Merge pull request #7702 from kellykelly3/8428-search-for-deleted-files_2

8428-search-for-deleted-files_2
2025-07-06 21:00:22 +00:00 · 2022-11-03 16:20:22 -04:00 · 2022-11-03 16:20:22 -04:00 · c8f546a0d7
commit c8f546a0d7
parent 0f104e411e 5d56f181de
6 changed files with 172 additions and 13 deletions
--- a/Core/src/org/sleuthkit/autopsy/filesearch/Bundle.properties
+++ b/Core/src/org/sleuthkit/autopsy/filesearch/Bundle.properties
@ -62,3 +62,4 @@ MimeTypePanel.noteLabel.text=*Note: Multiple MIME types can be selected
 HashSearchPanel.sha256CheckBox.text=SHA-256:
 HashSearchPanel.sha256TextField.text=
 FileSearchPanel.closeButton.text=Close
+DeletedFilesSearchPanel.deletedCheckbox.text=Deleted
--- a/Core/src/org/sleuthkit/autopsy/filesearch/Bundle.properties-MERGED
+++ b/Core/src/org/sleuthkit/autopsy/filesearch/Bundle.properties-MERGED
@ -19,7 +19,7 @@ KnownStatusSearchPanel.knownCheckBox.text=Known Status:
 KnownStatusSearchPanel.knownBadOptionCheckBox.text=Notable
 KnownStatusSearchPanel.knownOptionCheckBox.text=Known (NSRL or other)
 KnownStatusSearchPanel.unknownOptionCheckBox.text=Unknown
-DateSearchFilter.noneSelectedMsg.text=At least one date type must be selected\!
+DateSearchFilter.noneSelectedMsg.text=At least one date type must be selected!
 DateSearchPanel.dateCheckBox.text=Date:
 DateSearchPanel.jLabel4.text=Timezone:
 DateSearchPanel.createdCheckBox.text=Created
@ -60,7 +60,7 @@ FileSearchPanel.search.results.details=Large number of matches may impact perfor
 FileSearchPanel.search.exception.noFilterSelected.msg=At least one filter must be selected.
 FileSearchPanel.search.validationErr.msg=Validation Error: {0}
 FileSearchPanel.emptyWhereClause.text=Invalid options, nothing to show.
-KnownStatusSearchFilter.noneSelectedMsg.text=At least one known status must be selected\!
+KnownStatusSearchFilter.noneSelectedMsg.text=At least one known status must be selected!
 NameSearchFilter.emptyNameMsg.text=Must enter something for name search.
 SizeSearchPanel.sizeCompareComboBox.equalTo=equal to
 SizeSearchPanel.sizeCompareComboBox.greaterThan=greater than
@ -81,3 +81,4 @@ MimeTypePanel.noteLabel.text=*Note: Multiple MIME types can be selected
 HashSearchPanel.sha256CheckBox.text=SHA-256:
 HashSearchPanel.sha256TextField.text=
 FileSearchPanel.closeButton.text=Close
+DeletedFilesSearchPanel.deletedCheckbox.text=Deleted
--- a/Core/src/org/sleuthkit/autopsy/filesearch/DeletedFilesSearchPanel.form
+++ b/Core/src/org/sleuthkit/autopsy/filesearch/DeletedFilesSearchPanel.form
@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+
+<Form version="1.5" maxVersion="1.9" type="org.netbeans.modules.form.forminfo.JPanelFormInfo">
+  <Properties>
+    <Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
+      <Dimension value="[337, 49]"/>
+    </Property>
+    <Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
+      <Dimension value="[337, 49]"/>
+    </Property>
+  </Properties>
+  <AuxValues>
+    <AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/>
+    <AuxValue name="FormSettings_autoSetComponentName" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_generateFQN" type="java.lang.Boolean" value="true"/>
+    <AuxValue name="FormSettings_generateMnemonicsCode" type="java.lang.Boolean" value="true"/>
+    <AuxValue name="FormSettings_i18nAutoMode" type="java.lang.Boolean" value="true"/>
+    <AuxValue name="FormSettings_layoutCodeTarget" type="java.lang.Integer" value="1"/>
+    <AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
+    <AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
+    <AuxValue name="designerSize" type="java.awt.Dimension" value="-84,-19,0,5,115,114,0,18,106,97,118,97,46,97,119,116,46,68,105,109,101,110,115,105,111,110,65,-114,-39,-41,-84,95,68,20,2,0,2,73,0,6,104,101,105,103,104,116,73,0,5,119,105,100,116,104,120,112,0,0,0,35,0,0,0,76"/>
+  </AuxValues>
+
+  <Layout class="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout"/>
+  <SubComponents>
+    <Component class="javax.swing.JCheckBox" name="deletedCheckbox">
+      <Properties>
+        <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+          <ResourceString bundle="org/sleuthkit/autopsy/filesearch/Bundle.properties" key="DeletedFilesSearchPanel.deletedCheckbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+        </Property>
+        <Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
+          <Dimension value="[0, 0]"/>
+        </Property>
+      </Properties>
+      <Constraints>
+        <Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
+          <GridBagConstraints gridX="0" gridY="0" gridWidth="1" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="0" insetsBottom="0" insetsRight="0" anchor="18" weightX="1.0" weightY="1.0"/>
