harmonizing code

This commit is contained in:
Brian Sweeney 2018-03-22 12:48:18 -06:00
parent 8623479056
commit c92e644042
6 changed files with 134 additions and 24 deletions

View File

@ -0,0 +1,41 @@
/*
*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Constructs a CommonFilesMetaData for all DataSources in the case.
*/
public class AllCommonFiles extends CommonFilesMetaData {
AllCommonFiles() throws TskCoreException, SQLException, NoCurrentCaseException{
super();
}
private final String whereClause = "md5 in (select md5 from tsk_files where (known != 1 OR known IS NULL) GROUP BY md5 HAVING COUNT(*) > 1) order by md5";
@Override
protected String getSqlWhereClause() {
return this.whereClause;
}
}

View File

@ -1 +1,3 @@
CommonFilesPanel.searchButton.text=Search CommonFilesPanel.searchButton.text=Search
CommonFilesPanel.withinDataSourceRadioButton.text=Within a Data Source
CommonFilesPanel.allDataSourcesRadioButton.text=Across All Data Sources

View File

@ -33,10 +33,11 @@ import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
/** /**
* Utility and wrapper around data required for Common Files Search results * Utility and wrapper around data required for Common Files Search results.
* Subclass this to implement different selections of files from the case.
*/ */
public class CommonFilesMetaData { abstract class CommonFilesMetaData {
private final Map<AbstractFile, List<AbstractFile>> parentNodes; private final Map<AbstractFile, List<AbstractFile>> parentNodes;
private final Map<Long, String> dataSourceIdToNameMap; private final Map<Long, String> dataSourceIdToNameMap;
@ -48,12 +49,10 @@ public class CommonFilesMetaData {
this.sleuthkitCase = Case.getOpenCase().getSleuthkitCase(); this.sleuthkitCase = Case.getOpenCase().getSleuthkitCase();
this.loadDataSourcesMap(); this.loadDataSourcesMap();
this.collateFiles();
} }
//TODO chopping block - this will be passed in through the constructor eventually
private void loadDataSourcesMap() throws SQLException, TskCoreException { private void loadDataSourcesMap() throws SQLException, TskCoreException {
try ( try (
@ -68,15 +67,22 @@ public class CommonFilesMetaData {
} }
} }
public Map<AbstractFile, List<AbstractFile>> getFilesMap() { Map<AbstractFile, List<AbstractFile>> getFilesMap() {
return Collections.unmodifiableMap(this.parentNodes); return Collections.unmodifiableMap(this.parentNodes);
} }
public Map<Long, String> getDataSourceIdToNameMap() { Map<Long, String> getDataSourceIdToNameMap() {
return Collections.unmodifiableMap(dataSourceIdToNameMap); return Collections.unmodifiableMap(dataSourceIdToNameMap);
} }
private void collateFiles() throws TskCoreException { /**
* Sorts files in selection into a parent/child hierarchy where actual files
* are nested beneath a parent node which represents the common match.
*
* @return returns a reference to itself for ease of use.
* @throws TskCoreException
*/
CommonFilesMetaData collateFiles() throws TskCoreException {
List<AbstractFile> files = this.sleuthkitCase.findAllFilesWhere(getSqlWhereClause()); List<AbstractFile> files = this.sleuthkitCase.findAllFilesWhere(getSqlWhereClause());
@ -100,14 +106,26 @@ public class CommonFilesMetaData {
children.add(file); children.add(file);
} }
} }
return this;
} }
//TODO subclass this type and make this abstract /**
protected String getSqlWhereClause() { * Implement this in order to specify which files are selected into this
return "md5 in (select md5 from tsk_files where (known != 1 OR known IS NULL) GROUP BY md5 HAVING COUNT(*) > 1) order by md5"; * CommonFilesMetaData and passed along to the view.
} *
* No SQL-side de-duping should be performed. Results should be ordered by MD5.
*
* @return a SQL WHERE clause to be used in common files selection
*/
protected abstract String getSqlWhereClause();
public List<AbstractFile> getChildrenForFile(AbstractFile t) { /**
*
* @param t
* @return
*/
List<AbstractFile> getChildrenForFile(AbstractFile t) {
return this.parentNodes.get(t); return this.parentNodes.get(t);
} }
} }

