mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 07:56:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

gather different data

Browse Source
This commit is contained in:
Greg DiCristofaro 2022-01-27 15:21:58 -05:00
parent 989fbd0c84
commit 58ff53dbfa
8 changed files with 238 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

112
Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java
View File

@ -24,14 +24,15 @@ import java.util.Collection;
import java.util.Collections; import java.util.Collections;
import java.util.HashSet; import java.util.HashSet;
import java.util.List; import java.util.List;
import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Pair;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory; import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory;
import org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException; import org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException;
import org.sleuthkit.datamodel.Blackboard;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
@ -70,32 +71,42 @@ public class PastCasesSummary {
*/ */
public static class PastCasesResult { public static class PastCasesResult {
private final List<Pair<String, Long>> sameIdsResults; private final List<Pair<String, Long>> previouslyNotable;
private final List<Pair<String, Long>> taggedNotable; private final List<Pair<String, Long>> previouslySeenDevices;
private final List<Pair<String, Long>> previouslySeenResults;
/** /**
* Main constructor. * Main constructor.
* *
* @param sameIdsResults Data for the cases with same id table. * @param previouslyNotable TSK_PREVIOUSLY_NOTABLE results.
* @param taggedNotable Data for the tagged notable table. * @param previouslySeenDevices TSK_PREVIOUSLY_SEEN device results.
* @param previouslySeenResults TSK_PREVIOUSLY_SEEN non-device results.
*/ */
public PastCasesResult(List<Pair<String, Long>> sameIdsResults, List<Pair<String, Long>> taggedNotable) { public PastCasesResult(List<Pair<String, Long>> previouslyNotable, List<Pair<String, Long>> previouslySeenDevices, List<Pair<String, Long>> previouslySeenResults) {
this.sameIdsResults = sameIdsResults; this.previouslyNotable = Collections.unmodifiableList(previouslyNotable);
this.taggedNotable = taggedNotable; this.previouslySeenDevices = Collections.unmodifiableList(previouslySeenDevices);
this.previouslySeenResults = Collections.unmodifiableList(previouslySeenResults);
} }
/** /**
* @return Data for the cases with same id table. * @return TSK_PREVIOUSLY_NOTABLE results.
*/ */
public List<Pair<String, Long>> getSameIdsResults() { public List<Pair<String, Long>> getPreviouslyNotable() {
return Collections.unmodifiableList(sameIdsResults); return previouslyNotable;
} }
/** /**
* @return Data for the tagged notable table. * @return TSK_PREVIOUSLY_SEEN device results.
*/ */
public List<Pair<String, Long>> getTaggedNotable() { public List<Pair<String, Long>> getPreviouslySeenDevices() {
return Collections.unmodifiableList(taggedNotable); return previouslySeenDevices;
}
/**
* @return TSK_PREVIOUSLY_SEEN non-device results.
*/
public List<Pair<String, Long>> getPreviouslySeenResults() {
return previouslySeenResults;
} }
} }
@ -105,7 +116,6 @@ public class PastCasesSummary {
)); ));
private static final String CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim(); private static final String CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim();
private static final BlackboardAttribute.Type TYPE_COMMENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_OTHER_CASES);
private static final Set<Integer> CR_DEVICE_TYPE_IDS = new HashSet<>(Arrays.asList( private static final Set<Integer> CR_DEVICE_TYPE_IDS = new HashSet<>(Arrays.asList(
ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID(), ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID(),
@ -180,11 +190,24 @@ public class PastCasesSummary {
BlackboardAttribute commentAttr = null; BlackboardAttribute commentAttr = null;
try { try {
commentAttr = artifact.getAttribute(TYPE_COMMENT); commentAttr = artifact.getAttribute(BlackboardAttribute.Type.TSK_OTHER_CASES);
} catch (TskCoreException ignored) { } catch (TskCoreException ignored) {
// ignore if no attribute can be found // ignore if no attribute can be found
} }
return getCasesFromAttr(commentAttr);
}
/**
* Gets a list of cases from the TSK_OTHER_CASES attribute. The cases
* string is expected to be of a form of "case1,case2...caseN".
*
* @param artifact The attribute.
*
* @return The list of cases if found or empty list if not.
*/
private static List<String> getCasesFromAttr(BlackboardAttribute commentAttr) {
if (commentAttr == null) { if (commentAttr == null) {
return Collections.emptyList(); return Collections.emptyList();
} }
@ -197,7 +220,6 @@ public class PastCasesSummary {
return Stream.of(justCasesStr.split(CASE_SEPARATOR)) return Stream.of(justCasesStr.split(CASE_SEPARATOR))
.map(String::trim) .map(String::trim)
.collect(Collectors.toList()); .collect(Collectors.toList());
} }
/** /**
@ -227,8 +249,27 @@ public class PastCasesSummary {
.collect(Collectors.toList()); .collect(Collectors.toList());
} }
/** /**
* Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves it's parent artifact. * Determines a list of counts for most populated cases based on comment
* attribute.
*
* @param artifacts The list of artifacts.
*
* @return The key value pairs mapping case to counts.
*/
private static List<Pair<String, Long>> getCaseCountsFromArtifacts(List<BlackboardArtifact> artifacts) {
List<String> cases = new ArrayList<>();
for (BlackboardArtifact art : artifacts) {
cases.addAll(getCasesFromArtifact(art));
}
return getCaseCounts(cases.stream());
}
/**
* Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves
* it's parent artifact.
* *
* @param artifact The input artifact. * @param artifact The input artifact.
* *
@ -285,28 +326,31 @@ public class PastCasesSummary {
return null; return null;
} }
SleuthkitCase skCase = caseProvider.get(); long dataSourceId = dataSource.getId();
List<String> deviceArtifactCases = new ArrayList<>(); Blackboard blackboard = caseProvider.get().getBlackboard();
List<String> nonDeviceArtifactCases = new ArrayList<>();
for (Integer typeId : ARTIFACT_UPDATE_TYPE_IDS) {
for (BlackboardArtifact artifact : skCase.getBlackboard().getArtifacts(typeId, dataSource.getId())) {
List<String> cases = getCasesFromArtifact(artifact);
if (cases == null || cases.isEmpty()) {
continue;
}
if (hasDeviceAssociatedArtifact(artifact)) { List<BlackboardArtifact> previouslyNotableArtifacts
deviceArtifactCases.addAll(cases); = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_NOTABLE.getTypeID(), dataSourceId);
} else {
nonDeviceArtifactCases.addAll(cases); List<BlackboardArtifact> previouslySeenArtifacts
} = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_SEEN.getTypeID(), dataSourceId);
List<BlackboardArtifact> previouslySeenDevice = new ArrayList<>();
List<BlackboardArtifact> previouslySeenNoDevice = new ArrayList<>();
for (BlackboardArtifact art : previouslySeenArtifacts) {
if (hasDeviceAssociatedArtifact(art)) {
previouslySeenDevice.add(art);
} else {
previouslySeenNoDevice.add(art);
} }
} }
return new PastCasesResult( return new PastCasesResult(
getCaseCounts(deviceArtifactCases.stream()), getCaseCountsFromArtifacts(previouslyNotableArtifacts),
getCaseCounts(nonDeviceArtifactCases.stream()) getCaseCountsFromArtifacts(previouslySeenDevice),
getCaseCountsFromArtifacts(previouslySeenNoDevice)
); );
} }
} }

