mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 07:56:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

cleared up bugs illuminated by removing the file cache for the inter case leaf notes

Browse Source
This commit is contained in:
Brian Sweeney 2018-07-26 17:16:11 -06:00
parent 178b48ecb7
commit 94f0dfbee1
8 changed files with 65 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java
View File

@ -153,26 +153,8 @@ public abstract class AbstractCommonAttributeInstance {
if (abstractFile == null) {
leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance);
} else {
final String attributeDataSourceName = attributeInstance.getCorrelationDataSource().getName();
final String abstractFileDataSourceName = abstractFile.getDataSource().getName();
final String attributeInstanceCaseName = attributeInstance.getCorrelationCase().getDisplayName();
final String attributeInstanceFullPath = attributeInstance.getFilePath().replace("\\", "/");
final String currentAbstractFileParentPath = abstractFile.getParentPath();
final String currentAbstractFileName = abstractFile.getName();
final String abstractFileFullPath = (currentAbstractFileParentPath + currentAbstractFileName).replace("\\", "/");
final boolean sameCase = attributeInstanceCaseName.equalsIgnoreCase(currentCaseName);
final boolean sameFileName = attributeInstanceFullPath.equalsIgnoreCase(abstractFileFullPath);
final boolean sameDataSource = attributeDataSourceName.equalsIgnoreCase(abstractFileDataSourceName);
if (sameCase && sameFileName && sameDataSource) {
leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName);
} else {
leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance);
}
leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName);
}
return leafNode;

9
Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java
View File

@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.Map;
import java.util.Set;
@ -38,12 +39,18 @@ import org.sleuthkit.datamodel.TskCoreException;
*/
public abstract class AbstractCommonAttributeSearcher {
private final Map<Long, String> dataSourceIdToNameMap;
private boolean filterByMedia;
private boolean filterByDoc;
AbstractCommonAttributeSearcher(boolean filterByMedia, boolean filterByDoc){
AbstractCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMedia, boolean filterByDoc){
this.filterByDoc = filterByDoc;
this.filterByMedia = filterByMedia;
this.dataSourceIdToNameMap = dataSourceIdMap;
}
Map<Long, String> getDataSourceIdToNameMap(){
return Collections.unmodifiableMap(this.dataSourceIdToNameMap);
}
/**

4
Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java
View File

@ -41,8 +41,8 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut
* broadly categorized as document types
* @throws EamDbException
*/
public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType);
public AllInterCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
}
@Override