View File

@ -33,7 +33,7 @@
<Component id="withinDataSourceRadioButton" alignment="0" min="-2" max="-2" attributes="0"/> <Component id="withinDataSourceRadioButton" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="allDataSourcesRadioButton" alignment="0" min="-2" max="-2" attributes="0"/> <Component id="allDataSourcesRadioButton" alignment="0" min="-2" max="-2" attributes="0"/>
</Group> </Group>
<EmptySpace pref="26" max="32767" attributes="0"/> <EmptySpace max="32767" attributes="0"/>
</Group> </Group>
</Group> </Group>
</DimensionLayout> </DimensionLayout>

View File

@ -19,7 +19,10 @@
package org.sleuthkit.autopsy.commonfilesearch; package org.sleuthkit.autopsy.commonfilesearch;
import java.awt.event.ActionListener; import java.awt.event.ActionListener;
import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry; import java.util.Map.Entry;
import java.util.concurrent.ExecutionException; import java.util.concurrent.ExecutionException;
import java.util.logging.Level; import java.util.logging.Level;
@ -29,6 +32,7 @@ import javax.swing.SwingWorker;
import javax.swing.event.ListDataListener; import javax.swing.event.ListDataListener;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.openide.windows.TopComponent; import org.openide.windows.TopComponent;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent; import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent;
import org.sleuthkit.autopsy.corecomponents.TableFilterNode; import org.sleuthkit.autopsy.corecomponents.TableFilterNode;
@ -36,6 +40,8 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.directorytree.DataResultFilterNode; import org.sleuthkit.autopsy.directorytree.DataResultFilterNode;
import org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent; import org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
/** /**
@ -129,9 +135,6 @@ public final class CommonFilesPanel extends javax.swing.JPanel {
@SuppressWarnings("FinallyDiscardsException") @SuppressWarnings("FinallyDiscardsException")
protected CommonFilesMetaData doInBackground() throws TskCoreException, NoCurrentCaseException, SQLException { protected CommonFilesMetaData doInBackground() throws TskCoreException, NoCurrentCaseException, SQLException {
/*Case currentCase = Case.getOpenCase();
SleuthkitCase tskDb = currentCase.getSleuthkitCase();
if(singleDataSource) { if(singleDataSource) {
Long selectedObjId = 0L; Long selectedObjId = 0L;
for (Entry<Long, String> dataSource : dataSourceMap.entrySet()) { for (Entry<Long, String> dataSource : dataSourceMap.entrySet()) {
@ -140,10 +143,10 @@ public final class CommonFilesPanel extends javax.swing.JPanel {
break; break;
} }
} }
return tskDb.findAllFilesWhere("md5 in (select md5 from tsk_files where data_source_obj_id="+ selectedObjId +" and (known != 1 OR known IS NULL) GROUP BY md5 HAVING COUNT(*) > 1) AND data_source_obj_id="+ selectedObjId +" order by md5"); return new SingleDataSourceCommonFiles(selectedObjId).collateFiles();
} } else {
return tskDb.findAllFilesWhere("md5 in (select md5 from tsk_files where (known != 1 OR known IS NULL) GROUP BY md5 HAVING COUNT(*) > 1) order by md5");*/ return new AllCommonFiles().collateFiles();
return new CommonFilesMetaData(); }
} }
@Override @Override

View File

@ -0,0 +1,46 @@
/*
*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Constructs CommonFilesMetaData for files within the given DataSource.
*/
public class SingleDataSourceCommonFiles extends CommonFilesMetaData {
private final String whereClause;
SingleDataSourceCommonFiles(long dataSourceId) throws TskCoreException, SQLException, NoCurrentCaseException{
super();
Object[] args = new String[] {Long.toString(dataSourceId), Long.toString(dataSourceId)};
this.whereClause = String.format(
"md5 in (select md5 from tsk_files where data_source_obj_id=%s and (known != 1 OR known IS NULL) GROUP BY md5 HAVING COUNT(*) > 1) AND data_source_obj_id=%s order by md5",
args);
}
@Override
protected String getSqlWhereClause() {
return this.whereClause;
}
}