mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 02:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '3202-TagsMessagingOnStatusChange' of https://github.com/wschaeferB/autopsy into 3203-TagsContextMenuChanges

Browse Source
This commit is contained in:
William Schaefer 2017-11-22 17:07:33 -05:00
commit ba2f3640f2
3 changed files with 81 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
Core/src/org/sleuthkit/autopsy/casemodule/Case.java
View File

@ -364,10 +364,11 @@ public class Case {
*/ */
CASE_DETAILS, CASE_DETAILS,
/** /**
* The status which a Tag indicates has been changed and the new value * A tag definition has changed (e.g., description, known status). The
* of the TagNameDefinition is included. * old value of the PropertyChangeEvent is the display name of the tag
* definition that has changed.
*/ */
TAG_STATUS_CHANGED; TAG_DEFINITION_CHANGED;
}; };
@ -1478,9 +1479,18 @@ public class Case {
eventPublisher.publish(new ContentTagDeletedEvent(deletedTag)); eventPublisher.publish(new ContentTagDeletedEvent(deletedTag));
} }
public void notifyTagStatusChanged(String changedTagName) { /**
eventPublisher.publish(new AutopsyEvent(Events.TAG_STATUS_CHANGED.toString(), changedTagName, changedTagName)); * Notifies case event subscribers that a tag definition has changed.
*
* This should not be called from the event dispatch thread (EDT)
*
* @param changedTagName the name of the tag definition which was changed
*/
public void notifyTagDefinitionChanged(String changedTagName) {
//leaving new value of changedTagName as null, because we do not currently support changing the display name of a tag.
eventPublisher.publish(new AutopsyEvent(Events.TAG_DEFINITION_CHANGED.toString(), changedTagName, null));
} }
/** /**
* Notifies case event subscribers that an artifact tag has been added. * Notifies case event subscribers that an artifact tag has been added.
* *

5
Core/src/org/sleuthkit/autopsy/casemodule/services/TagOptionsPanel.java
View File

@ -423,7 +423,10 @@ final class TagOptionsPanel extends javax.swing.JPanel implements OptionsPanel {
private void sendStatusChangedEvents() { private void sendStatusChangedEvents() {
for (String modifiedTagDisplayName : updatedStatusTags) { for (String modifiedTagDisplayName : updatedStatusTags) {
Case.getCurrentCase().notifyTagStatusChanged(modifiedTagDisplayName); //if user closes their case after options have been changed but before application of them is complete don't notify
if (Case.isCaseOpen()) {
Case.getCurrentCase().notifyTagDefinitionChanged(modifiedTagDisplayName);
}
} }
updatedStatusTags.clear(); updatedStatusTags.clear();
} }

