Merge branch 'master' of https://github.com/sleuthkit/autopsy

CoreComponents/nbproject/project.xml

@@ -50,6 +50,22 @@
                         <specification-version>1.9.1</specification-version>
                     </run-dependency>
                 </dependency>
+                <dependency>
+                    <code-name-base>org.netbeans.swing.plaf</code-name-base>
+                    <build-prerequisite/>
+                    <compile-dependency/>
+                    <run-dependency>
+                        <specification-version>1.20.2</specification-version>
+                    </run-dependency>
+                </dependency>
+                <dependency>
+                    <code-name-base>org.netbeans.swing.tabcontrol</code-name-base>
+                    <build-prerequisite/>
+                    <compile-dependency/>
+                    <run-dependency>
+                        <specification-version>1.25.1</specification-version>
+                    </run-dependency>
+                </dependency>
                 <dependency>
                     <code-name-base>org.openide.awt</code-name-base>
                     <build-prerequisite/>

CoreComponents/src/org/sleuthkit/autopsy/corecomponents/DataResultTopComponent.java

@@ -59,6 +59,8 @@ public final class DataResultTopComponent extends TopComponent implements DataRe
         setTitle(title); // set the title
         this.isMain = isMain;
         putClientProperty(TopComponent.PROP_CLOSING_DISABLED, Boolean.valueOf(isMain)); // set option to close compoment in GUI
+        putClientProperty(TopComponent.PROP_MAXIMIZATION_DISABLED, true);
+        putClientProperty(TopComponent.PROP_DRAGGING_DISABLED, true);
 
         this.dataResultTabbedPanel.addChangeListener(this);
     }

CoreComponents/src/org/sleuthkit/autopsy/corecomponents/DataResultViewerTable.java

@@ -187,6 +187,28 @@ public class DataResultViewerTable extends AbstractDataResultViewer {
        
     }
     
+    Set<Property> propertiesAcc = new LinkedHashSet<Property>();
+    /**
+     * Gets regular Bean property set properties from all children and, recursively, subchildren of Node.
+     * Note: won't work out the box for lazy load - you need to set all children props for the parent by hand
+     * @param parent Node with at least one child to get properties from
+     */
+    private void getAllChildPropertyHeadersRec(Node parent, int rows) {
+        for(int i = 0; i < Math.min(rows, parent.getChildren().getNodesCount()); i++){
+            Node child = parent.getChildren().getNodeAt(i);
+            for (PropertySet ps : child.getPropertySets()) {
+                    //if (ps.getName().equals(Sheet.PROPERTIES)) {
+                        //return ps.getProperties();
+                        final Property [] props = ps.getProperties();
+                        final int propsNum = props.length;
+                        for (int j = 0; j< propsNum; ++j)
+                            propertiesAcc.add(props[j]);
+                    //}
+                }
+            getAllChildPropertyHeadersRec(child, rows);
+        }
+    }
+
     @Override
     public void setNode(Node selectedNode) {
         // change the cursor to "waiting cursor" for this operation
@@ -215,7 +237,11 @@ public class DataResultViewerTable extends AbstractDataResultViewer {
 
                 OutlineView ov = ((OutlineView) this.tableScrollPanel);
 
-                List<Node.Property> tempProps = new ArrayList<Node.Property>(Arrays.asList(getAllChildPropertyHeaders(selectedNode)));
+                propertiesAcc.clear();
+                Logger logger = Logger.getLogger(DataResultViewerTable.class.getName());
+                this.getAllChildPropertyHeadersRec(selectedNode, 100);
+                List<Node.Property> tempProps = new ArrayList<Node.Property>(Arrays.asList(propertiesAcc.toArray(new Property[propertiesAcc.size()])));
+                //List<Node.Property> tempProps = new ArrayList<Node.Property>(Arrays.asList(getAllChildPropertyHeaders(selectedNode)));
                 if(tempProps.size() > 0)
                     tempProps.remove(0);
 
@@ -374,6 +400,8 @@ public class DataResultViewerTable extends AbstractDataResultViewer {
 
         // Get maximum width of column data
         for (int i = 0; i < table.length; i++) {
+            if(index >= table[i].length)
+                continue;
             String test = table[i][index].toString();
             colWidth = Math.max(colWidth, metrics.stringWidth(test));
         }

CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Installer.java

@@ -18,13 +18,16 @@
  */
 package org.sleuthkit.autopsy.corecomponents;
 
+import java.awt.Color;
+import java.awt.Insets;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.swing.BorderFactory;
 import javax.swing.UIManager;
 import javax.swing.UIManager.LookAndFeelInfo;
 import javax.swing.UnsupportedLookAndFeelException;
+import org.netbeans.swing.tabcontrol.plaf.DefaultTabbedContainerUI;
 import org.openide.modules.ModuleInstall;
-import org.openide.util.Exceptions;
 import org.openide.windows.WindowManager;
 import org.sleuthkit.autopsy.casemodule.Case;
 
@@ -47,7 +50,11 @@ public class Installer extends ModuleInstall {
             }
         });
 
+        Logger logger = Logger.getLogger(Installer.class.getName());
         //setupLAF();
+        //UIManager.put("ViewTabDisplayerUI", "org.sleuthkit.autopsy.corecomponents.NoTabsTabDisplayerUI");
+        //UIManager.put(DefaultTabbedContainerUI.KEY_VIEW_CONTENT_BORDER, BorderFactory.createEmptyBorder());
+        //UIManager.put("TabbedPane.contentBorderInsets", new Insets(0, 0, 0, 0));
     }
 
     private void setupLAF() {

CoreComponents/src/org/sleuthkit/autopsy/corecomponents/NoTabsTabDisplayerUI.java

@@ -0,0 +1,105 @@
+/*
+ * Autopsy Forensic Browser
+ * 
+ * Copyright 2011 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.autopsy.corecomponents;
+
+import java.awt.Dimension;
+import java.awt.Point;
+import java.awt.Polygon;
+import java.awt.Rectangle;
+import javax.swing.DefaultSingleSelectionModel;
+import javax.swing.JComponent;
+import javax.swing.SingleSelectionModel;
+import javax.swing.plaf.ComponentUI;
+import org.netbeans.swing.tabcontrol.TabDisplayer;
+import org.netbeans.swing.tabcontrol.TabDisplayerUI;
+
+/**
+ *
+ * @author dfickling
+ */
+public class NoTabsTabDisplayerUI extends TabDisplayerUI {
+    
+    /** Creates a new instance of NoTabsTabDisplayerUI */
+    public NoTabsTabDisplayerUI(TabDisplayer displayer) {
+        super(displayer);
+    }
+    
+    public static ComponentUI createUI(JComponent jc) {
+        assert jc instanceof TabDisplayer;
+        return new NoTabsTabDisplayerUI((TabDisplayer) jc);
+    }
+    
+    private static final int[] PTS = new int[] { 0, 0, 0 };
+    public Polygon getExactTabIndication(int i) {
+        //Should never be called
+        return new Polygon(PTS, PTS, PTS.length);
+    }
+    
+    public Polygon getInsertTabIndication(int i) {
+        return new Polygon(PTS, PTS, PTS.length);
+    }
+    
+    public int tabForCoordinate(Point point) {
+        return -1;
+    }
+    
+    public Rectangle getTabRect(int i, Rectangle rectangle) {
+        return new Rectangle(0,0,0,0);
+    }
+    
+    protected SingleSelectionModel createSelectionModel() {
+        return new DefaultSingleSelectionModel();
+    }
+    
+    public java.lang.String getCommandAtPoint(Point point) {
+        return null;
+    }
+    
+    public int dropIndexOfPoint(Point point) {
+        return -1;
+    }
+    
+    public void registerShortcuts(javax.swing.JComponent jComponent) {
+        //do nothing
+    }
+    
+    public void unregisterShortcuts(javax.swing.JComponent jComponent) {
+        //do nothing
+    }
+    
+    protected void requestAttention(int i) {
+        //do nothing
+    }
+    
+    protected void cancelRequestAttention(int i) {
+        //do nothing
+    }
+    
+    public Dimension getPreferredSize(javax.swing.JComponent c) {
+        return new Dimension(0, 0);
+    }
+    
+    public Dimension getMinimumSize(javax.swing.JComponent c) {
+        return new Dimension(0, 0);
+    }
+    
+    public Dimension getMaximumSize(javax.swing.JComponent c) {
+        return new Dimension(0, 0);
+    }
+}

