mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 02:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

3757: Group views in the case tree by data source

Browse Source
This commit is contained in:
Raman 2018-04-27 11:08:46 -04:00
parent bdfa460d5d
commit c05e92aec2
14 changed files with 467 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Core/src/org/sleuthkit/autopsy/core/UserPreferences.java
View File

@ -69,6 +69,7 @@ public final class UserPreferences {
private static final String MODE = "AutopsyMode"; // NON-NLS
private static final String MAX_NUM_OF_LOG_FILE = "MaximumNumberOfLogFiles";
private static final int LOG_FILE_NUM_INT = 10;
public static final String GROUP_ITEMS_IN_TREE_BY_DATASOURCE = "GroupItemsInTreeByDataSource"; //NON-NLS
// Prevent instantiation.
private UserPreferences() {
@ -187,6 +188,14 @@ public final class UserPreferences {
preferences.putInt(NUMBER_OF_FILE_INGEST_THREADS, value);
}
public static boolean groupItemsInTreeByDatasource() {
return preferences.getBoolean(GROUP_ITEMS_IN_TREE_BY_DATASOURCE, false);
}
public static void setGroupItemsInTreeByDatasource(boolean value) {
preferences.putBoolean(GROUP_ITEMS_IN_TREE_BY_DATASOURCE, value);
}
/**
* Reads persisted case database connection info.
*

6
Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java
View File

@ -162,12 +162,12 @@ abstract class AbstractContentChildren<T> extends Keys<T> {
@Override
public AbstractNode visit(DeletedContent dc) {
return new DeletedContent.DeletedContentsNode(dc.getSleuthkitCase());
return new DeletedContent.DeletedContentsNode(dc.getSleuthkitCase(), dc.filteringDataSourceObjId());
}
@Override
public AbstractNode visit(FileSize dc) {
return new FileSize.FileSizeRootNode(dc.getSleuthkitCase());
return new FileSize.FileSizeRootNode(dc.getSleuthkitCase(), dc.filteringDataSourceObjId());
}
@Override
@ -234,7 +234,7 @@ abstract class AbstractContentChildren<T> extends Keys<T> {
@Override
public AbstractNode visit(FileTypesByMimeType ftByMimeTypeItem) {
return ftByMimeTypeItem.new ByMimeTypeNode();
return ftByMimeTypeItem.new ByMimeTypeNode(/*ftByMimeTypeItem.filteringDataSourceObjId()*/);
}
}
}

114
Core/src/org/sleuthkit/autopsy/datamodel/DataSourceLayerNode.java Normal file
View File

@ -0,0 +1,114 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.util.Arrays;
import java.util.Collections;
import java.util.Optional;
import java.util.logging.Level;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.DataSourcesLayerChildren.SubtreeEnum;
import org.sleuthkit.datamodel.DataSource;
import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.LocalFilesDataSource;
/**
* Datasource layer node - an optional grouping node in the data tree view
*
*/
public class DataSourceLayerNode extends DisplayableItemNode {
private static final Logger logger = Logger.getLogger(DataSourceLayerNode.class.getName());
/**
* Creates the Datasource node for the given data source,
* and initializes the children nodes under it based on the subtree specified
*
* @param dataSourceLayerInfo specifies the
*/
DataSourceLayerNode(DataSourcesLayerChildren.DataSourceLayerInfo dataSourceLayerInfo) {
super (Optional.ofNullable(createDSLayerNodeChildren(dataSourceLayerInfo))
.orElse(new RootContentChildren(Arrays.asList(Collections.EMPTY_LIST))));
DataSource dataSource = dataSourceLayerInfo.getDataSource();
if (dataSource instanceof Image) {
Image image = (Image) dataSource;
super.setName(image.getName());
super.setDisplayName(image.getName());
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/image.png");
} else if (dataSource instanceof LocalFilesDataSource) {
LocalFilesDataSource localFilesDataSource = (LocalFilesDataSource) dataSource;
super.setName(localFilesDataSource.getName());
super.setDisplayName(localFilesDataSource.getName());
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/fileset-icon-16.png");
}
}
@Override
public boolean isLeafTypeNode() {
return false;
}
private static RootContentChildren createDSLayerNodeChildren(DataSourcesLayerChildren.DataSourceLayerInfo dataSourceLayerInfo) {
SubtreeEnum subtree = dataSourceLayerInfo.getSubtree();
long dsObjId = dataSourceLayerInfo.getDataSource().getId();
try {
switch (subtree) {
case VIEWS:
return new RootContentChildren(Arrays.asList(
new FileTypes(Case.getOpenCase().getSleuthkitCase(), dsObjId),
new DeletedContent(Case.getOpenCase().getSleuthkitCase(), dsObjId),
new FileSize(Case.getOpenCase().getSleuthkitCase(), dsObjId))
);
case RESULTS: // TBD:
case TAGS: // TBD:
case REPORTS: // TBD:
default:
{
logger.log(Level.SEVERE, "Unknown subtree type " + subtree.name()); //NON-NLS
return null;
}
}
} catch (NoCurrentCaseException ex) {
logger.log(Level.SEVERE, "Error getting open case.", ex); //NON-NLS
return null;
}
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
return visitor.visit(this);
}
@Override
public String getItemType() {
return getClass().getName();
}
}

