From 4a1a305e4ef0011f608a47c1ea034e0332c123f6 Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Thu, 1 Aug 2019 12:16:12 -0400 Subject: [PATCH 1/2] Fix bugs with frequency filter --- .../org/sleuthkit/autopsy/filequery/FileSearch.java | 9 +++++++-- .../sleuthkit/autopsy/filequery/FileSearchData.java | 12 ++++++------ 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java b/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java index f863e28038..6c3209f5db 100644 --- a/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java +++ b/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java @@ -866,13 +866,13 @@ class FileSearch { private final List files; private FrequencyCallback(List files) { - this.files = files; + this.files = new ArrayList<>(files); } @Override public void process(ResultSet resultSet) { try { - + while (resultSet.next()) { String hash = resultSet.getString(1); int count = resultSet.getInt(2); @@ -884,6 +884,11 @@ class FileSearch { } } } + + // The files left had no matching entries in the CR, so mark them as unique + for (ResultFile file : files) { + file.setFrequency(Frequency.UNIQUE); + } } catch (SQLException ex) { logger.log(Level.WARNING, "Error getting frequency counts from Central Repository", ex); // NON-NLS } diff --git a/Core/src/org/sleuthkit/autopsy/filequery/FileSearchData.java b/Core/src/org/sleuthkit/autopsy/filequery/FileSearchData.java index db488db8f7..46013ad1de 100644 --- a/Core/src/org/sleuthkit/autopsy/filequery/FileSearchData.java +++ b/Core/src/org/sleuthkit/autopsy/filequery/FileSearchData.java @@ -46,12 +46,12 @@ class FileSearchData { enum Frequency { UNIQUE(0, 1, Bundle.FileSearchData_Frequency_unique_displayName()), RARE(1, 5, Bundle.FileSearchData_Frequency_rare_displayName()), - COUNT_10(1, 10, Bundle.FileSearchData_Frequency_count_10_displayName()), - COUNT_20(1, 10, Bundle.FileSearchData_Frequency_count_20_displayName()), - COUNT_50(1, 10, Bundle.FileSearchData_Frequency_count_50_displayName()), - COUNT_100(1, 10, Bundle.FileSearchData_Frequency_count_100_displayName()), - COMMON(2, 0, Bundle.FileSearchData_Frequency_common_displayName()), - UNKNOWN(3, 0, Bundle.FileSearchData_Frequency_unknown_displayName()); + COUNT_10(2, 10, Bundle.FileSearchData_Frequency_count_10_displayName()), + COUNT_20(3, 20, Bundle.FileSearchData_Frequency_count_20_displayName()), + COUNT_50(4, 50, Bundle.FileSearchData_Frequency_count_50_displayName()), + COUNT_100(5, 100, Bundle.FileSearchData_Frequency_count_100_displayName()), + COMMON(6, 0, Bundle.FileSearchData_Frequency_common_displayName()), + UNKNOWN(7, 0, Bundle.FileSearchData_Frequency_unknown_displayName()); private final int ranking; private final String displayName; From a6fcee3621cc4d0c85a1df07f5ed2889972e5081 Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Thu, 1 Aug 2019 14:47:56 -0400 Subject: [PATCH 2/2] Count cases not data sources --- Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java b/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java index 6c3209f5db..5d61d6dbbe 100644 --- a/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java +++ b/Core/src/org/sleuthkit/autopsy/filequery/FileSearch.java @@ -843,7 +843,7 @@ class FileSearch { String tableName = EamDbUtil.correlationTypeToInstanceTableName(attributeType); String selectClause = " value, COUNT(value) FROM " - + "(SELECT DISTINCT case_id, data_source_id, value FROM " + tableName + + "(SELECT DISTINCT case_id, value FROM " + tableName + " WHERE value IN (" + hashes + ")) AS foo GROUP BY value";