From 5802fb0faa775bace54ac4b25eca80f9800b7eda Mon Sep 17 00:00:00 2001 From: apriestman Date: Tue, 2 Mar 2021 09:38:35 -0500 Subject: [PATCH 01/10] Only hold controllersByCaseLock when using controllersByCase. Prevent NPE in DrawableFile. --- .../imagegallery/ImageGalleryController.java | 7 +++++-- .../imagegallery/datamodel/DrawableFile.java | 17 +++++++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java index 2f13a48fd2..d2c9ac5b36 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java @@ -192,12 +192,15 @@ public final class ImageGalleryController { * @param theCase The case. */ static void shutDownController(Case theCase) { + ImageGalleryController controller = null; synchronized (controllersByCaseLock) { if (controllersByCase.containsKey(theCase.getName())) { - ImageGalleryController controller = controllersByCase.remove(theCase.getName()); - controller.shutDown(); + controller = controllersByCase.remove(theCase.getName()); } } + if (controller != null) { + controller.shutDown(); + } } /** diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java index 112c7ab6ec..534bdfc8c8 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java @@ -105,8 +105,15 @@ public abstract class DrawableFile { protected DrawableFile(AbstractFile file, Boolean analyzed) { this.analyzed = new SimpleBooleanProperty(analyzed); this.file = file; - - categoryManager = ImageGalleryController.getController(Case.getCurrentCase()).getCategoryManager(); + + ImageGalleryController controllerForCase = ImageGalleryController.getController(Case.getCurrentCase()); + if (controllerForCase != null) { + categoryManager = ImageGalleryController.getController(Case.getCurrentCase()).getCategoryManager(); + } else { + // If getting the controller fails it means the case is currently closing. No need to + // print an error. + categoryManager = null; + } } public abstract boolean isVideo(); @@ -246,6 +253,12 @@ public abstract class DrawableFile { * Update the category property. */ private void updateCategory() { + // This only happens when a DrawableFile is created while the case is closing. No need + // to display the error message. + if (categoryManager == null) { + return; + } + try { List contentTags = getContentTags(); TagName tag = null; From 79fe98e2c30379b46afaf8aae69e832a8c388772 Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Wed, 10 Mar 2021 10:30:03 -0500 Subject: [PATCH 02/10] Align with artifact catalog align artifacts with artifact catalog. --- .../aleap-artifact-attribute-reference.xml | 26 +++++++-------- .../ileap-artifact-attribute-reference.xml | 33 ++++++++----------- 2 files changed, 26 insertions(+), 33 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml index d5d0af5d55..fcac67a398 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml @@ -66,8 +66,8 @@ - - + + @@ -90,7 +90,7 @@ - + @@ -120,7 +120,7 @@ - + @@ -163,13 +163,13 @@ - - + + - + @@ -209,7 +209,7 @@ - + @@ -225,7 +225,7 @@ - + @@ -236,13 +236,13 @@ - - + + - + @@ -282,7 +282,7 @@ - + diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml index 5799161685..adb42c4ac8 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml @@ -72,7 +72,7 @@ - + @@ -237,8 +237,8 @@ - - + + @@ -252,16 +252,16 @@ - - - + + + - + @@ -314,9 +314,9 @@ - - - + + + @@ -357,7 +357,7 @@ - + @@ -377,7 +377,7 @@ - + @@ -495,13 +495,6 @@ - - - - - - - @@ -714,7 +707,7 @@ - + From d1dabed82e0f381faced96e6e6f09b6101cd5a3f Mon Sep 17 00:00:00 2001 From: apriestman Date: Wed, 10 Mar 2021 10:48:21 -0500 Subject: [PATCH 03/10] Refactor DrawableFile NPE fix --- .../imagegallery/datamodel/DrawableFile.java | 29 ++++++------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java index 534bdfc8c8..e520e2d0ec 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java @@ -100,20 +100,9 @@ public abstract class DrawableFile { private String model; - private final CategoryManager categoryManager; - protected DrawableFile(AbstractFile