134
Core/src/org/sleuthkit/autopsy/datamodel/DataSourcesLayerChildren.java Normal file
View File

@ -0,0 +1,134 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.util.Collections;
import java.util.EnumSet;
import java.util.List;
import java.util.logging.Level;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.DataSource;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Child factory for DataSource node layer in the Results, Views Tags subtrees
*
*/
class DataSourcesLayerChildren extends Children.Keys<DataSource> {
private static final Logger logger = Logger.getLogger(DataSourcesLayerChildren.class.getName());
private final SleuthkitCase sleuthkitCase;
private final SubtreeEnum subTree;
/**
* Subtree in which this DataSourcesLayerChildren exist
*/
public enum SubtreeEnum {
VIEWS,
RESULTS,
TAGS,
REPORTS
}
/**
* Simple wrapper class to pass Datasource and subtree down to children nodes
*
*/
class DataSourceLayerInfo {
private final DataSource dataSource;
private final SubtreeEnum subTree;
DataSourceLayerInfo(DataSource dataSource, SubtreeEnum subTree) {
this.dataSource = dataSource;
this.subTree = subTree;
}
DataSource getDataSource() {
return this.dataSource;
}
SubtreeEnum getSubtree() {
return this.subTree;
}
}
/**
* Constructs the factory to create optional datasource nodes
*
* @param tskCase - Case DB
* @param subTree - subtree under which data source nodes are to be created
*/
public DataSourcesLayerChildren(SleuthkitCase tskCase, SubtreeEnum subTree) {
// super(true);
super(false);
this.sleuthkitCase = tskCase;
this.subTree = subTree;
}
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
reloadKeys();
}
}
};
private void reloadKeys() {
try {
List<DataSource> keys = sleuthkitCase.getDataSources();
setKeys(keys);
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Failed to get Datasources from DB", ex);
}
}
@Override
protected void addNotify() {
super.addNotify();
Case.addEventTypeSubscriber(EnumSet.of(Case.Events.DATA_SOURCE_ADDED), pcl);
reloadKeys();
}
@Override
protected void removeNotify() {
super.removeNotify();
Case.removeEventTypeSubscriber(EnumSet.of(Case.Events.DATA_SOURCE_ADDED), pcl);
setKeys(Collections.emptyList());
}
@Override
protected Node[] createNodes(DataSource ds) {
return new Node[]{createNodeForKey(ds)};
}
protected Node createNodeForKey(DataSource ds) {
return new DataSourceLayerNode(new DataSourceLayerInfo(ds, subTree));
}
}

