From ba622eaa22d72d3efd6cdfce59d486586246f86f Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Wed, 15 Sep 2021 10:37:43 -0400 Subject: [PATCH 01/15] Update SummaryHelpers.java Make returned message more meaning full --- .../sleuthkit/autopsy/discovery/search/SummaryHelpers.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/SummaryHelpers.java b/Core/src/org/sleuthkit/autopsy/discovery/search/SummaryHelpers.java index c258801f70..6a21ef94ba 100644 --- a/Core/src/org/sleuthkit/autopsy/discovery/search/SummaryHelpers.java +++ b/Core/src/org/sleuthkit/autopsy/discovery/search/SummaryHelpers.java @@ -31,6 +31,7 @@ import java.util.Collection; import java.util.logging.Level; import org.apache.commons.lang.StringUtils; import org.openide.util.Lookup; +import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.coreutils.ImageUtils; @@ -194,6 +195,7 @@ class SummaryHelpers { } } + @NbBundle.Messages({"SummaryHelper.documentSummary.unable.to.read=Unable to extract text from file."}) /** * Get the beginning of text from the specified AbstractFile. * @@ -217,7 +219,7 @@ class SummaryHelpers { } catch (IOException ex) { return Bundle.FileSearch_documentSummary_noBytes(); } catch (TextExtractor.InitReaderException ex) { - return Bundle.FileSearch_documentSummary_noPreview(); + return Bundle.SummaryHelper_documentSummary_unable_to_read(); } } From b2782c0278eb754b7e8aa500abce8584f35eca5a Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Wed, 15 Sep 2021 11:12:38 -0400 Subject: [PATCH 02/15] annotations viewer with listeners --- .../annotations/AnnotationsContentViewer.java | 158 ++++++++++++++++-- 1 file changed, 140 insertions(+), 18 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java index faed21e1b1..ec3652c6fa 100755 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java @@ -18,7 +18,12 @@ */ package org.sleuthkit.autopsy.contentviewers.annotations; +import com.google.common.collect.ImmutableSet; import java.awt.Component; +import java.beans.PropertyChangeEvent; +import java.beans.PropertyChangeListener; +import java.util.EnumSet; +import java.util.Set; import java.util.concurrent.ExecutionException; import java.util.logging.Level; import javax.swing.SwingWorker; @@ -29,8 +34,15 @@ import org.openide.util.lookup.ServiceProvider; import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer; import org.sleuthkit.autopsy.coreutils.Logger; import org.jsoup.nodes.Document; +import org.openide.util.WeakListeners; +import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles; import org.sleuthkit.autopsy.contentviewers.utils.ViewerPriority; +import org.sleuthkit.autopsy.guiutils.RefreshThrottler; +import org.sleuthkit.autopsy.guiutils.RefreshThrottler.Refresher; +import org.sleuthkit.autopsy.ingest.IngestManager; +import org.sleuthkit.autopsy.ingest.ModuleDataEvent; +import org.sleuthkit.datamodel.BlackboardArtifact; /** * Annotations view of file contents. @@ -47,7 +59,49 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data private static final long serialVersionUID = 1L; private static final Logger logger = Logger.getLogger(AnnotationsContentViewer.class.getName()); - private AnnotationWorker worker; + private static final Set CASE_EVENTS_OF_INTEREST = EnumSet.of( + Case.Events.BLACKBOARD_ARTIFACT_TAG_ADDED, + Case.Events.BLACKBOARD_ARTIFACT_TAG_DELETED, + Case.Events.CONTENT_TAG_ADDED, + Case.Events.CONTENT_TAG_DELETED, + Case.Events.CR_COMMENT_CHANGED); + + private static final Set ARTIFACT_TYPES_OF_INTEREST = ImmutableSet.of( + BlackboardArtifact.Type.TSK_HASHSET_HIT, + BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT + ); + + /** + * Refresher used with refresh throttler to listen for artifact events. + */ + private final Refresher refresher = new Refresher() { + + @Override + public void refresh() { + AnnotationsContentViewer.this.refresh(); + } + + @Override + public boolean isRefreshRequired(PropertyChangeEvent evt) { + if (IngestManager.IngestModuleEvent.DATA_ADDED.toString().equals(evt.getPropertyName()) && evt.getOldValue() instanceof ModuleDataEvent) { + ModuleDataEvent moduleDataEvent = (ModuleDataEvent) evt.getOldValue(); + if (ARTIFACT_TYPES_OF_INTEREST.contains(moduleDataEvent.getBlackboardArtifactType())) { + return true; + } + } + return false; + } + }; + + private final RefreshThrottler refreshThrottler = new RefreshThrottler(refresher); + + private final PropertyChangeListener caseEventListener = WeakListeners.propertyChange((pcl) -> refresh(), null); + + private final Object updateLock = new Object(); + + private AnnotationWorker worker = null; + + private Node node; /** * Creates an instance of AnnotationsContentViewer. @@ -55,23 +109,74 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data public AnnotationsContentViewer() { initComponents(); ContentViewerHtmlStyles.setupHtmlJTextPane(textPanel); + registerListeners(); + } + + @Override + protected void finalize() throws Throwable { + unregisterListeners(); + } + + /** + * Registers case event and ingest event listeners. + */ + private void registerListeners() { + Case.addEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, caseEventListener); + refreshThrottler.registerForIngestModuleEvents();; + } + + /** + * Unregisters case event and ingest event listeners. + */ + private void unregisterListeners() { + Case.removeEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, caseEventListener); + refreshThrottler.unregisterEventListener(); } @Override public void setNode(Node node) { - resetComponent(); + this.node = node; + updateData(this.node, true); + } - if (worker != null) { - worker.cancel(true); - worker = null; - } + /** + * Refreshes the data displayed. + */ + private void refresh() { + updateData(this.node, false); + } + /** + * Updates data displayed in the viewer. + * + * @param node The node to use for data. + * @param forceReset If true, forces a reset cancelling the previous worker + * if one exists and clearing data in the component. If + * false, only submits a worker if no previous worker is + * running. + */ + private void updateData(Node node, boolean forceReset) { if (node == null) { return; } - worker = new AnnotationWorker(node); - worker.execute(); + if (forceReset) { + resetComponent(); + } + + synchronized (updateLock) { + if (worker != null) { + if (forceReset) { + worker.cancel(true); + worker = null; + } else { + return; + } + } + + worker = new AnnotationWorker(node, forceReset); + worker.execute(); + } } /** @@ -151,9 +256,18 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data private class AnnotationWorker extends SwingWorker { private final Node node; + private final boolean resetCaretPosition; - AnnotationWorker(Node node) { + /** + * Main constructor. + * + * @param node The node for which data will be fetched. + * @param resetCaretPosition Whether or not to reset the caret position + * when finished. + */ + AnnotationWorker(Node node, boolean resetCaretPosition) { this.node = node; + this.resetCaretPosition = resetCaretPosition; } @Override @@ -173,17 +287,25 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data @Override public void done() { - if (isCancelled()) { - return; + if (!isCancelled()) { + try { + String text = get(); + ContentViewerHtmlStyles.setStyles(textPanel); + textPanel.setText(text); + + if (resetCaretPosition) { + textPanel.setCaretPosition(0); + } + + } catch (InterruptedException | ExecutionException ex) { + logger.log(Level.SEVERE, "Failed to get annotation information for node", ex); + } } - try { - String text = get(); - ContentViewerHtmlStyles.setStyles(textPanel); - textPanel.setText(text); - textPanel.setCaretPosition(0); - } catch (InterruptedException | ExecutionException ex) { - logger.log(Level.SEVERE, "Failed to get annotation information for node", ex); + synchronized (updateLock) { + if (worker == this) { + worker = null; + } } } From 8b95fec5b4d1c4b0e21ba44eba6df2ade9a461d4 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Wed, 15 Sep 2021 12:26:44 -0400 Subject: [PATCH 03/15] bug fixes --- .../annotations/AnnotationsContentViewer.java | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java index ec3652c6fa..9ed0bb6992 100755 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java @@ -95,8 +95,10 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data private final RefreshThrottler refreshThrottler = new RefreshThrottler(refresher); - private final PropertyChangeListener caseEventListener = WeakListeners.propertyChange((pcl) -> refresh(), null); - + + private final PropertyChangeListener caseEventListener = (pcl) -> refresh(); + private final PropertyChangeListener weakCaseEventListener = WeakListeners.propertyChange(caseEventListener, null); + private final Object updateLock = new Object(); private AnnotationWorker worker = null; @@ -121,8 +123,8 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data * Registers case event and ingest event listeners. */ private void registerListeners() { - Case.addEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, caseEventListener); - refreshThrottler.registerForIngestModuleEvents();; + Case.addEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, weakCaseEventListener); + refreshThrottler.registerForIngestModuleEvents(); } /** @@ -143,7 +145,9 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data * Refreshes the data displayed. */ private void refresh() { - updateData(this.node, false); + if (this.isVisible()) { + updateData(this.node, false); + } } /** From 90364e87d73bad8aa2858000fe475578df423470 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Wed, 15 Sep 2021 12:27:33 -0400 Subject: [PATCH 04/15] formatting --- .../annotations/AnnotationsContentViewer.java | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java index 9ed0bb6992..82fcbdb568 100755 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java @@ -95,14 +95,12 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data private final RefreshThrottler refreshThrottler = new RefreshThrottler(refresher); - private final PropertyChangeListener caseEventListener = (pcl) -> refresh(); private final PropertyChangeListener weakCaseEventListener = WeakListeners.propertyChange(caseEventListener, null); - + private final Object updateLock = new Object(); private AnnotationWorker worker = null; - private Node node; /** @@ -146,7 +144,7 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data */ private void refresh() { if (this.isVisible()) { - updateData(this.node, false); + updateData(this.node, false); } } From ac220d2562f5aae8622773566c2b2104b77b7247 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Wed, 15 Sep 2021 14:44:52 -0400 Subject: [PATCH 05/15] fixes for more precise events --- .../annotations/AnnotationsContentViewer.java | 130 +++++++++++++++--- 1 file changed, 108 insertions(+), 22 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java index 82fcbdb568..0436c83368 100755 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java @@ -27,6 +27,7 @@ import java.util.Set; import java.util.concurrent.ExecutionException; import