6
Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties
View File

@ -39,7 +39,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits
RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.openDocsLabel.text=Recently Opened Documents
RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.downloadLabel.text=Recent Downloads
RecentFilesPanel.attachmentLabel.text=Recent Attachments RecentFilesPanel.attachmentLabel.text=Recent Attachments
PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs
DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected.
TimelinePanel.activityRangeLabel.text=Activity Range TimelinePanel.activityRangeLabel.text=Activity Range
GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown' GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown'
@ -62,4 +61,7 @@ ExportPanel.xlsxExportButton.text=Export Summary Data
ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to:
ExcelExportDialog.okButton.text=OK ExcelExportDialog.okButton.text=OK
PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable
PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable
PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.)
PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.)
PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates.

6
Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED
View File

@ -116,7 +116,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits
RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.openDocsLabel.text=Recently Opened Documents
RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.downloadLabel.text=Recent Downloads
RecentFilesPanel.attachmentLabel.text=Recent Attachments RecentFilesPanel.attachmentLabel.text=Recent Attachments
PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs
DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected.
TimelinePanel.activityRangeLabel.text=Activity Range TimelinePanel.activityRangeLabel.text=Activity Range
GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown' GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown'
@ -139,7 +138,10 @@ ExportPanel.xlsxExportButton.text=Export Summary Data
ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to:
ExcelExportDialog.okButton.text=OK ExcelExportDialog.okButton.text=OK
PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable
PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable
PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.)
PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.)
PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates.
UserActivityPanel_noDataExists=No communication data exists UserActivityPanel_noDataExists=No communication data exists
UserActivityPanel_tab_title=User Activity UserActivityPanel_tab_title=User Activity
UserActivityPanel_TopAccountTableModel_accountType_header=Account Type UserActivityPanel_TopAccountTableModel_accountType_header=Account Type

4
Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties
View File

@ -121,7 +121,6 @@ IngestJobExcelExport_moduleNameTimeColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u540d
IngestJobExcelExport_sheetName=\u53d6\u8fbc\u307f\u6b74\u53f2 IngestJobExcelExport_sheetName=\u53d6\u8fbc\u307f\u6b74\u53f2
IngestJobExcelExport_startTimeColumn=\u30b9\u30bf\u30fc\u30c8\u6642\u9593 IngestJobExcelExport_startTimeColumn=\u30b9\u30bf\u30fc\u30c8\u6642\u9593
IngestJobExcelExport_versionColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3 IngestJobExcelExport_versionColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3
PastCasesPanel.sameIdLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9
PastCasesPanel_caseColumn_title=\u30b1\u30fc\u30b9 PastCasesPanel_caseColumn_title=\u30b1\u30fc\u30b9
PastCasesPanel_countColumn_title=\u30ab\u30a6\u30f3\u30c8 PastCasesPanel_countColumn_title=\u30ab\u30a6\u30f3\u30c8
PastCasesPanel_notableFileTable_tabName=\u300c\u6ce8\u76ee\u300d\u3068\u30bf\u30b0\u4ed8\u3051\u3055\u308c\u305f\u4e00\u822c\u7684\u306a\u30b1\u30fc\u30b9 PastCasesPanel_notableFileTable_tabName=\u300c\u6ce8\u76ee\u300d\u3068\u30bf\u30b0\u4ed8\u3051\u3055\u308c\u305f\u4e00\u822c\u7684\u306a\u30b1\u30fc\u30b9
@ -212,3 +211,6 @@ UserActivityPanel_TopWebSearchTableModel_translatedResult_header=\u7ffb\u8a33\u6
UserActivityPanel_noDataExists=\u901a\u4fe1\u30c7\u30fc\u30bf\u304c\u3042\u308a\u307e\u305b\u3093 UserActivityPanel_noDataExists=\u901a\u4fe1\u30c7\u30fc\u30bf\u304c\u3042\u308a\u307e\u305b\u3093
UserActivityPanel_tab_title=\u30e6\u30fc\u30b6\u30fc\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3 UserActivityPanel_tab_title=\u30e6\u30fc\u30b6\u30fc\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3
ViewSummaryInformationAction.name.text=\u6982\u8981\u60c5\u5831\u3092\u8868\u793a ViewSummaryInformationAction.name.text=\u6982\u8981\u60c5\u5831\u3092\u8868\u793a
PastCasesPanel.seenDeviceLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9
PastCasesPanel.seenResultLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9
PastCasesPanel.warningLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9

