mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-13 08:26:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

first pass at fixing all the merge conflicts

Browse Source
This commit is contained in:
Brian Sweeney 2018-08-24 17:18:59 -06:00
parent 33837e8d18
commit c829b57ec9
14 changed files with 163 additions and 138 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Core/src/org/sleuthkit/autopsy/centralrepository/AddEditCentralRepoCommentAction.java
View File

@ -24,8 +24,6 @@ import javax.swing.AbstractAction;
import org.openide.DialogDisplayer; import org.openide.DialogDisplayer;
import org.openide.NotifyDescriptor; import org.openide.NotifyDescriptor;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil; import org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb;

69
Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/DataContentViewerOtherCases.java
View File

@ -52,6 +52,7 @@ import javax.swing.table.TableColumn;
import org.joda.time.DateTimeZone; import org.joda.time.DateTimeZone;
import org.joda.time.LocalDateTime; import org.joda.time.LocalDateTime;
import org.openide.nodes.Node; import org.openide.nodes.Node;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.openide.util.lookup.ServiceProvider; import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
@ -140,8 +141,6 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
} }
} catch (EamDbException ex) { } catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error performing Add/Edit Comment action", ex); //NON-NLS LOGGER.log(Level.SEVERE, "Error performing Add/Edit Comment action", ex); //NON-NLS
} catch(CorrelationAttributeNormalizationException ex){
LOGGER.log(Level.INFO, "Error performing Add/Edit Comment action", ex); //NON-NLS
} }
} }
} }
@ -185,12 +184,12 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
try { try {
percentage = dbManager.getFrequencyPercentage(eamArtifact); percentage = dbManager.getFrequencyPercentage(eamArtifact);
msg.append(Bundle.DataContentViewerOtherCases_correlatedArtifacts_byType(percentage, msg.append(Bundle.DataContentViewerOtherCases_correlatedArtifacts_byType(percentage,
eamArtifact.getCorrelationType().getDisplayName(), eamArtifact.getCorrelationType().getDisplayName(),
eamArtifact.getCorrelationValue())); eamArtifact.getCorrelationValue()));
} catch (CorrelationAttributeNormalizationException ex) { } catch (CorrelationAttributeNormalizationException ex) {
String message = String.format("Unable to determine commonality for artifact %s", eamArtifact.toString()); Exceptions.printStackTrace(ex);
LOGGER.log(Level.INFO, message, ex);
} }
} }
JOptionPane.showConfirmDialog(showCommonalityMenuItem, JOptionPane.showConfirmDialog(showCommonalityMenuItem,
msg.toString(), msg.toString(),
@ -446,14 +445,18 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
for (CorrelationAttributeInstance.Type aType : artifactTypes) { for (CorrelationAttributeInstance.Type aType : artifactTypes) {
if (aType.getId() == CorrelationAttributeInstance.FILES_TYPE_ID) { if (aType.getId() == CorrelationAttributeInstance.FILES_TYPE_ID) {
CorrelationCase corCase = EamDb.getInstance().getCase(Case.getCurrentCase()); CorrelationCase corCase = EamDb.getInstance().getCase(Case.getCurrentCase());
ret.add(new CorrelationAttributeInstance( try {
md5, ret.add(new CorrelationAttributeInstance(
aType, md5,
corCase, aType,
CorrelationDataSource.fromTSKDataSource(corCase, file.getDataSource()), corCase,
file.getParentPath() + file.getName(), CorrelationDataSource.fromTSKDataSource(corCase, file.getDataSource()),
"", file.getParentPath() + file.getName(),
file.getKnown())); "",
file.getKnown()));
} catch (CorrelationAttributeNormalizationException ex) {
LOGGER.log(Level.INFO, String.format("Unable to check create CorrelationAttribtueInstance for value %s and type %s.", md5, aType.toString()), ex);
}
break; break;
} }
} }
@ -463,16 +466,26 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
} }
} else { } else {
try {
// If EamDb not enabled, get the Files default correlation type to allow Other Occurances to be enabled. // If EamDb not enabled, get the Files default correlation type to allow Other Occurances to be enabled.
if (this.file != null) { if (this.file != null) {
String md5 = this.file.getMd5Hash(); String md5 = this.file.getMd5Hash();
if (md5 != null && !md5.isEmpty()) { if (md5 != null && !md5.isEmpty()) {
ret.add(new CorrelationAttributeInstance(CorrelationAttributeInstance.getDefaultCorrelationTypes().get(0), md5)); try {
final CorrelationAttributeInstance.Type fileAttributeType
= CorrelationAttributeInstance.getDefaultCorrelationTypes()
.stream()
.filter(attrType -> attrType.getId() == CorrelationAttributeInstance.FILES_TYPE_ID)
.findAny()
.get();
ret.add(new CorrelationAttributeInstance(fileAttributeType, md5));
} catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error connecting to DB", ex); // NON-NLS
} catch (CorrelationAttributeNormalizationException ex) {
LOGGER.log(Level.INFO, String.format("Unable to create CorrelationAttributeInstance for value %s", md5), ex); // NON-NLS
} }
} }
} catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error connecting to DB", ex); // NON-NLS
} }
} }
@ -519,9 +532,9 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
* artifact. If the central repo is not enabled, this will only return files * artifact. If the central repo is not enabled, this will only return files
* from the current case with matching MD5 hashes. * from the current case with matching MD5 hashes.
* *
* @param corAttr CorrelationAttribute to query for * @param corAttr CorrelationAttribute to query for
* @param dataSourceName Data source to filter results * @param dataSourceName Data source to filter results
* @param deviceId Device Id to filter results * @param deviceId Device Id to filter results
* *
* @return A collection of correlated artifact instances * @return A collection of correlated artifact instances
*/ */
@ -567,7 +580,7 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
return nodeDataMap; return nodeDataMap;
} catch (EamDbException ex) { } catch (EamDbException ex) {
LOGGER.log(Level.SEVERE, "Error getting artifact instances from database.", ex); // NON-NLS LOGGER.log(Level.SEVERE, "Error getting artifact instances from database.", ex); // NON-NLS
} catch(CorrelationAttributeNormalizationException ex) { } catch (CorrelationAttributeNormalizationException ex) {
LOGGER.log(Level.INFO, "Error getting artifact instances from database.", ex); // NON-NLS LOGGER.log(Level.INFO, "Error getting artifact instances from database.", ex); // NON-NLS
} catch (NoCurrentCaseException ex) { } catch (NoCurrentCaseException ex) {
LOGGER.log(Level.SEVERE, "Exception while getting open case.", ex); // NON-NLS LOGGER.log(Level.SEVERE, "Exception while getting open case.", ex); // NON-NLS
@ -584,7 +597,7 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
* Get all other abstract files in the current case with the same MD5 as the * Get all other abstract files in the current case with the same MD5 as the
* selected node. * selected node.
* *
* @param corAttr The CorrelationAttribute containing the MD5 to search for * @param corAttr The CorrelationAttribute containing the MD5 to search for
* @param openCase The current case * @param openCase The current case
* *
* @return List of matching AbstractFile objects * @return List of matching AbstractFile objects
@ -737,8 +750,8 @@ public class DataContentViewerOtherCases extends JPanel implements DataContentVi
* Adjust a given column for the text provided. * Adjust a given column for the text provided.
* *
* @param columnIndex The index of the column to adjust. * @param columnIndex The index of the column to adjust.
* @param text The text whose length will be used to adjust the * @param text The text whose length will be used to adjust the column
* column width. * width.
*/ */
private void setColumnWidthToText(int columnIndex, String text) { private void setColumnWidthToText(int columnIndex, String text) {
TableColumn column = otherCasesTable.getColumnModel().getColumn(columnIndex); TableColumn column = otherCasesTable.getColumnModel().getColumn(columnIndex);