java.util.logging.Level; import javax.swing.SwingWorker; +import org.apache.commons.lang3.tuple.Pair; import static org.openide.util.NbBundle.Messages; import org.openide.nodes.Node; @@ -36,10 +37,13 @@ import org.sleuthkit.autopsy.coreutils.Logger; import org.jsoup.nodes.Document; import org.openide.util.WeakListeners; import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.events.BlackBoardArtifactTagAddedEvent; +import org.sleuthkit.autopsy.casemodule.events.BlackBoardArtifactTagDeletedEvent; +import org.sleuthkit.autopsy.casemodule.events.CommentChangedEvent; +import org.sleuthkit.autopsy.casemodule.events.ContentTagAddedEvent; +import org.sleuthkit.autopsy.casemodule.events.ContentTagDeletedEvent; import org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles; import org.sleuthkit.autopsy.contentviewers.utils.ViewerPriority; -import org.sleuthkit.autopsy.guiutils.RefreshThrottler; -import org.sleuthkit.autopsy.guiutils.RefreshThrottler.Refresher; import org.sleuthkit.autopsy.ingest.IngestManager; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.BlackboardArtifact; @@ -71,37 +75,59 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT ); - /** - * Refresher used with refresh throttler to listen for artifact events. - */ - private final Refresher refresher = new Refresher() { + private final PropertyChangeListener ingestEventListener = (evt) -> { + Long curArtifactId = AnnotationsContentViewer.this.curArtifactId; + Long curContentId = AnnotationsContentViewer.this.curContentId; - @Override - public void refresh() { - AnnotationsContentViewer.this.refresh(); + if (curArtifactId == null && curContentId == null) { + return; } - @Override - public boolean isRefreshRequired(PropertyChangeEvent evt) { - if (IngestManager.IngestModuleEvent.DATA_ADDED.toString().equals(evt.getPropertyName()) && evt.getOldValue() instanceof ModuleDataEvent) { - ModuleDataEvent moduleDataEvent = (ModuleDataEvent) evt.getOldValue(); - if (ARTIFACT_TYPES_OF_INTEREST.contains(moduleDataEvent.getBlackboardArtifactType())) { - return true; + Pair artifactContentId = getIdsFromEvent(evt); + Long artifactId = artifactContentId.getLeft(); + Long contentId = artifactContentId.getRight(); + + if ((curArtifactId != null && curArtifactId == artifactId) || (curContentId != null && curContentId == contentId)) { + refresh(); + } + }; + + private final PropertyChangeListener weakIngestEventListener = WeakListeners.propertyChange(ingestEventListener, null); + + private final PropertyChangeListener caseEventListener = (evt) -> { + Long curArtifactId = AnnotationsContentViewer.this.curArtifactId; + Long curContentId = AnnotationsContentViewer.this.curContentId; + + if (curArtifactId == null && curContentId == null) { + return; + } + + // if it is a module data event + if (IngestManager.IngestModuleEvent.DATA_ADDED.toString().equals(evt.getPropertyName()) + && evt.getOldValue() instanceof ModuleDataEvent) { + + ModuleDataEvent moduleDataEvent = (ModuleDataEvent) evt.getOldValue(); + + // if an artifact is relevant, refresh + if (ARTIFACT_TYPES_OF_INTEREST.contains(moduleDataEvent.getBlackboardArtifactType())) { + for (BlackboardArtifact artifact : moduleDataEvent.getArtifacts()) { + if (artifact.getArtifactID() == curArtifactId || artifact.getObjectID() == curContentId) { + refresh(); + return; + } } } - return false; } }; - private final RefreshThrottler refreshThrottler = new RefreshThrottler(refresher); - - private final PropertyChangeListener caseEventListener = (pcl) -> refresh(); private final PropertyChangeListener weakCaseEventListener = WeakListeners.propertyChange(caseEventListener, null); private final Object updateLock = new Object(); private AnnotationWorker worker = null; private Node node; + private Long curArtifactId; + private Long curContentId; /** * Creates an instance of AnnotationsContentViewer. @@ -122,15 +148,15 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data */ private void registerListeners() { Case.addEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, weakCaseEventListener); - refreshThrottler.registerForIngestModuleEvents(); + IngestManager.getInstance().addIngestJobEventListener(weakIngestEventListener); } /** * Unregisters case event and ingest event listeners. */ private void unregisterListeners() { - Case.removeEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, caseEventListener); - refreshThrottler.unregisterEventListener(); + Case.removeEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, weakCaseEventListener); + IngestManager.getInstance().removeIngestJobEventListener(weakIngestEventListener); } @Override @@ -139,6 +165,65 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data updateData(this.node, true); } + /** + * Returns a pair of the artifact id (or null) and the content id (or null) + * for the case event. + * + * @param evt The case event. + * + * @return A pair of the artifact id (or null) and the content id (or null) + * for the case event. + */ + private static Pair getIdsFromEvent(PropertyChangeEvent evt) { + Case.Events eventType = null; + try { + eventType = Case.Events.valueOf(evt.getPropertyName()); + } catch (IllegalArgumentException ex) { + logger.log(Level.SEVERE, "Unknown event type: " + evt.getPropertyName(), ex); + return Pair.of(null, null); + } + + Long artifactId = null; + Long contentId = null; + + switch (eventType) { + case BLACKBOARD_ARTIFACT_TAG_ADDED: + if (evt instanceof BlackBoardArtifactTagAddedEvent) { + BlackboardArtifact art = ((BlackBoardArtifactTagAddedEvent) evt).getAddedTag().getArtifact(); + artifactId = art.getArtifactID(); + contentId = art.getObjectID(); + } + break; + case BLACKBOARD_ARTIFACT_TAG_DELETED: + if (evt instanceof BlackBoardArtifactTagDeletedEvent) { + artifactId = ((BlackBoardArtifactTagDeletedEvent) evt).getDeletedTagInfo().getArtifactID(); + contentId = ((BlackBoardArtifactTagDeletedEvent) evt).getDeletedTagInfo().getContentID(); + } + break; + case CONTENT_TAG_ADDED: + if (evt instanceof ContentTagAddedEvent) { + contentId = ((ContentTagAddedEvent) evt).getAddedTag().getContent().getId(); + } + break; + case CONTENT_TAG_DELETED: + if (evt instanceof ContentTagDeletedEvent) { + contentId = ((ContentTagDeletedEvent) evt).getDeletedTagInfo().getContentID(); + } + break; + case CR_COMMENT_CHANGED: + if (evt instanceof CommentChangedEvent) { + long commentObjId = ((CommentChangedEvent) evt).getContentID(); + artifactId = commentObjId; + contentId = commentObjId; + } + break; + default: + break; + }; + + return Pair.of(artifactId, contentId); + } + /** * Refreshes the data displayed. */ @@ -249,6 +334,7 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data @Override public void resetComponent() { textPanel.setText(""); + } /** From 9f820c4f86e39b24c517fbb699449e8da51c3964 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Mon, 20 Sep 2021 11:46:25 -0400 Subject: [PATCH 06/15] fixes --- .../annotations/AnnotationUtils.java | 49 +++++++++++++-- .../annotations/AnnotationsContentViewer.java | 62 +++++++++++-------- 2 files changed, 78 insertions(+), 33 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java index 97cf7d7e6d..a3320d2e02 100755 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java @@ -135,7 +135,7 @@ public class AnnotationUtils { * @return The pair of artifact (or null if not present) and content (either * artifact parent content, the node content, or null). */ - private static Pair getDisplayContent(Node node) { + static DisplayTskItems getDisplayContent(Node node) { BlackboardArtifactItem artItem = node.getLookup().lookup(BlackboardArtifactItem.class); BlackboardArtifact artifact = artItem == null ? null : artItem.getTskContent(); @@ -143,16 +143,18 @@ public class AnnotationUtils { ? artItem.getSourceContent() : node.getLookup().lookup(AbstractFile.class); - return Pair.of(artifact, content); + return new DisplayTskItems(artifact, content); } /** * Returns whether or not the node is supported by the annotation viewer. + * * @param node The node to display. + * * @return True if the node is supported. */ public static boolean isSupported(Node node) { - return getDisplayContent(node).getRight() != null; + return getDisplayContent(node).getContent() != null; } /** @@ -168,9 +170,9 @@ public class AnnotationUtils { Document html = Jsoup.parse(EMPTY_HTML); Element body = html.getElementsByTag("body").first(); - Pair displayPair = getDisplayContent(node); - BlackboardArtifact artifact = displayPair.getLeft(); - Content srcContent = displayPair.getRight(); + DisplayTskItems displayItems = getDisplayContent(node); + BlackboardArtifact artifact = displayItems.getArtifact(); + Content srcContent = displayItems.getContent(); boolean somethingWasRendered = false; if (artifact != null) { @@ -677,4 +679,39 @@ public class AnnotationUtils { } } + /** + * The TSK items that are being displayed as deciphered from the netbeans + * node. + */ + static class DisplayTskItems { + + private final BlackboardArtifact artifact; + private final Content content; + + /** + * Main constructor. + * + * @param artifact The artifact being displayed or null. + * @param content The parent content or source file being displayed or + * null. + */ + DisplayTskItems(BlackboardArtifact artifact, Content content) { + this.artifact = artifact; + this.content = content; + } + + /** + * @return The selected artifact or null if no selected artifact. + */ + BlackboardArtifact getArtifact() { + return artifact; + } + + /** + * @return The parent content or source file being displayed or null. + */ + Content getContent() { + return content; + } + } } diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java index 0436c83368..c01548026b 100755 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java @@ -42,6 +42,7 @@ import org.sleuthkit.autopsy.casemodule.events.BlackBoardArtifactTagDeletedEvent import org.sleuthkit.autopsy.casemodule.events.CommentChangedEvent; import org.sleuthkit.autopsy.casemodule.events.ContentTagAddedEvent; import org.sleuthkit.autopsy.casemodule.events.ContentTagDeletedEvent; +import org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.DisplayTskItems; import org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles; import org.sleuthkit.autopsy.contentviewers.utils.ViewerPriority; import org.sleuthkit.autopsy.ingest.IngestManager; @@ -70,6 +71,8 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data Case.Events.CONTENT_TAG_DELETED, Case.Events.CR_COMMENT_CHANGED); + private static final Set INGEST_MODULE_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestModuleEvent.DATA_ADDED); + private static final Set ARTIFACT_TYPES_OF_INTEREST = ImmutableSet.of( BlackboardArtifact.Type.TSK_HASHSET_HIT, BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT @@ -83,25 +86,6 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data return; } - Pair artifactContentId = getIdsFromEvent(evt); - Long artifactId = artifactContentId.getLeft(); - Long contentId = artifactContentId.getRight(); - - if ((curArtifactId != null && curArtifactId == artifactId) || (curContentId != null && curContentId == contentId)) { - refresh(); - } - }; - - private final PropertyChangeListener weakIngestEventListener = WeakListeners.propertyChange(ingestEventListener, null); - - private final PropertyChangeListener caseEventListener = (evt) -> { - Long curArtifactId = AnnotationsContentViewer.this.curArtifactId; - Long curContentId = AnnotationsContentViewer.this.curContentId; - - if (curArtifactId == null && curContentId == null) { - return; - } - // if it is a module data event if (IngestManager.IngestModuleEvent.DATA_ADDED.toString().equals(evt.getPropertyName()) && evt.getOldValue() instanceof ModuleDataEvent) { @@ -111,7 +95,8 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data // if an artifact is relevant, refresh if (ARTIFACT_TYPES_OF_INTEREST.contains(moduleDataEvent.getBlackboardArtifactType())) { for (BlackboardArtifact artifact : moduleDataEvent.getArtifacts()) { - if (artifact.getArtifactID() == curArtifactId || artifact.getObjectID() == curContentId) { + if ((curArtifactId != null && artifact.getArtifactID() == curArtifactId) + || (curContentId != null && artifact.getObjectID() == curContentId)) { refresh(); return; } @@ -120,6 +105,26 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data } }; + private final PropertyChangeListener weakIngestEventListener = WeakListeners.propertyChange(ingestEventListener, null); + + private final PropertyChangeListener caseEventListener = (evt) -> { + Long curArtifactId = AnnotationsContentViewer.this.curArtifactId; + Long curContentId = AnnotationsContentViewer.this.curContentId; + + if (curArtifactId == null && curContentId == null) { + return; + } + + Pair artifactContentId = getIdsFromEvent(evt); + Long artifactId = artifactContentId.getLeft(); + Long contentId = artifactContentId.getRight(); + + // if there is a match of content id or artifact id and the event, refresh + if ((curArtifactId != null && curArtifactId.equals(artifactId)) || (curContentId != null && curContentId.equals(contentId))) { + refresh(); + } + }; + private final PropertyChangeListener weakCaseEventListener = WeakListeners.propertyChange(caseEventListener, null); private final Object updateLock = new Object(); @@ -138,17 +143,17 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data registerListeners(); } - @Override - protected void finalize() throws Throwable { - unregisterListeners(); - } - /** * Registers case event and ingest event listeners. */ private void registerListeners() { Case.addEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, weakCaseEventListener); - IngestManager.getInstance().addIngestJobEventListener(weakIngestEventListener); + IngestManager.getInstance().addIngestModuleEventListener(INGEST_MODULE_EVENTS_OF_INTEREST, weakIngestEventListener); + } + + @Override + protected void finalize() throws Throwable { + unregisterListeners(); } /** @@ -156,12 +161,15 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data */ private void unregisterListeners() { Case.removeEventTypeSubscriber(CASE_EVENTS_OF_INTEREST, weakCaseEventListener); - IngestManager.getInstance().removeIngestJobEventListener(weakIngestEventListener); + IngestManager.getInstance().addIngestModuleEventListener(INGEST_MODULE_EVENTS_OF_INTEREST, weakIngestEventListener); } @Override public void setNode(Node node) { this.node = node; + DisplayTskItems displayItems = AnnotationUtils.getDisplayContent(node); + this.curArtifactId = displayItems.getArtifact() == null ? null : displayItems.getArtifact().getArtifactID(); + this.curContentId = displayItems.getContent() == null ? null : displayItems.getContent().getId(); updateData(this.node, true); } From b87c8b876c17e5756c3b13b2120aaccb4bcdba14 Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Mon, 20 Sep 2021 16:08:59 -0400 Subject: [PATCH 07/15] Fix for regex patterns that have boundary characters --- .../org/sleuthkit/autopsy/keywordsearch/RegexQuery.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java index eaac4f12b4..31334f852e 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java @@ -364,6 +364,15 @@ final class RegexQuery implements KeywordSearchQuery { } offset = hitMatcher.end(); + if (offset > 1) { + /* NOTE: some of our regex patterns look for boundary characters immediately before and + * after the keyword hit (e.g. PHONE_NUMBER_REGEX, IP_ADDRESS_REGEX). After a match, Java + * pattern mather re-starts at the first character not matched by the previous match. This + * basically requires two boundary characters to be present between each pattern match. + * To mitigate this we are resetting the offest one character back. + */ + offset--; + } final ATTRIBUTE_TYPE artifactAttributeType = originalKeyword.getArtifactAttributeType(); // We attempt to reduce false positives for phone numbers and IP address hits From f780b92af5891e8b601fe3b0f9caa2402619a572 Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Mon, 20 Sep 2021 17:10:29 -0400 Subject: [PATCH 08/15] Limited the changes to IP and email regexes only --- .../autopsy/keywordsearch/RegexQuery.java | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java index 31334f852e..61ddc44921 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java @@ -364,15 +364,6 @@ final class RegexQuery implements KeywordSearchQuery { } offset = hitMatcher.end(); - if (offset > 1) { - /* NOTE: some of our regex patterns look for boundary characters immediately before and - * after the keyword hit (e.g. PHONE_NUMBER_REGEX, IP_ADDRESS_REGEX). After a match, Java - * pattern mather re-starts at the