file, Boolean analyzed) { this.analyzed = new SimpleBooleanProperty(analyzed); this.file = file; - - ImageGalleryController controllerForCase = ImageGalleryController.getController(Case.getCurrentCase()); - if (controllerForCase != null) { - categoryManager = ImageGalleryController.getController(Case.getCurrentCase()).getCategoryManager(); - } else { - // If getting the controller fails it means the case is currently closing. No need to - // print an error. - categoryManager = null; - } } public abstract boolean isVideo(); @@ -252,19 +241,19 @@ public abstract class DrawableFile { /** * Update the category property. */ - private void updateCategory() { - // This only happens when a DrawableFile is created while the case is closing. No need - // to display the error message. - if (categoryManager == null) { - return; - } - + private void updateCategory() { try { + ImageGalleryController controllerForCase = ImageGalleryController.getController(Case.getCurrentCaseThrows()); + if (controllerForCase == null) { + // This can only happen during case closing, so return without generating an error. + return; + } + List contentTags = getContentTags(); TagName tag = null; for (ContentTag ct : contentTags) { TagName tagName = ct.getName(); - if (categoryManager.isCategoryTagName(tagName)) { + if (controllerForCase.getCategoryManager().isCategoryTagName(tagName)) { tag = tagName; break; } @@ -272,7 +261,7 @@ public abstract class DrawableFile { categoryTagName.set(tag); } catch (TskCoreException ex) { LOGGER.log(Level.WARNING, "problem looking up category for " + this.getContentPathSafe(), ex); //NON-NLS - } catch (IllegalStateException ex) { + } catch (IllegalStateException | NoCurrentCaseException ex) { // We get here many times if the case is closed during ingest, so don't print out a ton of warnings. } } From 6a80782fcbe562be9c9271909d813f984664b454 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Wed, 10 Mar 2021 13:50:28 -0500 Subject: [PATCH 04/10] Fixed OsAccountDactoryNode exception --- .../autopsy/datamodel/OsAccounts.java | 36 ++++++++++++------- 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java b/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java index ade1ef6329..6fc3151bbf 100755 --- a/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java @@ -51,7 +51,7 @@ public final class OsAccounts implements AutopsyVisitableItem { private static final String ICON_PATH = "org/sleuthkit/autopsy/images/os-account.png"; private static final SimpleDateFormat DATE_FORMATTER = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss z"); - private final SleuthkitCase skCase; + private SleuthkitCase skCase; private final long filteringDSObjId; public OsAccounts(SleuthkitCase skCase) { @@ -111,34 +111,46 @@ public final class OsAccounts implements AutopsyVisitableItem { private final PropertyChangeListener listener = new PropertyChangeListener() { @Override public void propertyChange(PropertyChangeEvent evt) { - refresh(true); + String eventType = evt.getPropertyName(); + if(eventType.equals(Case.Events.OS_ACCOUNT_ADDED.toString())) { + refresh(true); + } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) { + // case was closed. Remove listeners so that we don't get called with a stale case handle + if (evt.getNewValue() == null) { + removeNotify(); + skCase = null; + } + } } }; @Override protected void addNotify() { Case.addEventTypeSubscriber(Collections.singleton(Case.Events.OS_ACCOUNT_ADDED), listener); + Case.addEventTypeSubscriber(EnumSet.of(Case.Events.CURRENT_CASE), listener); } @Override protected void removeNotify() { Case.removeEventTypeSubscriber(Collections.singleton(Case.Events.OS_ACCOUNT_ADDED), listener); + Case.removeEventTypeSubscriber(EnumSet.of(Case.Events.CURRENT_CASE), listener); } @Override protected boolean createKeys(List list) { - try { - if (filteringDSObjId == 0) { - list.addAll(skCase.getOsAccountManager().getAccounts()); - } else { - Host