mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

4791 fix sorting of results by count for inter-case search

Browse Source
This commit is contained in:
William Schaefer 2019-03-05 18:35:19 -05:00
parent b6c8936d55
commit 88404aa9ee
4 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Core/src/org/sleuthkit/autopsy/commonpropertiessearch/AbstractCommonAttributeSearcher.java
View File

@ -130,9 +130,9 @@ public abstract class AbstractCommonAttributeSearcher {
} }
} }
static Map<Integer, CommonAttributeValueList> collateMatchesByNumberOfInstances(Map<String, CommonAttributeValue> commonFiles) { static TreeMap<Integer, CommonAttributeValueList> collateMatchesByNumberOfInstances(Map<String, CommonAttributeValue> commonFiles) {
//collate matches by number of matching instances - doing this in sql doesnt seem efficient //collate matches by number of matching instances - doing this in sql doesnt seem efficient
Map<Integer, CommonAttributeValueList> instanceCollatedCommonFiles = new TreeMap<>(); TreeMap<Integer, CommonAttributeValueList> instanceCollatedCommonFiles = new TreeMap<>();
for (CommonAttributeValue md5Metadata : commonFiles.values()) { for (CommonAttributeValue md5Metadata : commonFiles.values()) {
Integer size = md5Metadata.getDataSources().size(); Integer size = md5Metadata.getDataSources().size();

7
Core/src/org/sleuthkit/autopsy/commonpropertiessearch/CommonAttributeCountSearchResults.java
View File

@ -25,6 +25,7 @@ import java.util.HashMap;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Map.Entry; import java.util.Map.Entry;
import java.util.TreeMap;
import java.util.logging.Level; import java.util.logging.Level;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException;
@ -41,7 +42,7 @@ final public class CommonAttributeCountSearchResults {
private static final Logger LOGGER = Logger.getLogger(CommonAttributeCountSearchResults.class.getName()); private static final Logger LOGGER = Logger.getLogger(CommonAttributeCountSearchResults.class.getName());
// maps instance count to list of attribute values. // maps instance count to list of attribute values.
private final Map<Integer, CommonAttributeValueList> instanceCountToAttributeValues; private final TreeMap<Integer, CommonAttributeValueList> instanceCountToAttributeValues;
private final int percentageThreshold; private final int percentageThreshold;
private final int resultTypeId; private final int resultTypeId;
@ -58,7 +59,7 @@ final public class CommonAttributeCountSearchResults {
*/ */
CommonAttributeCountSearchResults(Map<Integer, CommonAttributeValueList> metadata, int percentageThreshold, CorrelationAttributeInstance.Type resultType) { CommonAttributeCountSearchResults(Map<Integer, CommonAttributeValueList> metadata, int percentageThreshold, CorrelationAttributeInstance.Type resultType) {
//wrap in a new object in case any client code has used an unmodifiable collection //wrap in a new object in case any client code has used an unmodifiable collection
this.instanceCountToAttributeValues = new HashMap<>(metadata); this.instanceCountToAttributeValues = new TreeMap<>(metadata);
this.percentageThreshold = percentageThreshold; this.percentageThreshold = percentageThreshold;
this.resultTypeId = resultType.getId(); this.resultTypeId = resultType.getId();
} }
@ -73,7 +74,7 @@ final public class CommonAttributeCountSearchResults {
*/ */
CommonAttributeCountSearchResults(Map<Integer, CommonAttributeValueList> metadata, int percentageThreshold) { CommonAttributeCountSearchResults(Map<Integer, CommonAttributeValueList> metadata, int percentageThreshold) {
//wrap in a new object in case any client code has used an unmodifiable collection //wrap in a new object in case any client code has used an unmodifiable collection
this.instanceCountToAttributeValues = new HashMap<>(metadata); this.instanceCountToAttributeValues = new TreeMap<>(metadata);
this.percentageThreshold = percentageThreshold; this.percentageThreshold = percentageThreshold;
this.resultTypeId = CorrelationAttributeInstance.FILES_TYPE_ID; this.resultTypeId = CorrelationAttributeInstance.FILES_TYPE_ID;
} }

9
Core/src/org/sleuthkit/autopsy/commonpropertiessearch/InterCaseSearchResultsProcessor.java
View File

@ -29,6 +29,7 @@ import java.util.HashSet;
import java.util.Set; import java.util.Set;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.TreeMap;
import java.util.logging.Level; import java.util.logging.Level;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
@ -173,7 +174,7 @@ final class InterCaseSearchResultsProcessor {
} catch (EamDbException | TskCoreException ex) { } catch (EamDbException | TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
} }
return new HashMap<>(); return new TreeMap<>();
} }
/** /**
@ -205,7 +206,7 @@ final class InterCaseSearchResultsProcessor {
} catch (EamDbException | TskCoreException ex) { } catch (EamDbException | TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex);
} }
return new HashMap<>(); return new TreeMap<>();
} }
/** /**
@ -248,7 +249,7 @@ final class InterCaseSearchResultsProcessor {
*/ */
private class InterCaseByCountCallback implements CaseDbAccessManager.CaseDbAccessQueryCallback, InstanceTableCallback { private class InterCaseByCountCallback implements CaseDbAccessManager.CaseDbAccessQueryCallback, InstanceTableCallback {
private final Map<Integer, CommonAttributeValueList> instanceCollatedCommonFiles = new HashMap<>(); private final TreeMap<Integer, CommonAttributeValueList> instanceCollatedCommonFiles = new TreeMap<>();
private final int caseID; private final int caseID;
private final int targetCase; private final int targetCase;
@ -311,7 +312,7 @@ final class InterCaseSearchResultsProcessor {
} }
Map<Integer, CommonAttributeValueList> getInstanceCollatedCommonFiles() { Map<Integer, CommonAttributeValueList> getInstanceCollatedCommonFiles() {
return Collections.unmodifiableMap(instanceCollatedCommonFiles); return Collections.unmodifiableSortedMap(instanceCollatedCommonFiles);
} }
} }

3
Core/src/org/sleuthkit/autopsy/commonpropertiessearch/IntraCaseCommonAttributeSearcher.java
View File

@ -26,6 +26,7 @@ import java.util.HashMap;
import java.util.HashSet; import java.util.HashSet;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.TreeMap;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
@ -137,7 +138,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
} }
} }
Map<Integer, CommonAttributeValueList> instanceCollatedCommonFiles = collateMatchesByNumberOfInstances(commonFiles); TreeMap<Integer, CommonAttributeValueList> instanceCollatedCommonFiles = collateMatchesByNumberOfInstances(commonFiles);
return new CommonAttributeCountSearchResults(instanceCollatedCommonFiles, this.frequencyPercentageThreshold); return new CommonAttributeCountSearchResults(instanceCollatedCommonFiles, this.frequencyPercentageThreshold);
} }