+        </Constraint>
+      </Constraints>
+    </Component>
+  </SubComponents>
+</Form>
--- a/Core/src/org/sleuthkit/autopsy/filesearch/DeletedFilesSearchPanel.java
+++ b/Core/src/org/sleuthkit/autopsy/filesearch/DeletedFilesSearchPanel.java
@ -0,0 +1,118 @@
+/*
+ * Autopsy Forensic Browser
+ *
+ * Copyright 2022 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.autopsy.filesearch;
+
+import java.awt.event.ActionListener;
+import org.sleuthkit.datamodel.TskData;
+
+class DeletedFilesSearchPanel extends javax.swing.JPanel {
+
+    private static final long serialVersionUID = 1L;
+    
+    private final static String ALL_DELETED_CONTENT_QUERY = "( "
+                + "(dir_flags = " + TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC.getValue() //NON-NLS
+                + " OR " //NON-NLS
+                + "meta_flags = " + TskData.TSK_FS_META_FLAG_ENUM.ORPHAN.getValue() //NON-NLS
+                + ")"
+                + " AND type = " + TskData.TSK_DB_FILES_TYPE_ENUM.FS.getFileType() //NON-NLS
+                + " )"
+                + " OR type = " + TskData.TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType() //NON-NLS
+                + " OR (dir_flags = " + TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC.getValue()
+                + " AND type = " + TskData.TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType() + " )";
+
+    /**
+     * Creates new form DeletedFilesSearchPanel
+     */
+    DeletedFilesSearchPanel() {
+        initComponents();
+    }
+    
+    boolean isDeletedFileSelected() {
+        return deletedCheckbox.isSelected();
+    }
+    
+    void setDeletedFileSelected(boolean selected) {
+        deletedCheckbox.setSelected(selected);
+    }
+
+    /**
+     * This method is called from within the constructor to initialize the form.
+     * WARNING: Do NOT modify this code. The content of this method is always
+     * regenerated by the Form Editor.
+     */
+    @SuppressWarnings("unchecked")
+    // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
+    private void initComponents() {
+        java.awt.GridBagConstraints gridBagConstraints;
+
+        deletedCheckbox = new javax.swing.JCheckBox();
+
+        setMinimumSize(new java.awt.Dimension(337, 49));
+        setPreferredSize(new java.awt.Dimension(337, 49));
+        setLayout(new java.awt.GridBagLayout());
+
+        org.openide.awt.Mnemonics.setLocalizedText(deletedCheckbox, org.openide.util.NbBundle.getMessage(DeletedFilesSearchPanel.class, "DeletedFilesSearchPanel.deletedCheckbox.text")); // NOI18N
+        deletedCheckbox.setMinimumSize(new java.awt.Dimension(0, 0));
+        gridBagConstraints = new java.awt.GridBagConstraints();
+        gridBagConstraints.gridx = 0;
+        gridBagConstraints.gridy = 0;
+        gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
+        gridBagConstraints.weightx = 1.0;
+        gridBagConstraints.weighty = 1.0;
+        add(deletedCheckbox, gridBagConstraints);
+    }// </editor-fold>//GEN-END:initComponents
+
+
+    // Variables declaration - do not modify//GEN-BEGIN:variables
+    private javax.swing.JCheckBox deletedCheckbox;
+    // End of variables declaration//GEN-END:variables
+    static final class DeletedFileSearchFilter extends AbstractFileSearchFilter<DeletedFilesSearchPanel> {
+
+        DeletedFileSearchFilter() {
+            super(new DeletedFilesSearchPanel());
+        }
+        
+        @Override
+        public boolean isEnabled() {
+            return true;
+        }
+
+        @Override
+        public boolean isValid() {
+            return true;
+        }
+
+        @Override
+        public String getPredicate() throws FilterValidationException {
+            if (getComponent().isDeletedFileSelected()) {
+                return ALL_DELETED_CONTENT_QUERY;
+            }
+            
+            return "";
+        }
+
+        @Override
+        public void addActionListener(ActionListener l) {
+            
+        }
+        
+    }
+
+
+}
--- a/Core/src/org/sleuthkit/autopsy/filesearch/FileSearchPanel.form
+++ b/Core/src/org/sleuthkit/autopsy/filesearch/FileSearchPanel.form
@ -16,6 +16,7 @@
    <AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
    <AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
    <AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
+    <AuxValue name="designerSize" type="java.awt.Dimension" value="-84,-19,0,5,115,114,0,18,106,97,118,97,46,97,119,116,46,68,105,109,101,110,115,105,111,110,65,-114,-39,-41,-84,95,68,20,2,0,2,73,0,6,104,101,105,103,104,116,73,0,5,119,105,100,116,104,120,112,0,0,1,44,0,0,1,-112"/>
  </AuxValues>