104
Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java
View File

@ -98,8 +98,8 @@ final class CaseEventListener implements PropertyChangeListener {
jobProcessingExecutor.submit(new DataSourceAddedTask(dbManager, evt)); jobProcessingExecutor.submit(new DataSourceAddedTask(dbManager, evt));
} }
break; break;
case TAG_STATUS_CHANGED: { case TAG_DEFINITION_CHANGED: {
jobProcessingExecutor.submit(new TagStatusChangeTask(evt)); jobProcessingExecutor.submit(new TagDefinitionChangeTask(evt));
} }
break; break;
case CURRENT_CASE: { case CURRENT_CASE: {
@ -298,11 +298,11 @@ final class CaseEventListener implements PropertyChangeListener {
} }
private final class TagStatusChangeTask implements Runnable { private final class TagDefinitionChangeTask implements Runnable {
private final PropertyChangeEvent event; private final PropertyChangeEvent event;
private TagStatusChangeTask(PropertyChangeEvent evt) { private TagDefinitionChangeTask(PropertyChangeEvent evt) {
event = evt; event = evt;
} }
@ -311,73 +311,93 @@ final class CaseEventListener implements PropertyChangeListener {
if (!EamDb.isEnabled()) { if (!EamDb.isEnabled()) {
return; return;
} }
String modifiedTagName = (String) event.getNewValue(); //get the display name of the tag that has had it's definition modified
List<String> notableTags = TagsManager.getNotableTagDisplayNames(); String modifiedTagName = (String) event.getOldValue();
TskData.FileKnown status = notableTags.contains(modifiedTagName) ? TskData.FileKnown.BAD : TskData.FileKnown.UNKNOWN;
/** /*
* Set knownBad status for all files/artifacts in the given case * Set knownBad status for all files/artifacts in the given case
* that are tagged with the given tag name. * that are tagged with the given tag name.
*/ */
try { try {
TagName tagName = Case.getCurrentCase().getServices().getTagsManager().getDisplayNamesToTagNamesMap().get(modifiedTagName); TagName tagName = Case.getCurrentCase().getServices().getTagsManager().getDisplayNamesToTagNamesMap().get(modifiedTagName);
// First find any matching artifacts //First update the artifacts
//Get all BlackboardArtifactTags with this tag name
List<BlackboardArtifactTag> artifactTags = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifactTagsByTagName(tagName); List<BlackboardArtifactTag> artifactTags = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifactTagsByTagName(tagName);
for (BlackboardArtifactTag bbTag : artifactTags) { for (BlackboardArtifactTag bbTag : artifactTags) {
List<CorrelationAttribute> convertedArtifacts = EamArtifactUtil.getCorrelationAttributeFromBlackboardArtifact(bbTag.getArtifact(), true, true); //start with assumption that none of the other tags applied to this Correlation Attribute will prevent it's status from being changed
for (CorrelationAttribute eamArtifact : convertedArtifacts) { boolean hasTagWithConflictingKnownStatus = false;
boolean hasOtherBadTags = false; // if the status of the tag has been changed to TskData.FileKnown.UNKNOWN
//if the new status of the tag is unknown UNKNOWN ensure we are not changing the status of BlackboardArtifact which still have other tags with a non-unknown status // we need to check the status of all other tags on this correlation attribute before changing
if (status == TskData.FileKnown.UNKNOWN) { // the status of the correlation attribute in the central repository
Content content = bbTag.getContent(); if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) { Content content = bbTag.getContent();
// If the content which this Blackboard Artifact Tag is linked to is an AbstractFile with KNOWN status then
// it's status in the central reporsitory should not be changed to UNKNOWN
if ((content instanceof AbstractFile) && (((AbstractFile) content).getKnown() == TskData.FileKnown.KNOWN)) {
continue;
}
//Get the BlackboardArtifact which this BlackboardArtifactTag has been applied to.
BlackboardArtifact bbArtifact = bbTag.getArtifact();
TagsManager tagsManager = Case.getCurrentCase().getServices().getTagsManager();
List<BlackboardArtifactTag> tags = tagsManager.getBlackboardArtifactTagsByArtifact(bbArtifact);
//get all tags which are on this blackboard artifact
for (BlackboardArtifactTag t : tags) {
//All instances of the modified tag name will be changed, they can not conflict with each other
if (t.getName().equals(tagName)) {
continue;
}
//if any other tags on this artifact are Notable in status then this artifact can not have its status changed
if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
//a tag with a conflicting status has been found, the status of this correlation attribute can not be modified
hasTagWithConflictingKnownStatus = true;
break; break;
} }
BlackboardArtifact bbArtifact = bbTag.getArtifact();
TagsManager tagsManager = Case.getCurrentCase().getServices().getTagsManager();
List<BlackboardArtifactTag> tags = tagsManager.getBlackboardArtifactTagsByArtifact(bbArtifact);
for (BlackboardArtifactTag t : tags) {
//avoid the possibility for threading issues if the tag whose status is currently changing is ever still in the tags manager with the old status
if (t.getName().equals(tagName)) {
continue;
}
//if any other tags on this artifact are Notable in status then this artifact can not have its status changed
if (notableTags.contains(t.getName().getDisplayName())) {
hasOtherBadTags = true;
break;
}
}
} }
if (!hasOtherBadTags) { }
EamDb.getInstance().setArtifactInstanceKnownStatus(eamArtifact, status); //if the Correlation Attribute will have no tags with a status which would prevent the current status from being changed
if (!hasTagWithConflictingKnownStatus) {
//Get the correlation atttributes that correspond to the current BlackboardArtifactTag if their status should be changed
//with the initial set of correlation attributes this should be a single correlation attribute
List<CorrelationAttribute> convertedArtifacts = EamArtifactUtil.getCorrelationAttributeFromBlackboardArtifact(bbTag.getArtifact(), true, true);
for (CorrelationAttribute eamArtifact : convertedArtifacts) {
EamDb.getInstance().setArtifactInstanceKnownStatus(eamArtifact, tagName.getKnownStatus());
} }
} }
} }
// Now search for files // Next update the files
List<ContentTag> fileTags = Case.getCurrentCase().getSleuthkitCase().getContentTagsByTagName(tagName); List<ContentTag> fileTags = Case.getCurrentCase().getSleuthkitCase().getContentTagsByTagName(tagName);
//Get all ContentTags with this tag name
for (ContentTag contentTag : fileTags) { for (ContentTag contentTag : fileTags) {
boolean hasOtherBadTags = false; //start with assumption that none of the other tags applied to this ContentTag will prevent it's status from being changed
//if the new status of the tag is unknown UNKNOWN ensure we are not changing the status of files which still have other tags with a Notable status boolean hasTagWithConflictingKnownStatus = false;
if (status == TskData.FileKnown.UNKNOWN) { // if the status of the tag has been changed to TskData.FileKnown.UNKNOWN
// we need to check the status of all other tags on this file before changing
// the status of the file in the central repository
if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) {
Content content = contentTag.getContent(); Content content = contentTag.getContent();
TagsManager tagsManager = Case.getCurrentCase().getServices().getTagsManager(); TagsManager tagsManager = Case.getCurrentCase().getServices().getTagsManager();
List<ContentTag> tags = tagsManager.getContentTagsByContent(content); List<ContentTag> tags = tagsManager.getContentTagsByContent(content);
//get all tags which are on this file
for (ContentTag t : tags) { for (ContentTag t : tags) {
//avoid the possibility for threading issues if the tag whose status is currently changing is ever still in the tags manager with the old status //All instances of the modified tag name will be changed, they can not conflict with each other
if (t.getName().equals(tagName)) { if (t.getName().equals(tagName)) {
continue; continue;
} }
//if any other tags on this file are Notable in status then this file can not have its status changed //if any other tags on this file are Notable in status then this file can not have its status changed
if (notableTags.contains(t.getName().getDisplayName())) { if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) {
hasOtherBadTags = true; //a tag with a conflicting status has been found, the status of this file can not be modified
hasTagWithConflictingKnownStatus = true;
break; break;
} }
} }
} }
if (!hasOtherBadTags) { //if the file will have no tags with a status which would prevent the current status from being changed
if (!hasTagWithConflictingKnownStatus) {
final CorrelationAttribute eamArtifact = EamArtifactUtil.getEamArtifactFromContent(contentTag.getContent(), final CorrelationAttribute eamArtifact = EamArtifactUtil.getEamArtifactFromContent(contentTag.getContent(),
status, ""); tagName.getKnownStatus(), "");
if (eamArtifact != null) { if (eamArtifact != null) {
EamDb.getInstance().setArtifactInstanceKnownStatus(eamArtifact, status); EamDb.getInstance().setArtifactInstanceKnownStatus(eamArtifact, tagName.getKnownStatus());
} }
} }
} }