103
Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form
View File

@ -21,7 +21,7 @@
</DimensionLayout> </DimensionLayout>
<DimensionLayout dim="1"> <DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Component id="mainScrollPane" alignment="0" pref="300" max="32767" attributes="0"/> <Component id="mainScrollPane" alignment="0" max="32767" attributes="0"/>
</Group> </Group>
</DimensionLayout> </DimensionLayout>
</Layout> </Layout>
@ -147,10 +147,10 @@
<AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalStrut"/> <AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalStrut"/>
</AuxValues> </AuxValues>
</Component> </Component>
<Component class="javax.swing.JLabel" name="sameIdLabel"> <Component class="javax.swing.JLabel" name="seenResultLabel">
<Properties> <Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor"> <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties" key="PastCasesPanel.sameIdLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/> <ResourceString bundle="org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties" key="PastCasesPanel.seenResultLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property> </Property>
</Properties> </Properties>
<AuxValues> <AuxValues>
@ -177,7 +177,7 @@
<AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalStrut"/> <AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalStrut"/>
</AuxValues> </AuxValues>
</Component> </Component>
<Container class="javax.swing.JPanel" name="sameIdPanel"> <Container class="javax.swing.JPanel" name="seenResultPanel">
<Properties> <Properties>
<Property name="alignmentX" type="float" value="0.0"/> <Property name="alignmentX" type="float" value="0.0"/>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor"> <Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
@ -191,24 +191,111 @@
</Property> </Property>
</Properties> </Properties>
<AuxValues> <AuxValues>
<AuxValue name="JavaCodeGenerator_CreateCodeCustom" type="java.lang.String" value="sameIdTable"/> <AuxValue name="JavaCodeGenerator_CreateCodeCustom" type="java.lang.String" value="seenResultTable"/>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/> <AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/> <AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues> </AuxValues>
<Layout class="org.netbeans.modules.form.compat2.layouts.DesignFlowLayout"/> <Layout class="org.netbeans.modules.form.compat2.layouts.DesignFlowLayout"/>
</Container> </Container>
<Component class="javax.swing.Box$Filler" name="filler5"> <Component class="javax.swing.Box$Filler" name="filler4">
<Properties> <Properties>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor"> <Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 32767]"/> <Dimension value="[0, 20]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 20]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 20]"/>
</Property> </Property>
<Property name="alignmentX" type="float" value="0.0"/> <Property name="alignmentX" type="float" value="0.0"/>
</Properties> </Properties>
<AuxValues> <AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/> <AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/> <AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
<AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalGlue"/> <AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalStrut"/>
</AuxValues>
</Component>
<Component class="javax.swing.JLabel" name="seenDeviceLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties" key="PastCasesPanel.seenDeviceLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
</Component>
<Component class="javax.swing.Box$Filler" name="filler5">
<Properties>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 2]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 2]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 2]"/>
</Property>
<Property name="alignmentX" type="float" value="0.0"/>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
<AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalStrut"/>
</AuxValues>
</Component>
<Container class="javax.swing.JPanel" name="seenDevicePanel">
<Properties>
<Property name="alignmentX" type="float" value="0.0"/>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[32767, 106]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[100, 106]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[100, 106]"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_CreateCodeCustom" type="java.lang.String" value="seenDeviceTable"/>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
<Layout class="org.netbeans.modules.form.compat2.layouts.DesignFlowLayout"/>
</Container>
<Component class="javax.swing.Box$Filler" name="filler6">
<Properties>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 20]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 20]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 20]"/>
</Property>
<Property name="alignmentX" type="float" value="0.0"/>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
<AuxValue name="classDetails" type="java.lang.String" value="Box.Filler.VerticalStrut"/>
</AuxValues>
</Component>
<Component class="javax.swing.JLabel" name="warningLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties" key="PastCasesPanel.warningLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues> </AuxValues>
</Component> </Component>
</SubComponents> </SubComponents>