51
Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java
View File

@ -61,6 +61,7 @@ import org.sleuthkit.datamodel.TskData;
public class DeletedContent implements AutopsyVisitableItem {
private SleuthkitCase skCase;
private final long datasourceObjId;
@NbBundle.Messages({"DeletedContent.fsDelFilter.text=File System",
"DeletedContent.allDelFilter.text=All"})
@ -101,9 +102,18 @@ public class DeletedContent implements AutopsyVisitableItem {
}
public DeletedContent(SleuthkitCase skCase) {
this.skCase = skCase;
this(skCase, 0);
}
public DeletedContent(SleuthkitCase skCase, long dsObjId) {
this.skCase = skCase;
this.datasourceObjId = dsObjId;
}
long filteringDataSourceObjId() {
return this.datasourceObjId;
}
@Override
public <T> T accept(AutopsyItemVisitor<T> v) {
return v.visit(this);
@ -118,8 +128,8 @@ public class DeletedContent implements AutopsyVisitableItem {
@NbBundle.Messages("DeletedContent.deletedContentsNode.name=Deleted Files")
private static final String NAME = Bundle.DeletedContent_deletedContentsNode_name();
DeletedContentsNode(SleuthkitCase skCase) {
super(Children.create(new DeletedContentsChildren(skCase), true), Lookups.singleton(NAME));
DeletedContentsNode(SleuthkitCase skCase, long datasourceObjId) {
super(Children.create(new DeletedContentsChildren(skCase, datasourceObjId), true), Lookups.singleton(NAME));
super.setName(NAME);
super.setDisplayName(NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file-icon-deleted.png"); //NON-NLS
@ -164,11 +174,13 @@ public class DeletedContent implements AutopsyVisitableItem {
private SleuthkitCase skCase;
private Observable notifier;
private final long datasourceObjId;
// true if we have already told user that not all files will be shown
private static volatile boolean maxFilesDialogShown = false;
public DeletedContentsChildren(SleuthkitCase skCase) {
public DeletedContentsChildren(SleuthkitCase skCase, long dsObjId) {
this.skCase = skCase;
this.datasourceObjId = dsObjId;
this.notifier = new DeletedContentsChildrenObservable();
}
@ -257,24 +269,27 @@ public class DeletedContent implements AutopsyVisitableItem {
@Override
protected Node createNodeForKey(DeletedContent.DeletedContentFilter key) {
return new DeletedContentNode(skCase, key, notifier);
return new DeletedContentNode(skCase, key, notifier, datasourceObjId);
}
public class DeletedContentNode extends DisplayableItemNode {
private final DeletedContent.DeletedContentFilter filter;
private final long datasourceObjId;
// Use version that has observer for updates
@Deprecated
DeletedContentNode(SleuthkitCase skCase, DeletedContent.DeletedContentFilter filter) {
super(Children.create(new DeletedContentChildren(filter, skCase, null), true), Lookups.singleton(filter.getDisplayName()));
DeletedContentNode(SleuthkitCase skCase, DeletedContent.DeletedContentFilter filter, long dsObjId) {
super(Children.create(new DeletedContentChildren(filter, skCase, null, dsObjId ), true), Lookups.singleton(filter.getDisplayName()));
this.filter = filter;
this.datasourceObjId = dsObjId;
init();
}
DeletedContentNode(SleuthkitCase skCase, DeletedContent.DeletedContentFilter filter, Observable o) {
super(Children.create(new DeletedContentChildren(filter, skCase, o), true), Lookups.singleton(filter.getDisplayName()));
DeletedContentNode(SleuthkitCase skCase, DeletedContent.DeletedContentFilter filter, Observable o, long dsObjId) {
super(Children.create(new DeletedContentChildren(filter, skCase, o, dsObjId), true), Lookups.singleton(filter.getDisplayName()));
this.filter = filter;
this.datasourceObjId = dsObjId;
init();
o.addObserver(new DeletedContentNodeObserver());
}
@ -299,7 +314,7 @@ public class DeletedContent implements AutopsyVisitableItem {
private void updateDisplayName() {
//get count of children without preloading all children nodes
final long count = DeletedContentChildren.calculateItems(skCase, filter);
final long count = DeletedContentChildren.calculateItems(skCase, filter, datasourceObjId);
//final long count = getChildren().getNodesCount(true);
super.setDisplayName(filter.getDisplayName() + " (" + count + ")");
}
@ -351,11 +366,13 @@ public class DeletedContent implements AutopsyVisitableItem {
private static final Logger logger = Logger.getLogger(DeletedContentChildren.class.getName());
private static final int MAX_OBJECTS = 10001;
private final Observable notifier;
private final long datasourceObjId;
DeletedContentChildren(DeletedContent.DeletedContentFilter filter, SleuthkitCase skCase, Observable o) {
DeletedContentChildren(DeletedContent.DeletedContentFilter filter, SleuthkitCase skCase, Observable o, long datasourceObjId) {
this.skCase = skCase;
this.filter = filter;
this.notifier = o;
this.datasourceObjId = datasourceObjId;
}
private final Observer observer = new DeletedContentChildrenObserver();
@ -405,7 +422,7 @@ public class DeletedContent implements AutopsyVisitableItem {
return true;
}
static private String makeQuery(DeletedContent.DeletedContentFilter filter) {
static private String makeQuery(DeletedContent.DeletedContentFilter filter, long filteringDSObjId) {
String query = "";
switch (filter) {
case FS_DELETED_FILTER:
@ -443,6 +460,10 @@ public class DeletedContent implements AutopsyVisitableItem {
+ " OR known IS NULL)"; //NON-NLS
}
if (UserPreferences.groupItemsInTreeByDatasource()) {
query += " AND data_source_obj_id = " + filteringDSObjId;
}
query += " LIMIT " + MAX_OBJECTS; //NON-NLS
return query;
}
@ -450,7 +471,7 @@ public class DeletedContent implements AutopsyVisitableItem {
private List<AbstractFile> runFsQuery() {
List<AbstractFile> ret = new ArrayList<>();
String query = makeQuery(filter);
String query = makeQuery(filter, datasourceObjId);
try {
ret = skCase.findAllFilesWhere(query);
} catch (TskCoreException e) {
@ -469,9 +490,9 @@ public class DeletedContent implements AutopsyVisitableItem {
*
* @return
*/
static long calculateItems(SleuthkitCase sleuthkitCase, DeletedContent.DeletedContentFilter filter) {
static long calculateItems(SleuthkitCase sleuthkitCase, DeletedContent.DeletedContentFilter filter, long datasourceObjId) {
try {
return sleuthkitCase.countFilesWhere(makeQuery(filter));
return sleuthkitCase.countFilesWhere(makeQuery(filter, datasourceObjId));
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error getting deleted files search view count", ex); //NON-NLS
return 0;