DataModel/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java

@@ -22,6 +22,7 @@ package org.sleuthkit.autopsy.datamodel;
 import org.openide.nodes.AbstractNode;
 import org.openide.nodes.Children.Keys;
 import org.openide.nodes.Node;
+import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsRootNode;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.Directory;
 import org.sleuthkit.datamodel.File;
@@ -123,7 +124,7 @@ abstract class AbstractContentChildren extends Keys<Object> {
         
         @Override
         public AbstractNode visit(SearchFilters sf) {
-            return new SearchFiltersNode(sf.getSleuthkitCase());
+            return new SearchFiltersNode(sf.getSleuthkitCase(), true);
         }
         
         @Override
@@ -131,6 +132,11 @@ abstract class AbstractContentChildren extends Keys<Object> {
             return new RecentFilesNode(rf.getSleuthkitCase());
         }
         
+        @Override
+        public AbstractNode visit(KeywordHits kh) {
+            return kh.new KeywordHitsRootNode();
+        }
+
         @Override
         protected AbstractNode defaultVisit(AutopsyVisitableItem di) {
             throw new UnsupportedOperationException("No Node defined for the given DisplayableItem");

DataModel/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java

@@ -27,8 +27,10 @@ public interface AutopsyItemVisitor<T> {
     T visit(ExtractedContent ec);
     T visit(SearchFilters sf);
     T visit(SearchFilters.FileSearchFilter fsf);
+    T visit(SearchFilters.DocumentFilter df);
     T visit(RecentFiles rf);
     T visit(RecentFiles.RecentFilesFilter rff);
+    T visit(KeywordHits kf);
     
     static abstract public class Default<T> implements AutopsyItemVisitor<T> {
 
@@ -49,6 +51,11 @@ public interface AutopsyItemVisitor<T> {
             return defaultVisit(fsf);
         }
         
+        @Override
+        public T visit(SearchFilters.DocumentFilter df) {
+            return defaultVisit(df);
+        }
+        
         @Override
         public T visit(RecentFiles rf) {
             return defaultVisit(rf);
@@ -58,5 +65,10 @@ public interface AutopsyItemVisitor<T> {
         public T visit(RecentFiles.RecentFilesFilter rff) {
             return defaultVisit(rff);
         }
+        
+        @Override
+        public T visit(KeywordHits kh) {
+            return defaultVisit(kh);
+        }
     }
 }

DataModel/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java

@@ -18,6 +18,9 @@
  */
 package org.sleuthkit.autopsy.datamodel;
 
+import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsRootNode;
+import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsSetNode;
+
 /**
  * Visitor pattern for DisplayableItemNodes
  */
@@ -45,6 +48,10 @@ public interface DisplayableItemNodeVisitor<T> {
     
     T visit(RecentFilesFilterNode rffn);
     
+    T visit(KeywordHitsRootNode khrn);
+    
+    T visit(KeywordHitsSetNode khsn);
+
     /**
      * Visitor with an implementable default behavior for all types. Override
      * specific visit types to not use the default behavior.
@@ -113,5 +120,15 @@ public interface DisplayableItemNodeVisitor<T> {
         public T visit(RecentFilesFilterNode rffn) {
             return defaultVisit(rffn);
         }
+        
+        @Override
+        public T visit(KeywordHitsRootNode khrn) {
+            return defaultVisit(khrn);
+        }
+        
+        @Override
+        public T visit(KeywordHitsSetNode khsn) {
+            return defaultVisit(khsn);
+        }
     }
 }

DataModel/src/org/sleuthkit/autopsy/datamodel/ExtractedContentChildren.java

@@ -41,6 +41,7 @@ public class ExtractedContentChildren extends ChildFactory<BlackboardArtifact.AR
     @Override
     protected boolean createKeys(List<BlackboardArtifact.ARTIFACT_TYPE> list) {
         list.addAll(Arrays.asList(BlackboardArtifact.ARTIFACT_TYPE.values()));
+        list.remove(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT);
         return true;
     }
     

DataModel/src/org/sleuthkit/autopsy/datamodel/FileSearchFilterChildren.java

@@ -43,10 +43,10 @@ import org.sleuthkit.datamodel.SleuthkitCase;
 class FileSearchFilterChildren extends ChildFactory<Content> {
     
     SleuthkitCase skCase;
-    FileSearchFilter filter;
+    SearchFilters.SearchFilterInterface filter;
     Logger logger = Logger.getLogger(FileSearchFilterChildren.class.getName());
 
-    public FileSearchFilterChildren(FileSearchFilter filter, SleuthkitCase skCase) {
+    public FileSearchFilterChildren(SearchFilters.SearchFilterInterface filter, SleuthkitCase skCase) {
         this.filter = filter;
         this.skCase = skCase;
     }

DataModel/src/org/sleuthkit/autopsy/datamodel/FileSearchFilterNode.java

@@ -31,16 +31,16 @@ import org.sleuthkit.datamodel.SleuthkitCase;
  */
 public class FileSearchFilterNode extends AbstractNode implements DisplayableItemNode{
     
-    FileSearchFilter filter;
+    SearchFilters.SearchFilterInterface filter;
     SleuthkitCase skCase;
 
-    FileSearchFilterNode(FileSearchFilter filter, SleuthkitCase skCase) {
+    FileSearchFilterNode(SearchFilters.SearchFilterInterface filter, SleuthkitCase skCase) {
         super(Children.create(new FileSearchFilterChildren(filter, skCase), true), Lookups.singleton(filter.getDisplayName()));
         super.setName(filter.getName());
         super.setDisplayName(filter.getDisplayName());
         this.filter = filter;
         this.skCase = skCase;
-        this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/filter-icon.png");
+        this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file-filter-icon.png");
     }
 
