From 1042f2844ffc71b07ea1215af859d7b2196bd649 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 13 May 2021 17:09:04 -0400 Subject: [PATCH 1/4] 7608 fix other occurrences viewer --- .../contentviewer/OtherOccurrencesPanel.java | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java index d6588c2313..12d676200e 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java @@ -380,13 +380,12 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { int totalCount = 0; Set dataSources = new HashSet<>(); if (CentralRepository.isEnabled()) { - try { - List instances; - instances = CentralRepository.getInstance().getArtifactInstancesByTypeValue(aType, value); + correlationAttributes.addAll(CentralRepository.getInstance().getArtifactInstancesByTypeValue(aType, value)); HashMap nodeDataMap = new HashMap<>(); String caseUUID = Case.getCurrentCase().getName(); - for (CorrelationAttributeInstance artifactInstance : instances) { + // get the attributes we can correlate on + for (CorrelationAttributeInstance artifactInstance : correlationAttributes) { // Only add the attribute if it isn't the object the user selected. // We consider it to be a different object if at least one of the following is true: @@ -395,10 +394,9 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { // - the data source device ID is different // - the file path is different if (artifactInstance.getCorrelationCase().getCaseUUID().equals(caseUUID) - || (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName)) - || (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId)) - || (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { - correlationAttributes.add(artifactInstance); + && (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName)) + && (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId)) + && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { continue; } OtherOccurrenceNodeInstanceData newNode = new OtherOccurrenceNodeInstanceData(artifactInstance, aType, value); @@ -510,7 +508,7 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { * artifact. If the central repo is not enabled, this will only return files * from the current case with matching MD5 hashes. * - * @param corAttr CorrelationAttribute to query for + * @param corAttr CorrelationAttribute to query for * * @return A collection of correlated artifact instances */ @@ -533,9 +531,9 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { // - the data source device ID is different // - the file path is different if (artifactInstance.getCorrelationCase().getCaseUUID().equals(caseUUID) - || (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName)) - || (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId)) - || (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { + && (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName)) + && (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId)) + && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { continue; } OtherOccurrenceNodeInstanceData newNode = new OtherOccurrenceNodeInstanceData(artifactInstance, corAttr.getCorrelationType(), corAttr.getCorrelationValue()); From abfbc3106e15cf86c5ef66ce625f903713bdcf88 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 13 May 2021 17:34:54 -0400 Subject: [PATCH 2/4] 7608 fix discovery use case and add comment --- .../contentviewer/OtherOccurrencesPanel.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java index 12d676200e..b0d24cad06 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java @@ -381,11 +381,12 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { Set dataSources = new HashSet<>(); if (CentralRepository.isEnabled()) { try { - correlationAttributes.addAll(CentralRepository.getInstance().getArtifactInstancesByTypeValue(aType, value)); + List instances; + instances = CentralRepository.getInstance().getArtifactInstancesByTypeValue(aType, value); HashMap nodeDataMap = new HashMap<>(); String caseUUID = Case.getCurrentCase().getName(); // get the attributes we can correlate on - for (CorrelationAttributeInstance artifactInstance : correlationAttributes) { + for (CorrelationAttributeInstance artifactInstance : instances) { // Only add the attribute if it isn't the object the user selected. // We consider it to be a different object if at least one of the following is true: @@ -396,7 +397,9 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { if (artifactInstance.getCorrelationCase().getCaseUUID().equals(caseUUID) && (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName)) && (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId)) - && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { + && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { + //because we are only correlating on one type we can add that only when everything is the same + correlationAttributes.add(artifactInstance); continue; } OtherOccurrenceNodeInstanceData newNode = new OtherOccurrenceNodeInstanceData(artifactInstance, aType, value); From f5b017362c43c3ec681d1497cb4a5e65b7d42498 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 13 May 2021 18:44:03 -0400 Subject: [PATCH 3/4] 7608 fix the discovery version --- .../contentviewer/OtherOccurrencesPanel.java | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java index b0d24cad06..f1e724c092 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java @@ -397,11 +397,10 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { if (artifactInstance.getCorrelationCase().getCaseUUID().equals(caseUUID) && (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName)) && (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId)) - && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { - //because we are only correlating on one type we can add that only when everything is the same - correlationAttributes.add(artifactInstance); + && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) { continue; } + correlationAttributes.add(artifactInstance); OtherOccurrenceNodeInstanceData newNode = new OtherOccurrenceNodeInstanceData(artifactInstance, aType, value); UniquePathKey uniquePathKey = new UniquePathKey(newNode); nodeDataMap.put(uniquePathKey, newNode); From 9ecf7c77ddb17eed8d200edeb4a50a07c9524aa8 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 13 May 2021 18:45:55 -0400 Subject: [PATCH 4/4] 7608 remove wrong comment --- .../centralrepository/contentviewer/OtherOccurrencesPanel.java | 1 - 1 file changed, 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java index f1e724c092..1be181bff2 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesPanel.java @@ -385,7 +385,6 @@ public final class OtherOccurrencesPanel extends javax.swing.JPanel { instances = CentralRepository.getInstance().getArtifactInstancesByTypeValue(aType, value); HashMap nodeDataMap = new HashMap<>(); String caseUUID = Case.getCurrentCase().getName(); - // get the attributes we can correlate on for (CorrelationAttributeInstance artifactInstance : instances) { // Only add the attribute if it isn't the object the user selected.