first character not matched by the previous match. This - * basically requires two boundary characters to be present between each pattern match. - * To mitigate this we are resetting the offest one character back. - */ - offset--; - } final ATTRIBUTE_TYPE artifactAttributeType = originalKeyword.getArtifactAttributeType(); // We attempt to reduce false positives for phone numbers and IP address hits @@ -393,6 +384,20 @@ final class RegexQuery implements KeywordSearchQuery { } // Replace all non numeric at the end of the hit. hit = hit.replaceAll("[^0-9]$", ""); + + if (offset > 1) { + /* + * NOTE: our IP and phone number regex patterns look for + * boundary characters immediately before and after + * the keyword hit. After a match, Java pattern + * mather re-starts at the first character not + * matched by the previous match. This basically + * requires two boundary characters to be present + * between each pattern match. To mitigate this we + * are resetting the offest one character back. + */ + offset--; + } } /** From c3f0e1a935f4c435a87c92e8999e9c6053bb4e5f Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Wed, 22 Sep 2021 15:05:19 -0400 Subject: [PATCH 09/15] changes to text in Past Cases tab --- .../autopsy/datasourcesummary/ui/Bundle.properties-MERGED | 2 +- .../sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java | 2 +- .../modules/datasourcesummaryexport/Bundle.properties-MERGED | 2 +- .../report/modules/datasourcesummaryexport/ExportPastCases.java | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED index a7a4e5870f..59bcaa6ff4 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED @@ -66,7 +66,7 @@ GeolocationPanel_onNoCrIngest_message=No results will be shown because the GPX P GeolocationPanel_unknownRow_title=Unknown PastCasesPanel_caseColumn_title=Case PastCasesPanel_countColumn_title=Count -PastCasesPanel_notableFileTable_tabName=Cases with Common Notable +PastCasesPanel_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest PastCasesPanel_onNoCrIngest_message=No results will be shown because the Central Repository module was not run. PastCasesPanel_sameIdsTable_tabName=Past Cases with the Same Devices RecentFilesPanel_attachmentsTable_tabName=Recent Attachments diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java index 08679169d3..f4b4d6e956 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java @@ -41,7 +41,7 @@ import org.sleuthkit.datamodel.DataSource; "PastCasesPanel_caseColumn_title=Case", "PastCasesPanel_countColumn_title=Count", "PastCasesPanel_onNoCrIngest_message=No results will be shown because the Central Repository module was not run.", - "PastCasesPanel_notableFileTable_tabName=Cases with Common Notable", + "PastCasesPanel_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest", "PastCasesPanel_sameIdsTable_tabName=Past Cases with the Same Devices",}) public class PastCasesPanel extends BaseDataSourceSummaryPanel { diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED index 1767afc028..956adf7e01 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED @@ -54,7 +54,7 @@ ExportIngestHistory_startTimeColumn=Start Time ExportIngestHistory_versionColumn=Module Version ExportPastCases_caseColumn_title=Case ExportPastCases_countColumn_title=Count -ExportPastCases_notableFileTable_tabName=Cases with Common Notable +ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices ExportRecentFiles_attachmentsTable_tabName=Recent Attachments ExportRecentFiles_col_head_date=Date diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java index be824477a1..96aefebaff 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java @@ -37,7 +37,7 @@ import org.sleuthkit.datamodel.DataSource; @Messages({ "ExportPastCases_caseColumn_title=Case", "ExportPastCases_countColumn_title=Count", - "ExportPastCases_notableFileTable_tabName=Cases with Common Notable", + "ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest", "ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices",}) class ExportPastCases { From e8df94b393b2b596911934d9ced22fbde0a0554a Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Wed, 22 Sep 2021 22:44:46 -0400 Subject: [PATCH 10/15] fix illegalArgument Exception Fix illegalArgument Exception with corrupt cache files. --- .../recentactivity/Bundle.properties-MERGED | 10 +++++++ .../recentactivity/ChromeCacheExtractor.java | 27 ++++++++++++++----- 2 files changed, 30 insertions(+), 7 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Bundle.properties-MERGED b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Bundle.properties-MERGED index 5b2b92e49b..3aadf1914b 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Bundle.properties-MERGED +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Bundle.properties-MERGED @@ -5,6 +5,10 @@ ChromeCacheExtract_adding_artifacts_msg=Chrome Cache: Adding %d artifacts for an ChromeCacheExtract_adding_extracted_files_msg=Chrome Cache: Adding %d extracted files for analysis. ChromeCacheExtract_loading_files_msg=Chrome Cache: Loading files from %s. ChromeCacheExtractor.moduleName=ChromeCacheExtractor +# {0} - module name +# {1} - row number +# {2} - table length +# {3} - cache path ChromeCacheExtractor.progressMsg={0}: Extracting cache entry {1} of {2} entries from {3} DataSourceUsage_AndroidMedia=Android Media Card DataSourceUsage_DJU_Drone_DAT=DJI Internal SD Card @@ -152,13 +156,19 @@ Firefox.getDlV24.errMsg.errAnalyzeFile={0}: Error while trying to analyze file:{ Firefox.getDlV24.errMsg.errParsingArtifacts={0}: Error parsing {1} Firefox