     @Override

DataModel/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java

@@ -0,0 +1,208 @@
+/*
+ * Autopsy Forensic Browser
+ * 
+ * Copyright 2011 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.autopsy.datamodel;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.openide.nodes.AbstractNode;
+import org.openide.nodes.ChildFactory;
+import org.openide.nodes.Children;
+import org.openide.nodes.Node;
+import org.openide.nodes.Sheet;
+import org.openide.util.lookup.Lookups;
+import org.sleuthkit.datamodel.BlackboardArtifact;
+import org.sleuthkit.datamodel.BlackboardAttribute;
+import org.sleuthkit.datamodel.SleuthkitCase;
+import org.sleuthkit.datamodel.TskException;
+
+/**
+ *
+ * @author dfickling
+ */
+public class KeywordHits implements AutopsyVisitableItem {
+    
+    SleuthkitCase skCase;
+    private static final Logger logger = Logger.getLogger(KeywordHits.class.getName());
+    private static final String KEYWORD_HITS = "Keyword Hits";
+    private static final String SIMPLE_SEARCH = "Single Keyword Search";
+    //Map<String, Map<String, List<BlackboardArtifact>>> artifactMap = new HashMap<String, Map<String, List<BlackboardArtifact>>>();
+    Map<String, List<Long>> listMap = new LinkedHashMap<String, List<Long>>();
+
+    public KeywordHits(SleuthkitCase skCase) {
+        this.skCase = skCase;
+        initMap();
+    }
+    
+    private void initMap() {
+        listMap.clear();
+        try {
+            String query = "select value_text,artifact_id from blackboard_attributes where attribute_type_id=" + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SET.getTypeID();
+            ResultSet rs = skCase.runQuery(query);
+            listMap.put(SIMPLE_SEARCH, new ArrayList<Long>());
+            while(rs.next()){
+                String listName = rs.getString("value_text");
+                if(listName == null || listName.equals(""))
+                    listName = SIMPLE_SEARCH;
+                long artifactID = rs.getLong("artifact_id");
+                if(!listMap.containsKey(listName))
+                    listMap.put(listName, new ArrayList<Long>());
+                listMap.get(listName).add(artifactID);
+            }
+            if(listMap.get(SIMPLE_SEARCH).isEmpty())
+                listMap.remove(SIMPLE_SEARCH);
+            Statement s = rs.getStatement();
+            rs.close();
+            if (s != null)
+                s.close();
+        } catch (SQLException ex) {
+            logger.log(Level.INFO, "SQL Exception occurred: ", ex);
+        }
+    }
+
+    @Override
+    public <T> T accept(AutopsyItemVisitor<T> v) {
+        return v.visit(this);
+    }
+
+    public class KeywordHitsRootNode extends AbstractNode implements DisplayableItemNode {
+
+
+        public KeywordHitsRootNode() {
+            super(Children.create(new KeywordHitsRootChildren(), true), Lookups.singleton(KEYWORD_HITS));
+            super.setName(KEYWORD_HITS);
+            super.setDisplayName(KEYWORD_HITS);
+            this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/keyword-search-icon.png");
+            initMap();
+        }
+
+        @Override
+        public <T> T accept(DisplayableItemNodeVisitor<T> v) {
+            return v.visit(this);
+        }
+        
+        @Override
+        protected Sheet createSheet() {
+            Sheet s = super.createSheet();
+            Sheet.Set ss = s.get(Sheet.PROPERTIES);
+            if (ss == null) {
+                ss = Sheet.createPropertiesSet();
+                s.put(ss);
+            }
+
+            ss.put(new NodeProperty(KEYWORD_HITS,
+                    KEYWORD_HITS,
+                    "no description",
+                    getName()));
+            
+            return s;
+        }
+    }
+
+    class KeywordHitsRootChildren extends ChildFactory<String> {
+
+        KeywordHitsRootChildren() {
+            super();
+        }
+
+        @Override
+        protected boolean createKeys(List<String> list) {
+            list.addAll(listMap.keySet());
+            return true;
+        }
+
+        @Override
+        protected Node createNodeForKey(String key) {
+            return new KeywordHitsSetNode(key);
+        }
+    }
+    
+    public class KeywordHitsSetNode extends AbstractNode implements DisplayableItemNode {
+
+        String setName;
+        public KeywordHitsSetNode(String key) {
+            super(Children.create(new KeywordHitsSetChildren(key), true), Lookups.singleton(key));
+            super.setName(key);
+            super.setDisplayName(key + " (" + listMap.get(key).size() + ")");
+            setName = key;
+            this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/keyword-search-icon.png");
+        }
+
+        @Override
+        public <T> T accept(DisplayableItemNodeVisitor<T> v) {
+            return v.visit(this);
+        }
+
+        @Override
+        protected Sheet createSheet() {
+            Sheet s = super.createSheet();
+            Sheet.Set ss = s.get(Sheet.PROPERTIES);
+            if (ss == null) {
+                ss = Sheet.createPropertiesSet();
+                s.put(ss);
+            }
+
+            ss.put(new NodeProperty("List Name",
+                    "List Name",
+                    "no description",
+                    setName));
+            
+            
+            ss.put(new NodeProperty("Number of Hits",
+                    "Number of Hits",
+                    "no description",
+                    listMap.get(setName).size()));
+            
+            return s;
+        }
+    }
+
+    class KeywordHitsSetChildren extends ChildFactory<BlackboardArtifact> {
+
+        String setName;
+        KeywordHitsSetChildren(String setName) {
+            super();
+            this.setName = setName;
+        }
+
+        @Override
+        protected boolean createKeys(List<BlackboardArtifact> list) {
+            for (long l : listMap.get(setName)) {
+                try {
+                    //TODO: bulk artifact gettings
+                    list.add(skCase.getBlackboardArtifact(l));
+                } catch (TskException ex) {
+                    logger.log(Level.INFO, "TSK Exception occurred", ex);
+                }
+            }
+            return true;
+        }
+
+        @Override
+        protected Node createNodeForKey(BlackboardArtifact artifact) {
+            return new BlackboardArtifactNode(artifact);
+        }
+    }
+}

DataModel/src/org/sleuthkit/autopsy/datamodel/SearchFilters.java

@@ -29,7 +29,7 @@ public class SearchFilters implements AutopsyVisitableItem{
 
     SleuthkitCase skCase;
 
-    public enum FileSearchFilter implements AutopsyVisitableItem {
+    public enum FileSearchFilter implements AutopsyVisitableItem,SearchFilterInterface {
         TSK_IMAGE_FILTER(0, "TSK_IMAGE_FILTER", "Images", Arrays.asList(".jpg", ".jpeg", ".png", ".psd", ".nef", ".tiff")),
         TSK_VIDEO_FILTER(1, "TSK_VIDEO_FILTER", "Videos",
             Arrays.asList(".aaf", ".3gp", ".asf", ".avi", ".m1v", ".m2v", ".m4v",
@@ -57,18 +57,68 @@ public class SearchFilters implements AutopsyVisitableItem{
             return v.visit(this);
         }
 
+        @Override
         public String getName(){
             return this.name;
         }
 
+        @Override
         public int getId(){
             return this.id;
         }
 
+        @Override
         public String getDisplayName(){
             return this.displayName;
         }
 
+        @Override
+        public List<String> getFilter(){
+            return this.filter;
+        }
+    }
+    
+    public enum DocumentFilter implements AutopsyVisitableItem,SearchFilterInterface {
+        AUT_DOC_HTML(0, "AUT_DOC_HTML", "HTML", Arrays.asList(".htm", ".html")),
+        AUT_DOC_OFFICE(1, "AUT_DOC_OFFICE", "Office", Arrays.asList(".doc", ".docx", 
+                ".odt", ".xls", ".xlsx", ".ppt", ".pptx")),
+        AUT_DOC_PDF(2, "AUT_DOC_PDF", "PDF", Arrays.asList(".pdf")),
+        AUT_DOC_TXT(3, "AUT_DOC_TXT", "Plain Text", Arrays.asList(".txt")),
+        AUT_DOC_RTF(4, "AUT_DOC_RTF", "Rich Text", Arrays.asList(".rtf"));
+
+        int id;
+        String name;
+        String displayName;
+        List<String> filter;
+
+        private DocumentFilter(int id, String name, String displayName, List<String> filter){
+            this.id = id;
+            this.name = name;
+            this.displayName = displayName;
+            this.filter = filter;
+        }
+
+        @Override
+        public <T> T accept(AutopsyItemVisitor<T> v) {
+            return v.visit(this);
+        }
+
+        @Override
+        public String getName(){
+            return this.name;
+        }
+
+        @Override
+        public int getId(){
+            return this.id;
+        }
+
+        @Override
+        public String getDisplayName(){
+            return this.displayName;
+        }
+
+        @Override
         public List<String> getFilter(){
             return this.filter;
         }
@@ -86,4 +136,14 @@ public class SearchFilters implements AutopsyVisitableItem{
     public SleuthkitCase getSleuthkitCase(){
         return this.skCase;
     }
+    
+    interface SearchFilterInterface {
+        public String getName();
+
+        public int getId();
+
+        public String getDisplayName();
+
+        public List<String> getFilter();
+    }
 }

DataModel/src/org/sleuthkit/autopsy/datamodel/SearchFiltersChildren.java

@@ -29,22 +29,30 @@ import org.sleuthkit.datamodel.SleuthkitCase;
  *
  * @author dfickling
  */
-class SearchFiltersChildren extends ChildFactory<SearchFilters.FileSearchFilter> {
+class SearchFiltersChildren extends ChildFactory<SearchFilters.SearchFilterInterface> {
     
     SleuthkitCase skCase;
+    boolean root;
 
-    public SearchFiltersChildren(SleuthkitCase skCase) {
+    public SearchFiltersChildren(SleuthkitCase skCase, boolean root) {
         this.skCase = skCase;
+        this.root = root;
     }
 
     @Override
-    protected boolean createKeys(List<FileSearchFilter> list) {
+    protected boolean createKeys(List<SearchFilters.SearchFilterInterface> list) {
+        if(root)
             list.addAll(Arrays.asList(FileSearchFilter.values()));
+        else
+            list.addAll(Arrays.asList(SearchFilters.DocumentFilter.values()));
         return true;
     }
     
