mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-12 07:56:16 +00:00
renames and comments for CR results processing.
This commit is contained in:
parent
487222dcbc
commit
8233f41fd6
@ -33,18 +33,16 @@ import org.sleuthkit.datamodel.TskCoreException;
|
|||||||
* present case.
|
* present case.
|
||||||
*/
|
*/
|
||||||
public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttributeSearcher {
|
public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttributeSearcher {
|
||||||
|
|
||||||
public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
||||||
super(filterByMediaMimeType, filterByDocMimeType);
|
super(filterByMediaMimeType, filterByDocMimeType);
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
|
public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
|
||||||
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>();
|
|
||||||
|
|
||||||
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
|
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
|
||||||
eamDbAttrInst.processCorrelationCaseAttributeValues(Case.getCurrentCase());
|
eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase());
|
||||||
interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
|
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
|
||||||
|
|
||||||
return new CommonAttributeSearchResults(interCaseCommonFiles);
|
return new CommonAttributeSearchResults(interCaseCommonFiles);
|
||||||
}
|
}
|
||||||
|
@ -78,7 +78,7 @@ final public class InterCaseCommonAttributeSearchResults extends CommonAttribute
|
|||||||
@Override
|
@Override
|
||||||
public DisplayableItemNode[] generateNodes() {
|
public DisplayableItemNode[] generateNodes() {
|
||||||
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
|
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
|
||||||
CorrelationAttribute corrAttr = eamDbAttrInst.processCorrelationCaseSingleAttribute(crFileId); //TODO which do we want
|
CorrelationAttribute corrAttr = eamDbAttrInst.findSingleCorrelationAttribute(crFileId); //TODO which do we want
|
||||||
List<DisplayableItemNode> attrInstNodeList = new ArrayList<>(0);
|
List<DisplayableItemNode> attrInstNodeList = new ArrayList<>(0);
|
||||||
|
|
||||||
for (CorrelationAttributeInstance attrInst : corrAttr.getInstances()) {
|
for (CorrelationAttributeInstance attrInst : corrAttr.getInstances()) {
|
||||||
|
@ -44,49 +44,62 @@ final class InterCaseSearchResultsProcessor {
|
|||||||
|
|
||||||
private final Map<Integer, String> intercaseCommonValuesMap = new HashMap<>();
|
private final Map<Integer, String> intercaseCommonValuesMap = new HashMap<>();
|
||||||
private final Map<Integer, Integer> intercaseCommonCasesMap = new HashMap<>();
|
private final Map<Integer, Integer> intercaseCommonCasesMap = new HashMap<>();
|
||||||
|
|
||||||
CorrelationAttribute processCorrelationCaseSingleAttribute(int attrbuteId) {
|
/**
|
||||||
try {
|
* Finds a single CorrelationAttribute given an id.
|
||||||
EamDbAttributeInstanceRowCallback instancetableCallback = new EamDbAttributeInstanceRowCallback();
|
*
|
||||||
|
* @param attrbuteId Row of CorrelationAttribute to retrieve from the EamDb
|
||||||
|
* @return CorrelationAttribute object representation of retrieved match
|
||||||
|
*/
|
||||||
|
CorrelationAttribute findSingleCorrelationAttribute(int attrbuteId) {
|
||||||
|
try {
|
||||||
|
InterCaseCommonAttributeRowCallback instancetableCallback = new InterCaseCommonAttributeRowCallback();
|
||||||
EamDb DbManager = EamDb.getInstance();
|
EamDb DbManager = EamDb.getInstance();
|
||||||
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
||||||
DbManager.processInstanceTableRow(fileType, attrbuteId, instancetableCallback);
|
DbManager.processInstanceTableRow(fileType, attrbuteId, instancetableCallback);
|
||||||
|
|
||||||
return instancetableCallback.getCorrelationAttribute();
|
return instancetableCallback.getCorrelationAttribute();
|
||||||
|
|
||||||
} catch (EamDbException ex) {
|
} catch (EamDbException ex) {
|
||||||
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing InstanceTable row.", ex);
|
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing InstanceTable row.", ex);
|
||||||
}
|
}
|
||||||
|
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
void processCorrelationCaseAttributeValues(Case currentCase) {
|
/**
|
||||||
|
* Given the current case, fins all intercase common files from the EamDb
|
||||||
|
* and builds maps of obj id to md5 and case.
|
||||||
|
*
|
||||||
|
* @param currentCase The current TSK Case.
|
||||||
|
*/
|
||||||
|
void findInterCaseCommonAttributeValues(Case currentCase) {
|
||||||
try {
|
try {
|
||||||
EamDbAttributeInstancesCallback instancetableCallback = new EamDbAttributeInstancesCallback();
|
InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback();
|
||||||
EamDb DbManager = EamDb.getInstance();
|
EamDb DbManager = EamDb.getInstance();
|
||||||
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
||||||
DbManager.processCaseInstancesTable(fileType, DbManager.getCase(currentCase), instancetableCallback);
|
DbManager.processCaseInstancesTable(fileType, DbManager.getCase(currentCase), instancetableCallback);
|
||||||
|
|
||||||
intercaseCommonValuesMap.putAll(instancetableCallback.getCorrelationIdValueMap());
|
|
||||||
intercaseCommonCasesMap.putAll(instancetableCallback.getCorrelationIdToCaseMap());
|
|
||||||
} catch (EamDbException ex) {
|
} catch (EamDbException ex) {
|
||||||
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
|
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void processSingleCaseCorrelationCaseAttributeValues(Case currentCase, CorrelationCase singleCase) {
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Given the current case, and a specific case of interest, finds common
|
||||||
|
* files which exist between cases from the EamDb. Builds maps of obj id to
|
||||||
|
* md5 and case.