2
Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrenceNodeInstanceData.java
View File

@ -19,8 +19,6 @@
package org.sleuthkit.autopsy.centralrepository.contentviewer; package org.sleuthkit.autopsy.centralrepository.contentviewer;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;

39
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java
View File

@ -35,6 +35,7 @@ import java.util.HashMap;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.logging.Level; import java.util.logging.Level;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import static org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.updateSchemaVersion; import static org.sleuthkit.autopsy.centralrepository.datamodel.EamDbUtil.updateSchemaVersion;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
@ -712,7 +713,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* @throws EamDbException * @throws EamDbException
*/ */
@Override @Override
public List<CorrelationAttributeInstance> getArtifactInstancesByTypeValue(CorrelationAttribute.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException { public List<CorrelationAttributeInstance> getArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value); String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value);
@ -809,8 +810,12 @@ abstract class AbstractSqlEamDb implements EamDb {
preparedStatement.setString(1, filePath.toLowerCase()); preparedStatement.setString(1, filePath.toLowerCase());
resultSet = preparedStatement.executeQuery(); resultSet = preparedStatement.executeQuery();
while (resultSet.next()) { while (resultSet.next()) {
artifactInstance = getEamArtifactInstanceFromResultSet(resultSet, aType); try {
artifactInstances.add(artifactInstance); artifactInstance = getEamArtifactInstanceFromResultSet(resultSet, aType);
artifactInstances.add(artifactInstance);
} catch (CorrelationAttributeNormalizationException ex) {
logger.log(Level.INFO, "Unable to get artifact instance from resultset.", ex);
}
} }
} catch (SQLException ex) { } catch (SQLException ex) {
throw new EamDbException("Error getting artifact instances by artifactType and artifactValue.", ex); // NON-NLS throw new EamDbException("Error getting artifact instances by artifactType and artifactValue.", ex); // NON-NLS
@ -834,7 +839,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* ArtifactValue. * ArtifactValue.
*/ */
@Override @Override
public Long getCountArtifactInstancesByTypeValue(CorrelationAttribute.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException { public Long getCountArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value); String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value);
Connection conn = connect(); Connection conn = connect();
@ -867,7 +872,7 @@ abstract class AbstractSqlEamDb implements EamDb {
} }
@Override @Override
public int getFrequencyPercentage(CorrelationAttributeInstance corAttr) throws EamDbException { public int getFrequencyPercentage(CorrelationAttributeInstance corAttr) throws EamDbException, CorrelationAttributeNormalizationException {
if (corAttr == null) { if (corAttr == null) {
throw new EamDbException("CorrelationAttribute is null"); throw new EamDbException("CorrelationAttribute is null");
} }
@ -888,7 +893,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* @return Number of unique tuples * @return Number of unique tuples
*/ */
@Override @Override
public Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttribute.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException { public Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value); String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value);
Connection conn = connect(); Connection conn = connect();
@ -1326,7 +1331,7 @@ abstract class AbstractSqlEamDb implements EamDb {
correlationAttributeInstance = new CorrelationAttributeInstance(type, value, correlationAttributeInstance = new CorrelationAttributeInstance(type, value,
instanceId, correlationCase, correlationDataSource, filePath, comment, TskData.FileKnown.valueOf((byte) knownStatus)); instanceId, correlationCase, correlationDataSource, filePath, comment, TskData.FileKnown.valueOf((byte) knownStatus));
} }
} catch (CorrelationAttributeNormalizationException | SQLException ex) { } catch (SQLException ex) {
throw new EamDbException("Error getting notable artifact instances.", ex); // NON-NLS throw new EamDbException("Error getting notable artifact instances.", ex); // NON-NLS
} finally { } finally {
EamDbUtil.closeStatement(preparedStatement); EamDbUtil.closeStatement(preparedStatement);
@ -1446,7 +1451,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* @return List with 0 or more matching eamArtifact instances. * @return List with 0 or more matching eamArtifact instances.
*/ */
@Override @Override
public List<CorrelationAttributeInstance> getArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException { public List<CorrelationAttributeInstance> getArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value); String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value);
Connection conn = connect(); Connection conn = connect();
@ -1539,8 +1544,12 @@ abstract class AbstractSqlEamDb implements EamDb {
preparedStatement.setByte(1, TskData.FileKnown.BAD.getFileKnownValue()); preparedStatement.setByte(1, TskData.FileKnown.BAD.getFileKnownValue());
resultSet = preparedStatement.executeQuery(); resultSet = preparedStatement.executeQuery();
while (resultSet.next()) { while (resultSet.next()) {
artifactInstance = getEamArtifactInstanceFromResultSet(resultSet, aType); try {
artifactInstances.add(artifactInstance); artifactInstance = getEamArtifactInstanceFromResultSet(resultSet, aType);
artifactInstances.add(artifactInstance);
} catch (CorrelationAttributeNormalizationException ex) {
logger.log(Level.INFO, "Unable to get artifact instance from resultset.", ex);
}
} }
} catch (SQLException ex) { } catch (SQLException ex) {
throw new EamDbException("Error getting notable artifact instances.", ex); // NON-NLS throw new EamDbException("Error getting notable artifact instances.", ex); // NON-NLS
@ -1562,7 +1571,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* @return Number of matching eamArtifacts * @return Number of matching eamArtifacts
*/ */
@Override @Override
public Long getCountArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException { public Long getCountArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value); String normalizedValue = CorrelationAttributeNormalizer.normalize(aType, value);
@ -1609,7 +1618,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* @throws EamDbException * @throws EamDbException
*/ */
@Override @Override
public List<String> getListCasesHavingArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException { public List<String> getListCasesHavingArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizeValuedd = CorrelationAttributeNormalizer.normalize(aType, value); String normalizeValuedd = CorrelationAttributeNormalizer.normalize(aType, value);
@ -1807,7 +1816,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* @return Global known status of the artifact * @return Global known status of the artifact
*/ */
@Override @Override
public boolean isArtifactKnownBadByReference(CorrelationAttribute.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException { public boolean isArtifactKnownBadByReference(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizeValued = CorrelationAttributeNormalizer.normalize(aType, value); String normalizeValued = CorrelationAttributeNormalizer.normalize(aType, value);
@ -2406,7 +2415,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* @throws EamDbException * @throws EamDbException
*/ */
@Override @Override
public List<EamGlobalFileInstance> getReferenceInstancesByTypeValue(CorrelationAttribute.Type aType, String aValue) throws EamDbException, CorrelationAttributeNormalizationException { public List<EamGlobalFileInstance> getReferenceInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String aValue) throws EamDbException, CorrelationAttributeNormalizationException {
String normalizeValued = CorrelationAttributeNormalizer.normalize(aType, aValue); String normalizeValued = CorrelationAttributeNormalizer.normalize(aType, aValue);
Connection conn = connect(); Connection conn = connect();
@ -2813,7 +2822,7 @@ abstract class AbstractSqlEamDb implements EamDb {
* *
* @throws SQLException when an expected column name is not in the resultSet * @throws SQLException when an expected column name is not in the resultSet
*/ */
private CorrelationAttributeInstance getEamArtifactInstanceFromResultSet(ResultSet resultSet, CorrelationAttributeInstance.Type aType) throws SQLException, EamDbException { private CorrelationAttributeInstance getEamArtifactInstanceFromResultSet(ResultSet resultSet, CorrelationAttributeInstance.Type aType) throws SQLException, EamDbException, CorrelationAttributeNormalizationException {
if (null == resultSet) { if (null == resultSet) {
return null; return null;
} }

