cleared up bugs illuminated by removing the file cache for the inter case leaf notes

This commit is contained in:
Brian Sweeney 2018-07-26 17:16:11 -06:00
parent 178b48ecb7
commit 94f0dfbee1
8 changed files with 65 additions and 60 deletions

View File

@ -153,26 +153,8 @@ public abstract class AbstractCommonAttributeInstance {
if (abstractFile == null) { if (abstractFile == null) {
leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance); leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance);
} else { } else {
final String attributeDataSourceName = attributeInstance.getCorrelationDataSource().getName();
final String abstractFileDataSourceName = abstractFile.getDataSource().getName(); final String abstractFileDataSourceName = abstractFile.getDataSource().getName();
leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName);
final String attributeInstanceCaseName = attributeInstance.getCorrelationCase().getDisplayName();
final String attributeInstanceFullPath = attributeInstance.getFilePath().replace("\\", "/");
final String currentAbstractFileParentPath = abstractFile.getParentPath();
final String currentAbstractFileName = abstractFile.getName();
final String abstractFileFullPath = (currentAbstractFileParentPath + currentAbstractFileName).replace("\\", "/");
final boolean sameCase = attributeInstanceCaseName.equalsIgnoreCase(currentCaseName);
final boolean sameFileName = attributeInstanceFullPath.equalsIgnoreCase(abstractFileFullPath);
final boolean sameDataSource = attributeDataSourceName.equalsIgnoreCase(abstractFileDataSourceName);
if (sameCase && sameFileName && sameDataSource) {
leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName);
} else {
leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance);
}
} }
return leafNode; return leafNode;

View File

@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collections;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
@ -38,12 +39,18 @@ import org.sleuthkit.datamodel.TskCoreException;
*/ */
public abstract class AbstractCommonAttributeSearcher { public abstract class AbstractCommonAttributeSearcher {
private final Map<Long, String> dataSourceIdToNameMap;
private boolean filterByMedia; private boolean filterByMedia;
private boolean filterByDoc; private boolean filterByDoc;
AbstractCommonAttributeSearcher(boolean filterByMedia, boolean filterByDoc){ AbstractCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMedia, boolean filterByDoc){
this.filterByDoc = filterByDoc; this.filterByDoc = filterByDoc;
this.filterByMedia = filterByMedia; this.filterByMedia = filterByMedia;
this.dataSourceIdToNameMap = dataSourceIdMap;
}
Map<Long, String> getDataSourceIdToNameMap(){
return Collections.unmodifiableMap(this.dataSourceIdToNameMap);
} }
/** /**

View File

@ -41,8 +41,8 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut
* broadly categorized as document types * broadly categorized as document types
* @throws EamDbException * @throws EamDbException
*/ */
public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { public AllInterCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType); super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
} }
@Override @Override

View File

@ -21,11 +21,14 @@ package org.sleuthkit.autopsy.commonfilesearch;
import java.io.File; import java.io.File;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.HashMap;
import java.util.List; import java.util.List;
import java.util.Map;
import java.util.logging.Level; import java.util.logging.Level;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
@ -42,10 +45,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName()); private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName());
private final Integer crFileId; private final Integer crFileId;
private CorrelationAttribute currentAttribute; private CorrelationAttribute currentAttribute;
private Map<String, Long> dataSourceNameToIdMap;
CentralRepoCommonAttributeInstance(Integer attrInstId) { CentralRepoCommonAttributeInstance(Integer attrInstId, Map<Long, String> dataSourceIdToNameMap) {
super(); super();
this.crFileId = attrInstId; this.crFileId = attrInstId;
this.dataSourceNameToIdMap = invertMap(dataSourceIdToNameMap);
} }
void setCurrentAttributeInst(CorrelationAttribute attribute) { void setCurrentAttributeInst(CorrelationAttribute attribute) {
@ -57,37 +62,42 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
Case currentCase; Case currentCase;
if (this.currentAttribute != null) { if (this.currentAttribute != null) {
String currentFullPath = this.currentAttribute.getInstances().get(0).getFilePath();
try {
currentCase = Case.getCurrentCaseThrows();
SleuthkitCase tskDb = currentCase.getSleuthkitCase(); final CorrelationAttributeInstance currentAttributeInstance = this.currentAttribute.getInstances().get(0);
String currentFullPath = currentAttributeInstance.getFilePath();
String currentDataSource = currentAttributeInstance.getCorrelationDataSource().getName();
if(this.dataSourceNameToIdMap.containsKey(currentDataSource)){
Long dataSourceObjectId = this.dataSourceNameToIdMap.get(currentDataSource);
try {
currentCase = Case.getCurrentCaseThrows();
SleuthkitCase tskDb = currentCase.getSleuthkitCase();
File fileFromPath = new File(currentFullPath);
String fileName = fileFromPath.getName();
String parentPath = (fileFromPath.getParent() + File.separator).replace("\\", "/");
final String whereClause = String.format("lower(name) = '%s' AND md5 = '%s' AND lower(parent_path) = '%s' AND data_source_obj_id = %s", fileName, currentAttribute.getCorrelationValue(), parentPath, dataSourceObjectId);
List<AbstractFile> potentialAbstractFiles = tskDb.findAllFilesWhere(whereClause);
File fileFromPath = new File(currentFullPath);
String fileName = fileFromPath.getName();
String parentPath = fileFromPath.getParent() + File.separator;
List<AbstractFile> potentialAbstractFiles = tskDb.findAllFilesWhere(String.format("lower(name) = '%s' AND md5 = '%s'", fileName, currentAttribute.getCorrelationValue()));
AbstractFile finalAbstractFile = null;
for (AbstractFile aFile : potentialAbstractFiles) {
// If a direct match exists, return that and we'll create a CaseDb instance node from it
if (aFile.getParentPath().equalsIgnoreCase(parentPath)) {
finalAbstractFile = aFile;
break;
}
}
// If not direct match exists, return first md5 match, only used as a backing file for CR instance node.
if (finalAbstractFile == null) {
if(potentialAbstractFiles.isEmpty()){ if(potentialAbstractFiles.isEmpty()){
return null; return null;
} else if(potentialAbstractFiles.size() > 1){
LOGGER.log(Level.WARNING, String.format("Unable to find an exact match for AbstractFile for record with filePath: %s. May have returned the wrong file.", new Object[]{currentFullPath}));
return potentialAbstractFiles.get(0);
} else { } else {
finalAbstractFile = potentialAbstractFiles.get(0); return potentialAbstractFiles.get(0);
} }
} catch (TskCoreException | NoCurrentCaseException ex) {
LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex);
return null;
} }
} else {
return finalAbstractFile;
} catch (TskCoreException | NoCurrentCaseException ex) {
LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex);
return null; return null;
} }
} }
@ -116,4 +126,12 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr
return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]); return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]);
} }
private Map<String, Long> invertMap(Map<Long, String> dataSourceIdToNameMap) {
HashMap<String, Long> invertedMap = new HashMap<>();
for (Map.Entry<Long, String> entry : dataSourceIdToNameMap.entrySet()){
invertedMap.put(entry.getValue(), entry.getKey());
}
return invertedMap;
}
} }