     @Override
-    protected Node createNodeForKey(FileSearchFilter key){
+    protected Node createNodeForKey(SearchFilters.SearchFilterInterface key){
+        if(key.getName().equals(SearchFilters.FileSearchFilter.TSK_DOCUMENT_FILTER.getName())){
+            return new SearchFiltersNode(skCase, false);
+        }
         return new FileSearchFilterNode(key, skCase);
     }
     

DataModel/src/org/sleuthkit/autopsy/datamodel/SearchFiltersNode.java

@@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.datamodel;
 
 import org.openide.nodes.AbstractNode;
 import org.openide.nodes.Children;
+import org.openide.nodes.Sheet;
 import org.openide.util.lookup.Lookups;
 import org.sleuthkit.datamodel.SleuthkitCase;
 
@@ -31,17 +32,37 @@ public class SearchFiltersNode extends AbstractNode implements DisplayableItemNo
     
     SleuthkitCase skCase;
 
-    SearchFiltersNode(SleuthkitCase skCase) {
+    SearchFiltersNode(SleuthkitCase skCase, boolean root) {
-        super(Children.create(new SearchFiltersChildren(skCase), true), Lookups.singleton("Search Filters"));
+        super(Children.create(new SearchFiltersChildren(skCase, root), true), Lookups.singleton(root ? "File Types" : "Documents"));
+        if(root){
             super.setName("File Types");
             super.setDisplayName("File Types");
+        } else {
+            super.setName("Documents");
+            super.setDisplayName("Documents");
+        }
         this.skCase = skCase;
-        this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/filter-icon.png");
+        this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file-filter-icon.png");
-}
+    }
 
     @Override
     public <T> T accept(DisplayableItemNodeVisitor<T> v) {
        return v.visit(this);
     }
 
+    @Override
+    protected Sheet createSheet() {
+        Sheet s = super.createSheet();
+        Sheet.Set ss = s.get(Sheet.PROPERTIES);
+        if (ss == null) {
+            ss = Sheet.createPropertiesSet();
+            s.put(ss);
+        }
+
+        ss.put(new NodeProperty("Search Filter",
+                "Search Filter",
+                "no description",
+                getName()));
+        return s;
+    }
 }

DirectoryTree/src/org/sleuthkit/autopsy/directorytree/DataResultFilterNode.java

@@ -42,7 +42,9 @@ import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor;
 import org.sleuthkit.autopsy.datamodel.FileNode;
 import org.sleuthkit.autopsy.datamodel.FileSearchFilterNode;
 import org.sleuthkit.autopsy.datamodel.ImageNode;
+import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsSetNode;
 import org.sleuthkit.autopsy.datamodel.RecentFilesFilterNode;
+import org.sleuthkit.autopsy.datamodel.SearchFiltersNode;
 import org.sleuthkit.datamodel.Content;
 
 
@@ -209,11 +211,21 @@ public class DataResultFilterNode extends FilterNode{
             return openChild(fsfn);
         }
         
+        @Override
+        public AbstractAction visit(SearchFiltersNode sfn) {
+            return openChild(sfn);
+        }
+        
         @Override
         public AbstractAction visit(RecentFilesFilterNode rffn) {
             return openChild(rffn);
         }
         
+        @Override
+        public AbstractAction visit(KeywordHitsSetNode khsn) {
+            return openChild(khsn);
+        }
+        
         @Override
         protected AbstractAction defaultVisit(DisplayableItemNode c) {
             return null;

DirectoryTree/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterChildren.java

@@ -27,6 +27,8 @@ import org.openide.nodes.Node;
 import org.sleuthkit.autopsy.datamodel.ArtifactTypeNode;
 import org.sleuthkit.autopsy.datamodel.ExtractedContentNode;
 import org.sleuthkit.autopsy.datamodel.FileSearchFilterNode;
+import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsRootNode;
+import org.sleuthkit.autopsy.datamodel.KeywordHits.KeywordHitsSetNode;
 import org.sleuthkit.autopsy.datamodel.RecentFilesFilterNode;
 import org.sleuthkit.autopsy.datamodel.RecentFilesNode;
 import org.sleuthkit.autopsy.datamodel.SearchFiltersNode;
@@ -68,7 +70,9 @@ class DirectoryTreeFilterChildren extends FilterNode.Children {
                 arg0 instanceof FileSearchFilterNode ||
                 arg0 instanceof SearchFiltersNode ||
                 arg0 instanceof RecentFilesNode ||
-                arg0 instanceof RecentFilesFilterNode)) {
+                arg0 instanceof RecentFilesFilterNode ||
+                arg0 instanceof KeywordHitsRootNode ||
+                arg0 instanceof KeywordHitsSetNode)) {
             return new Node[]{this.copyNode(arg0)};
         } else {
             return new Node[]{};

DirectoryTree/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java

@@ -56,6 +56,7 @@ import org.sleuthkit.autopsy.datamodel.ContentUtils;
 import org.sleuthkit.autopsy.datamodel.DataConversion;
 import org.sleuthkit.autopsy.datamodel.ExtractedContent;
 import org.sleuthkit.autopsy.datamodel.ExtractedContentNode;
+import org.sleuthkit.autopsy.datamodel.KeywordHits;
 import org.sleuthkit.autopsy.datamodel.RecentFiles;
 import org.sleuthkit.autopsy.datamodel.RootContentChildren;
 import org.sleuthkit.autopsy.datamodel.SearchFilters;
@@ -330,6 +331,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
                     List<Object> items = new ArrayList<Object>();
                     items.addAll(currentCase.getRootObjects());
                     items.add(new ExtractedContent(currentCase.getSleuthkitCase()));
+                    items.add(new KeywordHits(currentCase.getSleuthkitCase()));
                     items.add(new SearchFilters(currentCase.getSleuthkitCase()));
                     items.add(new RecentFiles(currentCase.getSleuthkitCase()));
                     contentChildren = new RootContentChildren(items);

FileSearch/src/org/sleuthkit/autopsy/filesearch/Bundle.properties

@@ -1,4 +1,4 @@
-CTL_FileSearchAction=FileSearch
+CTL_FileSearchAction=File Search
 CTL_FileSearchTopComponent=File Search
 HINT_FileSearchTopComponent=This is a FileSearch window
 OpenIDE-Module-Name=FileSearch

FileSearch/src/org/sleuthkit/autopsy/filesearch/DateSearchFilter.java

@@ -19,6 +19,7 @@
 package org.sleuthkit.autopsy.filesearch;
 
 import java.awt.Component;
+import java.awt.event.ActionListener;
 import java.beans.PropertyChangeEvent;
 import java.beans.PropertyChangeListener;
 import java.text.DateFormat;
@@ -193,6 +194,11 @@ class DateSearchFilter extends AbstractFileSearchFilter<DateSearchPanel> {
         return timeZones;
     }
 
+    @Override
+    public void addActionListener(ActionListener l) {
+        getComponent().addActionListener(l);
+    }
+
     /**
      * Inner class to put the separator inside the combo box.
      */

FileSearch/src/org/sleuthkit/autopsy/filesearch/DateSearchPanel.java

@@ -363,4 +363,9 @@ class DateSearchPanel extends javax.swing.JPanel {
     private javax.swing.JMenuItem selectAllMenuItem;
     private javax.swing.JComboBox timeZoneComboBox;
     // End of variables declaration//GEN-END:variables
+
+    void addActionListener(ActionListener l) {
+        dateFromTextField.addActionListener(l);
+        dateToTextField.addActionListener(l);
+    }
 }

FileSearch/src/org/sleuthkit/autopsy/filesearch/FileSearchAction.java

@@ -0,0 +1,30 @@
+/*
+ * Autopsy Forensic Browser
+ * 
+ * Copyright 2011 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.autopsy.filesearch;
+
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+
+public final class FileSearchAction implements ActionListener {
+
+    @Override
+    public void actionPerformed(ActionEvent e) {
+        new FileSearchDialog().setVisible(true);
+    }
+}

