mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-12 16:06:15 +00:00
cleared up bugs illuminated by removing the file cache for the inter case leaf notes
This commit is contained in:
parent
178b48ecb7
commit
94f0dfbee1
@ -153,26 +153,8 @@ public abstract class AbstractCommonAttributeInstance {
|
|||||||
if (abstractFile == null) {
|
if (abstractFile == null) {
|
||||||
leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance);
|
leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance);
|
||||||
} else {
|
} else {
|
||||||
final String attributeDataSourceName = attributeInstance.getCorrelationDataSource().getName();
|
|
||||||
final String abstractFileDataSourceName = abstractFile.getDataSource().getName();
|
final String abstractFileDataSourceName = abstractFile.getDataSource().getName();
|
||||||
|
leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName);
|
||||||
final String attributeInstanceCaseName = attributeInstance.getCorrelationCase().getDisplayName();
|
|
||||||
|
|
||||||
final String attributeInstanceFullPath = attributeInstance.getFilePath().replace("\\", "/");
|
|
||||||
|
|
||||||
final String currentAbstractFileParentPath = abstractFile.getParentPath();
|
|
||||||
final String currentAbstractFileName = abstractFile.getName();
|
|
||||||
final String abstractFileFullPath = (currentAbstractFileParentPath + currentAbstractFileName).replace("\\", "/");
|
|
||||||
|
|
||||||
final boolean sameCase = attributeInstanceCaseName.equalsIgnoreCase(currentCaseName);
|
|
||||||
final boolean sameFileName = attributeInstanceFullPath.equalsIgnoreCase(abstractFileFullPath);
|
|
||||||
final boolean sameDataSource = attributeDataSourceName.equalsIgnoreCase(abstractFileDataSourceName);
|
|
||||||
|
|
||||||
if (sameCase && sameFileName && sameDataSource) {
|
|
||||||
leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName);
|
|
||||||
} else {
|
|
||||||
leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return leafNode;
|
return leafNode;
|
||||||
|
@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.commonfilesearch;
|
|||||||
|
|
||||||
import java.sql.SQLException;
|
import java.sql.SQLException;
|
||||||
import java.util.ArrayList;
|
import java.util.ArrayList;
|
||||||
|
import java.util.Collections;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
import java.util.Map;
|
import java.util.Map;
|
||||||
import java.util.Set;
|
import java.util.Set;
|
||||||
@ -38,12 +39,18 @@ import org.sleuthkit.datamodel.TskCoreException;
|
|||||||
*/
|
*/
|
||||||
public abstract class AbstractCommonAttributeSearcher {
|
public abstract class AbstractCommonAttributeSearcher {
|
||||||
|
|
||||||
|
private final Map<Long, String> dataSourceIdToNameMap;
|
||||||
private boolean filterByMedia;
|
private boolean filterByMedia;
|
||||||
private boolean filterByDoc;
|
private boolean filterByDoc;
|
||||||
|
|
||||||
AbstractCommonAttributeSearcher(boolean filterByMedia, boolean filterByDoc){
|
AbstractCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMedia, boolean filterByDoc){
|
||||||
this.filterByDoc = filterByDoc;
|
this.filterByDoc = filterByDoc;
|
||||||
this.filterByMedia = filterByMedia;
|
this.filterByMedia = filterByMedia;
|
||||||
|
this.dataSourceIdToNameMap = dataSourceIdMap;
|
||||||
|
}
|
||||||
|
|
||||||
|
Map<Long, String> getDataSourceIdToNameMap(){
|
||||||
|
return Collections.unmodifiableMap(this.dataSourceIdToNameMap);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -41,8 +41,8 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut
|
|||||||
* broadly categorized as document types
|
* broadly categorized as document types
|
||||||
* @throws EamDbException
|
* @throws EamDbException
|
||||||
*/
|
*/
|
||||||
public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
public AllInterCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
||||||
super(filterByMediaMimeType, filterByDocMimeType);
|
super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
|
@ -21,11 +21,14 @@ package org.sleuthkit.autopsy.commonfilesearch;
|
|||||||
|
|
||||||
import java.io.File;
