mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-13 16:36:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Polish and minor refactors

Browse Source
This commit is contained in:
Andrew Ziehl 2018-05-21 12:43:40 -07:00
parent 1a0b0a4a86
commit ada7ec2bc0
2 changed files with 39 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java
View File

@ -677,7 +677,7 @@ public abstract class AbstractSqlEamDb implements EamDb {
ResultSet resultSet = null; ResultSet resultSet = null;
String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType); String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType);
StringBuilder sql = new StringBuilder(9); StringBuilder sql = new StringBuilder(10);
sql.append("SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, value FROM "); sql.append("SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, value FROM ");
sql.append(tableName); sql.append(tableName);
sql.append(" LEFT JOIN cases ON "); sql.append(" LEFT JOIN cases ON ");

73
Core/src/org/sleuthkit/autopsy/commonfilesearch/AllDataSourcesEamDbCommonFilesAlgorithm.java
View File

@ -20,7 +20,7 @@
package org.sleuthkit.autopsy.commonfilesearch; package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.Arrays; import java.util.ArrayList;
import java.util.Collection; import java.util.Collection;
import java.util.HashMap; import java.util.HashMap;
import java.util.List; import java.util.List;
@ -45,7 +45,7 @@ public class AllDataSourcesEamDbCommonFilesAlgorithm extends CommonFilesMetadat
private static final String WHERE_CLAUSE = "%s md5 in (select md5 from tsk_files where (known != 1 OR known IS NULL)%s GROUP BY md5) order by md5"; //NON-NLS private static final String WHERE_CLAUSE = "%s md5 in (select md5 from tsk_files where (known != 1 OR known IS NULL)%s GROUP BY md5) order by md5"; //NON-NLS
private EamDb dbManager; private final EamDb dbManager;
/** /**
* Implements the algorithm for getting common files across all data * Implements the algorithm for getting common files across all data
@ -61,11 +61,11 @@ public class AllDataSourcesEamDbCommonFilesAlgorithm extends CommonFilesMetadat
dbManager = EamDb.getInstance(); dbManager = EamDb.getInstance();
} }
public CommonFilesMetadata findEamDbCommonFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { CommonFilesMetadata findEamDbCommonFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
return this.findEamDbCommonFiles(null); return this.findEamDbCommonFiles(null);
} }
public CommonFilesMetadata findEamDbCommonFiles(int correlationCaseId) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException, Exception { CommonFilesMetadata findEamDbCommonFiles(int correlationCaseId) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException, Exception {
CorrelationCase cCase = this.getCorrelationCaseFromId(correlationCaseId); CorrelationCase cCase = this.getCorrelationCaseFromId(correlationCaseId);
@ -73,15 +73,14 @@ public class AllDataSourcesEamDbCommonFilesAlgorithm extends CommonFilesMetadat
} }
/** /**
* TODO Refactor, abstract shared code above, call this method via new AllDataSourcesEamDbCommonFilesAlgorithm Class
* @param correlationCase Optionally null, otherwise a case, or could be a CR case ID * @param correlationCase Optionally null, otherwise a case, or could be a CR case ID
* @return * @return CommonFilesMetaData md5s to build Common Files search results.
* @throws TskCoreException * @throws TskCoreException
* @throws NoCurrentCaseException * @throws NoCurrentCaseException
* @throws SQLException * @throws SQLException
* @throws EamDbException * @throws EamDbException
*/ */
public CommonFilesMetadata findEamDbCommonFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { private CommonFilesMetadata findEamDbCommonFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
CommonFilesMetadata metaData = this.findCommonFiles(); CommonFilesMetadata metaData = this.findCommonFiles();