7
Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java
View File

@ -60,6 +60,8 @@ public interface DisplayableItemNodeVisitor<T> {
*/
T visit(ViewsNode vn);
T visit(DataSourceLayerNode vn);
T visit(org.sleuthkit.autopsy.datamodel.FileTypesByExtension.FileExtensionNode fsfn);
T visit(DeletedContentNode dcn);
@ -307,6 +309,11 @@ public interface DisplayableItemNodeVisitor<T> {
return defaultVisit(vn);
}
@Override
public T visit(DataSourceLayerNode vn) {
return defaultVisit(vn);
}
@Override
public T visit(ResultsNode rn) {
return defaultVisit(rn);

53
Core/src/org/sleuthkit/autopsy/datamodel/FileSize.java
View File

@ -61,6 +61,7 @@ import org.sleuthkit.datamodel.VirtualDirectory;
public class FileSize implements AutopsyVisitableItem {
private SleuthkitCase skCase;
private final long datasourceObjId;
public enum FileSizeFilter implements AutopsyVisitableItem {
@ -97,9 +98,14 @@ public class FileSize implements AutopsyVisitableItem {
}
public FileSize(SleuthkitCase skCase) {
this.skCase = skCase;
this(skCase, 0);
}
public FileSize(SleuthkitCase skCase, long dsObjId) {
this.skCase = skCase;
this.datasourceObjId = dsObjId;
}
@Override
public <T> T accept(AutopsyItemVisitor<T> v) {
return v.visit(this);
@ -109,6 +115,9 @@ public class FileSize implements AutopsyVisitableItem {
return this.skCase;
}
long filteringDataSourceObjId() {
return this.datasourceObjId;
}
/*
* Root node. Children are nodes for specific sizes.
*/
@ -116,8 +125,8 @@ public class FileSize implements AutopsyVisitableItem {
private static final String NAME = NbBundle.getMessage(FileSize.class, "FileSize.fileSizeRootNode.name");
FileSizeRootNode(SleuthkitCase skCase) {
super(Children.create(new FileSizeRootChildren(skCase), true), Lookups.singleton(NAME));
FileSizeRootNode(SleuthkitCase skCase, long datasourceObjId) {
super(Children.create(new FileSizeRootChildren(skCase, datasourceObjId), true), Lookups.singleton(NAME));
super.setName(NAME);
super.setDisplayName(NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file-size-16.png"); //NON-NLS
@ -161,10 +170,12 @@ public class FileSize implements AutopsyVisitableItem {
public static class FileSizeRootChildren extends ChildFactory<org.sleuthkit.autopsy.datamodel.FileSize.FileSizeFilter> {
private SleuthkitCase skCase;
private long datasourceObjId;
private Observable notifier;
public FileSizeRootChildren(SleuthkitCase skCase) {
public FileSizeRootChildren(SleuthkitCase skCase, long datasourceObjId) {
this.skCase = skCase;
this.datasourceObjId = datasourceObjId;
notifier = new FileSizeRootChildrenObservable();
}
@ -248,7 +259,7 @@ public class FileSize implements AutopsyVisitableItem {
@Override
protected Node createNodeForKey(FileSizeFilter key) {
return new FileSizeNode(skCase, key, notifier);
return new FileSizeNode(skCase, key, notifier, datasourceObjId);
}
/*
@ -257,12 +268,14 @@ public class FileSize implements AutopsyVisitableItem {
public class FileSizeNode extends DisplayableItemNode {
private FileSizeFilter filter;
private final long datasourceObjId;
// use version with observer instead so that it updates
@Deprecated
FileSizeNode(SleuthkitCase skCase, FileSizeFilter filter) {
super(Children.create(new FileSizeChildren(filter, skCase, null), true), Lookups.singleton(filter.getDisplayName()));
FileSizeNode(SleuthkitCase skCase, FileSizeFilter filter, long datasourceObjId) {
super(Children.create(new FileSizeChildren(filter, skCase, null, datasourceObjId), true), Lookups.singleton(filter.getDisplayName()));
