diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java index d6ef8dfb03..abb7a1e683 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java @@ -153,26 +153,8 @@ public abstract class AbstractCommonAttributeInstance { if (abstractFile == null) { leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance); } else { - final String attributeDataSourceName = attributeInstance.getCorrelationDataSource().getName(); final String abstractFileDataSourceName = abstractFile.getDataSource().getName(); - - final String attributeInstanceCaseName = attributeInstance.getCorrelationCase().getDisplayName(); - - final String attributeInstanceFullPath = attributeInstance.getFilePath().replace("\\", "/"); - - final String currentAbstractFileParentPath = abstractFile.getParentPath(); - final String currentAbstractFileName = abstractFile.getName(); - final String abstractFileFullPath = (currentAbstractFileParentPath + currentAbstractFileName).replace("\\", "/"); - - final boolean sameCase = attributeInstanceCaseName.equalsIgnoreCase(currentCaseName); - final boolean sameFileName = attributeInstanceFullPath.equalsIgnoreCase(abstractFileFullPath); - final boolean sameDataSource = attributeDataSourceName.equalsIgnoreCase(abstractFileDataSourceName); - - if (sameCase && sameFileName && sameDataSource) { - leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName); - } else { - leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance); - } + leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName); } return leafNode; diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java index fb8cbd312d..97456bda04 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java @@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.sql.SQLException; import java.util.ArrayList; +import java.util.Collections; import java.util.List; import java.util.Map; import java.util.Set; @@ -38,12 +39,18 @@ import org.sleuthkit.datamodel.TskCoreException; */ public abstract class AbstractCommonAttributeSearcher { + private final Map dataSourceIdToNameMap; private boolean filterByMedia; private boolean filterByDoc; - AbstractCommonAttributeSearcher(boolean filterByMedia, boolean filterByDoc){ + AbstractCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMedia, boolean filterByDoc){ this.filterByDoc = filterByDoc; this.filterByMedia = filterByMedia; + this.dataSourceIdToNameMap = dataSourceIdMap; + } + + Map getDataSourceIdToNameMap(){ + return Collections.unmodifiableMap(this.dataSourceIdToNameMap); } /** diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java index d86a4b9878..7e039a9419 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java @@ -41,8 +41,8 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut * broadly categorized as document types * @throws EamDbException */ - public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(filterByMediaMimeType, filterByDocMimeType); + public AllInterCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); } @Override diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java index 2e0d623fa4..68e795d37b 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java @@ -21,11 +21,14 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.io.File; import java.util.ArrayList; +import java.util.HashMap; import java.util.List; +import java.util.Map; import java.util.logging.Level; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute; +import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.datamodel.AbstractFile; @@ -42,10 +45,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName()); private final Integer crFileId; private CorrelationAttribute currentAttribute; + private Map dataSourceNameToIdMap; - CentralRepoCommonAttributeInstance(Integer attrInstId) { + CentralRepoCommonAttributeInstance(Integer attrInstId, Map dataSourceIdToNameMap) { super(); this.crFileId = attrInstId; + this.dataSourceNameToIdMap = invertMap(dataSourceIdToNameMap); } void setCurrentAttributeInst(CorrelationAttribute attribute) { @@ -57,39 +62,44 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr Case currentCase; if (this.currentAttribute != null) { - String currentFullPath = this.currentAttribute.getInstances().get(0).getFilePath(); - try { - currentCase = Case.getCurrentCaseThrows(); + + final CorrelationAttributeInstance currentAttributeInstance = this.currentAttribute.getInstances().get(0); + + String currentFullPath = currentAttributeInstance.getFilePath(); + String currentDataSource = currentAttributeInstance.getCorrelationDataSource().getName(); + + + if(this.dataSourceNameToIdMap.containsKey(currentDataSource)){ + Long dataSourceObjectId = this.dataSourceNameToIdMap.get(currentDataSource); + + try { + currentCase = Case.getCurrentCaseThrows(); - SleuthkitCase tskDb = currentCase.getSleuthkitCase(); + SleuthkitCase tskDb = currentCase.getSleuthkitCase(); + + File fileFromPath = new File(currentFullPath); + String fileName = fileFromPath.getName(); + String parentPath = (fileFromPath.getParent() + File.separator).replace("\\", "/"); + + final String whereClause = String.format("lower(name) = '%s' AND md5 = '%s' AND lower(parent_path) = '%s' AND data_source_obj_id = %s", fileName, currentAttribute.getCorrelationValue(), parentPath, dataSourceObjectId); + List potentialAbstractFiles = tskDb.findAllFilesWhere(whereClause); - File fileFromPath = new File(currentFullPath); - String