renames and comments for CR results processing.

This commit is contained in:
Andrew Ziehl 2018-07-17 11:58:15 -07:00
parent 487222dcbc
commit 8233f41fd6
4 changed files with 46 additions and 46 deletions

View File

@ -33,18 +33,16 @@ import org.sleuthkit.datamodel.TskCoreException;
* present case. * present case.
*/ */
public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttributeSearcher { public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttributeSearcher {
public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType); super(filterByMediaMimeType, filterByDocMimeType);
} }
@Override @Override
public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>();
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
eamDbAttrInst.processCorrelationCaseAttributeValues(Case.getCurrentCase()); eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase());
interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap()); Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
return new CommonAttributeSearchResults(interCaseCommonFiles); return new CommonAttributeSearchResults(interCaseCommonFiles);
} }

View File

@ -78,7 +78,7 @@ final public class InterCaseCommonAttributeSearchResults extends CommonAttribute
@Override @Override
public DisplayableItemNode[] generateNodes() { public DisplayableItemNode[] generateNodes() {
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
CorrelationAttribute corrAttr = eamDbAttrInst.processCorrelationCaseSingleAttribute(crFileId); //TODO which do we want CorrelationAttribute corrAttr = eamDbAttrInst.findSingleCorrelationAttribute(crFileId); //TODO which do we want
List<DisplayableItemNode> attrInstNodeList = new ArrayList<>(0); List<DisplayableItemNode> attrInstNodeList = new ArrayList<>(0);
for (CorrelationAttributeInstance attrInst : corrAttr.getInstances()) { for (CorrelationAttributeInstance attrInst : corrAttr.getInstances()) {