this.filter = filter;
this.datasourceObjId = datasourceObjId;
init();
}
@ -272,10 +285,12 @@ public class FileSize implements AutopsyVisitableItem {
* @param filter
* @param o Observable that provides updates when events are
* fired
* @param datasourceObjId filter by data source, if configured in user preferences
*/
FileSizeNode(SleuthkitCase skCase, FileSizeFilter filter, Observable o) {
super(Children.create(new FileSizeChildren(filter, skCase, o), true), Lookups.singleton(filter.getDisplayName()));
FileSizeNode(SleuthkitCase skCase, FileSizeFilter filter, Observable o, long datasourceObjId) {
super(Children.create(new FileSizeChildren(filter, skCase, o, datasourceObjId), true), Lookups.singleton(filter.getDisplayName()));
this.filter = filter;
this.datasourceObjId = datasourceObjId;
init();
o.addObserver(new FileSizeNodeObserver());
}
@ -309,7 +324,7 @@ public class FileSize implements AutopsyVisitableItem {
}
private void updateDisplayName() {
final long numVisibleChildren = FileSizeChildren.calculateItems(skCase, filter);
final long numVisibleChildren = FileSizeChildren.calculateItems(skCase, filter, datasourceObjId);
super.setDisplayName(filter.getDisplayName() + " (" + numVisibleChildren + ")");
}
@ -349,6 +364,7 @@ public class FileSize implements AutopsyVisitableItem {
private final SleuthkitCase skCase;
private final FileSizeFilter filter;
private final Observable notifier;
private final long datasourceObjId;
private static final Logger logger = Logger.getLogger(FileSizeChildren.class.getName());
/**
@ -358,10 +374,12 @@ public class FileSize implements AutopsyVisitableItem {
* @param o Observable that provides updates when new files are
* added to case
*/
FileSizeChildren(FileSizeFilter filter, SleuthkitCase skCase, Observable o) {
FileSizeChildren(FileSizeFilter filter, SleuthkitCase skCase, Observable o, long dsObjId) {
this.skCase = skCase;
this.filter = filter;
this.notifier = o;
this.datasourceObjId = dsObjId;
}
@Override
@ -395,7 +413,7 @@ public class FileSize implements AutopsyVisitableItem {
return true;
}
private static String makeQuery(FileSizeFilter filter) {
private static String makeQuery(FileSizeFilter filter, long filteringDSObjId) {
String query;
switch (filter) {
case SIZE_50_200:
@ -427,6 +445,11 @@ public class FileSize implements AutopsyVisitableItem {
query += " AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType() + ")"; //NON-NLS
}
// filter by datasource if indicated in user preferences
if (UserPreferences.groupItemsInTreeByDatasource()) {
query += " AND data_source_obj_id = " + filteringDSObjId;
}
return query;
}
@ -434,7 +457,7 @@ public class FileSize implements AutopsyVisitableItem {
List<AbstractFile> ret = new ArrayList<>();
try {
String query = makeQuery(filter);
String query = makeQuery(filter, datasourceObjId);
ret = skCase.findAllFilesWhere(query);
} catch (Exception e) {
@ -449,9 +472,9 @@ public class FileSize implements AutopsyVisitableItem {
*
* @return
*/
static long calculateItems(SleuthkitCase sleuthkitCase, FileSizeFilter filter) {
static long calculateItems(SleuthkitCase sleuthkitCase, FileSizeFilter filter, long datasourceObjId) {
try {
return sleuthkitCase.countFilesWhere(makeQuery(filter));
return sleuthkitCase.countFilesWhere(makeQuery(filter, datasourceObjId));
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error getting files by size search view count", ex); //NON-NLS
return 0;