16
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeInstance.java
View File

@ -55,7 +55,7 @@ public class CorrelationAttributeInstance implements Serializable {
CorrelationCase eamCase, CorrelationCase eamCase,
CorrelationDataSource eamDataSource, CorrelationDataSource eamDataSource,
String filePath String filePath
) throws EamDbException { ) throws EamDbException, CorrelationAttributeNormalizationException {
this(correlationType, correlationValue, -1, eamCase, eamDataSource, filePath, null, TskData.FileKnown.UNKNOWN); this(correlationType, correlationValue, -1, eamCase, eamDataSource, filePath, null, TskData.FileKnown.UNKNOWN);
} }
@ -67,7 +67,7 @@ public class CorrelationAttributeInstance implements Serializable {
String filePath, String filePath,
String comment, String comment,
TskData.FileKnown knownStatus TskData.FileKnown knownStatus
) throws EamDbException { ) throws EamDbException, CorrelationAttributeNormalizationException {
this(correlationType, correlationValue, -1, eamCase, eamDataSource, filePath, comment, knownStatus); this(correlationType, correlationValue, -1, eamCase, eamDataSource, filePath, comment, knownStatus);
} }
@ -76,7 +76,7 @@ public class CorrelationAttributeInstance implements Serializable {
String correlationValue, String correlationValue,
CorrelationCase correlationCase, CorrelationCase correlationCase,
CorrelationDataSource fromTSKDataSource, CorrelationDataSource fromTSKDataSource,
String string) throws EamDbException { String string) throws EamDbException, CorrelationAttributeNormalizationException {
this(correlationType, correlationValue, -1, correlationCase, fromTSKDataSource, string, "", TskData.FileKnown.UNKNOWN); this(correlationType, correlationValue, -1, correlationCase, fromTSKDataSource, string, "", TskData.FileKnown.UNKNOWN);
} }
@ -86,7 +86,7 @@ public class CorrelationAttributeInstance implements Serializable {
* @param aType CorrelationAttributeInstance.Type * @param aType CorrelationAttributeInstance.Type
* @param value correlation value * @param value correlation value
*/ */
public CorrelationAttributeInstance(Type aType, String value) throws EamDbException { public CorrelationAttributeInstance(Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
this(aType, value, -1, null, null, "", "", TskData.FileKnown.UNKNOWN); this(aType, value, -1, null, null, "", "", TskData.FileKnown.UNKNOWN);
} }
@ -99,17 +99,13 @@ public class CorrelationAttributeInstance implements Serializable {
String filePath, String filePath,
String comment, String comment,
TskData.FileKnown knownStatus TskData.FileKnown knownStatus
) throws EamDbException { ) throws EamDbException, CorrelationAttributeNormalizationException {
if (filePath == null) { if (filePath == null) {
throw new EamDbException("file path is null"); throw new EamDbException("file path is null");
} }
if (value == null) {
throw new EamDbException("correlation value is null");
}
this.correlationType = type; this.correlationType = type;
this.correlationValue = value; this.correlationValue = CorrelationAttributeNormalizer.normalize(type, value);
this.ID = instanceId; this.ID = instanceId;
this.correlationCase = eamCase; this.correlationCase = eamCase;
this.correlationDataSource = eamDataSource; this.correlationDataSource = eamDataSource;

18
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeNormalizer.java
View File