View File

@ -44,49 +44,62 @@ final class InterCaseSearchResultsProcessor {
private final Map<Integer, String> intercaseCommonValuesMap = new HashMap<>(); private final Map<Integer, String> intercaseCommonValuesMap = new HashMap<>();
private final Map<Integer, Integer> intercaseCommonCasesMap = new HashMap<>(); private final Map<Integer, Integer> intercaseCommonCasesMap = new HashMap<>();
CorrelationAttribute processCorrelationCaseSingleAttribute(int attrbuteId) { /**
try { * Finds a single CorrelationAttribute given an id.
EamDbAttributeInstanceRowCallback instancetableCallback = new EamDbAttributeInstanceRowCallback(); *
* @param attrbuteId Row of CorrelationAttribute to retrieve from the EamDb
* @return CorrelationAttribute object representation of retrieved match
*/
CorrelationAttribute findSingleCorrelationAttribute(int attrbuteId) {
try {
InterCaseCommonAttributeRowCallback instancetableCallback = new InterCaseCommonAttributeRowCallback();
EamDb DbManager = EamDb.getInstance(); EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
DbManager.processInstanceTableRow(fileType, attrbuteId, instancetableCallback); DbManager.processInstanceTableRow(fileType, attrbuteId, instancetableCallback);
return instancetableCallback.getCorrelationAttribute(); return instancetableCallback.getCorrelationAttribute();
} catch (EamDbException ex) { } catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing InstanceTable row.", ex); LOGGER.log(Level.SEVERE, "Error accessing EamDb processing InstanceTable row.", ex);
} }
return null; return null;
} }
void processCorrelationCaseAttributeValues(Case currentCase) { /**
* Given the current case, fins all intercase common files from the EamDb
* and builds maps of obj id to md5 and case.
*
* @param currentCase The current TSK Case.
*/
void findInterCaseCommonAttributeValues(Case currentCase) {
try { try {
EamDbAttributeInstancesCallback instancetableCallback = new EamDbAttributeInstancesCallback(); InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback();
EamDb DbManager = EamDb.getInstance(); EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
DbManager.processCaseInstancesTable(fileType, DbManager.getCase(currentCase), instancetableCallback); DbManager.processCaseInstancesTable(fileType, DbManager.getCase(currentCase), instancetableCallback);
intercaseCommonValuesMap.putAll(instancetableCallback.getCorrelationIdValueMap());
intercaseCommonCasesMap.putAll(instancetableCallback.getCorrelationIdToCaseMap());
} catch (EamDbException ex) { } catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
} }
} }
void processSingleCaseCorrelationCaseAttributeValues(Case currentCase, CorrelationCase singleCase) {
/**
* Given the current case, and a specific case of interest, finds common
* files which exist between cases from the EamDb. Builds maps of obj id to
* md5 and case.
*
* @param currentCase The current TSK Case.
* @param singleCase The case of interest. Matches must exist in this case.
*/
void findSingleInterCaseCommonAttributeValues(Case currentCase, CorrelationCase singleCase) {
try { try {
EamDbAttributeInstancesCallback instancetableCallback = new EamDbAttributeInstancesCallback(); InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback();
EamDb DbManager = EamDb.getInstance(); EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
DbManager.processSingleCaseInstancesTable(fileType, DbManager.getCase(currentCase), singleCase, instancetableCallback); DbManager.processSingleCaseInstancesTable(fileType, DbManager.getCase(currentCase), singleCase, instancetableCallback);
intercaseCommonValuesMap.putAll(instancetableCallback.getCorrelationIdValueMap());
intercaseCommonCasesMap.putAll(instancetableCallback.getCorrelationIdToCaseMap());
} catch (EamDbException ex) { } catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
} }
@ -102,42 +115,31 @@ final class InterCaseSearchResultsProcessor {
} }
/** /**
* Callback to use with processCaseInstancesTable which generates a list of * Callback to use with findInterCaseCommonAttributeValues which generates a
* md5s for common files search * list of md5s for common files search
*/ */
private class EamDbAttributeInstancesCallback implements InstanceTableCallback { private class InterCaseCommonAttributesCallback implements InstanceTableCallback {
private final Map<Integer, String> correlationIdToValueMap = new HashMap<>();
private final Map<Integer, Integer> correlationIdToDatasourceMap = new HashMap<>();
@Override @Override
public void process(ResultSet resultSet) { public void process(ResultSet resultSet) {
try { try {
while (resultSet.next()) { while (resultSet.next()) {
int resultId = InstanceTableCallback.getId(resultSet); int resultId = InstanceTableCallback.getId(resultSet);
correlationIdToValueMap.put(resultId, InstanceTableCallback.getValue(resultSet)); intercaseCommonValuesMap.put(resultId, InstanceTableCallback.getValue(resultSet));
correlationIdToDatasourceMap.put(resultId, InstanceTableCallback.getCaseId(resultSet)); intercaseCommonCasesMap.put(resultId, InstanceTableCallback.getCaseId(resultSet));
} }
} catch (SQLException ex) { } catch (SQLException ex) {
Exceptions.printStackTrace(ex); Exceptions.printStackTrace(ex);
} }
} }
Map<Integer, String> getCorrelationIdValueMap() {
return Collections.unmodifiableMap(correlationIdToValueMap);
}
Map<Integer, Integer> getCorrelationIdToCaseMap() {
return Collections.unmodifiableMap(correlationIdToDatasourceMap);
}
} }
/** /**
* Callback to use with processCaseInstancesTable which generates a list of * Callback to use with findSingleCorrelationAttribute which retrieves a
* md5s for common files search * single CorrelationAttribute from the EamDb.
*/ */
private class EamDbAttributeInstanceRowCallback implements InstanceTableCallback { private class InterCaseCommonAttributeRowCallback implements InstanceTableCallback {
CorrelationAttribute correlationAttribute = null; CorrelationAttribute correlationAttribute = null;
@ -146,7 +148,7 @@ final class InterCaseSearchResultsProcessor {
try { try {
EamDb DbManager = EamDb.getInstance(); EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
while (resultSet.next()) { while (resultSet.next()) {
CorrelationCase correlationCase = DbManager.getCaseById(InstanceTableCallback.getCaseId(resultSet)); CorrelationCase correlationCase = DbManager.getCaseById(InstanceTableCallback.getCaseId(resultSet));
CorrelationDataSource dataSource = DbManager.getDataSourceById(correlationCase, InstanceTableCallback.getDataSourceId(resultSet)); CorrelationDataSource dataSource = DbManager.getDataSourceById(correlationCase, InstanceTableCallback.getDataSourceId(resultSet));

View File

@ -76,7 +76,7 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>(); Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>();
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
eamDbAttrInst.processSingleCaseCorrelationCaseAttributeValues(Case.getCurrentCase(), correlationCase); eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase);
interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap()); interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
return new CommonAttributeSearchResults(interCaseCommonFiles); return new CommonAttributeSearchResults(interCaseCommonFiles);