Merge pull request #1384 from rcordovano/closed-case-checks

Closed case checks
This commit is contained in:
Richard Cordovano 2015-06-19 14:32:53 -04:00
commit e1599e13a1
18 changed files with 674 additions and 285 deletions

View File

@ -1392,28 +1392,32 @@ public class Case {
Case.clearTempFolder();
checkSubFolders(toChangeTo);
// enable these menus
CallableSystemAction.get(AddImageAction.class).setEnabled(true);
CallableSystemAction.get(CaseCloseAction.class).setEnabled(true);
CallableSystemAction.get(CasePropertiesAction.class).setEnabled(true);
CallableSystemAction.get(CaseDeleteAction.class).setEnabled(true); // Delete Case menu
if (IngestManager.getInstance().isRunningInteractively()) {
// enable these menus
CallableSystemAction.get(AddImageAction.class).setEnabled(true);
CallableSystemAction.get(CaseCloseAction.class).setEnabled(true);
CallableSystemAction.get(CasePropertiesAction.class).setEnabled(true);
CallableSystemAction.get(CaseDeleteAction.class).setEnabled(true); // Delete Case menu
if (toChangeTo.hasData()) {
// open all top components
CoreComponentControl.openCoreWindows();
} else {
// close all top components
CoreComponentControl.closeCoreWindows();
if (toChangeTo.hasData()) {
// open all top components
CoreComponentControl.openCoreWindows();
} else {
// close all top components
CoreComponentControl.closeCoreWindows();
}
}
} else { // case is closed
// close all top components first
CoreComponentControl.closeCoreWindows();
if (IngestManager.getInstance().isRunningInteractively()) {
// close all top components first
CoreComponentControl.closeCoreWindows();
// disable these menus
CallableSystemAction.get(AddImageAction.class).setEnabled(false); // Add Image menu
CallableSystemAction.get(CaseCloseAction.class).setEnabled(false); // Case Close menu
CallableSystemAction.get(CasePropertiesAction.class).setEnabled(false); // Case Properties menu
CallableSystemAction.get(CaseDeleteAction.class).setEnabled(false); // Delete Case menu
// disable these menus
CallableSystemAction.get(AddImageAction.class).setEnabled(false); // Add Image menu
CallableSystemAction.get(CaseCloseAction.class).setEnabled(false); // Case Close menu
CallableSystemAction.get(CasePropertiesAction.class).setEnabled(false); // Case Properties menu
CallableSystemAction.get(CaseDeleteAction.class).setEnabled(false); // Delete Case menu
}
//clear pending notifications
MessageNotifyUtil.Notify.clear();

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013-2014 Basis Technology Corp.
* Copyright 2013-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -180,16 +180,40 @@ public class DeletedContent implements AutopsyVisitableItem {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
// new file was added
if (eventType.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) {
// @@@ COULD CHECK If the new file is deleted before notifying...
update();
/**
* Checking for a current case is a stop gap measure
* until a different way of handling the closing of
* cases is worked out. Currently, remote events may be
* received for a case that is already closed.
*/
try {
Case.getCurrentCase();
// new file was added
// @@@ COULD CHECK If the new file is deleted before notifying...
update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
update();
} else if (eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
update();
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())
|| eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
/**
* Checking for a current case is a stop gap measure
* until a different way of handling the closing of
* cases is worked out. Currently, remote events may be
* received for a case that is already closed.
*/
try {
Case.getCurrentCase();
update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {

View File

@ -204,17 +204,47 @@ public class EmailExtracted implements AutopsyVisitableItem {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
if (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG) {
emailResults.update();
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
/**
* Even with the check above, it is still possible that the
* case will be closed in a different thread before this
* code executes. If that happens, it is possible for the
* event to have a null oldValue.
*/
ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
if (null != eventData && eventData.getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG) {
emailResults.update();
}
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
emailResults.update();
}
else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
emailResults.update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {
removeNotify();

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -126,7 +126,7 @@ public class ExtractedContent implements AutopsyVisitableItem {
* more specific form elsewhere in the tree.
*/
private class TypeFactory extends ChildFactory.Detachable<BlackboardArtifact.ARTIFACT_TYPE> {
private final ArrayList<BlackboardArtifact.ARTIFACT_TYPE> doNotShow;
private final ArrayList<BlackboardArtifact.ARTIFACT_TYPE> doNotShow = new ArrayList<>();
// maps the artifact type to its child node
private final HashMap<BlackboardArtifact.ARTIFACT_TYPE, TypeNode> typeNodeList = new HashMap<>();
@ -134,7 +134,6 @@ public class ExtractedContent implements AutopsyVisitableItem {
super();
// these are shown in other parts of the UI tree
doNotShow = new ArrayList<>();
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT);
@ -143,26 +142,53 @@ public class ExtractedContent implements AutopsyVisitableItem {
doNotShow.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT);
}
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
/**
* This is a stop gap measure until a different way of
* handling the closing of cases is worked out. Currently,
* remote events may be received for a case that is already
* closed.
*/
try {
Case.getCurrentCase();
/**
* Due to some unresolved issues with how cases are
* closed, it is possible for the event to have a null
* oldValue if the event is a remote event.
*/
final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
if (doNotShow.contains(event.getArtifactType()) == false) {
if (null != event && doNotShow.contains(event.getArtifactType()) == false) {
refresh(true);
}
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
refresh(true);
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {
removeNotify();
skCase = null;
}
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
/**
* This is a stop gap measure until a different way of
* handling the closing of cases is worked out. Currently,
* remote events may be received for a case that is already
* closed.
*/
try {
Case.getCurrentCase();
refresh(true);
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {
removeNotify();
skCase = null;
}
}
};
@ -362,15 +388,46 @@ public class ExtractedContent implements AutopsyVisitableItem {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
if (event.getArtifactType() == type) {
refresh(true);
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
/**
* Even with the check above, it is still possible that
* the case will be closed in a different thread before
* this code executes. If that happens, it is possible
* for the event to have a null oldValue.
*/
final ModuleDataEvent event = (ModuleDataEvent) evt.getOldValue();
if (null != event && event.getArtifactType() == type) {
refresh(true);
}
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
refresh(true);
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
refresh(true);
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
}
};