FileSearch/src/org/sleuthkit/autopsy/filesearch/FileSearchDialog.form

@@ -0,0 +1,38 @@
+<?xml version="1.1" encoding="UTF-8" ?>
+
+<Form version="1.5" maxVersion="1.7" type="org.netbeans.modules.form.forminfo.JDialogFormInfo">
+  <Properties>
+    <Property name="defaultCloseOperation" type="int" value="2"/>
+  </Properties>
+  <SyntheticProperties>
+    <SyntheticProperty name="formSizePolicy" type="int" value="1"/>
+  </SyntheticProperties>
+  <AuxValues>
+    <AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/>
+    <AuxValue name="FormSettings_autoSetComponentName" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_generateFQN" type="java.lang.Boolean" value="true"/>
+    <AuxValue name="FormSettings_generateMnemonicsCode" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_i18nAutoMode" type="java.lang.Boolean" value="true"/>
+    <AuxValue name="FormSettings_layoutCodeTarget" type="java.lang.Integer" value="1"/>
+    <AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
+    <AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
+  </AuxValues>
+
+  <Layout>
+    <DimensionLayout dim="0">
+      <Group type="103" groupAlignment="0" attributes="0">
+          <Component id="fileSearchPanel1" alignment="0" pref="338" max="32767" attributes="0"/>
+      </Group>
+    </DimensionLayout>
+    <DimensionLayout dim="1">
+      <Group type="103" groupAlignment="0" attributes="0">
+          <Component id="fileSearchPanel1" alignment="0" pref="487" max="32767" attributes="0"/>
+      </Group>
+    </DimensionLayout>
+  </Layout>
+  <SubComponents>
+    <Component class="org.sleuthkit.autopsy.filesearch.FileSearchPanel" name="fileSearchPanel1">
+    </Component>
+  </SubComponents>
+</Form>

FileSearch/src/org/sleuthkit/autopsy/filesearch/FileSearchDialog.java

@@ -0,0 +1,88 @@
+/*
+ * Autopsy Forensic Browser
+ * 
+ * Copyright 2011 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * FileSearchDialog.java
+ *
+ * Created on Mar 5, 2012, 1:57:33 PM
+ */
+package org.sleuthkit.autopsy.filesearch;
+
+import java.awt.Dimension;
+import java.awt.Toolkit;
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import javax.swing.JFrame;
+
+/**
+ *
+ * @author dfickling
+ */
+public class FileSearchDialog extends javax.swing.JDialog {
+
+    /** Creates new form FileSearchDialog */
+    public FileSearchDialog() {
+        super(new JFrame("File Search"), true);
+        initComponents();
+
+        setResizable(false);
+        Dimension screenDimension = Toolkit.getDefaultToolkit().getScreenSize();
+        double w = getSize().getWidth();
+        double h = getSize().getHeight();
+        setLocation((int) ((screenDimension.getWidth() - w) / 2), (int) ((screenDimension.getHeight() - h) / 2));
+        fileSearchPanel1.addListenerToAll(new ActionListener() {
+
+            @Override
+            public void actionPerformed(ActionEvent e) {
+                dispose();
+            }
+        });
+    }
+
+    /** This method is called from within the constructor to
+     * initialize the form.
+     * WARNING: Do NOT modify this code. The content of this method is
+     * always regenerated by the Form Editor.
+     */
+    @SuppressWarnings("unchecked")
+    // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
+    private void initComponents() {
+
+        fileSearchPanel1 = new org.sleuthkit.autopsy.filesearch.FileSearchPanel();
+
+        setDefaultCloseOperation(javax.swing.WindowConstants.DISPOSE_ON_CLOSE);
+
+        javax.swing.GroupLayout layout = new javax.swing.GroupLayout(getContentPane());
+        getContentPane().setLayout(layout);
+        layout.setHorizontalGroup(
+            layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
+            .addComponent(fileSearchPanel1, javax.swing.GroupLayout.DEFAULT_SIZE, 338, Short.MAX_VALUE)
+        );
+        layout.setVerticalGroup(
+            layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
+            .addComponent(fileSearchPanel1, javax.swing.GroupLayout.DEFAULT_SIZE, 487, Short.MAX_VALUE)
+        );
+
+        pack();
+    }// </editor-fold>//GEN-END:initComponents
+
+    // Variables declaration - do not modify//GEN-BEGIN:variables
+    private org.sleuthkit.autopsy.filesearch.FileSearchPanel fileSearchPanel1;
+    // End of variables declaration//GEN-END:variables
+}

FileSearch/src/org/sleuthkit/autopsy/filesearch/FileSearchFilter.java

@@ -18,6 +18,7 @@
  */
 package org.sleuthkit.autopsy.filesearch;
 
+import java.awt.event.ActionListener;
 import javax.swing.JComponent;
 
 /**
@@ -46,6 +47,11 @@ interface FileSearchFilter {
      */
     String getPredicate() throws FilterValidationException;
     
+    /**
+     * Add an action listener to the fields of this panel
+     */
+    void addActionListener(ActionListener l);
+
     /**
      * Thrown if a filter's inputs are invalid
      */

FileSearch/src/org/sleuthkit/autopsy/filesearch/FileSearchPanel.form

@@ -0,0 +1,28 @@
+<?xml version="1.1" encoding="UTF-8" ?>
+
+<Form version="1.4" maxVersion="1.7" type="org.netbeans.modules.form.forminfo.JPanelFormInfo">
+  <AuxValues>
+    <AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/>
+    <AuxValue name="FormSettings_autoSetComponentName" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_generateFQN" type="java.lang.Boolean" value="true"/>
+    <AuxValue name="FormSettings_generateMnemonicsCode" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_i18nAutoMode" type="java.lang.Boolean" value="true"/>
+    <AuxValue name="FormSettings_layoutCodeTarget" type="java.lang.Integer" value="1"/>
+    <AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
+    <AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
+    <AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
+  </AuxValues>
+
+  <Layout>
+    <DimensionLayout dim="0">
+      <Group type="103" groupAlignment="0" attributes="0">
+          <EmptySpace min="0" pref="300" max="32767" attributes="0"/>
+      </Group>
+    </DimensionLayout>
+    <DimensionLayout dim="1">
+      <Group type="103" groupAlignment="0" attributes="0">
+          <EmptySpace min="0" pref="376" max="32767" attributes="0"/>
+      </Group>
+    </DimensionLayout>
+  </Layout>
+</Form>

