mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 16:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Cleanup KeywordHit.java

Browse Source
This commit is contained in:
millmanorama 2017-09-08 16:25:00 +02:00
parent 81e22212e8
commit aadb79331f
1 changed files with 36 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordHit.java
View File

@ -31,10 +31,13 @@ import org.sleuthkit.datamodel.TskCoreException;
* Represents the fact that a file or an artifact associated with a file had a
* keyword hit. All instances make both the document id of the Solr document
* where the keyword was found and the object Id of the file available to
* clients. Artifact keyword hits also make the artifact available to clients.
* clients. Keyword hits on the indexed text of an artifact also make the
* artifact available to clients.
*/
class KeywordHit implements Comparable<KeywordHit> {
private static final String GET_CONTENT_ID_FROM_ARTIFACT_ID = "SELECT obj_id FROM blackboard_artifacts WHERE artifact_id = ";
private final String solrDocumentId;
private final long solrObjectId;
private final int chunkId;
@ -43,41 +46,52 @@ class KeywordHit implements Comparable<KeywordHit> {
private final boolean hitOnArtifact;
private final String hit;
public String getHit() {
return hit;
}
/**
* Constructor
*
* @param solrDocumentId The ID of the document this hit is in.
* @param snippet A small amount of text from the document containing
* the hit.
* @param hit The exact text from the document that was the hit.
* For some searches (ie substring,regex) this will be
* different than the search term.
*
* @throws TskCoreException If there is a problem getting the underlying
* content associated with a hit on the text of an
* artifact..
*/
KeywordHit(String solrDocumentId, String snippet, String hit) throws TskCoreException {
this.snippet = StringUtils.stripToEmpty(snippet);
this.hit = hit;
this.solrDocumentId = solrDocumentId;
/**
/*
* Parse the Solr document id to get the Solr object id and chunk id.
* The Solr object id will either be a file id or an artifact id from
* the case database.
* The Solr object id will either be the object id of a file id or an
* artifact id from the case database.
*
* For every object (file or artifact) there will at least two Solr
* documents. One contains object metadata (chunk #1) and the second and
* subsequent documents contain chunks of the text.
*/
final int separatorIndex = solrDocumentId.indexOf(Server.CHUNK_ID_SEPARATOR);
if (-1 != separatorIndex) {
this.solrObjectId = Long.parseLong(solrDocumentId.substring(0, separatorIndex));
this.chunkId = Integer.parseInt(solrDocumentId.substring(separatorIndex + 1));
} else {
String[] split = solrDocumentId.split(Server.CHUNK_ID_SEPARATOR);
if (split.length == 1) {
//chunk 0 has only the bare document id without the chunk id.
this.solrObjectId = Long.parseLong(solrDocumentId);
this.chunkId = 0;
} else {
this.solrObjectId = Long.parseLong(split[0]);
this.chunkId = Integer.parseInt(split[1]);
}
//artifacts have negative obj ids
hitOnArtifact = this.solrObjectId < 0;
/*
* If the high order bit of the object id is set (ie, it is negative),
* the hit was in an artifact, look up the artifact.
*/
if (hitOnArtifact) {
// If the hit was in an artifact, look up the artifact.
SleuthkitCase caseDb = Case.getCurrentCase().getSleuthkitCase();
try (SleuthkitCase.CaseDbQuery executeQuery = caseDb.executeQuery("select obj_id from blackboard_artifacts where artifact_id = " + this.solrObjectId);
try (SleuthkitCase.CaseDbQuery executeQuery =
caseDb.executeQuery(GET_CONTENT_ID_FROM_ARTIFACT_ID + this.solrObjectId);
ResultSet resultSet = executeQuery.getResultSet();) {
if (resultSet.next()) {
contentID = resultSet.getLong("obj_id");
@ -93,6 +107,10 @@ class KeywordHit implements Comparable<KeywordHit> {
}
}
String getHit() {
return hit;
}
String getSolrDocumentId() {
return this.solrDocumentId;
}