  <Layout class="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout"/>
--- a/Core/src/org/sleuthkit/autopsy/filesearch/FileSearchPanel.java
+++ b/Core/src/org/sleuthkit/autopsy/filesearch/FileSearchPanel.java
@ -47,6 +47,7 @@ import org.sleuthkit.autopsy.corecomponents.TableFilterNode;
 import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
 import org.sleuthkit.autopsy.datamodel.EmptyNode;
+import org.sleuthkit.autopsy.filesearch.DeletedFilesSearchPanel.DeletedFileSearchFilter;
 import org.sleuthkit.autopsy.filesearch.FileSearchFilter.FilterValidationException;
 import org.sleuthkit.datamodel.AbstractFile;
 import org.sleuthkit.datamodel.SleuthkitCase;
@ -105,18 +106,19 @@ class FileSearchPanel extends javax.swing.JPanel {
        SizeSearchFilter sizeFilter = new SizeSearchFilter();
        DateSearchFilter dateFilter = new DateSearchFilter();
        KnownStatusSearchFilter knowStatusFilter = new KnownStatusSearchFilter();
+        DeletedFileSearchFilter deleltedFilter = new DeletedFileSearchFilter();
        HashSearchFilter hashFilter = new HashSearchFilter();
        panel2.add(new FilterArea(NbBundle.getMessage(this.getClass(), "FileSearchPanel.filterTitle.name"), nameFilter));

        panel3.add(new FilterArea(NbBundle.getMessage(this.getClass(), "FileSearchPanel.filterTitle.metadata"), sizeFilter));
-
        panel2.add(new FilterArea(NbBundle.getMessage(this.getClass(), "FileSearchPanel.filterTitle.metadata"), dateFilter));
        panel3.add(new FilterArea(NbBundle.getMessage(this.getClass(), "FileSearchPanel.filterTitle.knownStatus"), knowStatusFilter));

        panel5.add(new FilterArea(NbBundle.getMessage(this.getClass(), "HashSearchPanel.md5CheckBox.text"), hashFilter));
-        panel5.add(new JLabel(""));
        panel4.add(new FilterArea(NbBundle.getMessage(this.getClass(), "FileSearchPanel.filterTitle.metadata"), mimeTypeFilter));
        panel4.add(new FilterArea(NbBundle.getMessage(this.getClass(), "DataSourcePanel.dataSourceCheckBox.text"), dataSourceFilter));
+        panel5.add(new FilterArea(NbBundle.getMessage(this.getClass(), "DeletedFilesSearchPanel.deletedCheckbox.text"), deleltedFilter));   
+        
        filterPanel.add(panel1);
        filterPanel.add(panel2);
        filterPanel.add(panel3);
@ -130,6 +132,7 @@ class FileSearchPanel extends javax.swing.JPanel {
        filters.add(hashFilter);
        filters.add(mimeTypeFilter);
        filters.add(dataSourceFilter);
+        filters.add(deleltedFilter);

        for (FileSearchFilter filter : this.getFilters()) {
            filter.addPropertyChangeListener(new PropertyChangeListener() {
@ -294,15 +297,7 @@ class FileSearchPanel extends javax.swing.JPanel {
     *
     * @throws
     * org.sleuthkit.autopsy.filesearch.FileSearchFilter.FilterValidationException
-     *                                                                           if
-     *                                                                           an
-     *                                                                           enabled
-     *                                                                           filter
-     *                                                                           is
-     *                                                                           in
-     *                                                                           an
-     *                                                                           invalid
-     *                                                                           state
+     * if an enabled filter is in an invalid state
     */
    private String getQuery() throws FilterValidationException {