FileSearch/src/org/sleuthkit/autopsy/filesearch/FileSearchPanel.java

@@ -0,0 +1,302 @@
+/*
+ * Autopsy Forensic Browser
+ * 
+ * Copyright 2011 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * FileSearchPanel.java
+ *
+ * Created on Mar 5, 2012, 1:51:50 PM
+ */
+package org.sleuthkit.autopsy.filesearch;
+
+import java.awt.BorderLayout;
+import java.awt.Component;
+import java.awt.Cursor;
+import java.awt.Dimension;
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import java.beans.PropertyChangeEvent;
+import java.beans.PropertyChangeListener;
+import java.beans.PropertyChangeSupport;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import javax.swing.BoxLayout;
+import javax.swing.JButton;
+import javax.swing.JLabel;
+import javax.swing.JPanel;
+import javax.swing.border.EmptyBorder;
+import org.openide.DialogDisplayer;
+import org.openide.NotifyDescriptor;
+import org.openide.windows.TopComponent;
+import org.sleuthkit.autopsy.casemodule.Case;
+import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent;
+import org.sleuthkit.autopsy.corecomponents.TableFilterNode;
+import org.sleuthkit.autopsy.filesearch.FileSearchFilter.FilterValidationException;
+import org.sleuthkit.datamodel.FsContent;
+import org.sleuthkit.datamodel.SleuthkitCase;
+
+/**
+ *
+ * @author dfickling
+ */
+public class FileSearchPanel extends javax.swing.JPanel {
+    
+    private List<FilterArea> filterAreas = new ArrayList();
+    private JButton searchButton;
+    private PropertyChangeListener listener;
+    private static ArrayList<DataResultTopComponent> searchResults = new ArrayList<DataResultTopComponent>();
+
+    /** Creates new form FileSearchPanel */
+    public FileSearchPanel() {
+        initComponents();
+        customizeComponents();
+        setListener();
+        this.listener = new PropertyChangeListener() {
+
+            @Override
+            public void propertyChange(PropertyChangeEvent evt) {
+                String changed = evt.getPropertyName();
+                Object newValue = evt.getNewValue();
+
+                // if the one of the "FileSearchResult" window is closed
+                if (changed.equals(DataResultTopComponent.REMOVE_FILESEARCH)) {
+                    searchResults.remove((DataResultTopComponent) newValue);
+                }
+            }
+        };
+    }
+    
+    /**
+     * This method is called from within the constructor to
+     * initialize the form.
+     */
+    private void customizeComponents() {
+
+        this.setLayout(new BorderLayout());
+
+        JPanel filterPanel = new JPanel();
+        filterPanel.setLayout(new BoxLayout(filterPanel, BoxLayout.Y_AXIS));
+        filterPanel.setBorder(new EmptyBorder(10, 10, 10, 10));
+        
+        this.add(filterPanel, BorderLayout.CENTER);
+
+        JLabel label = new JLabel("Search for files that match the following criteria:");
+        label.setAlignmentX(Component.LEFT_ALIGNMENT);
+        label.setBorder(new EmptyBorder(0, 0, 10, 0));
+        filterPanel.add(label);
+
+        // Create and add filter areas
+        this.filterAreas.add(new FilterArea("Name", new NameSearchFilter()));
+
+        List<FileSearchFilter> metadataFilters = new ArrayList<FileSearchFilter>();
+        metadataFilters.add(new SizeSearchFilter());
+        metadataFilters.add(new DateSearchFilter());
+        this.filterAreas.add(new FilterArea("Metadata", metadataFilters));
+
+        this.filterAreas.add(new FilterArea("Known Status", new KnownStatusSearchFilter()));
+
+        for (FilterArea fa : this.filterAreas) {
+            fa.setMaximumSize(new Dimension(Integer.MAX_VALUE, fa.getMinimumSize().height));
+            fa.setAlignmentX(Component.LEFT_ALIGNMENT);
+            filterPanel.add(fa);
+        }
+
+        // Create and add search button
+        this.searchButton = new JButton("Search");
+        this.searchButton.setAlignmentX(Component.LEFT_ALIGNMENT);
+        filterPanel.add(searchButton);
+
+        addListenerToAll(new ActionListener() {
+
+            @Override
+            public void actionPerformed(ActionEvent e) {
+                search();
+            }
+        });
+    }
+
+    /**
+     * @return true if any of the filters in the panel are enabled (checked)
+     */
+    private boolean anyFiltersEnabled() {
+        for (FileSearchFilter filter : this.getFilters()) {
+            if (filter.isEnabled()) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Action when the "Search" button is pressed.
+     *
+     * @param evt  the action event
+     */
+    private void search() {
+        // change the cursor to "waiting cursor" for this operation
+        this.setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
+        try {
+            if (this.anyFiltersEnabled()) {
+                String title = "File Search Results";
+                String pathText = "Filename Search Results:";
+
+                // try to get the number of matches first
+                Case currentCase = Case.getCurrentCase(); // get the most updated case
+                int totalMatches = 0;
+                ArrayList<FsContent> fsContentList = new ArrayList<FsContent>();
+                try {
+                    List<FsContent> currentDbList;
+                    SleuthkitCase tempDb = currentCase.getSleuthkitCase();
+                    ResultSet rs = tempDb.runQuery(this.getQuery("count(*) as TotalMatches"));
+                    totalMatches = totalMatches + rs.getInt("TotalMatches");
+                    Statement s = rs.getStatement();
+                    rs.close();
+                    if (s != null)
+                        s.close();
+                    rs = tempDb.runQuery(this.getQuery(null));
+                    currentDbList = tempDb.resultSetToFsContents(rs);
+                    s = rs.getStatement();
+                    rs.close();
+                    if (s != null)
+                        s.close();
+                    fsContentList.addAll(currentDbList);
+                } catch (SQLException ex) {
+                    Logger logger = Logger.getLogger(this.getClass().getName());
+                    logger.log(Level.WARNING, "Error while trying to get the number of matches.", ex);
+                }
+
+                TopComponent searchResultWin = DataResultTopComponent.createInstance(title, pathText, new TableFilterNode(new SearchNode(fsContentList), true), totalMatches);
+
+                searchResultWin.requestActive(); // make it the active top component
+
+                searchResultWin.addPropertyChangeListener(listener);
+                searchResults.add((DataResultTopComponent) searchResultWin);
+
+                /**
+                 * If total matches more than 1000, pop up a dialog box that say
+                 * the performance maybe be slow and to increase the performance,
+                 * tell the users to refine their search.
+                 */
+                if (totalMatches > 1000) {
+                    // show the confirmation
+                    NotifyDescriptor d = new NotifyDescriptor.Message("Note: " + totalMatches + " matches found. Due to the large number of search results, performance may be slow for some operations. (In particular the thumbnail view in this version of Autospy, should be fixed in a future version) \n\nPlease refine your search to get better search results and improve performance.");
+                    DialogDisplayer.getDefault().notify(d);
+                }
+            } else {
+                throw new FilterValidationException("At least one filter must be selected.");
+            }
+        } catch (FilterValidationException ex) {
+            NotifyDescriptor d = new NotifyDescriptor.Message("Validation Error: " + ex.getMessage());
+            DialogDisplayer.getDefault().notify(d);
+        } finally {
+            this.setCursor(null);
+        }
+    }
+    
+    private void setListener() {
+        Case.addPropertyChangeListener(listener); // add this class to listen to any changes in the Case.java class
+    }
+
+    public static ArrayList<DataResultTopComponent> getFileSearchResultList() {
+        return searchResults;
+    }
+
+    /**
+     * Gets the SQL query to get the data from the database based on the
+     * criteria that user chooses on the FileSearch.
+     *
+     * @param addition  the additional selection for query. If nothing/null, will select all.
+     * @return query  the SQL query
+     * @throws org.sleuthkit.autopsy.filesearch.FileSearchFilter.FilterValidationException  if an enabled filter is in an invalid state
+     */
+    private String getQuery(String addition) throws FilterValidationException {
+        String tempQuery = "*";
+        if (addition != null && !addition.equals("")) {
+            tempQuery = addition;
+        }
+
+        String query = "select " + tempQuery + " from tsk_files where 1";
+
+        for (FileSearchFilter f : this.getEnabledFilters()) {
+            query += " and (" + f.getPredicate() + ")";
+        }
+
+        return query;
+    }
+
+    private Collection<FileSearchFilter> getFilters() {
+        Collection<FileSearchFilter> filters = new ArrayList<FileSearchFilter>();
+
+        for (FilterArea fa : this.filterAreas) {
+            filters.addAll(fa.getFilters());
+        }
+
+        return filters;
+    }
+
+    private Collection<FileSearchFilter> getEnabledFilters() {
+        Collection<FileSearchFilter> enabledFilters = new ArrayList<FileSearchFilter>();
+
+        for (FileSearchFilter f : this.getFilters()) {
+            if (f.isEnabled()) {
+                enabledFilters.add(f);
+            }
+        }
+
+        return enabledFilters;
+    }
+    
+    void addListenerToAll(ActionListener l) {
+        searchButton.addActionListener(l);
+        for (FilterArea fa : this.filterAreas) {
+            for(FileSearchFilter fsf : fa.getFilters()) {
+                fsf.addActionListener(l);
+            }
+        }
+    }
+
+    /** This method is called from within the constructor to
+     * initialize the form.
+     * WARNING: Do NOT modify this code. The content of this method is
+     * always regenerated by the Form Editor.
+     */
+    @SuppressWarnings("unchecked")
+    // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
+    private void initComponents() {
+
+        javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
+        this.setLayout(layout);
+        layout.setHorizontalGroup(
+            layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
+            .addGap(0, 300, Short.MAX_VALUE)
+        );
+        layout.setVerticalGroup(
+            layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
+            .addGap(0, 376, Short.MAX_VALUE)
+        );
+    }// </editor-fold>//GEN-END:initComponents
+    // Variables declaration - do not modify//GEN-BEGIN:variables
+    // End of variables declaration//GEN-END:variables
+}

FileSearch/src/org/sleuthkit/autopsy/filesearch/KnownStatusSearchFilter.java

@@ -18,6 +18,7 @@
  */
 package org.sleuthkit.autopsy.filesearch;
 