web download artifacts. Progress_Message_Analyze_Registry=Analyzing Registry Files Progress_Message_Analyze_Usage=Data Sources Usage Analysis +# {0} - browserName Progress_Message_Chrome_AutoFill=Chrome Auto Fill Browser {0} +# {0} - browserName Progress_Message_Chrome_Bookmarks=Chrome Bookmarks Browser {0} Progress_Message_Chrome_Cache=Chrome Cache +# {0} - browserName Progress_Message_Chrome_Cookies=Chrome Cookies Browser {0} +# {0} - browserName Progress_Message_Chrome_Downloads=Chrome Downloads Browser {0} Progress_Message_Chrome_FormHistory=Chrome Form History +# {0} - browserName Progress_Message_Chrome_History=Chrome History Browser {0} +# {0} - browserName Progress_Message_Chrome_Logins=Chrome Logins Browser {0} Progress_Message_Edge_Bookmarks=Microsoft Edge Bookmarks Progress_Message_Edge_Cookies=Microsoft Edge Cookies diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java index 42be2d0233..752f8ce4f7 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java @@ -592,8 +592,13 @@ final class ChromeCacheExtractor { // see if it is cached String fileTableKey = cacheFolderName + cacheFileName; - if (cacheFileName.startsWith("f_") && externalFilesTable.containsKey(fileTableKey)) { - return Optional.of(externalFilesTable.get(fileTableKey)); + + if (cacheFileName != null) { + if (cacheFileName.startsWith("f_") && externalFilesTable.containsKey(fileTableKey)) { + return Optional.of(externalFilesTable.get(fileTableKey)); + } + } else { + return Optional.empty(); } if (fileCopyCache.containsKey(fileTableKey)) { @@ -1306,7 +1311,7 @@ final class ChromeCacheExtractor { private String key; // Key may be found within the entry or may be external - CacheEntry(CacheAddress cacheAdress, FileWrapper cacheFileCopy ) throws TskCoreException { + CacheEntry(CacheAddress cacheAdress, FileWrapper cacheFileCopy ) throws TskCoreException, IngestModuleException { this.selfAddress = cacheAdress; this.cacheFileCopy = cacheFileCopy; @@ -1315,7 +1320,11 @@ final class ChromeCacheExtractor { int entryOffset = DATAFILE_HDR_SIZE + cacheAdress.getStartBlock() * cacheAdress.getBlockSize(); // reposition the buffer to the the correct offset - fileROBuf.position(entryOffset); + if (entryOffset < fileROBuf.capacity()) { + fileROBuf.position(entryOffset); + } else { + throw new IngestModuleException("Position seeked in Buffer to big"); // NON-NLS + } hash = fileROBuf.getInt() & UINT32_MASK; @@ -1364,11 +1373,15 @@ final class ChromeCacheExtractor { if (longKeyAddresses != null) { // Key is stored outside of the entry try { - CacheDataSegment data = new CacheDataSegment(longKeyAddresses, this.keyLen, true); - key = data.getDataString(); + if (longKeyAddresses.getFilename() != null) { + CacheDataSegment data = new CacheDataSegment(longKeyAddresses, this.keyLen, true); + key = data.getDataString(); + } } catch (TskCoreException | IngestModuleException ex) { throw new TskCoreException(String.format("Failed to get external key from address %s", longKeyAddresses)); //NON-NLS - } +// } catch (NullPointerException ex) { +// String name = "a"; + } } else { // key stored within entry StringBuilder strBuilder = new StringBuilder(MAX_KEY_LEN); From d594b06c3df1191031d8f3ae6e49e4998e4b51ca Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Wed, 22 Sep 2021 22:50:23 -0400 Subject: [PATCH 11/15] Update ChromeCacheExtractor.java Remove commented code. --- .../sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java | 2 -- 1 file changed, 2 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java index 752f8ce4f7..616b13d41f 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java @@ -1379,8 +1379,6 @@ final class ChromeCacheExtractor { } } catch (TskCoreException | IngestModuleException ex) { throw new TskCoreException(String.format("Failed to get external key from address %s", longKeyAddresses)); //NON-NLS -// } catch (NullPointerException ex) { -// String name = "a"; } } else { // key stored within entry From 461f5b2e4d831d3686d034f360fdd11680341d3c Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Thu, 23 Sep 2021 13:37:09 -0400 Subject: [PATCH 12/15] Update ExtractZoneIdentifier.java Try catch for IllegalArgument when it is thrown. log message and continue on processing --- .../autopsy/recentactivity/ExtractZoneIdentifier.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java index fc59685f9e..5cc6633205 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java @@ -318,7 +318,13 @@ final class ExtractZoneIdentifier extends Extract { */ ZoneIdentifierInfo(AbstractFile zoneFile) throws IOException { fileName = zoneFile.getName(); - properties.load(new ReadContentInputStream(zoneFile)); + // properties.load will throw IllegalArgument if unicode characters are found in the zone file. + try { + properties.load(new ReadContentInputStream(zoneFile)); + } catch (IllegalArgumentException ex) { + String message = String.format("Unable to parse Zone Id for File %s", fileName); //NON-NLS + LOG.log(Level.WARNING, message); + } } /** From b4b869dde686060763e271c5566e78f7ec09a06e Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Thu, 23 Sep 2021 13:41:52 -0400 Subject: [PATCH 13/15] Revert "7989 temp fix for 'sliced' artifact objects" This reverts commit e2b92669f5aa03a901f2e245a6be3f6a498a3ad5. --- .../autopsy/datamodel/BlackboardArtifactItem.java | 10 +++++----- .../autopsy/datamodel/BlackboardArtifactNode.java | 4 +--- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java index 9748c3b747..9a4d9e8c22 100755 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java @@ -23,13 +23,13 @@ import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.Content; /** - * An super class for an Autopsy Data Model item class with an underlying - * BlackboardArtifact Sleuth Kit Data Model object, i.e., a DataArtifact or an - * AnalysisResult. + * An abstract super class for an Autopsy Data Model item class with an + * underlying BlackboardArtifact Sleuth Kit Data Model object, i.e., a + * DataArtifact or an AnalysisResult. * - * @param The concrete BlackboardArtifact class type. + * @param The concrete BlackboardArtifact sub class type. */ -public class BlackboardArtifactItem extends TskContentItem { +public abstract class BlackboardArtifactItem extends TskContentItem { private final Content sourceContent; diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 2fcba80feb..cc32ae029f 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -384,10 +384,8 @@ public class BlackboardArtifactNode extends AbstractContentNode artifactItem; if (artifact instanceof AnalysisResult) { artifactItem = new AnalysisResultItem((AnalysisResult) artifact, content); - } else if (artifact instanceof DataArtifact) { - artifactItem = new DataArtifactItem((DataArtifact) artifact, content); } else { - artifactItem = new BlackboardArtifactItem<>(artifact, content); + artifactItem = new DataArtifactItem((DataArtifact) artifact, content); } /* From ce2f31b1ae83ed2ae09ed152224d2d7d2db85683 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Fri, 24 Sep 2021 12:26:57 -0400 Subject: [PATCH 14/15] Fixed datasource summary tab name --- .../autopsy/datasourcesummary/ui/Bundle.properties-MERGED | 2 +- .../autopsy/datasourcesummary/ui/RecentFilesPanel.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED index 59bcaa6ff4..06ca641cf7 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED @@ -75,7 +75,7 @@ RecentFilesPanel_col_header_domain=Domain RecentFilesPanel_col_header_path=Path RecentFilesPanel_col_header_sender=Sender RecentFilesPanel_docsTable_tabName=Recently Opened Documents -RecentFilesPanel_downloadsTable_tabName=Recently Downloads +RecentFilesPanel_downloadsTable_tabName=Recent Downloads RecentFilesPanel_no_open_documents=No recently open documents found. SizeRepresentationUtil_units_bytes=bytes SizeRepresentationUtil_units_gigabytes=GB diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/RecentFilesPanel.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/RecentFilesPanel.java index 0bc09d59ec..4773dae2fc 100755 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/RecentFilesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/RecentFilesPanel.java @@ -47,7 +47,7 @@ import org.sleuthkit.datamodel.DataSource; */ @Messages({ "RecentFilesPanel_docsTable_tabName=Recently Opened Documents", - "RecentFilesPanel_downloadsTable_tabName=Recently Downloads", + "RecentFilesPanel_downloadsTable_tabName=Recent Downloads", "RecentFilesPanel_attachmentsTable_tabName=Recent Attachments",}) public final class RecentFilesPanel extends BaseDataSourceSummaryPanel { From 47d842a3eb04bb338507fb9b2555eb0a598a2ef3 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Fri, 24 Sep 2021 15:07:25 -0400 Subject: [PATCH 15/15] 7978 change returning new array list to Collections.emptyList() --- .../centralrepository/application/OtherOccurrences.java | 4 ++-- .../datamodel/CorrelationAttributeUtil.java | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java b/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java index 85f0fcd6de..f1f0b5ea91 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java @@ -25,8 +25,8 @@ import java.nio.file.Files; import java.text.DateFormat; import java.text.ParseException; import java.text.SimpleDateFormat; -import java.util.ArrayList; import java.util.Collection; +import java.util.Collections; import java.util.HashMap; import java.util.List; import java.util.Locale; @@ -89,7 +89,7 @@ public final class OtherOccurrences { logger.log(Level.INFO, String.format("Unable to check create CorrelationAttribtueInstance for osAccount %s.", osAccountAddr.get()), ex); } } - return new ArrayList<>(); + return Collections.emptyList(); } /** diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java index ffd9c96399..bc934b0926 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java @@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.centralrepository.datamodel; import java.util.ArrayList; import java.util.Arrays; +import java.util.Collections; import java.util.HashSet; import java.util.List; import java.util.Optional; @@ -86,7 +87,7 @@ public class CorrelationAttributeUtil { if (artifactTypeID == ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() || artifactTypeID == ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() || artifactTypeID == ARTIFACT_TYPE.TSK_CONTACT.getTypeID()) { - return new ArrayList<>(); + return Collections.emptyList(); } return CorrelationAttributeUtil.makeCorrAttrsForSearch(artifact); } @@ -109,7 +110,7 @@ public class CorrelationAttributeUtil { } public static List makeCorrAttrsToSave(AnalysisResult file) { - return new ArrayList<>(); + return Collections.emptyList(); } public static List makeCorrAttrsToSave(OsAccountInstance osAccountInstance) { @@ -354,7 +355,7 @@ public class CorrelationAttributeUtil { /* * Normalize the phone number. */ - List corrAttrInstances = new ArrayList<>(); + List corrAttrInstances = Collections.emptyList(); if (value != null && CorrelationAttributeNormalizer.isValidPhoneNumber(value)) { value = CorrelationAttributeNormalizer.normalizePhone(value);