View File

@ -157,9 +157,9 @@ public final class CommonAttributePanel extends javax.swing.JDialog {
if (CommonAttributePanel.this.interCaseRadio.isSelected()) { if (CommonAttributePanel.this.interCaseRadio.isSelected()) {
if (caseId == InterCasePanel.NO_CASE_SELECTED) { if (caseId == InterCasePanel.NO_CASE_SELECTED) {
builder = new AllInterCaseCommonAttributeSearcher(filterByMedia, filterByDocuments); builder = new AllInterCaseCommonAttributeSearcher(intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments);
} else { } else {
builder = new SingleInterCaseCommonAttributeSearcher(caseId, filterByMedia, filterByDocuments); builder = new SingleInterCaseCommonAttributeSearcher(caseId, intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments);
} }
} else { } else {
if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) { if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) {

View File

@ -46,8 +46,8 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS
* *
* @throws EamDbException * @throws EamDbException
*/ */
InterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { InterCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType); super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
dbManager = EamDb.getInstance(); dbManager = EamDb.getInstance();
} }
@ -77,14 +77,14 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS
//Add to intercase metaData //Add to intercase metaData
final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5);
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId); AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap());
commonAttributeValue.addInstance(searchResult); commonAttributeValue.addInstance(searchResult);
} else { } else {
CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5);
interCaseCommonFiles.put(md5, commonAttributeValue); interCaseCommonFiles.put(md5, commonAttributeValue);
AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId); AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap());
commonAttributeValue.addInstance(searchResult); commonAttributeValue.addInstance(searchResult);
} }
} }

View File

@ -44,7 +44,6 @@ import org.sleuthkit.datamodel.TskCoreException;
@SuppressWarnings("PMD.AbstractNaming") @SuppressWarnings("PMD.AbstractNaming")
public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher { public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher {
private final Map<Long, String> dataSourceIdToNameMap;
private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on
/** /**
@ -57,8 +56,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
* broadly categorized as document types * broadly categorized as document types
*/ */
IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) { IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) {
super(filterByMediaMimeType, filterByDocMimeType); super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType);
dataSourceIdToNameMap = dataSourceIdMap;
} }
/** /**
@ -113,7 +111,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
Long objectId = resultSet.getLong(1); Long objectId = resultSet.getLong(1);
String md5 = resultSet.getString(2); String md5 = resultSet.getString(2);
Long dataSourceId = resultSet.getLong(3); Long dataSourceId = resultSet.getLong(3);
String dataSource = this.dataSourceIdToNameMap.get(dataSourceId); String dataSource = this.getDataSourceIdToNameMap().get(dataSourceId);
if (md5 == null || HashUtility.isNoDataMd5(md5)) { if (md5 == null || HashUtility.isNoDataMd5(md5)) {
continue; continue;

View File

@ -44,8 +44,8 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
* @param filterByDocMimeType * @param filterByDocMimeType
* @throws EamDbException * @throws EamDbException
*/ */
public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType); super(dataSourceIdMap,filterByMediaMimeType, filterByDocMimeType);
this.corrleationCaseId = correlationCaseId; this.corrleationCaseId = correlationCaseId;
this.correlationCaseName = ""; this.correlationCaseName = "";