+import java.awt.event.ActionListener;
 import org.sleuthkit.datamodel.TskData.FileKnown;
 
 /**
@@ -73,4 +74,8 @@ class KnownStatusSearchFilter extends AbstractFileSearchFilter<KnownStatusSearch
     private String predicateHelper(FileKnown knownStatus) {
         return "known is " + knownStatus.toLong();
     }
+
+    @Override
+    public void addActionListener(ActionListener l) {
+    }
 }

FileSearch/src/org/sleuthkit/autopsy/filesearch/NameSearchFilter.java

@@ -18,6 +18,7 @@
  */
 package org.sleuthkit.autopsy.filesearch;
 
+import java.awt.event.ActionListener;
 import org.sleuthkit.autopsy.filesearch.FileSearchFilter.FilterValidationException;
 
 /**
@@ -54,4 +55,9 @@ class NameSearchFilter extends AbstractFileSearchFilter<NameSearchPanel> {
 
         return "name like '%" + keyword + "%'";
     }
+
+    @Override
+    public void addActionListener(ActionListener l) {
+        getComponent().addActionListener(l);
+    }
 }

FileSearch/src/org/sleuthkit/autopsy/filesearch/NameSearchPanel.java

@@ -155,4 +155,8 @@ class NameSearchPanel extends javax.swing.JPanel {
     private javax.swing.JTextField searchTextField;
     private javax.swing.JMenuItem selectAllMenuItem;
     // End of variables declaration//GEN-END:variables
+
+    void addActionListener(ActionListener l) {
+        searchTextField.addActionListener(l);
+    }
 }

FileSearch/src/org/sleuthkit/autopsy/filesearch/SizeSearchFilter.java

@@ -18,6 +18,7 @@
  */
 package org.sleuthkit.autopsy.filesearch;
 
+import java.awt.event.ActionListener;
 import javax.swing.JComboBox;
 import org.sleuthkit.autopsy.filesearch.FileSearchFilter.FilterValidationException;
 
@@ -63,4 +64,9 @@ class SizeSearchFilter extends AbstractFileSearchFilter<SizeSearchPanel> {
             throw new IllegalArgumentException();
         }
     }
+
+    @Override
+    public void addActionListener(ActionListener l) {
+        getComponent().addActionListener(l);
+    }
 }

FileSearch/src/org/sleuthkit/autopsy/filesearch/SizeSearchPanel.java

@@ -161,4 +161,8 @@ class SizeSearchPanel extends javax.swing.JPanel {
     private javax.swing.JFormattedTextField sizeTextField;
     private javax.swing.JComboBox sizeUnitComboBox;
     // End of variables declaration//GEN-END:variables
+
+    void addActionListener(ActionListener l) {
+        sizeTextField.addActionListener(l);
+    }
 }

FileSearch/src/org/sleuthkit/autopsy/filesearch/layer.xml

@@ -1,40 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE filesystem PUBLIC "-//NetBeans//DTD Filesystem 1.2//EN" "http://www.netbeans.org/dtds/filesystem-1_2.dtd">
 <filesystem>
-    <folder name="Actions">
-        <folder name="Window">
-            <file name="org-sleuthkit-autopsy-filesearch-FileSearchAction.instance">
-                <attr name="component" methodvalue="org.sleuthkit.autopsy.filesearch.FileSearchTopComponent.findInstance"/>
-                <attr name="displayName" bundlevalue="org.sleuthkit.autopsy.filesearch.Bundle#CTL_FileSearchAction"/>
-                <attr name="instanceCreate" methodvalue="org.openide.windows.TopComponent.openAction"/>
-            </file>
-        </folder>
-    </folder>
-    <folder name="Menu">
-        <folder name="Window"/>
-    </folder>
     <folder name="Services">
         <folder name="JavaHelp">
             <file name="filesearch-helpset.xml" url="filesearch-helpset.xml">
                 <attr name="position" intvalue="3662"/>
             </file>
         </folder>
-        <file name="org-sleuthkit-autopsy-filesearch-FileSearchTopComponent.instance">
-            <attr name="instanceOf" stringvalue="org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer"/>
-            <attr name="instanceCreate" methodvalue="org.sleuthkit.autopsy.filesearch.FileSearchTopComponent.getDefault"/>
-            <attr name="position" intvalue="200"/>
-        </file>
-    </folder>
-    <folder name="Windows2">
-        <folder name="Components">
-            <file name="FileSearchTopComponent.settings" url="FileSearchTopComponentSettings.xml"/>
-        </folder>
-
-        <!-- Not letting NetBeans manage docking for us at all. It's all handled in CoreComponentInterfaces:CoreComponentControl
-        <folder name="Modes">
-            <folder name="explorer">
-                <file name="FileSearchTopComponent.wstcref" url="FileSearchTopComponentWstcref.xml"/>
-            </folder>
-        </folder> -->
     </folder>
 </filesystem>

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractKeywordSearchPerformer.java

@@ -73,6 +73,10 @@ abstract class AbstractKeywordSearchPerformer extends javax.swing.JPanel impleme
 
     @Override
     public void search() {
+        if (filesIndexed == 0) {
+            KeywordSearchUtil.displayDialog("Keyword Search Error", "No files are indexed, please index an image before searching", KeywordSearchUtil.DIALOG_MESSAGE_TYPE.ERROR);
+            return;
+        }
         KeywordSearchQueryManager man = null;
         if (isMultiwordQuery()) {
             final List<Keyword> keywords = getQueryList();

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties

@@ -81,5 +81,5 @@ KeywordSearchPanel.settingsLabel.text=
 KeywordSearchPanel.listsButton.text=Watch Lists
 KeywordSearchListsViewerPanel.searchAddButton.text=Search
 KeywordSearchListsViewerPanel.manageListsButton.text=Manage Lists
-KeywordSearchListsViewerPanel.ingestLabel.text=Ingest is ongoing. Results will appear as the index is populated.
 KeywordSearchIngestSimplePanel.jLabel1.text=Select lists to use during ingest:
+KeywordSearchListsViewerPanel.ingestIndexLabel.text=Files Indexed:

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchListsViewerPanel.form

@@ -26,8 +26,8 @@
           </Group>
           <Group type="102" alignment="0" attributes="0">
               <EmptySpace max="-2" attributes="0"/>
-              <Component id="ingestLabel" min="-2" max="-2" attributes="0"/>
+              <Component id="ingestIndexLabel" min="-2" max="-2" attributes="0"/>
-              <EmptySpace pref="109" max="32767" attributes="0"/>
+              <EmptySpace pref="327" max="32767" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>
@@ -36,7 +36,7 @@
           <Group type="102" alignment="0" attributes="0">
               <Component id="jSplitPane1" min="-2" pref="268" max="-2" attributes="0"/>
               <EmptySpace pref="7" max="32767" attributes="0"/>
-              <Component id="ingestLabel" min="-2" max="-2" attributes="0"/>
+              <Component id="ingestIndexLabel" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
               <Group type="103" groupAlignment="3" attributes="0">
                   <Component id="manageListsButton" alignment="3" min="-2" max="-2" attributes="0"/>
@@ -125,13 +125,13 @@
         </Property>
       </Properties>
     </Component>
-    <Component class="javax.swing.JLabel" name="ingestLabel">
+    <Component class="javax.swing.JLabel" name="ingestIndexLabel">
       <Properties>
         <Property name="font" type="java.awt.Font" editor="org.netbeans.beaninfo.editors.FontEditor">
           <Font name="Tahoma" size="10" style="0"/>
         </Property>
         <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
-          <ResourceString bundle="org/sleuthkit/autopsy/keywordsearch/Bundle.properties" key="KeywordSearchListsViewerPanel.ingestLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+          <ResourceString bundle="org/sleuthkit/autopsy/keywordsearch/Bundle.properties" key="KeywordSearchListsViewerPanel.ingestIndexLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
         </Property>
       </Properties>
     </Component>

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchListsViewerPanel.java

@@ -80,7 +80,6 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
     }
     
     private void customizeComponents() {
-        ingestLabel.setVisible(false);
         listsTable.setTableHeader(null);
         listsTable.setSelectionMode(ListSelectionModel.SINGLE_SELECTION);
         //customize column witdhs
@@ -106,6 +105,24 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
             }
         }
         