14
Core/src/org/sleuthkit/autopsy/datamodel/FileTypes.java
View File

@ -72,11 +72,18 @@ public final class FileTypes implements AutopsyVisitableItem {
private final SleuthkitCase skCase;
private final long datasourceObjId;
FileTypes(SleuthkitCase skCase) {
this.skCase = skCase;
updateShowCounts();
this(skCase, 0);
}
FileTypes(SleuthkitCase skCase, long dsObjId) {
this.skCase = skCase;
this.datasourceObjId = dsObjId;
updateShowCounts();
}
@Override
public <T> T accept(AutopsyItemVisitor<T> v) {
return v.visit(this);
@ -86,6 +93,9 @@ public final class FileTypes implements AutopsyVisitableItem {
return skCase;
}
long filteringDataSourceObjId() {
return this.datasourceObjId;
}
/**
* Check the db to determine if the nodes should show child counts.
*/

9
Core/src/org/sleuthkit/autopsy/datamodel/FileTypesByExtension.java
View File

@ -69,6 +69,10 @@ public final class FileTypesByExtension implements AutopsyVisitableItem {
return v.visit(this);
}
long filteringDataSourceObjId() {
return typesRoot.filteringDataSourceObjId();
}
/**
* Listens for case and ingest invest. Updates observers when events are
* fired. FileType and FileTypes nodes are all listening to this.
@ -153,7 +157,7 @@ public final class FileTypesByExtension implements AutopsyVisitableItem {
* @param o Observable that was created by a higher-level node that
* provides updates on events
*/
private FileTypesByExtNode(SleuthkitCase skCase, FileTypesByExtension.RootFilter filter, FileTypesByExtObservable o) {
private FileTypesByExtNode(SleuthkitCase skCase, FileTypesByExtension.RootFilter filter, FileTypesByExtObservable o /*, long datasourceObjId */) {
super(Children.create(new FileTypesByExtNodeChildren(skCase, filter, o), true),
Lookups.singleton(filter == null ? FNAME : filter.getDisplayName()));
@ -359,6 +363,9 @@ public final class FileTypesByExtension implements AutopsyVisitableItem {
+ (UserPreferences.hideKnownFilesInViewsTree()
? " AND (known IS NULL OR known != " + TskData.FileKnown.KNOWN.getFileKnownValue() + ")"
: " ")
+ (UserPreferences.groupItemsInTreeByDatasource()
? " AND data_source_obj_id = " + FileTypesByExtension.this.filteringDataSourceObjId()
: " ")
+ " AND (extension IN (" + filter.getFilter().stream()
.map(String::toLowerCase)
.map(s -> "'"+StringUtils.substringAfter(s, ".")+"'")

10
Core/src/org/sleuthkit/autopsy/datamodel/FileTypesByMimeType.java
View File

@ -42,6 +42,7 @@ import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.core.UserPreferences;
import static org.sleuthkit.autopsy.core.UserPreferences.hideKnownFilesInViewsTree;
import static org.sleuthkit.autopsy.core.UserPreferences.hideSlackFilesInViewsTree;
import org.sleuthkit.autopsy.coreutils.Logger;
@ -91,15 +92,16 @@ public final class FileTypesByMimeType extends Observable implements AutopsyVisi
* @return The base expression to be used in the where clause of queries for
* files by mime type.
*/
static private String createBaseWhereExpr() {
private String createBaseWhereExpr() {
return "(dir_type = " + TskData.TSK_FS_NAME_TYPE_ENUM.REG.getValue() + ")"
+ " AND (type IN ("
+ TskData.TSK_DB_FILES_TYPE_ENUM.FS.ordinal() + ","
+ TskData.TSK_DB_FILES_TYPE_ENUM.CARVED.ordinal() + ","
+ TskData.TSK_DB_FILES_TYPE_ENUM.DERIVED.ordinal() + ","
+ TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL.ordinal()
+ (hideSlackFilesInViewsTree() ? "" : ("," + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.ordinal()))
+ (hideSlackFilesInViewsTree() ? "" : ("," + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.ordinal()))
+ "))"
+ ( UserPreferences.groupItemsInTreeByDatasource() ? " AND data_source_obj_id = " + this.filteringDataSourceObjId() : " ")
+ (hideKnownFilesInViewsTree() ? (" AND (known IS NULL OR known != " + TskData.FileKnown.KNOWN.getFileKnownValue() + ")") : "");
}
@ -188,6 +190,10 @@ public final class FileTypesByMimeType extends Observable implements AutopsyVisi
return v.visit(this);
}
long filteringDataSourceObjId() {
return typesRoot.filteringDataSourceObjId();
}
/**
* Method to check if the node in question is a ByMimeTypeNode which is
* empty.