Map<String, Md5Metadata> commonFiles = metaData.getMetadata(); Map<String, Md5Metadata> commonFiles = metaData.getMetadata();
Collection<String> values = commonFiles.keySet(); Collection<String> values = commonFiles.keySet();
@ -91,35 +90,7 @@ public class AllDataSourcesEamDbCommonFilesAlgorithm extends CommonFilesMetadat
Collection<CorrelationAttributeCommonInstance> artifactInstances = dbManager.getArtifactInstancesByCaseValues(correlationCase, values).stream() Collection<CorrelationAttributeCommonInstance> artifactInstances = dbManager.getArtifactInstancesByCaseValues(correlationCase, values).stream()
.collect(Collectors.toList()); .collect(Collectors.toList());
gatherIntercaseResults(artifactInstances, commonFiles, interCaseCommonFiles);
for (CorrelationAttributeCommonInstance instance : artifactInstances) {
String md5 = instance.getValue();
String dataSource = String.format("%s: %s", instance.getCorrelationCase().getDisplayName(), instance.getCorrelationDataSource().getName());
if (md5 == null || HashUtility.isNoDataMd5(md5)) {
continue;
}
//Builds a 3rd list which contains instances which are in commonFiles map, uses current case objectId
if (commonFiles.containsKey(md5)) {
// TODO sloppy, but we don't *have* all the information for the rows in the CR, so what do we do?
Long objectId = commonFiles.get(md5).getMetadata().iterator().next().getObjectId();
if(interCaseCommonFiles.containsKey(md5)) {
//Add to intercase metaData
final Md5Metadata md5Metadata = interCaseCommonFiles.get(md5);
md5Metadata.addFileInstanceMetadata(new FileInstanceMetadata(objectId, dataSource));
} else {
// Create new intercase metadata
final Md5Metadata md5Metadata = commonFiles.get(md5);
md5Metadata.addFileInstanceMetadata(new FileInstanceMetadata(objectId, dataSource));
interCaseCommonFiles.put(md5, md5Metadata);
}
} else {
// TODO This should never happen. All current case files with potential matches are in comonFiles Map.
}
}
} catch (EamDbException ex) { } catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error getting artifact instances from database.", ex); // NON-NLS LOGGER.log(Level.SEVERE, "Error getting artifact instances from database.", ex); // NON-NLS
@ -129,6 +100,36 @@ public class AllDataSourcesEamDbCommonFilesAlgorithm extends CommonFilesMetadat
} }
private void gatherIntercaseResults(Collection<CorrelationAttributeCommonInstance> artifactInstances, Map<String, Md5Metadata> commonFiles, Map<String, Md5Metadata> interCaseCommonFiles) {
for (CorrelationAttributeCommonInstance instance : artifactInstances) {
String md5 = instance.getValue();
String dataSource = String.format("%s: %s", instance.getCorrelationCase().getDisplayName(), instance.getCorrelationDataSource().getName());
if (md5 == null || HashUtility.isNoDataMd5(md5)) {
continue;
}
//Builds a 3rd list which contains instances which are in commonFiles map, uses current case objectId
if (commonFiles.containsKey(md5)) {
// TODO sloppy, but we don't *have* all the information for the rows in the CR, so what do we do?
Long objectId = commonFiles.get(md5).getMetadata().iterator().next().getObjectId();
if(interCaseCommonFiles.containsKey(md5)) {
//Add to intercase metaData
final Md5Metadata md5Metadata = interCaseCommonFiles.get(md5);
md5Metadata.addFileInstanceMetadata(new FileInstanceMetadata(objectId, dataSource));
} else {
final List<FileInstanceMetadata> fileInstances = new ArrayList<>();
fileInstances.add(new FileInstanceMetadata(objectId, dataSource));
Md5Metadata md5Metadata = new Md5Metadata(md5, fileInstances);
interCaseCommonFiles.put(md5, md5Metadata);
}
} else {
// TODO This should never happen. All current case files with potential matches are in comonFiles Map.
}
}
}
@Override @Override
protected String buildSqlSelectStatement() { protected String buildSqlSelectStatement() {
Object[] args = new String[]{SELECT_PREFIX, determineMimeTypeFilter()}; Object[] args = new String[]{SELECT_PREFIX, determineMimeTypeFilter()};