mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 18:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

5020 initial query changes to fully populate correlation case

Browse Source
This commit is contained in:
William Schaefer 2019-05-08 18:09:36 -04:00
parent 43f23da38a
commit c65937f822
1 changed files with 24 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java
View File

@ -1117,16 +1117,17 @@ abstract class AbstractSqlEamDb implements EamDb {
String sql String sql
= "SELECT " = "SELECT "
+ tableName + tableName
+ ".id," + ".id as instance_id,"
+ tableName + tableName
+ ".value," + ".value,"
+ tableName + tableName
+ ".file_obj_id," + ".file_obj_id,"
+ " cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " + " cases.*, organizations.org_name, organizations.poc_name, organizations.poc_email, organizations.poc_phone, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM "
+ tableName + tableName
+ " LEFT JOIN cases ON " + " LEFT JOIN cases ON "
+ tableName + tableName
+ ".case_id=cases.id" + ".case_id=cases.id"
+ " LEFT JOIN organizations ON cases.org_id=organizations.id"
+ " LEFT JOIN data_sources ON " + " LEFT JOIN data_sources ON "
+ tableName + tableName
+ ".data_source_id=data_sources.id" + ".data_source_id=data_sources.id"
@ -1212,16 +1213,17 @@ abstract class AbstractSqlEamDb implements EamDb {
String sql String sql
= "SELECT " = "SELECT "
+ tableName + tableName
+ ".id, " + ".id as instance_id, "
+ tableName + tableName
+ ".value," + ".value,"
+ tableName + tableName
+ ".file_obj_id," + ".file_obj_id,"
+ " cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " + " cases.*, organizations.org_name, organizations.poc_name, organizations.poc_email, organizations.poc_phone, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM "
+ tableName + tableName
+ " LEFT JOIN cases ON " + " LEFT JOIN cases ON "
+ tableName + tableName
+ ".case_id=cases.id" + ".case_id=cases.id"
+ " LEFT JOIN organizations ON cases.org_id=organizations.id"
+ " LEFT JOIN data_sources ON " + " LEFT JOIN data_sources ON "
+ tableName + tableName
+ ".data_source_id=data_sources.id" + ".data_source_id=data_sources.id"
@ -1937,16 +1939,17 @@ abstract class AbstractSqlEamDb implements EamDb {
String sql String sql
= "SELECT " = "SELECT "
+ tableName + tableName
+ ".id, " + ".id as instance_id, "
+ tableName + tableName
+ ".value, " + ".value, "
+ tableName + tableName
+ ".file_obj_id," + ".file_obj_id,"
+ "cases.case_name, cases.case_uid, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " + "cases.*, organizations.org_name, organizations.poc_name, organizations.poc_email, organizations.poc_phone, data_sources.id AS data_source_id, data_sources.name, device_id, file_path, known_status, comment, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM "
+ tableName + tableName
+ " LEFT JOIN cases ON " + " LEFT JOIN cases ON "
+ tableName + tableName
+ ".case_id=cases.id" + ".case_id=cases.id"
+ " LEFT JOIN organizations ON cases.org_id=organizations.id"
+ " LEFT JOIN data_sources ON " + " LEFT JOIN data_sources ON "
+ tableName + tableName
+ ".data_source_id=data_sources.id" + ".data_source_id=data_sources.id"
@ -1999,11 +2002,14 @@ abstract class AbstractSqlEamDb implements EamDb {
String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType); String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType);
String sql String sql
= "SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, id, value, file_obj_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM " = "SELECT cases.*, organizations.org_name, organizations.poc_name, organizations.poc_email, organizations.poc_phone, data_sources.name, device_id, file_path, known_status, comment, "
+ tableName
+ ".id as instance_id, value, file_obj_id, data_sources.datasource_obj_id, data_sources.md5, data_sources.sha1, data_sources.sha256 FROM "
+ tableName + tableName
+ " LEFT JOIN cases ON " + " LEFT JOIN cases ON "
+ tableName + tableName
+ ".case_id=cases.id" + ".case_id=cases.id"
+ " LEFT JOIN organizations ON cases.org_id=organizations.id"
+ " LEFT JOIN data_sources ON " + " LEFT JOIN data_sources ON "
+ tableName + tableName
+ ".data_source_id=data_sources.id" + ".data_source_id=data_sources.id"
@ -3321,11 +3327,20 @@ abstract class AbstractSqlEamDb implements EamDb {
if (null == resultSet) { if (null == resultSet) {
return null; return null;
} }
EamOrganization eamOrg = new EamOrganization(resultSet.getInt("org_id"),
resultSet.getString("org_name"),
resultSet.getString("poc_name"),
resultSet.getString("poc_email"),
resultSet.getString("poc_phone"));
return new CorrelationAttributeInstance( return new CorrelationAttributeInstance(
aType, aType,
resultSet.getString("value"), resultSet.getString("value"),
resultSet.getInt("id"), resultSet.getInt("instance_id"),
new CorrelationCase(resultSet.getInt("case_id"), resultSet.getString("case_uid"), resultSet.getString("case_name")), new CorrelationCase(resultSet.getInt("id"), resultSet.getString("case_uid"), eamOrg, resultSet.getString("case_name"),
resultSet.getString("creation_date"), resultSet.getString("case_number"), resultSet.getString("examiner_name"),
resultSet.getString("examiner_email"), resultSet.getString("examiner_phone"), resultSet.getString("notes")),
new CorrelationDataSource( new CorrelationDataSource(
resultSet.getInt("case_id"), resultSet.getInt("data_source_id"), resultSet.getString("device_id"), resultSet.getString("name"), resultSet.getInt("case_id"), resultSet.getInt("data_source_id"), resultSet.getString("device_id"), resultSet.getString("name"),
resultSet.getLong("datasource_obj_id"), resultSet.getString("md5"), resultSet.getString("sha1"), resultSet.getString("sha256")), resultSet.getLong("datasource_obj_id"), resultSet.getString("md5"), resultSet.getString("sha1"), resultSet.getString("sha256")),