|
import java.io.File;
|
||||||
import java.util.ArrayList;
|
import java.util.ArrayList;
|
||||||
|
import java.util.HashMap;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
|
import java.util.Map;
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
import org.sleuthkit.autopsy.casemodule.Case;
|
||||||
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
||||||
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
|
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
|
||||||
|
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
|
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
@ -42,10 +45,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
|
|||||||
private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName());
|
private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName());
|
||||||
private final Integer crFileId;
|
private final Integer crFileId;
|
||||||
private CorrelationAttribute currentAttribute;
|
private CorrelationAttribute currentAttribute;
|
||||||
|
private Map<String, Long> dataSourceNameToIdMap;
|
||||||
|
|
||||||
CentralRepoCommonAttributeInstance(Integer attrInstId) {
|
CentralRepoCommonAttributeInstance(Integer attrInstId, Map<Long, String> dataSourceIdToNameMap) {
|
||||||
super();
|
super();
|
||||||
this.crFileId = attrInstId;
|
this.crFileId = attrInstId;
|
||||||
|
this.dataSourceNameToIdMap = invertMap(dataSourceIdToNameMap);
|
||||||
}
|
}
|
||||||
|
|
||||||
void setCurrentAttributeInst(CorrelationAttribute attribute) {
|
void setCurrentAttributeInst(CorrelationAttribute attribute) {
|
||||||
@ -57,37 +62,42 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
|
|||||||
|
|
||||||
Case currentCase;
|
Case currentCase;
|
||||||
if (this.currentAttribute != null) {
|
if (this.currentAttribute != null) {
|
||||||
String currentFullPath = this.currentAttribute.getInstances().get(0).getFilePath();
|
|
||||||
try {
|
|
||||||
currentCase = Case.getCurrentCaseThrows();
|
|
||||||
|
|
||||||
SleuthkitCase tskDb = currentCase.getSleuthkitCase();
|
final CorrelationAttributeInstance currentAttributeInstance = this.currentAttribute.getInstances().get(0);
|
||||||
|
|
||||||
|
String currentFullPath = currentAttributeInstance.getFilePath();
|
||||||
|
String currentDataSource = currentAttributeInstance.getCorrelationDataSource().getName();
|
||||||
|
|
||||||
|
|
||||||
|
if(this.dataSourceNameToIdMap.containsKey(currentDataSource)){
|
||||||
|
Long dataSourceObjectId = this.dataSourceNameToIdMap.get(currentDataSource);
|
||||||
|
|
||||||
|
try {
|
||||||
|
currentCase = Case.getCurrentCaseThrows();
|
||||||
|
|
||||||
|
SleuthkitCase tskDb = currentCase.getSleuthkitCase();
|
||||||
|
|
||||||
|
File fileFromPath = new File(currentFullPath);
|
||||||
|
String fileName = fileFromPath.getName();
|
||||||
|
String parentPath = (fileFromPath.getParent() + File.separator).replace("\\", "/");
|
||||||
|
|
||||||
|
final String whereClause = String.format("lower(name) = '%s' AND md5 = '%s' AND lower(parent_path) = '%s' AND data_source_obj_id = %s", fileName, currentAttribute.getCorrelationValue(), parentPath, dataSourceObjectId);
|
||||||
|
List<AbstractFile> potentialAbstractFiles = tskDb.findAllFilesWhere(whereClause);
|
||||||
|
|
||||||
File fileFromPath = new File(currentFullPath);
|
|
||||||
String fileName = fileFromPath.getName();
|
|
||||||
String parentPath = fileFromPath.getParent() + File.separator;
|
|
||||||
List<AbstractFile> potentialAbstractFiles = tskDb.findAllFilesWhere(String.format("lower(name) = '%s' AND md5 = '%s'", fileName, currentAttribute.getCorrelationValue()));
|
|
||||||
AbstractFile finalAbstractFile = null;
|
|
||||||
for (AbstractFile aFile : potentialAbstractFiles) {
|
|
||||||
// If a direct match exists, return that and we'll create a CaseDb instance node from it
|
|
||||||
if (aFile.getParentPath().equalsIgnoreCase(parentPath)) {
|
|
||||||
finalAbstractFile = aFile;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// If not direct match exists, return first md5 match, only used as a backing file for CR instance node.