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013-2014 Basis Technology Corp.
* Copyright 2013-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -178,15 +178,40 @@ public class FileSize implements AutopsyVisitableItem {
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
// new file was added
if (eventType.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) {
// @@@ could check the size here and only fire off updates if we know the file meets the min size criteria
update();
/**
* Checking for a current case is a stop gap measure
* until a different way of handling the closing of
* cases is worked out. Currently, remote events may be
* received for a case that is already closed.
*/
try {
// new file was added
// @@@ could check the size here and only fire off updates if we know the file meets the min size criteria
Case.getCurrentCase();
update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
update();
} else if (eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
update();
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())
|| eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
/**
* Checking for a current case is a stop gap measure
* until a different way of handling the closing of
* cases is worked out. Currently, remote events may be
* received for a case that is already closed.
*/
try {
Case.getCurrentCase();
update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -152,15 +152,24 @@ public class FileTypesNode extends DisplayableItemNode {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
// new file was added
if (eventType.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) {
update();
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
update();
} else if (eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
update();
if (eventType.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())
|| eventType.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
/**
* Checking for a current case is a stop gap measure
* until a different way of handling the closing of
* cases is worked out. Currently, remote events may be
* received for a case that is already closed.
*/
try {
Case.getCurrentCase();
update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -181,17 +181,46 @@ public class HashsetHits implements AutopsyVisitableItem {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
if (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == ARTIFACT_TYPE.TSK_HASHSET_HIT) {
hashsetResults.update();
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
/**
* Due to some unresolved issues with how cases are
* closed, it is possible for the event to have a null
* oldValue if the event is a remote event.
*/
ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
if (null != eventData && eventData.getArtifactType() == ARTIFACT_TYPE.TSK_HASHSET_HIT) {
hashsetResults.update();
}
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
hashsetResults.update();
}
else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
hashsetResults.update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {
removeNotify();

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -18,7 +18,6 @@
*/
package org.sleuthkit.autopsy.datamodel;
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.sql.ResultSet;
@ -50,7 +49,6 @@ import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
import org.sleuthkit.datamodel.TskCoreException;
public class InterestingHits implements AutopsyVisitableItem {
private static final String INTERESTING_ITEMS = NbBundle
@ -66,6 +64,7 @@ public class InterestingHits implements AutopsyVisitableItem {
}
private class InterestingResults extends Observable {
private final Map<String, Set<Long>> interestingItemsMap = new LinkedHashMap<>();
public List<String> getSetNames() {
@ -87,7 +86,8 @@ public class InterestingHits implements AutopsyVisitableItem {
}
/*
* Reads the artifacts of specified type, grouped by Set, and loads into the interestingItemsMap
* Reads the artifacts of specified type, grouped by Set, and loads into
* the interestingItemsMap
*/
@SuppressWarnings("deprecation")
private void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) {
@ -124,7 +124,7 @@ public class InterestingHits implements AutopsyVisitableItem {
return v.visit(this);
}
/**
/**
* Node for the interesting items
*/
public class RootNode extends DisplayableItemNode {
@ -156,36 +156,67 @@ public class InterestingHits implements AutopsyVisitableItem {
}
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.displayName"),
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
getName()));
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.displayName"),
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
getName()));
return s;
}
}
private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
/* This should probably be in the top-level class, but the factory has nice methods
* for its startup and shutdown, so it seemed like a cleaner place to register the
* property change listener.
/*
* This should probably be in the top-level class, but the factory has
* nice methods for its startup and shutdown, so it seemed like a
* cleaner place to register the property change listener.
*/
private final PropertyChangeListener pcl = new PropertyChangeListener() {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
if ((((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT) ||
(((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)) {
interestingResults.update();
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
/**
* Even with the check above, it is still possible that
* the case will be closed in a different thread before
* this code executes. If that happens, it is possible
* for the event to have a null oldValue.
*/
ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
if (null != eventData && (eventData.getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT
|| eventData.getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)) {
interestingResults.update();
}
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
interestingResults.update();
}
else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
interestingResults.update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {
removeNotify();
@ -230,7 +261,9 @@ public class InterestingHits implements AutopsyVisitableItem {
}
public class SetNameNode extends DisplayableItemNode implements Observer {
private final String setName;
public SetNameNode(String setName) {//, Set<Long> children) {
super(Children.create(new HitFactory(setName), true), Lookups.singleton(setName));
this.setName = setName;
@ -259,9 +292,9 @@ public class InterestingHits implements AutopsyVisitableItem {
}
ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
getName()));
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
getName()));
return s;
}
@ -278,6 +311,7 @@ public class InterestingHits implements AutopsyVisitableItem {
}
private class HitFactory extends ChildFactory<Long> implements Observer {
private final String setName;
private HitFactory(String setName) {

