mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 07:56:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

renames and comments for CR results processing.

Browse Source
This commit is contained in:
Andrew Ziehl 2018-07-17 11:58:15 -07:00
parent 487222dcbc
commit 8233f41fd6
4 changed files with 46 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java
View File

@ -33,18 +33,16 @@ import org.sleuthkit.datamodel.TskCoreException;
* present case.
*/
public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttributeSearcher {
public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType);
}
}
@Override
public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>();
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
eamDbAttrInst.processCorrelationCaseAttributeValues(Case.getCurrentCase());
interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase());
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
return new CommonAttributeSearchResults(interCaseCommonFiles);
}

2
Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearchResults.java
View File

@ -78,7 +78,7 @@ final public class InterCaseCommonAttributeSearchResults extends CommonAttribute
@Override
public DisplayableItemNode[] generateNodes() {
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
CorrelationAttribute corrAttr = eamDbAttrInst.processCorrelationCaseSingleAttribute(crFileId); //TODO which do we want
CorrelationAttribute corrAttr = eamDbAttrInst.findSingleCorrelationAttribute(crFileId); //TODO which do we want
List<DisplayableItemNode> attrInstNodeList = new ArrayList<>(0);
for (CorrelationAttributeInstance attrInst : corrAttr.getInstances()) {

76
Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java
View File

@ -44,49 +44,62 @@ final class InterCaseSearchResultsProcessor {
private final Map<Integer, String> intercaseCommonValuesMap = new HashMap<>();
private final Map<Integer, Integer> intercaseCommonCasesMap = new HashMap<>();
CorrelationAttribute processCorrelationCaseSingleAttribute(int attrbuteId) {
try {
EamDbAttributeInstanceRowCallback instancetableCallback = new EamDbAttributeInstanceRowCallback();
/**
* Finds a single CorrelationAttribute given an id.
*
* @param attrbuteId Row of CorrelationAttribute to retrieve from the EamDb
* @return CorrelationAttribute object representation of retrieved match
*/
CorrelationAttribute findSingleCorrelationAttribute(int attrbuteId) {
try {
InterCaseCommonAttributeRowCallback instancetableCallback = new InterCaseCommonAttributeRowCallback();
EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
DbManager.processInstanceTableRow(fileType, attrbuteId, instancetableCallback);
return instancetableCallback.getCorrelationAttribute();
} catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing InstanceTable row.", ex);
}
return null;
}
void processCorrelationCaseAttributeValues(Case currentCase) {
/**
* Given the current case, fins all intercase common files from the EamDb
* and builds maps of obj id to md5 and case.
*
* @param currentCase The current TSK Case.
*/
void findInterCaseCommonAttributeValues(Case currentCase) {
try {
EamDbAttributeInstancesCallback instancetableCallback = new EamDbAttributeInstancesCallback();
InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback();
EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
DbManager.processCaseInstancesTable(fileType, DbManager.getCase(currentCase), instancetableCallback);
intercaseCommonValuesMap.putAll(instancetableCallback.getCorrelationIdValueMap());
intercaseCommonCasesMap.putAll(instancetableCallback.getCorrelationIdToCaseMap());
} catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
}
}
void processSingleCaseCorrelationCaseAttributeValues(Case currentCase, CorrelationCase singleCase) {
/**
* Given the current case, and a specific case of interest, finds common
* files which exist between cases from the EamDb. Builds maps of obj id to
* md5 and case.
*
* @param currentCase The current TSK Case.
* @param singleCase The case of interest. Matches must exist in this case.
*/
void findSingleInterCaseCommonAttributeValues(Case currentCase, CorrelationCase singleCase) {
try {
EamDbAttributeInstancesCallback instancetableCallback = new EamDbAttributeInstancesCallback();
InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback();
EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
DbManager.processSingleCaseInstancesTable(fileType, DbManager.getCase(currentCase), singleCase, instancetableCallback);
intercaseCommonValuesMap.putAll(instancetableCallback.getCorrelationIdValueMap());
intercaseCommonCasesMap.putAll(instancetableCallback.getCorrelationIdToCaseMap());
} catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
}
@ -102,42 +115,31 @@ final class InterCaseSearchResultsProcessor {
}
/**
* Callback to use with processCaseInstancesTable which generates a list of
* md5s for common files search
* Callback to use with findInterCaseCommonAttributeValues which generates a
* list of md5s for common files search
*/
private class EamDbAttributeInstancesCallback implements InstanceTableCallback {
private final Map<Integer, String> correlationIdToValueMap = new HashMap<>();
private final Map<Integer, Integer> correlationIdToDatasourceMap = new HashMap<>();
private class InterCaseCommonAttributesCallback implements InstanceTableCallback {
@Override
public void process(ResultSet resultSet) {
try {
while (resultSet.next()) {
int resultId = InstanceTableCallback.getId(resultSet);
correlationIdToValueMap.put(resultId, InstanceTableCallback.getValue(resultSet));
correlationIdToDatasourceMap.put(resultId, InstanceTableCallback.getCaseId(resultSet));
intercaseCommonValuesMap.put(resultId, InstanceTableCallback.getValue(resultSet));
intercaseCommonCasesMap.put(resultId, InstanceTableCallback.getCaseId(resultSet));
}
} catch (SQLException ex) {
Exceptions.printStackTrace(ex);
}
}
Map<Integer, String> getCorrelationIdValueMap() {
return Collections.unmodifiableMap(correlationIdToValueMap);
}
Map<Integer, Integer> getCorrelationIdToCaseMap() {
return Collections.unmodifiableMap(correlationIdToDatasourceMap);
}
}
/**
* Callback to use with processCaseInstancesTable which generates a list of
* md5s for common files search
* Callback to use with findSingleCorrelationAttribute which retrieves a
* single CorrelationAttribute from the EamDb.
*/
private class EamDbAttributeInstanceRowCallback implements InstanceTableCallback {
private class InterCaseCommonAttributeRowCallback implements InstanceTableCallback {
CorrelationAttribute correlationAttribute = null;
@ -146,7 +148,7 @@ final class InterCaseSearchResultsProcessor {
try {
EamDb DbManager = EamDb.getInstance();
CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID);
while (resultSet.next()) {
CorrelationCase correlationCase = DbManager.getCaseById(InstanceTableCallback.getCaseId(resultSet));
CorrelationDataSource dataSource = DbManager.getDataSourceById(correlationCase, InstanceTableCallback.getDataSourceId(resultSet));

2
Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java
View File

@ -76,7 +76,7 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
Map<Integer, List<CommonAttributeValue>> interCaseCommonFiles = new HashMap<>();
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor();
eamDbAttrInst.processSingleCaseCorrelationCaseAttributeValues(Case.getCurrentCase(), correlationCase);
eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase);
interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap());
return new CommonAttributeSearchResults(interCaseCommonFiles);