70
Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java
View File

@ -21,11 +21,14 @@ package org.sleuthkit.autopsy.commonfilesearch;
import java.io.File;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.logging.Level;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.datamodel.AbstractFile;
@ -42,10 +45,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName());
private final Integer crFileId;
private CorrelationAttribute currentAttribute;
private Map<String, Long> dataSourceNameToIdMap;
CentralRepoCommonAttributeInstance(Integer attrInstId) {
CentralRepoCommonAttributeInstance(Integer attrInstId, Map<Long, String> dataSourceIdToNameMap) {
super();
this.crFileId = attrInstId;
this.dataSourceNameToIdMap = invertMap(dataSourceIdToNameMap);
}
void setCurrentAttributeInst(CorrelationAttribute attribute) {
@ -57,39 +62,44 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
Case currentCase;
if (this.currentAttribute != null) {
String currentFullPath = this.currentAttribute.getInstances().get(0).getFilePath();
try {
currentCase = Case.getCurrentCaseThrows();
final CorrelationAttributeInstance currentAttributeInstance = this.currentAttribute.getInstances().get(0);
String currentFullPath = currentAttributeInstance.getFilePath();
String currentDataSource = currentAttributeInstance.getCorrelationDataSource().getName();
if(this.dataSourceNameToIdMap.containsKey(currentDataSource)){
Long dataSourceObjectId = this.dataSourceNameToIdMap.get(currentDataSource);
try {
currentCase = Case.getCurrentCaseThrows();
SleuthkitCase tskDb = currentCase.getSleuthkitCase();
SleuthkitCase tskDb = currentCase.getSleuthkitCase();
File fileFromPath = new File(currentFullPath);
String fileName = fileFromPath.getName();
String parentPath = (fileFromPath.getParent() + File.separator).replace("\\", "/");
final String whereClause = String.format("lower(name) = '%s' AND md5 = '%s' AND lower(parent_path) = '%s' AND data_source_obj_id = %s", fileName, currentAttribute.getCorrelationValue(), parentPath, dataSourceObjectId);
List<AbstractFile> potentialAbstractFiles = tskDb.findAllFilesWhere(whereClause);
File fileFromPath = new File(currentFullPath);
String fileName = fileFromPath.getName();
String parentPath = fileFromPath.getParent() + File.separator;
List<AbstractFile> potentialAbstractFiles = tskDb.findAllFilesWhere(String.format("lower(name) = '%s' AND md5 = '%s'", fileName, currentAttribute.getCorrelationValue()));
AbstractFile finalAbstractFile = null;
for (AbstractFile aFile : potentialAbstractFiles) {
// If a direct match exists, return that and we'll create a CaseDb instance node from it
if (aFile.getParentPath().equalsIgnoreCase(parentPath)) {
finalAbstractFile = aFile;
break;
}
}
// If not direct match exists, return first md5 match, only used as a backing file for CR instance node.
if (finalAbstractFile == null) {
if(potentialAbstractFiles.isEmpty()){
return null;
} else if(potentialAbstractFiles.size() > 1){
LOGGER.log(Level.WARNING, String.format("Unable to find an exact match for AbstractFile for record with filePath: %s. May have returned the wrong file.", new Object[]{currentFullPath}));
return potentialAbstractFiles.get(0);
} else {
finalAbstractFile = potentialAbstractFiles.get(0);
return potentialAbstractFiles.get(0);
}
} catch (TskCoreException | NoCurrentCaseException ex) {
LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex);
return null;
}
return finalAbstractFile;
} catch (TskCoreException | NoCurrentCaseException ex) {
LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex);
} else {
return null;
}
}
}
return null;
}
@ -116,4 +126,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]);
}
private Map<String, Long> invertMap(Map<Long, String> dataSourceIdToNameMap) {
HashMap<String, Long> invertedMap = new HashMap<>();
for (Map.Entry<Long, String> entry : dataSourceIdToNameMap.entrySet()){
invertedMap.put(entry.getValue(), entry.getKey());
}
return invertedMap;
}
}

4
Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java
View File

@ -157,9 +157,9 @@ public final class CommonAttributePanel extends javax.swing.JDialog {
if (CommonAttributePanel.this.interCaseRadio.isSelected()) {
if (caseId == InterCasePanel.NO_CASE_SELECTED) {
builder = new AllInterCaseCommonAttributeSearcher(filterByMedia, filterByDocuments);
builder = new AllInterCaseCommonAttributeSearcher(intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments);
} else {
builder = new SingleInterCaseCommonAttributeSearcher(caseId, filterByMedia, filterByDocuments);
builder = new SingleInterCaseCommonAttributeSearcher(caseId, intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments);
}
} else {
if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) {

8
Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java
View File

@ -46,8 +46,8 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS
*
* @throws EamDbException
*/
InterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType);
InterCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
dbManager = EamDb.getInstance();
}
@ -77,14 +77,14 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS
//Add to intercase metaData
final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5);
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId);
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap());
commonAttributeValue.addInstance(searchResult);
} else {
CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5);
interCaseCommonFiles.put(md5, commonAttributeValue);
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId);
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap());
commonAttributeValue.addInstance(searchResult);
}
}

6
Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java
View File

@ -44,7 +44,6 @@ import org.sleuthkit.datamodel.TskCoreException;
@SuppressWarnings("PMD.AbstractNaming")
public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher {
private final Map<Long, String> dataSourceIdToNameMap;
private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on
/**
@ -57,8 +56,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
* broadly categorized as document types
*/
IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) {
super(filterByMediaMimeType, filterByDocMimeType);
dataSourceIdToNameMap = dataSourceIdMap;
super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
}
/**
@ -113,7 +111,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
Long objectId = resultSet.getLong(1);
String md5 = resultSet.getString(2);
Long dataSourceId = resultSet.getLong(3);
String dataSource = this.dataSourceIdToNameMap.get(dataSourceId);
String dataSource = this.getDataSourceIdToNameMap().get(dataSourceId);
if (md5 == null || HashUtility.isNoDataMd5(md5)) {
continue;

4
Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java
View File

@ -44,8 +44,8 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
* @param filterByDocMimeType
* @throws EamDbException
*/
public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType);
public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(dataSourceIdMap,filterByMediaMimeType, filterByDocMimeType);
this.corrleationCaseId = correlationCaseId;
this.correlationCaseName = "";