3068\u30bf\u30b0\u4ed8\u3051\u3055\u308c\u305f\u4e00\u822c\u7684\u306a\u30b1\u30fc\u30b9 @@ -212,3 +211,6 @@ UserActivityPanel_TopWebSearchTableModel_translatedResult_header=\u7ffb\u8a33\u6 UserActivityPanel_noDataExists=\u901a\u4fe1\u30c7\u30fc\u30bf\u304c\u3042\u308a\u307e\u305b\u3093 UserActivityPanel_tab_title=\u30e6\u30fc\u30b6\u30fc\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3 ViewSummaryInformationAction.name.text=\u6982\u8981\u60c5\u5831\u3092\u8868\u793a +PastCasesPanel.seenDeviceLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 +PastCasesPanel.seenResultLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 +PastCasesPanel.warningLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form index 7c84d44660..9ae72f4b83 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form @@ -21,7 +21,7 @@ - + @@ -147,10 +147,10 @@ - + - + @@ -177,7 +177,7 @@ - + @@ -191,24 +191,111 @@ - + - + - + + + + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java index ebb5fa2de8..04ccf08686 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java @@ -64,12 +64,13 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { = Arrays.asList(CASE_COL, COUNT_COL); private final JTablePanel> notableFileTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); - - private final JTablePanel> sameIdTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); + private final JTablePanel> seenDeviceTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); + private final JTablePanel> seenResultTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); private final List> tables = Arrays.asList( notableFileTable, - sameIdTable + seenResultTable, + seenDeviceTable ); private final List> dataFetchComponents; @@ -107,8 +108,9 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { * @param result The result. */ private void handleResult(DataFetchResult result) { - notableFileTable.showDataFetchResult(DataFetchResult.getSubResult(result, (res) -> res.getTaggedNotable())); - sameIdTable.showDataFetchResult(DataFetchResult.getSubResult(result, (res) -> res.getSameIdsResults())); + notableFileTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslyNotable())); + seenResultTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslySeenResults())); + seenDeviceTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslySeenDevices())); } @Override @@ -143,10 +145,15 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { javax.swing.Box.Filler filler1 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); javax.swing.JPanel notableFilePanel = notableFileTable; javax.swing.Box.Filler filler2 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20)); - javax.swing.JLabel sameIdLabel = new javax.swing.JLabel(); + javax.swing.JLabel seenResultLabel = new javax.swing.JLabel(); javax.swing.Box.Filler filler3 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); - javax.swing.JPanel sameIdPanel = sameIdTable; - javax.swing.Box.Filler filler5 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 0), new java.awt.Dimension(0, 0), new java.awt.Dimension(0, 32767)); + javax.swing.JPanel seenResultPanel = seenResultTable; + javax.swing.Box.Filler filler4 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20)); + javax.swing.JLabel seenDeviceLabel = new javax.swing.JLabel(); + javax.swing.Box.Filler filler5 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); + javax.swing.JPanel seenDevicePanel = seenDeviceTable; + javax.swing.Box.Filler filler6 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20)); + javax.swing.JLabel warningLabel = new javax.swing.JLabel(); mainContentPanel.setBorder(javax.swing.BorderFactory.createEmptyBorder(10, 10, 10, 10)); mainContentPanel.setLayout(new javax.swing.BoxLayout(mainContentPanel, javax.swing.BoxLayout.PAGE_AXIS)); @@ -173,21 +180,39 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { filler2.setAlignmentX(0.0F); mainContentPanel.add(filler2); - org.openide.awt.Mnemonics.setLocalizedText(sameIdLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.sameIdLabel.text")); // NOI18N - mainContentPanel.add(sameIdLabel); + org.openide.awt.Mnemonics.setLocalizedText(seenResultLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.seenResultLabel.text")); // NOI18N + mainContentPanel.add(seenResultLabel); filler3.setAlignmentX(0.0F); mainContentPanel.add(filler3); - sameIdPanel.setAlignmentX(0.0F); - sameIdPanel.setMaximumSize(new java.awt.Dimension(32767, 106)); - sameIdPanel.setMinimumSize(new java.awt.Dimension(100, 106)); - sameIdPanel.setPreferredSize(new java.awt.Dimension(100, 106)); - mainContentPanel.add(sameIdPanel); + seenResultPanel.setAlignmentX(0.0F); + seenResultPanel.setMaximumSize(new java.awt.Dimension(32767, 106)); + seenResultPanel.setMinimumSize(new java.awt.Dimension(100, 106)); + seenResultPanel.setPreferredSize(new java.awt.Dimension(100, 106)); + mainContentPanel.add(seenResultPanel); + + filler4.setAlignmentX(0.0F); + mainContentPanel.add(filler4); + + org.openide.awt.Mnemonics.setLocalizedText(seenDeviceLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.seenDeviceLabel.text")); // NOI18N + mainContentPanel.add(seenDeviceLabel); filler5.setAlignmentX(0.0F); mainContentPanel.add(filler5); + seenDevicePanel.setAlignmentX(0.0F); + seenDevicePanel.setMaximumSize(new java.awt.Dimension(32767, 106)); + seenDevicePanel.setMinimumSize(new java.awt.Dimension(100, 106)); + seenDevicePanel.setPreferredSize(new java.awt.Dimension(100, 106)); + mainContentPanel.add(seenDevicePanel); + + filler6.setAlignmentX(0.0F); + mainContentPanel.add(filler6); + + org.openide.awt.Mnemonics.setLocalizedText(warningLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.warningLabel.text")); // NOI18N + mainContentPanel.add(warningLabel); + mainScrollPane.setViewportView(mainContentPanel); javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); @@ -198,7 +223,7 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(mainScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 300, Short.MAX_VALUE) + .addComponent(mainScrollPane) ); }// //GEN-END:initComponents diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED index 58f4dcb10e..07bad183cf 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED @@ -54,8 +54,9 @@ ExportIngestHistory_startTimeColumn=Start Time ExportIngestHistory_versionColumn=Module Version ExportPastCases_caseColumn_title=Case ExportPastCases_countColumn_title=Count -ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest -ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices +ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items +ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs +ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses ExportRecentFiles_attachmentsTable_tabName=Recent Attachments ExportRecentFiles_col_head_date=Date ExportRecentFiles_col_header_domain=Domain diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java index 96aefebaff..ae7c4522b4 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java @@ -37,10 +37,11 @@ import org.sleuthkit.datamodel.DataSource; @Messages({ "ExportPastCases_caseColumn_title=Case", "ExportPastCases_countColumn_title=Count", - "ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest", - "ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices",}) + "ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items", + "ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses", + "ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs",}) class ExportPastCases { - + private final PastCasesSummary pastSummary; // model for column indicating the case @@ -73,8 +74,9 @@ class ExportPastCases { } return Arrays.asList( - getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_notableFileTable_tabName(), result.getTaggedNotable()), - getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_sameIdsTable_tabName(), result.getSameIdsResults()) + getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_notableFileTable_tabName(), result.getPreviouslyNotable()), + getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_seenResultsTable_tabName(), result.getPreviouslySeenResults()), + getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_seenDevicesTable_tabName(), result.getPreviouslySeenDevices()) ); } }