25
Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Copyright 2011-2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -22,6 +22,8 @@ import java.util.Arrays;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.core.UserPreferences;
import org.sleuthkit.autopsy.datamodel.DataSourcesLayerChildren.SubtreeEnum;
import org.sleuthkit.datamodel.SleuthkitCase;
/**
@ -34,14 +36,19 @@ public class ViewsNode extends DisplayableItemNode {
public static final String NAME = NbBundle.getMessage(ViewsNode.class, "ViewsNode.name.text");
public ViewsNode(SleuthkitCase sleuthkitCase) {
super(new RootContentChildren(Arrays.asList(
new FileTypes(sleuthkitCase),
// June '15: Recent Files was removed because it was not useful w/out filtering
// add it back in if we can filter the results to a more managable size.
// new RecentFiles(sleuthkitCase),
new DeletedContent(sleuthkitCase),
new FileSize(sleuthkitCase))),
Lookups.singleton(NAME));
super( UserPreferences.groupItemsInTreeByDatasource() ?
new DataSourcesLayerChildren(sleuthkitCase, SubtreeEnum.VIEWS) :
new RootContentChildren(Arrays.asList(
new FileTypes(sleuthkitCase),
// June '15: Recent Files was removed because it was not useful w/out filtering
// add it back in if we can filter the results to a more managable size.
// new RecentFiles(sleuthkitCase),
new DeletedContent(sleuthkitCase),
new FileSize(sleuthkitCase))
),
Lookups.singleton(NAME)
);
setName(NAME);
setDisplayName(NAME);
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/views.png"); //NON-NLS

1
Core/src/org/sleuthkit/autopsy/directorytree/Bundle.properties
View File

@ -119,3 +119,4 @@ AddExternalViewerRulePanel.browseButton.text=Browse
AddExternalViewerRulePanel.exePathTextField.text=
AddExternalViewerRulePanel.exePathLabel.text=Path of the program to use for files with this type or extension
AddExternalViewerRulePanel.extRadioButton.text=Extension
DirectoryTreeTopComponent.groupByDatasourceCheckBox.text=Group by Data Source

46
Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.form
View File

@ -16,14 +16,17 @@
<Layout>
<DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="treeView" alignment="0" pref="262" max="32767" attributes="0"/>
<Group type="102" attributes="0">
<EmptySpace min="-2" pref="5" max="-2" attributes="0"/>
<Component id="treeView" alignment="0" max="32767" attributes="0"/>
<Group type="102" alignment="0" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Component id="backButton" min="-2" pref="23" max="-2" attributes="0"/>
<EmptySpace min="0" pref="0" max="-2" attributes="0"/>
<Component id="forwardButton" min="-2" pref="23" max="-2" attributes="0"/>
<EmptySpace pref="46" max="32767" attributes="0"/>
<Component id="showRejectedCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace pref="65" max="32767" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="showRejectedCheckBox" min="-2" max="-2" attributes="0"/>
<Component id="groupByDatasourceCheckBox" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace max="-2" attributes="0"/>
</Group>
</Group>
@ -31,14 +34,23 @@
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="5" max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0">
<Component id="forwardButton" min="-2" pref="26" max="-2" attributes="1"/>
<Component id="backButton" min="-2" pref="26" max="-2" attributes="1"/>
<Component id="showRejectedCheckBox" min="-2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<EmptySpace min="-2" pref="5" max="-2" attributes="0"/>
<Component id="showRejectedCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="groupByDatasourceCheckBox" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0">
<Component id="forwardButton" min="-2" pref="26" max="-2" attributes="1"/>
<Component id="backButton" min="-2" pref="26" max="-2" attributes="1"/>
</Group>
</Group>
</Group>
<EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="treeView" pref="854" max="32767" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="treeView" pref="838" max="32767" attributes="0"/>
<EmptySpace min="0" pref="0" max="-2" attributes="0"/>
</Group>
</Group>
@ -130,5 +142,15 @@
</Property>
</Properties>
</Component>
<Component class="javax.swing.JCheckBox" name="groupByDatasourceCheckBox">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/directorytree/Bundle.properties" key="DirectoryTreeTopComponent.groupByDatasourceCheckBox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="groupByDatasourceCheckBoxActionPerformed"/>
</Events>
</Component>
</SubComponents>
</Form>