host = skCase.getHostManager().getHost(skCase.getDataSource(filteringDSObjId)); - list.addAll(skCase.getOsAccountManager().getAccounts(host)); + if(skCase != null) { + try { + if (filteringDSObjId == 0) { + list.addAll(skCase.getOsAccountManager().getAccounts()); + } else { + Host host = skCase.getHostManager().getHost(skCase.getDataSource(filteringDSObjId)); + list.addAll(skCase.getOsAccountManager().getAccounts(host)); + } + } catch (TskCoreException | TskDataException ex) { + logger.log(Level.SEVERE, "Unable to retrieve list of OsAccounts for case", ex); + return false; } - } catch (TskCoreException | TskDataException ex) { - logger.log(Level.SEVERE, "Unable to retrieve list of OsAccounts for case", ex); - return false; } - return true; } From 0d2fe89e72f5272fc1dff6feca2b0ed109dddb7c Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Wed, 10 Mar 2021 15:15:48 -0500 Subject: [PATCH 05/10] Update ileap-artifact-attribute-reference.xml Fix xml mappings --- .../ileap-artifact-attribute-reference.xml | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml index adb42c4ac8..85df267353 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml @@ -255,14 +255,12 @@ - + - - @@ -517,7 +515,7 @@ - + @@ -536,14 +534,12 @@ - + - - @@ -711,9 +707,10 @@ - + + - + From b09ccea25de55d293f0a24ca18ba2b38d6f18d4f Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Thu, 11 Mar 2021 15:31:33 -0500 Subject: [PATCH 06/10] merged in latest develop --- Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java | 1 + 1 file changed, 1 insertion(+) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java b/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java index 272d5ed0d0..df0d1968aa 100755 --- a/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/OsAccounts.java @@ -24,6 +24,7 @@ import java.text.SimpleDateFormat; import java.util.ArrayList; import java.util.Arrays; import java.util.Collections; +import java.util.EnumSet; import java.util.List; import java.util.Optional; import java.util.logging.Level; From b32ed1971e3167715c0918da14a6cd30b2869e17 Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Fri, 12 Mar 2021 11:26:55 -0500 Subject: [PATCH 07/10] More alignment for catalog More alignment to catalog. --- .../aleap-artifact-attribute-reference.xml | 12 ++++++------ .../ileap-artifact-attribute-reference.xml | 8 ++++---- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml index fcac67a398..27d3bc7263 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml @@ -48,7 +48,7 @@ - + @@ -72,7 +72,7 @@ - + @@ -318,7 +318,7 @@ - + @@ -333,7 +333,7 @@ - + @@ -482,8 +482,8 @@ - - + + diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml index 85df267353..16409f42c7 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml @@ -312,7 +312,7 @@ - + @@ -731,13 +731,13 @@ - + - + - + From 64f6551316014e1c8579c8892296f1f199bc58e7 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Fri, 12 Mar 2021 13:36:57 -0500 Subject: [PATCH 08/10] 7422 replace tsk os account object id with sid in account instances diff --- test/script/tskdbdiff.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/test/script/tskdbdiff.py b/test/script/tskdbdiff.py index 85087892b1..9452b335d9 100644 --- a/test/script/tskdbdiff.py +++ b/test/script/tskdbdiff.py @@ -444,6 +444,7 @@ def normalize_db_entry(line, files_table, vs_parts_table, vs_info_table, fs_info ig_groups_seen_index = line.find('INSERT INTO "image_gallery_groups_seen"') > -1 or line.find('INSERT INTO image_gallery_groups_seen ') > -1 os_account_index = line.find('INSERT INTO "tsk_os_accounts"') > -1 or line.find('INSERT INTO tsk_os_accounts') > -1 os_account_attr_index = line.find('INSERT INTO "tsk_os_account_attributes"') > -1 or line.find('INSERT INTO tsk_os_account_attributes') > -1 + os_account_instances_index = line.find('INSERT INTO "tsk_os_account_instances"') > -1 or line.find('INSERT INTO tsk_os_account_instances') > -1 parens = line[line.find('(') + 