From 766ded2d75f5b810bf560919a6e041e41f7b1a46 Mon Sep 17 00:00:00 2001 From: "Samuel H. Kenyon" Date: Tue, 29 Apr 2014 18:12:18 -0400 Subject: [PATCH] SearchRunner now also uses writeAllHitsToBlackBoard() --- .../autopsy/keywordsearch/QueryResults.java | 17 +++-- .../autopsy/keywordsearch/SearchRunner.java | 69 ++----------------- 2 files changed, 19 insertions(+), 67 deletions(-) diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java index 8236b8b7b1..2f06a31e02 100755 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java @@ -103,17 +103,22 @@ class QueryResults { * Creates a blackboard artifact for each keyword hit * @param query * @param listName - * @param progress + * @param progress can be null + * @param subProgress can be null * @param notifyInbox flag indicating whether or not to call writeInboxMessage() for each hit * @return list of new artifacts */ public Collection writeAllHitsToBlackBoard(KeywordSearchQuery query, String listName, ProgressHandle progress, ProgressContributor subProgress, SwingWorker worker, boolean notifyInbox) { final Collection newArtifacts = new ArrayList<>(); - progress.start(getKeywords().size()); + if (progress != null) { + progress.start(getKeywords().size()); + } int unitProgress = 0; for (final Keyword hitTerm : getKeywords()) { - progress.progress(hitTerm.toString(), unitProgress); + if (progress != null) { + progress.progress(hitTerm.toString(), unitProgress); + } if (worker.isCancelled()) { logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", hitTerm.getQuery()); //NON-NLS @@ -133,8 +138,9 @@ class QueryResults { Map flattened = getUniqueFiles(hitTerm); for (AbstractFile hitFile : flattened.keySet()) { + String termHit = notifyInbox ? hitTerm.getQuery() : hitTerm.toString(); int chunkId = flattened.get(hitFile); - final String snippetQuery = KeywordSearchUtil.escapeLuceneQuery(hitTerm.toString()); + final String snippetQuery = KeywordSearchUtil.escapeLuceneQuery(termHit); String snippet; try { snippet = LuceneQuery.querySnippet(snippetQuery, hitFile.getId(), chunkId, !query.isLiteral(), true); @@ -147,7 +153,8 @@ class QueryResults { continue; } if (snippet != null) { - KeywordWriteResult written = query.writeToBlackBoard(hitTerm.toString(), hitFile, snippet, listName); + KeywordWriteResult written = query.writeToBlackBoard(termHit, hitFile, snippet, listName); + if (written != null) { newArtifacts.add(written.getArtifact()); if (notifyInbox) { diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SearchRunner.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SearchRunner.java index e46970e6bb..4b1a5d1515 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SearchRunner.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SearchRunner.java @@ -440,11 +440,11 @@ public final class SearchRunner { final KeywordQueryFilter dataSourceFilter = new KeywordQueryFilter(KeywordQueryFilter.FilterType.DATA_SOURCE, job.getDataSourceId()); keywordSearchQuery.addFilter(dataSourceFilter); - QueryResults queryResult; + QueryResults queryResults; // Do the actual search try { - queryResult = keywordSearchQuery.performQuery(); + queryResults = keywordSearchQuery.performQuery(); } catch (NoOpenCoreException ex) { logger.log(Level.WARNING, "Error performing query: " + keywordQuery.getQuery(), ex); //NON-NLS //no reason to continue with next query if recovery failed @@ -461,7 +461,7 @@ public final class SearchRunner { // calculate new results by substracting results already obtained in this ingest // this creates a map of each keyword to the list of unique files that have that hit. - QueryResults newResults = filterResults(queryResult, isRegex); + QueryResults newResults = filterResults(queryResults, isRegex); if (!newResults.getKeywords().isEmpty()) { @@ -479,65 +479,10 @@ public final class SearchRunner { queryDisplayStr = queryDisplayStr.substring(0, 49) + "..."; } subProgresses[keywordsSearched].progress(listName + ": " + queryDisplayStr, unitProgress); - - // cycle through the keywords returned -- only one unless it was a regexp - for (final Keyword hitTerm : newResults.getKeywords()) { - //checking for cancellation between results - if (this.isCancelled()) { - logger.log(Level.INFO, "Cancel detected, bailing before new hit processed for query: {0}", keywordQuery.getQuery()); //NON-NLS - return null; - } - - // update progress display - String hitDisplayStr = hitTerm.getQuery(); - if (hitDisplayStr.length() > 50) { - hitDisplayStr = hitDisplayStr.substring(0, 49) + "..."; - } - subProgresses[keywordsSearched].progress(listName + ": " + hitDisplayStr, unitProgress); - - // this returns the unique files in the set with the first chunk that has a hit - Map contentHitsFlattened = newResults.getUniqueFiles(hitTerm); - for (final AbstractFile hitFile : contentHitsFlattened.keySet()) { - - // get the snippet for the first hit in the file - String snippet; - final String snippetQuery = KeywordSearchUtil.escapeLuceneQuery(hitTerm.getQuery()); - int chunkId = contentHitsFlattened.get(hitFile); - try { - snippet = LuceneQuery.querySnippet(snippetQuery, hitFile.getId(), chunkId, isRegex, true); - } catch (NoOpenCoreException e) { - logger.log(Level.WARNING, "Error querying snippet: " + snippetQuery, e); //NON-NLS - //no reason to continue - return null; - } catch (Exception e) { - logger.log(Level.WARNING, "Error querying snippet: " + snippetQuery, e); //NON-NLS - continue; - } - - // write the blackboard artifact for this keyword in this file - KeywordWriteResult written = keywordSearchQuery.writeToBlackBoard(hitTerm.getQuery(), hitFile, snippet, listName); - if (written == null) { - logger.log(Level.WARNING, "BB artifact for keyword hit not written, file: {0}, hit: {1}", new Object[]{hitFile, hitTerm.toString()}); //NON-NLS - continue; - } - - newArtifacts.add(written.getArtifact()); - - // Inbox messages - if (list.getIngestMessages()) { - newResults.writeInboxMessage(keywordSearchQuery, written, hitFile); - } - - } //for each file hit - - ++unitProgress; - - }//for each hit term - - //update artifact browser - if (!newArtifacts.isEmpty()) { - services.fireModuleDataEvent(new ModuleDataEvent(KeywordSearchModuleFactory.getModuleName(), BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT, newArtifacts)); - } + + // Create blackboard artifacts + newArtifacts = queryResults.writeAllHitsToBlackBoard(keywordSearchQuery, listName, null, subProgresses[keywordsSearched], this, list.getIngestMessages()); + } //if has results //reset the status text before it goes away