@ -43,7 +43,7 @@ final public class CorrelationAttributeNormalizer {
* *
* @return normalized data * @return normalized data
*/ */
public static String normalize(CorrelationAttribute.Type attributeType, String data) throws CorrelationAttributeNormalizationException { public static String normalize(CorrelationAttributeInstance.Type attributeType, String data) throws CorrelationAttributeNormalizationException {
final String errorMessage = "Validator function not found for attribute type: %s"; final String errorMessage = "Validator function not found for attribute type: %s";
@ -52,15 +52,15 @@ final public class CorrelationAttributeNormalizer {
} }
switch(attributeType.getId()){ switch(attributeType.getId()){
case CorrelationAttribute.FILES_TYPE_ID: case CorrelationAttributeInstance.FILES_TYPE_ID:
return normalizeMd5(data); return normalizeMd5(data);
case CorrelationAttribute.DOMAIN_TYPE_ID: case CorrelationAttributeInstance.DOMAIN_TYPE_ID:
return normalizeDomain(data); return normalizeDomain(data);
case CorrelationAttribute.EMAIL_TYPE_ID: case CorrelationAttributeInstance.EMAIL_TYPE_ID:
return normalizeEmail(data); return normalizeEmail(data);
case CorrelationAttribute.PHONE_TYPE_ID: case CorrelationAttributeInstance.PHONE_TYPE_ID:
return normalizePhone(data); return normalizePhone(data);
case CorrelationAttribute.USBID_TYPE_ID: case CorrelationAttributeInstance.USBID_TYPE_ID:
return normalizeUsbId(data); return normalizeUsbId(data);
default: default:
throw new CorrelationAttributeNormalizationException(String.format(errorMessage, attributeType.getDisplayName())); throw new CorrelationAttributeNormalizationException(String.format(errorMessage, attributeType.getDisplayName()));
@ -78,11 +78,11 @@ final public class CorrelationAttributeNormalizer {
*/ */
public static String normalize(int attributeTypeId, String data) throws CorrelationAttributeNormalizationException { public static String normalize(int attributeTypeId, String data) throws CorrelationAttributeNormalizationException {
try { try {
List<CorrelationAttribute.Type> defaultTypes = CorrelationAttribute.getDefaultCorrelationTypes(); List<CorrelationAttributeInstance.Type> defaultTypes = CorrelationAttributeInstance.getDefaultCorrelationTypes();
Optional<CorrelationAttribute.Type> typeOption = defaultTypes.stream().filter(attributeType -> attributeType.getId() == attributeTypeId).findAny(); Optional<CorrelationAttributeInstance.Type> typeOption = defaultTypes.stream().filter(attributeType -> attributeType.getId() == attributeTypeId).findAny();
if(typeOption.isPresent()){ if(typeOption.isPresent()){
CorrelationAttribute.Type type = typeOption.get(); CorrelationAttributeInstance.Type type = typeOption.get();
return CorrelationAttributeNormalizer.normalize(type, data); return CorrelationAttributeNormalizer.normalize(type, data);
} else { } else {
throw new CorrelationAttributeNormalizationException(String.format("Given attributeTypeId did not correspond to any known Attribute: %s", attributeTypeId)); throw new CorrelationAttributeNormalizationException(String.format("Given attributeTypeId did not correspond to any known Attribute: %s", attributeTypeId));