|
|
||||||
if (finalAbstractFile == null) {
|
|
||||||
if(potentialAbstractFiles.isEmpty()){
|
if(potentialAbstractFiles.isEmpty()){
|
||||||
return null;
|
return null;
|
||||||
|
} else if(potentialAbstractFiles.size() > 1){
|
||||||
|
LOGGER.log(Level.WARNING, String.format("Unable to find an exact match for AbstractFile for record with filePath: %s. May have returned the wrong file.", new Object[]{currentFullPath}));
|
||||||
|
return potentialAbstractFiles.get(0);
|
||||||
} else {
|
} else {
|
||||||
finalAbstractFile = potentialAbstractFiles.get(0);
|
return potentialAbstractFiles.get(0);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} catch (TskCoreException | NoCurrentCaseException ex) {
|
||||||
|
LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex);
|
||||||
|
return null;
|
||||||
}
|
}
|
||||||
|
} else {
|
||||||
return finalAbstractFile;
|
|
||||||
|
|
||||||
} catch (TskCoreException | NoCurrentCaseException ex) {
|
|
||||||
LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex);
|
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -116,4 +126,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
|
|||||||
|
|
||||||
return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]);
|
return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
private Map<String, Long> invertMap(Map<Long, String> dataSourceIdToNameMap) {
|
||||||
|
HashMap<String, Long> invertedMap = new HashMap<>();
|
||||||
|
for (Map.Entry<Long, String> entry : dataSourceIdToNameMap.entrySet()){
|
||||||
|
invertedMap.put(entry.getValue(), entry.getKey());
|
||||||
|
}
|
||||||
|
return invertedMap;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
@ -157,9 +157,9 @@ public final class CommonAttributePanel extends javax.swing.JDialog {
|
|||||||
if (CommonAttributePanel.this.interCaseRadio.isSelected()) {
|
if (CommonAttributePanel.this.interCaseRadio.isSelected()) {
|
||||||
|
|
||||||
if (caseId == InterCasePanel.NO_CASE_SELECTED) {
|
if (caseId == InterCasePanel.NO_CASE_SELECTED) {
|
||||||
builder = new AllInterCaseCommonAttributeSearcher(filterByMedia, filterByDocuments);
|
builder = new AllInterCaseCommonAttributeSearcher(intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments);
|
||||||
} else {
|
} else {
|
||||||
builder = new SingleInterCaseCommonAttributeSearcher(caseId, filterByMedia, filterByDocuments);
|
builder = new SingleInterCaseCommonAttributeSearcher(caseId, intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments);
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) {
|
if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) {
|
||||||
|
@ -46,8 +46,8 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS
|
|||||||
*
|
*
|
||||||
* @throws EamDbException
|
* @throws EamDbException
|
||||||
*/
|
*/
|
||||||
InterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
InterCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
||||||
super(filterByMediaMimeType, filterByDocMimeType);
|
super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
|
||||||
dbManager = EamDb.getInstance();
|
dbManager = EamDb.getInstance();
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -77,14 +77,14 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS
|
|||||||
//Add to intercase metaData
|
//Add to intercase metaData
|
||||||
final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5);
|
final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5);
|
||||||
|
|
||||||
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId);
|
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap());
|
||||||
commonAttributeValue.addInstance(searchResult);
|
commonAttributeValue.addInstance(searchResult);
|
||||||
|
|
||||||
} else {
|
} else {
|
||||||
CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5);
|
CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5);
|
||||||
interCaseCommonFiles.put(md5, commonAttributeValue);
|
interCaseCommonFiles.put(md5, commonAttributeValue);
|
||||||
|
|
||||||
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId);
|
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap());
|
||||||
commonAttributeValue.addInstance(searchResult);
|
commonAttributeValue.addInstance(searchResult);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -44,7 +44,6 @@ import org.sleuthkit.datamodel.TskCoreException;
|
|||||||
@SuppressWarnings("PMD.AbstractNaming")
|
@SuppressWarnings("PMD.AbstractNaming")
|
||||||
public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher {
|
public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher {
|
||||||
|
|
||||||
private final Map<Long, String> dataSourceIdToNameMap;
|
|
||||||
private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on
|
private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -57,8 +56,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
|
|||||||
* broadly categorized as document types
|
* broadly categorized as document types
|
||||||
*/
|
*/
|
||||||
IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) {
|
IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) {
|
||||||
super(filterByMediaMimeType, filterByDocMimeType);
|
super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
|
||||||
dataSourceIdToNameMap = dataSourceIdMap;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -113,7 +111,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
|
|||||||
Long objectId = resultSet.getLong(1);
|
Long objectId = resultSet.getLong(1);
|
||||||
String md5 = resultSet.getString(2);
|
String md5 = resultSet.getString(2);
|
||||||
Long dataSourceId = resultSet.getLong(3);
|
Long dataSourceId = resultSet.getLong(3);
|
||||||
String dataSource = this.dataSourceIdToNameMap.get(dataSourceId);
|
String dataSource = this.getDataSourceIdToNameMap().get(dataSourceId);
|
||||||
|
|
||||||
if (md5 == null || HashUtility.isNoDataMd5(md5)) {
|
if (md5 == null || HashUtility.isNoDataMd5(md5)) {
|
||||||
continue;
|
continue;
|
||||||
|
@ -44,8 +44,8 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
|
|||||||
* @param filterByDocMimeType
|
* @param filterByDocMimeType
|
||||||
* @throws EamDbException
|
* @throws EamDbException
|
||||||
*/
|
*/
|
||||||
public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
|
||||||
super(filterByMediaMimeType, filterByDocMimeType);
|
super(dataSourceIdMap,filterByMediaMimeType, filterByDocMimeType);
|
||||||
|
|
||||||
this.corrleationCaseId = correlationCaseId;
|
this.corrleationCaseId = correlationCaseId;
|
||||||
this.correlationCaseName = "";
|
this.correlationCaseName = "";
|
||||||
|
Loading…
x
Reference in New Issue
Block a user