revisions

This commit is contained in:
Greg DiCristofaro 2020-09-10 10:17:56 -04:00
parent 3569d5f66c
commit c4518c3c17
2 changed files with 76 additions and 37 deletions

View File

@ -59,6 +59,21 @@ import org.sleuthkit.datamodel.TskCoreException;
*/ */
public class DataSourcePastCasesSummary { public class DataSourcePastCasesSummary {
/**
* Exception that is thrown in the event that a data source has not been
* ingested with the Central Repository Ingest Module.
*/
public static class NotCentralRepoIngestedException extends Exception {
/**
* Main constructor.
* @param string Error message.
*/
public NotCentralRepoIngestedException(String string) {
super(string);
}
}
private static final String CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim(); private static final String CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim();
private static final BlackboardAttribute.Type TYPE_COMMENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COMMENT); private static final BlackboardAttribute.Type TYPE_COMMENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COMMENT);
@ -162,9 +177,12 @@ public class DataSourcePastCasesSummary {
* *
* @throws SleuthkitCaseProviderException * @throws SleuthkitCaseProviderException
* @throws TskCoreException * @throws TskCoreException
* @throws NotCentralRepoIngestedException
*/ */
private List<Pair<String, Long>> getPastCases(DataSource dataSource, ARTIFACT_TYPE artifactType) private List<Pair<String, Long>> getPastCases(DataSource dataSource, ARTIFACT_TYPE artifactType)
throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException { throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException, NotCentralRepoIngestedException {
throwOnNotCentralRepoIngested(dataSource);
Collection<List<String>> cases = this.caseProvider.get().getBlackboard().getArtifacts(artifactType.getTypeID(), dataSource.getId()) Collection<List<String>> cases = this.caseProvider.get().getBlackboard().getArtifacts(artifactType.getTypeID(), dataSource.getId())
.stream() .stream()
@ -234,6 +252,27 @@ public class DataSourcePastCasesSummary {
} }
/**
* Throws an exception if the current data source has not been ingested with
* the Central Repository Ingest Module.
*
* @param dataSource The data source to check if it has been ingested with
* the Central Repository Ingest Module.
*
* @throws SleuthkitCaseProviderException
* @throws TskCoreException
* @throws NotCentralRepoIngestedException
*/
private void throwOnNotCentralRepoIngested(DataSource dataSource)
throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException, NotCentralRepoIngestedException {
if (!isCentralRepoIngested(dataSource)) {
String objectId = (dataSource == null) ? "<null>" : String.valueOf(dataSource.getId());
String message = String.format("Data source: %s has not been ingested with the Central Repository Ingest Module.", objectId);
throw new NotCentralRepoIngestedException(message);
}
}
/** /**
* Get all cases that share notable files with the given data source. * Get all cases that share notable files with the given data source.
* *
@ -245,9 +284,10 @@ public class DataSourcePastCasesSummary {
* *
* @throws SleuthkitCaseProviderException * @throws SleuthkitCaseProviderException
* @throws TskCoreException * @throws TskCoreException
* @throws NotCentralRepoIngestedException
*/ */
public List<Pair<String, Long>> getPastCasesWithNotableFile(DataSource dataSource) public List<Pair<String, Long>> getPastCasesWithNotableFile(DataSource dataSource)
throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException { throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException, NotCentralRepoIngestedException {
return getPastCases(dataSource, ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); return getPastCases(dataSource, ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
} }
@ -263,9 +303,10 @@ public class DataSourcePastCasesSummary {
* *
* @throws SleuthkitCaseProviderException * @throws SleuthkitCaseProviderException
* @throws TskCoreException * @throws TskCoreException
* @throws NotCentralRepoIngestedException
*/ */
public List<Pair<String, Long>> getPastCasesWithSameId(DataSource dataSource) public List<Pair<String, Long>> getPastCasesWithSameId(DataSource dataSource)
throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException { throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException, NotCentralRepoIngestedException {
return getPastCases(dataSource, ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT); return getPastCases(dataSource, ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
} }
} }