58
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactUtil.java
View File

@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.centralrepository.datamodel;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
import java.util.Optional;
import java.util.logging.Level; import java.util.logging.Level;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
@ -76,19 +75,16 @@ public class EamArtifactUtil {
// have switch based on artifact type // have switch based on artifact type
for (CorrelationAttributeInstance.Type aType : EamDb.getInstance().getDefinedCorrelationTypes()) { for (CorrelationAttributeInstance.Type aType : EamDb.getInstance().getDefinedCorrelationTypes()) {
if ((checkEnabled && aType.isEnabled()) || !checkEnabled) { if ((checkEnabled && aType.isEnabled()) || !checkEnabled) {
Optional<CorrelationAttribute> correlationAttributeOptional = EamArtifactUtil.getCorrelationAttributeFromBlackboardArtifact(aType, bbArtifact); // Now always adds the instance details associated with this occurance.
if (correlationAttributeOptional.isPresent()) { CorrelationAttributeInstance correlationAttribute = EamArtifactUtil.makeInstanceFromBlackboardArtifact(aType, bbArtifact);
eamArtifacts.add(correlationAttributeOptional.get()); if (correlationAttribute != null) {
eamArtifacts.add(correlationAttribute);
} }
} }
} }
} catch (EamDbException ex) { } catch (EamDbException ex) {
logger.log(Level.SEVERE, "Error getting defined correlation types.", ex); // NON-NLS logger.log(Level.SEVERE, "Error getting defined correlation types.", ex); // NON-NLS
return eamArtifacts; return eamArtifacts;
} catch (CorrelationAttributeNormalizationException ex){
final String errorMessage = String.format("Error getting defined correlation types due to normalization exception: %s", ex.getMessage()); // NON-NLS
logger.log(Level.INFO, errorMessage);
return eamArtifacts;
} }
return eamArtifacts; return eamArtifacts;
@ -101,19 +97,15 @@ public class EamArtifactUtil {
* @param correlationType The Central Repository artifact type to create * @param correlationType The Central Repository artifact type to create
* @param bbArtifact The blackboard artifact to pull data from * @param bbArtifact The blackboard artifact to pull data from
* *
* @return the new EamArtifact. Throws an exception if one was not created because * @return the new EamArtifact, or null if one was not created because
* bbArtifact did not contain the needed data * bbArtifact did not contain the needed data
*/ */
private static Optional<CorrelationAttribute> getCorrelationAttributeFromBlackboardArtifact(CorrelationAttribute.Type correlationType, private static CorrelationAttributeInstance makeInstanceFromBlackboardArtifact(CorrelationAttributeInstance.Type correlationType,
BlackboardArtifact bbArtifact) throws EamDbException, CorrelationAttributeNormalizationException { BlackboardArtifact bbArtifact) throws EamDbException {
String value = null; String value = null;
int artifactTypeID = bbArtifact.getArtifactTypeID(); int artifactTypeID = bbArtifact.getArtifactTypeID();
try { try {
final int correlationTypeId = correlationType.getId();
if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeID) { if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeID) {
// Get the associated artifact // Get the associated artifact
BlackboardAttribute attribute = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)); BlackboardAttribute attribute = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
@ -136,7 +128,7 @@ public class EamArtifactUtil {
|| BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeID || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeID
|| BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeID)) { || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeID)) {
// Lower-case this to validate domains // Lower-case this to normalize domains
value = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)).getValueString(); value = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)).getValueString();
} else if (correlationType.getId() == CorrelationAttributeInstance.PHONE_TYPE_ID } else if (correlationType.getId() == CorrelationAttributeInstance.PHONE_TYPE_ID
&& (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeID && (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeID
@ -175,19 +167,16 @@ public class EamArtifactUtil {
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error getting attribute while getting type from BlackboardArtifact.", ex); // NON-NLS logger.log(Level.SEVERE, "Error getting attribute while getting type from BlackboardArtifact.", ex); // NON-NLS
return Optional.empty(); return null;
} catch (NoCurrentCaseException ex) { } catch (NoCurrentCaseException ex) {
logger.log(Level.SEVERE, "Exception while getting open case.", ex); // NON-NLS logger.log(Level.SEVERE, "Exception while getting open case.", ex); // NON-NLS
return Optional.empty(); return null;
} }
if(null != value){
CorrelationAttribute correlationAttribute = new CorrelationAttribute(correlationType, value);
return Optional.of(correlationAttribute);
if (null != value) { if (null != value) {
return makeCorrelationAttributeInstanceUsingTypeValue(bbArtifact, correlationType, value); return makeCorrelationAttributeInstanceUsingTypeValue(bbArtifact, correlationType, value);
} else { } else {
return Optional.empty(); return null;
} }
} }
@ -224,7 +213,7 @@ public class EamArtifactUtil {
TskData.FileKnown.UNKNOWN TskData.FileKnown.UNKNOWN
); );
} catch (TskCoreException | EamDbException ex) { } catch (TskCoreException | EamDbException | CorrelationAttributeNormalizationException ex) {
logger.log(Level.SEVERE, "Error creating artifact instance.", ex); // NON-NLS logger.log(Level.SEVERE, "Error creating artifact instance.", ex); // NON-NLS
return null; return null;
} catch (NoCurrentCaseException ex) { } catch (NoCurrentCaseException ex) {
@ -243,13 +232,13 @@ public class EamArtifactUtil {
public static CorrelationAttributeInstance getInstanceFromContent(Content content) { public static CorrelationAttributeInstance getInstanceFromContent(Content content) {
if (!(content instanceof AbstractFile)) { if (!(content instanceof AbstractFile)) {
throw new EamDbException("Content is not an AbstractFile."); return null;
} }
final AbstractFile file = (AbstractFile) content; final AbstractFile file = (AbstractFile) content;
if (!isSupportedAbstractFileType(file)) { if (!isSupportedAbstractFileType(file)) {
throw new EamDbException("File type is not supported."); return null;
} }
CorrelationAttributeInstance.Type type; CorrelationAttributeInstance.Type type;
@ -267,20 +256,22 @@ public class EamArtifactUtil {
correlationDataSource = CorrelationDataSource.fromTSKDataSource(correlationCase, file.getDataSource()); correlationDataSource = CorrelationDataSource.fromTSKDataSource(correlationCase, file.getDataSource());
value = file.getMd5Hash(); value = file.getMd5Hash();
filePath = (file.getParentPath() + file.getName()).toLowerCase(); filePath = (file.getParentPath() + file.getName()).toLowerCase();
} catch (TskCoreException ex) { } catch (TskCoreException | EamDbException ex) {
throw new EamDbException("Error retrieving correlation attribute.", ex); logger.log(Level.SEVERE, "Error retrieving correlation attribute.", ex);
return null;
} catch (NoCurrentCaseException ex) { } catch (NoCurrentCaseException ex) {
throw new EamDbException("Case is closed.", ex); logger.log(Level.SEVERE, "Case is closed.", ex);
return null;
} }
CorrelationAttributeInstance correlationAttributeInstance; CorrelationAttributeInstance correlationAttributeInstance;
try { try {
correlationAttributeInstance = EamDb.getInstance().getCorrelationAttributeInstance(type, correlationCase, correlationDataSource, value, filePath); correlationAttributeInstance = EamDb.getInstance().getCorrelationAttributeInstance(type, correlationCase, correlationDataSource, value, filePath);
} catch (EamDbException ex) { } catch (EamDbException | CorrelationAttributeNormalizationException ex) {
logger.log(Level.WARNING, String.format( logger.log(Level.WARNING, String.format(
"Correlation attribute could not be retrieved for '%s' (id=%d): %s", "Correlation attribute could not be retrieved for '%s' (id=%d): %s",
content.getName(), content.getId(), ex.getMessage())); content.getName(), content.getId(), ex.getMessage()));
throw ex; return null;
} }
return correlationAttributeInstance; return correlationAttributeInstance;
@ -331,8 +322,11 @@ public class EamArtifactUtil {
CorrelationDataSource.fromTSKDataSource(correlationCase, af.getDataSource()), CorrelationDataSource.fromTSKDataSource(correlationCase, af.getDataSource()),
af.getParentPath() + af.getName()); af.getParentPath() + af.getName());
} catch (TskCoreException | EamDbException | NoCurrentCaseException | CorrelationAttributeNormalizationException ex) { } catch (TskCoreException | EamDbException | CorrelationAttributeNormalizationException ex) {
logger.log(Level.SEVERE, "Error making correlation attribute.", ex); //NON-NLS logger.log(Level.SEVERE, "Error making correlation attribute.", ex);
return null;
} catch (NoCurrentCaseException ex) {
logger.log(Level.SEVERE, "Case is closed.", ex);
return null; return null;
} }
} }