+        KeywordSearch.changeSupport.addPropertyChangeListener(KeywordSearch.NUM_FILES_CHANGE_EVT,
+                new PropertyChangeListener() {
+
+                    @Override
+                    public void propertyChange(PropertyChangeEvent evt) {
+                        String changed = evt.getPropertyName();
+                        Object oldValue = evt.getOldValue();
+                        Object newValue = evt.getNewValue();
+
+                        if (changed.equals(KeywordSearch.NUM_FILES_CHANGE_EVT)) {
+                            int newFilesIndexed = ((Integer) newValue).intValue();
+                            if(!ingestRunning){
+                                ingestIndexLabel.setText("Files Indexed: " + newFilesIndexed);
+                            }
+                        }
+                    }
+                });
+        
         loader = KeywordSearchListsXML.getCurrent();
         loader.addPropertyChangeListener(new PropertyChangeListener() {
 
@@ -157,9 +174,9 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
         };
         
         if(IngestManager.getDefault().isServiceRunning(KeywordSearchIngestService.getDefault()))
-            initIngest(0);
+            initIngest(true);
         else
-            initIngest(1);
+            initIngest(false);
         
         IngestManager.addPropertyChangeListener(new PropertyChangeListener() {
 
@@ -169,13 +186,13 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
                 Object oldValue = evt.getOldValue();
                 if(changed.equals(IngestManager.SERVICE_COMPLETED_EVT) &&
                         ((String) oldValue).equals(KeywordSearchIngestService.MODULE_NAME))
-                    initIngest(1);
+                    initIngest(false);
                 else if(changed.equals(IngestManager.SERVICE_STARTED_EVT) &&
                         ((String) oldValue).equals(KeywordSearchIngestService.MODULE_NAME))
-                    initIngest(0);
+                    initIngest(true);
                 else if(changed.equals(IngestManager.SERVICE_STOPPED_EVT) &&
                         ((String) oldValue).equals(KeywordSearchIngestService.MODULE_NAME))
-                    initIngest(1);
+                    initIngest(false);
             }
             
         });
@@ -187,27 +204,25 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
      * case 0: ingest running
      * case 1: ingest not running
      */
-    private void initIngest(int running) {
+    private void initIngest(boolean running) {
         ActionListener[] current = searchAddButton.getActionListeners();
-        for(int i = 0; i < current.length; i++) {
+        for (int i = 0; i < current.length; i++) {
-            if(current[i].equals(ingestListener) || current[i].equals(searchListener))
+            if (current[i].equals(ingestListener) || current[i].equals(searchListener)) {
                 searchAddButton.removeActionListener(current[i]);
             }
-        switch (running) {
+        }
-            case 0:
+        if (running) {
             ingestRunning = true;
             searchAddButton.setText("Add to Ingest");
             searchAddButton.addActionListener(ingestListener);
             listsTableModel.resync();
-                ingestLabel.setVisible(true);
+            ingestIndexLabel.setText("Ingest is ongoing. Results will appear as the index is populated.");
-                break;
+        } else {
-            case 1:
             ingestRunning = false;
             searchAddButton.setText("Search");
             searchAddButton.addActionListener(searchListener);
             listsTableModel.resync();
-                ingestLabel.setVisible(false);
+            ingestIndexLabel.setText("Files Indexed: " + filesIndexed);
-                break;
         }
     }
 
@@ -227,7 +242,7 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
         keywordsTable = new javax.swing.JTable();
         manageListsButton = new javax.swing.JButton();
         searchAddButton = new javax.swing.JButton();
-        ingestLabel = new javax.swing.JLabel();
+        ingestIndexLabel = new javax.swing.JLabel();
 
         leftPane.setMinimumSize(new java.awt.Dimension(150, 23));
 
@@ -257,8 +272,8 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
 
         searchAddButton.setText(org.openide.util.NbBundle.getMessage(KeywordSearchListsViewerPanel.class, "KeywordSearchListsViewerPanel.searchAddButton.text")); // NOI18N
 
-        ingestLabel.setFont(new java.awt.Font("Tahoma", 0, 10)); // NOI18N
+        ingestIndexLabel.setFont(new java.awt.Font("Tahoma", 0, 10)); // NOI18N
-        ingestLabel.setText(org.openide.util.NbBundle.getMessage(KeywordSearchListsViewerPanel.class, "KeywordSearchListsViewerPanel.ingestLabel.text")); // NOI18N
+        ingestIndexLabel.setText(org.openide.util.NbBundle.getMessage(KeywordSearchListsViewerPanel.class, "KeywordSearchListsViewerPanel.ingestIndexLabel.text")); // NOI18N
 
         javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
         this.setLayout(layout);
@@ -273,15 +288,15 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
                 .addContainerGap())
             .addGroup(layout.createSequentialGroup()
                 .addContainerGap()
-                .addComponent(ingestLabel)
+                .addComponent(ingestIndexLabel)
-                .addContainerGap(109, Short.MAX_VALUE))
+                .addContainerGap(327, Short.MAX_VALUE))
         );
         layout.setVerticalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
             .addGroup(layout.createSequentialGroup()
                 .addComponent(jSplitPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 268, javax.swing.GroupLayout.PREFERRED_SIZE)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 7, Short.MAX_VALUE)
-                .addComponent(ingestLabel)
+                .addComponent(ingestIndexLabel)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
                     .addComponent(manageListsButton)
@@ -295,7 +310,7 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
     }//GEN-LAST:event_manageListsButtonActionPerformed
 
     // Variables declaration - do not modify//GEN-BEGIN:variables
-    private javax.swing.JLabel ingestLabel;
+    private javax.swing.JLabel ingestIndexLabel;
     private javax.swing.JSplitPane jSplitPane1;
     private javax.swing.JTable keywordsTable;
     private javax.swing.JScrollPane leftPane;
@@ -307,9 +322,6 @@ class KeywordSearchListsViewerPanel extends AbstractKeywordSearchPerformer {
 
     
     private void searchAction(ActionEvent e) {
-        if (filesIndexed == 0)
-            return;
-
        setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
 
         try {

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchPanel.java

@@ -216,8 +216,6 @@ public class KeywordSearchPanel extends AbstractKeywordSearchPerformer{
     }// </editor-fold>//GEN-END:initComponents
 
     private void searchBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_searchBoxActionPerformed
-        if (filesIndexed == 0)
-            return;
         getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
         try {
             search();

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java

@@ -164,10 +164,10 @@ public class LuceneQuery implements KeywordSearchQuery {
 
         //get listname
         String listName = "";
-        KeywordSearchList list = KeywordSearchListsXML.getCurrent().getListWithKeyword(query);
+        //KeywordSearchList list = KeywordSearchListsXML.getCurrent().getListWithKeyword(query);
-        if (list != null) {
+        //if (list != null) {
-            listName = list.getName();
+        //    listName = list.getName();
-        }
+        //}
         final String theListName = listName;
 
         Node rootNode = new KeywordSearchNode(matches, query);

MenuActions/src/org/sleuthkit/autopsy/menuactions/SearchResultMenu.java

@@ -27,7 +27,7 @@ import javax.swing.JMenuItem;
 import org.openide.awt.DynamicMenuContent;
 import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent;
 import org.sleuthkit.autopsy.directorytree.DirectoryTreeTopComponent;
-import org.sleuthkit.autopsy.filesearch.FileSearchTopComponent;
+import org.sleuthkit.autopsy.filesearch.FileSearchPanel;
 
 /**
  * Menu item lists DataResult tabs.
@@ -39,7 +39,7 @@ public class SearchResultMenu extends JMenuItem implements DynamicMenuContent {
 
     @Override
     public JComponent[] getMenuPresenters() {
-        List<DataResultTopComponent> searchResults = FileSearchTopComponent.getFileSearchResultList();
+        List<DataResultTopComponent> searchResults = FileSearchPanel.getFileSearchResultList();
         DirectoryTreeTopComponent directoryTree = DirectoryTreeTopComponent.findInstance();
         DataResultTopComponent directoryListing = directoryTree.getDirectoryListing();