|
||||||
|
*
|
||||||
|
* @param currentCase The current TSK Case.
|
||||||
|
* @param singleCase The case of interest. Matches must exist in this case.
|
||||||
|
*/
|
||||||
|
void findSingleInterCaseCommonAttributeValues(Case currentCase, CorrelationCase singleCase) {
|
||||||
try {
|
try {
|
||||||
EamDbAttributeInstancesCallback instancetableCallback = new EamDbAttributeInstancesCallback();
|
InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback();
|
||||||
EamDb DbManager = EamDb.getInstance();
|
EamDb DbManager = EamDb.getInstance();
|
||||||
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
||||||
DbManager.processSingleCaseInstancesTable(fileType, DbManager.getCase(currentCase), singleCase, instancetableCallback);
|
DbManager.processSingleCaseInstancesTable(fileType, DbManager.getCase(currentCase), singleCase, instancetableCallback);
|
||||||
|
|
||||||
intercaseCommonValuesMap.putAll(instancetableCallback.getCorrelationIdValueMap());
|
|
||||||
intercaseCommonCasesMap.putAll(instancetableCallback.getCorrelationIdToCaseMap());
|
|
||||||
} catch (EamDbException ex) {
|
} catch (EamDbException ex) {
|
||||||
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
|
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
|
||||||
}
|
}
|
||||||
@ -102,42 +115,31 @@ final class InterCaseSearchResultsProcessor {
|
|||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Callback to use with processCaseInstancesTable which generates a list of
|
* Callback to use with findInterCaseCommonAttributeValues which generates a
|
||||||
* md5s for common files search
|
* list of md5s for common files search
|
||||||
*/
|
*/
|
||||||
private class EamDbAttributeInstancesCallback implements InstanceTableCallback {
|
private class InterCaseCommonAttributesCallback implements InstanceTableCallback {
|
||||||
|
|
||||||
private final Map<Integer, String> correlationIdToValueMap = new HashMap<>();
|
|
||||||
private final Map<Integer, Integer> correlationIdToDatasourceMap = new HashMap<>();
|
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public void process(ResultSet resultSet) {
|
public void process(ResultSet resultSet) {
|
||||||
try {
|
try {
|
||||||
while (resultSet.next()) {
|
while (resultSet.next()) {
|
||||||
int resultId = InstanceTableCallback.getId(resultSet);
|
int resultId = InstanceTableCallback.getId(resultSet);
|
||||||
correlationIdToValueMap.put(resultId, InstanceTableCallback.getValue(resultSet));
|
intercaseCommonValuesMap.put(resultId, InstanceTableCallback.getValue(resultSet));
|
||||||
correlationIdToDatasourceMap.put(resultId, InstanceTableCallback.getCaseId(resultSet));
|
intercaseCommonCasesMap.put(resultId, InstanceTableCallback.getCaseId(resultSet));
|
||||||
}
|
}
|
||||||
} catch (SQLException ex) {
|
} catch (SQLException ex) {
|
||||||
Exceptions.printStackTrace(ex);
|
Exceptions.printStackTrace(ex);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
Map<Integer, String> getCorrelationIdValueMap() {
|
|
||||||
return Collections.unmodifiableMap(correlationIdToValueMap);
|
|
||||||
}
|
|
||||||
|
|
||||||
Map<Integer, Integer> getCorrelationIdToCaseMap() {
|
|
||||||
return Collections.unmodifiableMap(correlationIdToDatasourceMap);
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Callback to use with processCaseInstancesTable which generates a list of
|
* Callback to use with findSingleCorrelationAttribute which retrieves a
|
||||||
* md5s for common files search
|
* single CorrelationAttribute from the EamDb.
|
||||||
*/
|
*/
|
||||||
private class EamDbAttributeInstanceRowCallback implements InstanceTableCallback {
|
private class InterCaseCommonAttributeRowCallback implements InstanceTableCallback {
|
||||||
|
|
||||||
CorrelationAttribute correlationAttribute = null;
|
CorrelationAttribute correlationAttribute = null;
|
||||||
|
|
||||||
@ -146,7 +148,7 @@ final class InterCaseSearchResultsProcessor {
|
|||||||
try {
|
try {
|
||||||
EamDb DbManager = EamDb.getInstance();
|
EamDb DbManager = EamDb.getInstance();
|
||||||
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
|
||||||
|
|
||||||
while (resultSet.next()) {
|
while (resultSet.next()) {
|
||||||
CorrelationCase correlationCase = DbManager.getCaseById(InstanceTableCallback.getCaseId(resultSet));
|
CorrelationCase correlationCase = DbManager.getCaseById(InstanceTableCallback.getCaseId(resultSet));
|
||||||
CorrelationDataSource dataSource = DbManager.getDataSourceById(correlationCase, InstanceTableCallback.getDataSourceId(resultSet));
|
CorrelationDataSource dataSource = DbManager.getDataSourceById(correlationCase, InstanceTableCallback.getDataSourceId(resultSet));
|
||||||
|
@ -76,7 +76,7 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
|
|||||||
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>();
|
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>();
|
||||||
|
|
||||||
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
|
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
|
||||||
eamDbAttrInst.processSingleCaseCorrelationCaseAttributeValues(Case.getCurrentCase(), correlationCase);
|
eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase);
|
||||||
interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
|
interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
|
||||||
|
|
||||||
return new CommonAttributeSearchResults(interCaseCommonFiles);
|
return new CommonAttributeSearchResults(interCaseCommonFiles);
|
||||||
|
Loading…
x
Reference in New Issue
Block a user