18
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java
View File

@ -244,7 +244,7 @@ public interface EamDb {
* *
* @return List of artifact instances for a given type/value * @return List of artifact instances for a given type/value
*/ */
List<CorrelationAttributeInstance> getArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException; List<CorrelationAttributeInstance> getArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Retrieves eamArtifact instances from the database that are associated * Retrieves eamArtifact instances from the database that are associated
@ -269,7 +269,7 @@ public interface EamDb {
* @return Number of artifact instances having ArtifactType and * @return Number of artifact instances having ArtifactType and
* ArtifactValue. * ArtifactValue.
*/ */
Long getCountArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException; Long getCountArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Calculate the percentage of data sources that have this attribute value. * Calculate the percentage of data sources that have this attribute value.
@ -278,7 +278,7 @@ public interface EamDb {
* *
* @return Int between 0 and 100 * @return Int between 0 and 100
*/ */
int getFrequencyPercentage(CorrelationAttributeInstance corAttr) throws EamDbException; int getFrequencyPercentage(CorrelationAttributeInstance corAttr) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Retrieves number of unique caseDisplayName / dataSource tuples in the * Retrieves number of unique caseDisplayName / dataSource tuples in the
@ -290,7 +290,7 @@ public interface EamDb {
* *
* @return Number of unique tuples * @return Number of unique tuples
*/ */
Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException; Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Retrieves number of data sources in the database. * Retrieves number of data sources in the database.
@ -378,7 +378,7 @@ public interface EamDb {
* *
* @return List with 0 or more matching eamArtifact instances. * @return List with 0 or more matching eamArtifact instances.
*/ */
List<CorrelationAttributeInstance> getArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException; List<CorrelationAttributeInstance> getArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Gets list of matching eamArtifact instances that have knownStatus = * Gets list of matching eamArtifact instances that have knownStatus =
@ -397,7 +397,7 @@ public interface EamDb {
* *
* @return Number of matching eamArtifacts * @return Number of matching eamArtifacts
*/ */
Long getCountArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException; Long getCountArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Gets list of distinct case display names, where each case has 1+ Artifact * Gets list of distinct case display names, where each case has 1+ Artifact
@ -411,7 +411,7 @@ public interface EamDb {
* *
* @throws EamDbException * @throws EamDbException
*/ */
List<String> getListCasesHavingArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException; List<String> getListCasesHavingArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Remove a reference set and all values contained in it. * Remove a reference set and all values contained in it.
@ -483,7 +483,7 @@ public interface EamDb {
* *
* @return Global known status of the artifact * @return Global known status of the artifact
*/ */
boolean isArtifactKnownBadByReference(CorrelationAttributeInstance.Type aType, String value) throws EamDbException; boolean isArtifactKnownBadByReference(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Add a new organization * Add a new organization
@ -611,7 +611,7 @@ public interface EamDb {
* *
* @throws EamDbException * @throws EamDbException
*/ */
List<EamGlobalFileInstance> getReferenceInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String aValue) throws EamDbException; List<EamGlobalFileInstance> getReferenceInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String aValue) throws EamDbException, CorrelationAttributeNormalizationException;
/** /**
* Add a new EamArtifact.Type to the db. * Add a new EamArtifact.Type to the db.

4
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamGlobalFileInstance.java
View File

@ -52,7 +52,7 @@ public class EamGlobalFileInstance {
} }
this.instanceID = instanceID; this.instanceID = instanceID;
this.globalSetID = globalSetID; this.globalSetID = globalSetID;
this.MD5Hash = CorrelationAttributeNormalizer.normalize(CorrelationAttribute.FILES_TYPE_ID, MD5Hash); this.MD5Hash = CorrelationAttributeNormalizer.normalize(CorrelationAttributeInstance.FILES_TYPE_ID, MD5Hash);
this.knownStatus = knownStatus; this.knownStatus = knownStatus;
this.comment = comment; this.comment = comment;
} }
@ -115,7 +115,7 @@ public class EamGlobalFileInstance {
* @param MD5Hash the MD5Hash to set * @param MD5Hash the MD5Hash to set
*/ */
public void setMD5Hash(String MD5Hash) throws CorrelationAttributeNormalizationException { public void setMD5Hash(String MD5Hash) throws CorrelationAttributeNormalizationException {
this.MD5Hash = CorrelationAttributeNormalizer.normalize(CorrelationAttribute.FILES_TYPE_ID, MD5Hash); this.MD5Hash = CorrelationAttributeNormalizer.normalize(CorrelationAttributeInstance.FILES_TYPE_ID, MD5Hash);
} }
/** /**

18
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java
View File

@ -447,7 +447,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @return List of artifact instances for a given type/value * @return List of artifact instances for a given type/value
*/ */
@Override @Override
public List<CorrelationAttributeInstance> getArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException { public List<CorrelationAttributeInstance> getArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getArtifactInstancesByTypeValue(aType, value); return super.getArtifactInstancesByTypeValue(aType, value);
@ -489,7 +489,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @throws EamDbException * @throws EamDbException
*/ */
@Override @Override
public Long getCountArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException { public Long getCountArtifactInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getCountArtifactInstancesByTypeValue(aType, value); return super.getCountArtifactInstancesByTypeValue(aType, value);
@ -499,7 +499,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
} }
@Override @Override
public int getFrequencyPercentage(CorrelationAttributeInstance corAttr) throws EamDbException { public int getFrequencyPercentage(CorrelationAttributeInstance corAttr) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getFrequencyPercentage(corAttr); return super.getFrequencyPercentage(corAttr);
@ -520,7 +520,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @throws EamDbException * @throws EamDbException
*/ */
@Override @Override
public Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException { public Long getCountUniqueCaseDataSourceTuplesHavingTypeValue(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getCountUniqueCaseDataSourceTuplesHavingTypeValue(aType, value); return super.getCountUniqueCaseDataSourceTuplesHavingTypeValue(aType, value);
@ -617,7 +617,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @return List with 0 or more matching eamArtifact instances. * @return List with 0 or more matching eamArtifact instances.
*/ */
@Override @Override
public List<CorrelationAttributeInstance> getArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException { public List<CorrelationAttributeInstance> getArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getArtifactInstancesKnownBad(aType, value); return super.getArtifactInstancesKnownBad(aType, value);
@ -654,7 +654,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @return Number of matching eamArtifacts * @return Number of matching eamArtifacts
*/ */
@Override @Override
public Long getCountArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException { public Long getCountArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getCountArtifactInstancesKnownBad(aType, value); return super.getCountArtifactInstancesKnownBad(aType, value);
@ -676,7 +676,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @throws EamDbException * @throws EamDbException
*/ */
@Override @Override
public List<String> getListCasesHavingArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException { public List<String> getListCasesHavingArtifactInstancesKnownBad(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getListCasesHavingArtifactInstancesKnownBad(aType, value); return super.getListCasesHavingArtifactInstancesKnownBad(aType, value);
@ -782,7 +782,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @return Global known status of the artifact * @return Global known status of the artifact
*/ */
@Override @Override
public boolean isArtifactKnownBadByReference(CorrelationAttributeInstance.Type aType, String value) throws EamDbException { public boolean isArtifactKnownBadByReference(CorrelationAttributeInstance.Type aType, String value) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.isArtifactKnownBadByReference(aType, value); return super.isArtifactKnownBadByReference(aType, value);
@ -967,7 +967,7 @@ final class SqliteEamDb extends AbstractSqlEamDb {
* @throws EamDbException * @throws EamDbException
*/ */
@Override @Override
public List<EamGlobalFileInstance> getReferenceInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String aValue) throws EamDbException { public List<EamGlobalFileInstance> getReferenceInstancesByTypeValue(CorrelationAttributeInstance.Type aType, String aValue) throws EamDbException, CorrelationAttributeNormalizationException {
try { try {
acquireSharedLock(); acquireSharedLock();
return super.getReferenceInstancesByTypeValue(aType, aValue); return super.getReferenceInstancesByTypeValue(aType, aValue);