fileName = fileFromPath.getName(); - String parentPath = fileFromPath.getParent() + File.separator; - List potentialAbstractFiles = tskDb.findAllFilesWhere(String.format("lower(name) = '%s' AND md5 = '%s'", fileName, currentAttribute.getCorrelationValue())); - AbstractFile finalAbstractFile = null; - for (AbstractFile aFile : potentialAbstractFiles) { - // If a direct match exists, return that and we'll create a CaseDb instance node from it - if (aFile.getParentPath().equalsIgnoreCase(parentPath)) { - finalAbstractFile = aFile; - break; - } - } - // If not direct match exists, return first md5 match, only used as a backing file for CR instance node. - if (finalAbstractFile == null) { if(potentialAbstractFiles.isEmpty()){ return null; + } else if(potentialAbstractFiles.size() > 1){ + LOGGER.log(Level.WARNING, String.format("Unable to find an exact match for AbstractFile for record with filePath: %s. May have returned the wrong file.", new Object[]{currentFullPath})); + return potentialAbstractFiles.get(0); } else { - finalAbstractFile = potentialAbstractFiles.get(0); + return potentialAbstractFiles.get(0); } + + } catch (TskCoreException | NoCurrentCaseException ex) { + LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex); + return null; } - - return finalAbstractFile; - - } catch (TskCoreException | NoCurrentCaseException ex) { - LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex); + } else { return null; - } + } } return null; } @@ -116,4 +126,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]); } + + private Map invertMap(Map dataSourceIdToNameMap) { + HashMap invertedMap = new HashMap<>(); + for (Map.Entry entry : dataSourceIdToNameMap.entrySet()){ + invertedMap.put(entry.getValue(), entry.getKey()); + } + return invertedMap; + } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java index c83876f3ce..1b33bb9422 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java @@ -157,9 +157,9 @@ public final class CommonAttributePanel extends javax.swing.JDialog { if (CommonAttributePanel.this.interCaseRadio.isSelected()) { if (caseId == InterCasePanel.NO_CASE_SELECTED) { - builder = new AllInterCaseCommonAttributeSearcher(filterByMedia, filterByDocuments); + builder = new AllInterCaseCommonAttributeSearcher(intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments); } else { - builder = new SingleInterCaseCommonAttributeSearcher(caseId, filterByMedia, filterByDocuments); + builder = new SingleInterCaseCommonAttributeSearcher(caseId, intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments); } } else { if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) { diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java index 938a33fee8..fcdb4a319c 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java @@ -46,8 +46,8 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS * * @throws EamDbException */ - InterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(filterByMediaMimeType, filterByDocMimeType); + InterCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); dbManager = EamDb.getInstance(); } @@ -77,14 +77,14 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS //Add to intercase metaData final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId); + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap()); commonAttributeValue.addInstance(searchResult); } else { CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); interCaseCommonFiles.put(md5, commonAttributeValue); - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId); + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap()); commonAttributeValue.addInstance(searchResult); } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java index 143f061ed2..0967041b30 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java @@ -44,7 +44,6 @@ import org.sleuthkit.datamodel.TskCoreException; @SuppressWarnings("PMD.AbstractNaming") public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher { - private final Map dataSourceIdToNameMap; private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on /** @@ -57,8 +56,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt * broadly categorized as document types */ IntraCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) { - super(filterByMediaMimeType, filterByDocMimeType); - dataSourceIdToNameMap = dataSourceIdMap; + super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); } /** @@ -113,7 +111,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt Long objectId = resultSet.getLong(1); String md5 = resultSet.getString(2); Long dataSourceId = resultSet.getLong(3); - String dataSource = this.dataSourceIdToNameMap.get(dataSourceId); + String dataSource = this.getDataSourceIdToNameMap().get(dataSourceId); if (md5 == null || HashUtility.isNoDataMd5(md5)) { continue; diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java index 9486a9e43c..66a7106c63 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java @@ -44,8 +44,8 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri * @param filterByDocMimeType * @throws EamDbException */ - public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(filterByMediaMimeType, filterByDocMimeType); + public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(dataSourceIdMap,filterByMediaMimeType, filterByDocMimeType); this.corrleationCaseId = correlationCaseId; this.correlationCaseName = "";