57
Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java
View File

@ -64,12 +64,13 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
= Arrays.asList(CASE_COL, COUNT_COL); = Arrays.asList(CASE_COL, COUNT_COL);
private final JTablePanel<Pair<String, Long>> notableFileTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); private final JTablePanel<Pair<String, Long>> notableFileTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE);
private final JTablePanel<Pair<String, Long>> seenDeviceTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE);
private final JTablePanel<Pair<String, Long>> sameIdTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); private final JTablePanel<Pair<String, Long>> seenResultTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE);
private final List<JTablePanel<?>> tables = Arrays.asList( private final List<JTablePanel<?>> tables = Arrays.asList(
notableFileTable, notableFileTable,
sameIdTable seenResultTable,
seenDeviceTable
); );
private final List<DataFetchComponents<DataSource, ?>> dataFetchComponents; private final List<DataFetchComponents<DataSource, ?>> dataFetchComponents;
@ -107,8 +108,9 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
* @param result The result. * @param result The result.
*/ */
private void handleResult(DataFetchResult<PastCasesResult> result) { private void handleResult(DataFetchResult<PastCasesResult> result) {
notableFileTable.showDataFetchResult(DataFetchResult.getSubResult(result, (res) -> res.getTaggedNotable())); notableFileTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslyNotable()));
sameIdTable.showDataFetchResult(DataFetchResult.getSubResult(result, (res) -> res.getSameIdsResults())); seenResultTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslySeenResults()));
seenDeviceTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslySeenDevices()));
} }
@Override @Override
@ -143,10 +145,15 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
javax.swing.Box.Filler filler1 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); javax.swing.Box.Filler filler1 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2));
javax.swing.JPanel notableFilePanel = notableFileTable; javax.swing.JPanel notableFilePanel = notableFileTable;
javax.swing.Box.Filler filler2 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20)); javax.swing.Box.Filler filler2 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20));
javax.swing.JLabel sameIdLabel = new javax.swing.JLabel(); javax.swing.JLabel seenResultLabel = new javax.swing.JLabel();
javax.swing.Box.Filler filler3 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); javax.swing.Box.Filler filler3 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2));
javax.swing.JPanel sameIdPanel = sameIdTable; javax.swing.JPanel seenResultPanel = seenResultTable;
javax.swing.Box.Filler filler5 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 0), new java.awt.Dimension(0, 0), new java.awt.Dimension(0, 32767)); javax.swing.Box.Filler filler4 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20));
javax.swing.JLabel seenDeviceLabel = new javax.swing.JLabel();
javax.swing.Box.Filler filler5 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2));
javax.swing.JPanel seenDevicePanel = seenDeviceTable;
javax.swing.Box.Filler filler6 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20));
javax.swing.JLabel warningLabel = new javax.swing.JLabel();
mainContentPanel.setBorder(javax.swing.BorderFactory.createEmptyBorder(10, 10, 10, 10)); mainContentPanel.setBorder(javax.swing.BorderFactory.createEmptyBorder(10, 10, 10, 10));
mainContentPanel.setLayout(new javax.swing.BoxLayout(mainContentPanel, javax.swing.BoxLayout.PAGE_AXIS)); mainContentPanel.setLayout(new javax.swing.BoxLayout(mainContentPanel, javax.swing.BoxLayout.PAGE_AXIS));
@ -173,21 +180,39 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
filler2.setAlignmentX(0.0F); filler2.setAlignmentX(0.0F);
mainContentPanel.add(filler2); mainContentPanel.add(filler2);
org.openide.awt.Mnemonics.setLocalizedText(sameIdLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.sameIdLabel.text")); // NOI18N org.openide.awt.Mnemonics.setLocalizedText(seenResultLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.seenResultLabel.text")); // NOI18N
mainContentPanel.add(sameIdLabel); mainContentPanel.add(seenResultLabel);
filler3.setAlignmentX(0.0F); filler3.setAlignmentX(0.0F);
mainContentPanel.add(filler3); mainContentPanel.add(filler3);
sameIdPanel.setAlignmentX(0.0F); seenResultPanel.setAlignmentX(0.0F);
sameIdPanel.setMaximumSize(new java.awt.Dimension(32767, 106)); seenResultPanel.setMaximumSize(new java.awt.Dimension(32767, 106));
sameIdPanel.setMinimumSize(new java.awt.Dimension(100, 106)); seenResultPanel.setMinimumSize(new java.awt.Dimension(100, 106));
sameIdPanel.setPreferredSize(new java.awt.Dimension(100, 106)); seenResultPanel.setPreferredSize(new java.awt.Dimension(100, 106));
mainContentPanel.add(sameIdPanel); mainContentPanel.add(seenResultPanel);
filler4.setAlignmentX(0.0F);
mainContentPanel.add(filler4);
org.openide.awt.Mnemonics.setLocalizedText(seenDeviceLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.seenDeviceLabel.text")); // NOI18N
mainContentPanel.add(seenDeviceLabel);
filler5.setAlignmentX(0.0F); filler5.setAlignmentX(0.0F);
mainContentPanel.add(filler5); mainContentPanel.add(filler5);
seenDevicePanel.setAlignmentX(0.0F);
seenDevicePanel.setMaximumSize(new java.awt.Dimension(32767, 106));
seenDevicePanel.setMinimumSize(new java.awt.Dimension(100, 106));
seenDevicePanel.setPreferredSize(new java.awt.Dimension(100, 106));
mainContentPanel.add(seenDevicePanel);
filler6.setAlignmentX(0.0F);
mainContentPanel.add(filler6);
org.openide.awt.Mnemonics.setLocalizedText(warningLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.warningLabel.text")); // NOI18N
mainContentPanel.add(warningLabel);
mainScrollPane.setViewportView(mainContentPanel); mainScrollPane.setViewportView(mainContentPanel);
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
@ -198,7 +223,7 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
); );
layout.setVerticalGroup( layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(mainScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 300, Short.MAX_VALUE) .addComponent(mainScrollPane)
); );
}// </editor-fold>//GEN-END:initComponents }// </editor-fold>//GEN-END:initComponents