18
Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java
View File

@ -26,10 +26,10 @@ import java.util.HashMap;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.logging.Level; import java.util.logging.Level;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb;
@ -224,11 +224,15 @@ final class InterCaseSearchResultsProcessor {
while (resultSet.next()) { while (resultSet.next()) {
CorrelationCase correlationCase = DbManager.getCaseById(InstanceTableCallback.getCaseId(resultSet)); CorrelationCase correlationCase = DbManager.getCaseById(InstanceTableCallback.getCaseId(resultSet));
CorrelationDataSource dataSource = DbManager.getDataSourceById(correlationCase, InstanceTableCallback.getDataSourceId(resultSet)); CorrelationDataSource dataSource = DbManager.getDataSourceById(correlationCase, InstanceTableCallback.getDataSourceId(resultSet));
correlationAttributeInstance = DbManager.getCorrelationAttributeInstance(fileType, try {
correlationCase, correlationAttributeInstance = DbManager.getCorrelationAttributeInstance(fileType,
dataSource, correlationCase,
InstanceTableCallback.getValue(resultSet), dataSource,
InstanceTableCallback.getFilePath(resultSet)); InstanceTableCallback.getValue(resultSet),
InstanceTableCallback.getFilePath(resultSet));
} catch (CorrelationAttributeNormalizationException ex) {
LOGGER.log(Level.INFO, "Unable to get CorrelationAttributeInstance.", ex); // NON-NLS
}
} }
} catch (SQLException | EamDbException ex) { } catch (SQLException | EamDbException ex) {

1
Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbManager.java
View File

@ -40,7 +40,6 @@ import org.openide.util.NbBundle;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.openide.windows.WindowManager; import org.openide.windows.WindowManager;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeNormalizationException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;

18
Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java
View File

@ -786,7 +786,7 @@ public class CentralRepoDatamodelTest extends TestCase {
CorrelationAttributeInstance failAttr; CorrelationAttributeInstance failAttr;
try { try {
failAttr = new CorrelationAttributeInstance(fileType, randomHash()); failAttr = new CorrelationAttributeInstance(fileType, randomHash());
} catch (CorrelationAttributeNormalizationException ex) { } catch (CorrelationAttributeNormalizationException | EamDbException ex) {
Exceptions.printStackTrace(ex); Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage()); Assert.fail(ex.getMessage());
return; return;
@ -799,6 +799,8 @@ public class CentralRepoDatamodelTest extends TestCase {
fail("addArtifact failed to throw exception for null case"); fail("addArtifact failed to throw exception for null case");
} catch (EamDbException ex) { } catch (EamDbException ex) {
// This is the expected behavior // This is the expected behavior
} catch (CorrelationAttributeNormalizationException ex) {
fail("was expecting to get EamDbException");
} }
// Test adding instance with invalid case ID // Test adding instance with invalid case ID
@ -809,6 +811,8 @@ public class CentralRepoDatamodelTest extends TestCase {
fail("addArtifact failed to throw exception for invalid case"); fail("addArtifact failed to throw exception for invalid case");
} catch (EamDbException ex) { } catch (EamDbException ex) {
// This is the expected behavior // This is the expected behavior
} catch (CorrelationAttributeNormalizationException ex) {
fail("was expecting to get EamDbException");
} }
// Test adding instance with null data source // Test adding instance with null data source
@ -818,6 +822,8 @@ public class CentralRepoDatamodelTest extends TestCase {
fail("addArtifact failed to throw exception for null data source"); fail("addArtifact failed to throw exception for null data source");
} catch (EamDbException ex) { } catch (EamDbException ex) {
// This is the expected behavior // This is the expected behavior
} catch (CorrelationAttributeNormalizationException ex) {
fail("was expecting to get EamDbException");
} }
// Test adding instance with invalid data source ID // Test adding instance with invalid data source ID
@ -828,6 +834,8 @@ public class CentralRepoDatamodelTest extends TestCase {
fail("addArtifact failed to throw exception for invalid data source"); fail("addArtifact failed to throw exception for invalid data source");
} catch (EamDbException ex) { } catch (EamDbException ex) {
// This is the expected behavior // This is the expected behavior
} catch (CorrelationAttributeNormalizationException ex) {
fail("was expecting to get EamDbException");
} }
// Test adding instance with null path // Test adding instance with null path
@ -837,6 +845,8 @@ public class CentralRepoDatamodelTest extends TestCase {
fail("CorrelationAttributeInstance failed to throw exception for null path"); fail("CorrelationAttributeInstance failed to throw exception for null path");
} catch (EamDbException ex) { } catch (EamDbException ex) {
// This is the expected behavior // This is the expected behavior
} catch (CorrelationAttributeNormalizationException ex) {
fail("was expecting to get EamDbException");
} }
// Test adding instance with null known status // Test adding instance with null known status
@ -846,6 +856,8 @@ public class CentralRepoDatamodelTest extends TestCase {
fail("addArtifact failed to throw exception for null known status"); fail("addArtifact failed to throw exception for null known status");
} catch (EamDbException ex) { } catch (EamDbException ex) {
// This is the expected behavior // This is the expected behavior
} catch (CorrelationAttributeNormalizationException ex) {
fail("was expecting to get EamDbException");
} }
// Test CorrelationAttribute failure cases // Test CorrelationAttribute failure cases
@ -864,10 +876,12 @@ public class CentralRepoDatamodelTest extends TestCase {
// Test null value // Test null value
// This will fail in the CorrelationAttribute constructor // This will fail in the CorrelationAttribute constructor
try { try {
new CorrelationAttribute(fileType, null); new CorrelationAttributeInstance(fileType, null);
fail("addArtifact failed to throw exception for null value"); fail("addArtifact failed to throw exception for null value");
} catch (CorrelationAttributeNormalizationException ex) { } catch (CorrelationAttributeNormalizationException ex) {
// This is the expected behavior // This is the expected behavior
} catch (EamDbException ex) {
fail("expected to get CorrelationAttributeNormalizationException");
} }
// Test getting instances with expected results // Test getting instances with expected results