58
Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java
View File

@ -141,6 +141,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
switch (evt.getKey()) {
case UserPreferences.HIDE_KNOWN_FILES_IN_DATA_SRCS_TREE:
case UserPreferences.HIDE_SLACK_FILES_IN_DATA_SRCS_TREE:
case UserPreferences.GROUP_ITEMS_IN_TREE_BY_DATASOURCE:
refreshContentTreeSafe();
break;
case UserPreferences.HIDE_KNOWN_FILES_IN_VIEWS_TREE:
@ -181,6 +182,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
backButton = new javax.swing.JButton();
forwardButton = new javax.swing.JButton();
showRejectedCheckBox = new javax.swing.JCheckBox();
groupByDatasourceCheckBox = new javax.swing.JCheckBox();
treeView.setBorder(null);
@ -218,30 +220,45 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
org.openide.awt.Mnemonics.setLocalizedText(showRejectedCheckBox, org.openide.util.NbBundle.getMessage(DirectoryTreeTopComponent.class, "DirectoryTreeTopComponent.showRejectedCheckBox.text")); // NOI18N
org.openide.awt.Mnemonics.setLocalizedText(groupByDatasourceCheckBox, org.openide.util.NbBundle.getMessage(DirectoryTreeTopComponent.class, "DirectoryTreeTopComponent.groupByDatasourceCheckBox.text")); // NOI18N
groupByDatasourceCheckBox.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
groupByDatasourceCheckBoxActionPerformed(evt);
}
});
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
this.setLayout(layout);
layout.setHorizontalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(treeView, javax.swing.GroupLayout.DEFAULT_SIZE, 262, Short.MAX_VALUE)
.addComponent(treeView)
.addGroup(layout.createSequentialGroup()
.addGap(5, 5, 5)
.addContainerGap()
.addComponent(backButton, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGap(0, 0, 0)
.addComponent(forwardButton, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 46, Short.MAX_VALUE)
.addComponent(showRejectedCheckBox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 65, Short.MAX_VALUE)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(showRejectedCheckBox)
.addComponent(groupByDatasourceCheckBox))
.addContainerGap())
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addGap(5, 5, 5)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addComponent(forwardButton, javax.swing.GroupLayout.PREFERRED_SIZE, 26, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(backButton, javax.swing.GroupLayout.PREFERRED_SIZE, 26, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(showRejectedCheckBox))
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addGap(5, 5, 5)
.addComponent(showRejectedCheckBox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(groupByDatasourceCheckBox))
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addComponent(forwardButton, javax.swing.GroupLayout.PREFERRED_SIZE, 26, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(backButton, javax.swing.GroupLayout.PREFERRED_SIZE, 26, javax.swing.GroupLayout.PREFERRED_SIZE))))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(treeView, javax.swing.GroupLayout.DEFAULT_SIZE, 854, Short.MAX_VALUE)
.addComponent(treeView, javax.swing.GroupLayout.DEFAULT_SIZE, 838, Short.MAX_VALUE)
.addGap(0, 0, 0))
);
}// </editor-fold>//GEN-END:initComponents
@ -295,9 +312,14 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
this.setCursor(null);
}//GEN-LAST:event_forwardButtonActionPerformed
private void groupByDatasourceCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_groupByDatasourceCheckBoxActionPerformed
UserPreferences.setGroupItemsInTreeByDatasource(this.groupByDatasourceCheckBox.isSelected());
}//GEN-LAST:event_groupByDatasourceCheckBoxActionPerformed
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JButton backButton;
private javax.swing.JButton forwardButton;
private javax.swing.JCheckBox groupByDatasourceCheckBox;
private javax.swing.JCheckBox showRejectedCheckBox;
private javax.swing.JScrollPane treeView;
// End of variables declaration//GEN-END:variables
@ -429,6 +451,8 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
showRejectedCheckBox.setAction(accounts.newToggleShowRejectedAction());
showRejectedCheckBox.setSelected(false);
groupByDatasourceCheckBox.setSelected(UserPreferences.groupItemsInTreeByDatasource());
Node views = rootChildren.findChild(ViewsNode.NAME);
Arrays.stream(views.getChildren().getNodes()).forEach(tree::expandNode);
tree.collapseNode(views);
@ -772,7 +796,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
* Refresh the content node part of the dir tree safely in the EDT thread
*/
public void refreshContentTreeSafe() {
SwingUtilities.invokeLater(this::refreshDataSourceTree);
SwingUtilities.invokeLater(this::refreshTree);
}
/**
@ -793,6 +817,18 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
setSelectedNode(selectedPath, DataSourcesNode.NAME);
}
/**
* Refreshes the entire tree
*/
private void refreshTree() {
Node selectedNode = getSelectedNode();
final String[] selectedPath = NodeOp.createPath(selectedNode, em.getRootContext());
contentChildren.refreshContentKeys();
setSelectedNode(selectedPath, DataSourcesNode.NAME);
}
/**
* Set the selected node using a path to a previously selected node.
*