5
Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED
View File

@ -54,8 +54,9 @@ ExportIngestHistory_startTimeColumn=Start Time
ExportIngestHistory_versionColumn=Module Version ExportIngestHistory_versionColumn=Module Version
ExportPastCases_caseColumn_title=Case ExportPastCases_caseColumn_title=Case
ExportPastCases_countColumn_title=Count ExportPastCases_countColumn_title=Count
ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items
ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs
ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses
ExportRecentFiles_attachmentsTable_tabName=Recent Attachments ExportRecentFiles_attachmentsTable_tabName=Recent Attachments
ExportRecentFiles_col_head_date=Date ExportRecentFiles_col_head_date=Date
ExportRecentFiles_col_header_domain=Domain ExportRecentFiles_col_header_domain=Domain

10
Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java
View File

@ -37,8 +37,9 @@ import org.sleuthkit.datamodel.DataSource;
@Messages({ @Messages({
"ExportPastCases_caseColumn_title=Case", "ExportPastCases_caseColumn_title=Case",
"ExportPastCases_countColumn_title=Count", "ExportPastCases_countColumn_title=Count",
"ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest", "ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items",
"ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices",}) "ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses",
"ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs",})
class ExportPastCases { class ExportPastCases {
private final PastCasesSummary pastSummary; private final PastCasesSummary pastSummary;
@ -73,8 +74,9 @@ class ExportPastCases {
} }
return Arrays.asList( return Arrays.asList(
getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_notableFileTable_tabName(), result.getTaggedNotable()), getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_notableFileTable_tabName(), result.getPreviouslyNotable()),
getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_sameIdsTable_tabName(), result.getSameIdsResults()) getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_seenResultsTable_tabName(), result.getPreviouslySeenResults()),
getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_seenDevicesTable_tabName(), result.getPreviouslySeenDevices())
); );
} }
} }