12
Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeNormalizerTest.java
View File

@ -48,7 +48,7 @@ public class CorrelationAttributeNormalizerTest extends NbTestCase {
final String emptyHash = ""; //should fail final String emptyHash = ""; //should fail
final String nullHash = null; //should fail final String nullHash = null; //should fail
final int FILES_TYPE_ID = CorrelationAttribute.FILES_TYPE_ID; final int FILES_TYPE_ID = CorrelationAttributeInstance.FILES_TYPE_ID;
try { try {
assertTrue("This hash should just work", CorrelationAttributeNormalizer.normalize(FILES_TYPE_ID, aValidHash).equals(aValidHash)); assertTrue("This hash should just work", CorrelationAttributeNormalizer.normalize(FILES_TYPE_ID, aValidHash).equals(aValidHash));
@ -57,7 +57,7 @@ public class CorrelationAttributeNormalizerTest extends NbTestCase {
fail(ex.getMessage()); fail(ex.getMessage());
} }
try { try {
assertTrue("This hash just needs to be converted to lower case", CorrelationAttributeNormalizer.normalize(CorrelationAttribute.FILES_TYPE_ID, aValidHashWithCaps).equals(aValidHash)); assertTrue("This hash just needs to be converted to lower case", CorrelationAttributeNormalizer.normalize(CorrelationAttributeInstance.FILES_TYPE_ID, aValidHashWithCaps).equals(aValidHash));
} catch (CorrelationAttributeNormalizationException ex) { } catch (CorrelationAttributeNormalizationException ex) {
Exceptions.printStackTrace(ex); Exceptions.printStackTrace(ex);
fail(ex.getMessage()); fail(ex.getMessage());
@ -97,7 +97,7 @@ public class CorrelationAttributeNormalizerTest extends NbTestCase {
final String goodDomainTen = "WWW.TEST.COM"; //should pass but be lowered final String goodDomainTen = "WWW.TEST.COM"; //should pass but be lowered
final String goodDomainEleven = "TEST.COM"; //should pass but be lowered final String goodDomainEleven = "TEST.COM"; //should pass but be lowered
final int DOMAIN_TYPE_ID = CorrelationAttribute.DOMAIN_TYPE_ID; final int DOMAIN_TYPE_ID = CorrelationAttributeInstance.DOMAIN_TYPE_ID;
try { try {
assertTrue(THIS_DOMAIN_SHOULD_PASS, CorrelationAttributeNormalizer.normalize(DOMAIN_TYPE_ID, goodDomainOne).equals(goodDomainOne)); assertTrue(THIS_DOMAIN_SHOULD_PASS, CorrelationAttributeNormalizer.normalize(DOMAIN_TYPE_ID, goodDomainOne).equals(goodDomainOne));
@ -177,7 +177,7 @@ public class CorrelationAttributeNormalizerTest extends NbTestCase {
final String badEmailSix = "asdf@asdf"; //TODO looks bad but the lib accepts it... final String badEmailSix = "asdf@asdf"; //TODO looks bad but the lib accepts it...
final String badEmailSeven = "asdf.asdf"; //should final String badEmailSeven = "asdf.asdf"; //should
final int EMAIL_TYPE_ID = CorrelationAttribute.EMAIL_TYPE_ID; final int EMAIL_TYPE_ID = CorrelationAttributeInstance.EMAIL_TYPE_ID;
try { try {
assertTrue("This email should pass.", CorrelationAttributeNormalizer.normalize(EMAIL_TYPE_ID, goodEmailOne).equals(goodEmailOne)); assertTrue("This email should pass.", CorrelationAttributeNormalizer.normalize(EMAIL_TYPE_ID, goodEmailOne).equals(goodEmailOne));
@ -234,7 +234,7 @@ public class CorrelationAttributeNormalizerTest extends NbTestCase {
final String badPnEight = "asdfasdfasdf"; final String badPnEight = "asdfasdfasdf";
final String badPnNine = "asdf19784740486adsf"; final String badPnNine = "asdf19784740486adsf";
final int PHONE_TYPE_ID = CorrelationAttribute.PHONE_TYPE_ID; final int PHONE_TYPE_ID = CorrelationAttributeInstance.PHONE_TYPE_ID;
try { try {
assertTrue(THIS_PHONE_NUMBER_SHOULD_PASS, CorrelationAttributeNormalizer.normalize(PHONE_TYPE_ID, goodPnOne).equals(goodPnOne)); assertTrue(THIS_PHONE_NUMBER_SHOULD_PASS, CorrelationAttributeNormalizer.normalize(PHONE_TYPE_ID, goodPnOne).equals(goodPnOne));
@ -304,7 +304,7 @@ public class CorrelationAttributeNormalizerTest extends NbTestCase {
final String goodIdSeven = "0202AAFF"; //should pass final String goodIdSeven = "0202AAFF"; //should pass
final String goodIdEight = "0202-AAFF"; //should pass*/ final String goodIdEight = "0202-AAFF"; //should pass*/
final int USBID_TYPE_ID = CorrelationAttribute.USBID_TYPE_ID; final int USBID_TYPE_ID = CorrelationAttributeInstance.USBID_TYPE_ID;
try { try {
assertTrue(THIS_USB_ID_SHOULD_PASS, CorrelationAttributeNormalizer.normalize(USBID_TYPE_ID, goodIdOne).equals(goodIdOne)); assertTrue(THIS_USB_ID_SHOULD_PASS, CorrelationAttributeNormalizer.normalize(USBID_TYPE_ID, goodIdOne).equals(goodIdOne));