View File

@ -20,22 +20,21 @@ package org.sleuthkit.autopsy.datasourcesummary.ui;
import java.util.Arrays; import java.util.Arrays;
import java.util.List; import java.util.List;
import java.util.logging.Level;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Pair;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourcePastCasesSummary; import org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourcePastCasesSummary;
import org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider; import org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourcePastCasesSummary.NotCentralRepoIngestedException;
import org.sleuthkit.autopsy.datasourcesummary.uiutils.CellModelTableCellRenderer.DefaultCellModel; import org.sleuthkit.autopsy.datasourcesummary.uiutils.CellModelTableCellRenderer.DefaultCellModel;
import org.sleuthkit.autopsy.datasourcesummary.uiutils.DataFetchResult; import org.sleuthkit.autopsy.datasourcesummary.uiutils.DataFetchResult;
import org.sleuthkit.autopsy.datasourcesummary.uiutils.DataFetchResult.ResultType;
import org.sleuthkit.autopsy.datasourcesummary.uiutils.DataFetchWorker; import org.sleuthkit.autopsy.datasourcesummary.uiutils.DataFetchWorker;
import org.sleuthkit.autopsy.datasourcesummary.uiutils.DataFetchWorker.DataFetchComponents; import org.sleuthkit.autopsy.datasourcesummary.uiutils.DataFetchWorker.DataFetchComponents;
import org.sleuthkit.autopsy.datasourcesummary.uiutils.JTablePanel; import org.sleuthkit.autopsy.datasourcesummary.uiutils.JTablePanel;
import org.sleuthkit.autopsy.datasourcesummary.uiutils.JTablePanel.ColumnModel; import org.sleuthkit.autopsy.datasourcesummary.uiutils.JTablePanel.ColumnModel;
import org.sleuthkit.datamodel.DataSource; import org.sleuthkit.datamodel.DataSource;
import org.sleuthkit.datamodel.TskCoreException;
/** /**
* A tab shown in data source summary displaying information about a datasource * A tab shown in data source summary displaying information about a datasource
@ -81,29 +80,42 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
this(new DataSourcePastCasesSummary()); this(new DataSourcePastCasesSummary());
} }
private final DataSourcePastCasesSummary pastCaseData;
/** /**
* Creates new form PastCasesPanel * Creates new form PastCasesPanel
*/ */
public PastCasesPanel(DataSourcePastCasesSummary pastCaseData) { public PastCasesPanel(DataSourcePastCasesSummary pastCaseData) {
this.pastCaseData = pastCaseData;
// set up data acquisition methods // set up data acquisition methods
dataFetchComponents = Arrays.asList( dataFetchComponents = Arrays.asList(
// hashset hits loading components // hashset hits loading components
new DataFetchWorker.DataFetchComponents<>( new DataFetchWorker.DataFetchComponents<>(
(dataSource) -> pastCaseData.getPastCasesWithNotableFile(dataSource), (dataSource) -> pastCaseData.getPastCasesWithNotableFile(dataSource),
(result) -> notableFileTable.showDataFetchResult(result)), (result) -> handleResult(notableFileTable, result)),
// keyword hits loading components // keyword hits loading components
new DataFetchWorker.DataFetchComponents<>( new DataFetchWorker.DataFetchComponents<>(
(dataSource) -> pastCaseData.getPastCasesWithSameId(dataSource), (dataSource) -> pastCaseData.getPastCasesWithSameId(dataSource),
(result) -> sameIdTable.showDataFetchResult(result)) (result) -> handleResult(sameIdTable, result))
); );
initComponents(); initComponents();
} }
/**
* handles displaying the result for the table. If a
* NotCentralRepoIngestedException is thrown, then an appropriate message is
* shown. Otherwise, this method uses the tables default showDataFetchResult
* method.
*
* @param table The table.
* @param result The result.
*/
private <T> void handleResult(JTablePanel<T> table, DataFetchResult<List<T>> result) {
if (result.getResultType() == ResultType.ERROR && result.getException() instanceof NotCentralRepoIngestedException) {
table.showMessage(Bundle.PastCasesPanel_onNoCrIngest_message());
} else {
table.showDataFetchResult(result);
}
}
@Override @Override
protected void onNewDataSource(DataSource dataSource) { protected void onNewDataSource(DataSource dataSource) {
// if no data source is present or the case is not open, // if no data source is present or the case is not open,
@ -111,22 +123,8 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
if (dataSource == null || !Case.isCaseOpen()) { if (dataSource == null || !Case.isCaseOpen()) {
this.dataFetchComponents.forEach((item) -> item.getResultHandler() this.dataFetchComponents.forEach((item) -> item.getResultHandler()
.accept(DataFetchResult.getSuccessResult(null))); .accept(DataFetchResult.getSuccessResult(null)));
return;
}
boolean centralRepoIngested = false;
try {
centralRepoIngested = this.pastCaseData.isCentralRepoIngested(dataSource);
} catch (SleuthkitCaseProvider.SleuthkitCaseProviderException | TskCoreException ex) {
logger.log(Level.WARNING, "There was an error while determining if dataSource has been central repo ingested.", ex);
}
if (!centralRepoIngested) {
// set tables to display loading screen
this.tables.forEach((table) -> table.showMessage(Bundle.PastCasesPanel_onNoCrIngest_message()));
return;
}
} else {
// set tables to display loading screen // set tables to display loading screen
this.tables.forEach((table) -> table.showDefaultLoadingMessage()); this.tables.forEach((table) -> table.showDefaultLoadingMessage());
@ -138,7 +136,7 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel {
// submit swing workers to run // submit swing workers to run
submit(workers); submit(workers);
}
} }
/** /**