1 : line.rfind(')')] no_space_parens = parens.replace(" ", "") @@ -664,6 +665,11 @@ def normalize_db_entry(line, files_table, vs_parts_table, vs_info_table, fs_info fields_list[3] = "NULL" newLine = ('INSERT INTO "tsk_os_account_attributes" VALUES(' + ','.join(fields_list[1:]) + ');') # remove id return newLine + elif os_account_instances_index: + os_account_id = int(fields_list[1]) + fields_list[1] = accounts_table[os_account_id] + newLine = ('INSERT INTO "tsk_os_account_instances" VALUES(' + ','.join(fields_list[1:]) + ');') # remove id + return newLine else: return line From f37afa01cfbc76742eb824b2fae177a572de5b61 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Mon, 15 Mar 2021 11:14:50 -0400 Subject: [PATCH 09/10] data sources node update fix --- .../autopsy/datamodel/DataSourcesByTypeNode.java | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java index afeb99b8ec..0115426c2c 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java @@ -22,6 +22,7 @@ import java.beans.PropertyChangeEvent; import java.beans.PropertyChangeListener; import java.util.EnumSet; import java.util.List; +import java.util.Set; import java.util.logging.Level; import org.openide.nodes.ChildFactory; import org.openide.nodes.Children; @@ -59,15 +60,21 @@ public class DataSourcesByTypeNode extends DisplayableItemNode { } } }; + + private static final Set UPDATE_EVTS = EnumSet.of( + Case.Events.DATA_SOURCE_ADDED, + Case.Events.HOSTS_ADDED, + Case.Events.HOSTS_DELETED, + Case.Events.HOSTS_CHANGED); @Override protected void addNotify() { - Case.addEventTypeSubscriber(EnumSet.of(Case.Events.DATA_SOURCE_ADDED), pcl); + Case.addEventTypeSubscriber(UPDATE_EVTS, pcl); } @Override protected void removeNotify() { - Case.removeEventTypeSubscriber(EnumSet.of(Case.Events.DATA_SOURCE_ADDED), pcl); + Case.removeEventTypeSubscriber(UPDATE_EVTS, pcl); } @Override From 3bbeead9909909a2dad4f61b4a96dd496ac96b53 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Mon, 15 Mar 2021 12:07:38 -0400 Subject: [PATCH 10/10] pcl change --- .../datamodel/DataSourcesByTypeNode.java | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java index 0115426c2c..6dae811e99 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesByTypeNode.java @@ -24,6 +24,7 @@ import java.util.EnumSet; import java.util.List; import java.util.Set; import java.util.logging.Level; +import java.util.stream.Collectors; import org.openide.nodes.ChildFactory; import org.openide.nodes.Children; import org.openide.nodes.Node; @@ -49,23 +50,27 @@ public class DataSourcesByTypeNode extends DisplayableItemNode { */ public static class DataSourcesByTypeChildren extends ChildFactory.Detachable { + private static final Set UPDATE_EVTS = EnumSet.of( + Case.Events.DATA_SOURCE_ADDED, + Case.Events.HOSTS_ADDED, + Case.Events.HOSTS_DELETED, + Case.Events.HOSTS_CHANGED); + + private static final Set UPDATE_EVT_STRS = UPDATE_EVTS.stream() + .map(evt -> evt.name()) + .collect(Collectors.toSet()); + private static final Logger logger = Logger.getLogger(DataSourcesByTypeChildren.class.getName()); private final PropertyChangeListener pcl = new PropertyChangeListener() { @Override public void propertyChange(PropertyChangeEvent evt) { String eventType = evt.getPropertyName(); - if (eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) { + if (UPDATE_EVT_STRS.contains(eventType)) { refresh(true); } } }; - - private static final Set UPDATE_EVTS = EnumSet.of( - Case.Events.DATA_SOURCE_ADDED, - Case.Events.HOSTS_ADDED, - Case.Events.HOSTS_DELETED, - Case.Events.HOSTS_CHANGED); @Override protected void addNotify() { @@ -98,7 +103,7 @@ public class DataSourcesByTypeNode extends DisplayableItemNode { } } - + private static final String NAME = Bundle.DataSourcesHostsNode_name(); /** @@ -107,7 +112,7 @@ public class DataSourcesByTypeNode extends DisplayableItemNode { public static String getNameIdentifier() { return NAME; } - + /** * Main constructor. */