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -246,17 +246,47 @@ public class KeywordHits implements AutopsyVisitableItem {
@Override
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
if (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT) {
keywordResults.update();
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
/**
* Even with the check above, it is still possible that
* the case will be closed in a different thread before
* this code executes. If that happens, it is possible
* for the event to have a null oldValue.
*/
ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
if (null != eventData && eventData.getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT) {
keywordResults.update();
}
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
keywordResults.update();
}
else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
keywordResults.update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that we don't get called with a stale case handle
if (evt.getNewValue() == null) {
removeNotify();

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2014 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -98,7 +98,20 @@ public final class Reports implements AutopsyVisitableItem {
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(Case.Events.REPORT_ADDED.toString())) {
ReportNodeFactory.this.refresh(true);
/**
* Checking for a current case is a stop gap measure
* until a different way of handling the closing of
* cases is worked out. Currently, remote events may be
* received for a case that is already closed.
*/
try {
Case.getCurrentCase();
ReportNodeFactory.this.refresh(true);
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
}
});

View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -56,21 +56,18 @@ public class Tags implements AutopsyVisitableItem {
private final String DISPLAY_NAME = NbBundle.getMessage(RootNode.class, "TagsNode.displayName.text");
private final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
@Override
public <T> T accept(AutopsyItemVisitor<T> v) {
return v.visit(this);
}
/**
* This class largely does nothing except act as a top-level object that
* the other nodes can listen to. This mimics what other nodes have (keword search, etc.),
* but theirs stores data.
* This class largely does nothing except act as a top-level object that the
* other nodes can listen to. This mimics what other nodes have (keword
* search, etc.), but theirs stores data.
*/
private class TagResults extends Observable {
public void update() {
setChanged();
notifyObservers();
@ -123,20 +120,56 @@ public class Tags implements AutopsyVisitableItem {
public void propertyChange(PropertyChangeEvent evt) {
String eventType = evt.getPropertyName();
if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
/* Note: this is a hack. In an ideal world, TagsManager
* would fire events so that the directory tree would
* refresh. But, we haven't had a chance to add that so, we
* fire these events and the tree refreshes based on them. */
if ((((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT)
|| ((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE) {
refresh(true);
tagResults.update();
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
/**
* There are two things to note here. * First, even with
* the check above, it is still possible that the case
* will be closed in a different thread before this code
* executes. If that happens, it is possible for the
* event to have a null oldValue. Second, the use of
* deprecated artifact types here is explained by the
* fact that in an ideal world, the TagsManager would
* fire tag-related events so that the tags tree would
* refresh. But, we haven't had a chance to add that, so
* we fire these events with bogus artifacts to indicate
* a tree refresh is required.
*/
ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
if (null != eventData
&& (eventData.getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT
|| eventData.getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE)) {
refresh(true);
tagResults.update();
}
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString()) || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
refresh(true);
tagResults.update();
}
else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
refresh(true);
tagResults.update();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
// case was closed. Remove listeners so that this can be garbage collected
if (evt.getNewValue() == null) {
removeNotify();
@ -187,8 +220,8 @@ public class Tags implements AutopsyVisitableItem {
/**
* Instances of this class are elements of Node hierarchies consisting of
* content and blackboard artifact tags, grouped first by tag type, then by tag
* name.
* content and blackboard artifact tags, grouped first by tag type, then by
* tag name.
*/
public class TagNameNode extends DisplayableItemNode implements Observer {
@ -252,10 +285,11 @@ public class Tags implements AutopsyVisitableItem {
}
/**
* Creates nodes for the two types of tags: file and artifact.
* Does not need observer / messages since it always has the same children
* Creates nodes for the two types of tags: file and artifact. Does not need
* observer / messages since it always has the same children
*/
private class TagTypeNodeFactory extends ChildFactory<String> {
private final TagName tagName;
private final String CONTENT_TAG_TYPE_NODE_KEY = NbBundle.getMessage(TagNameNode.class, "TagNameNode.contentTagTypeNodeKey.text");
private final String BLACKBOARD_ARTIFACT_TAG_TYPE_NODE_KEY = NbBundle.getMessage(TagNameNode.class, "TagNameNode.bbArtTagTypeNodeKey.text");
@ -288,15 +322,16 @@ public class Tags implements AutopsyVisitableItem {
private final String CONTENT_DISPLAY_NAME = NbBundle.getMessage(ContentTagTypeNode.class, "ContentTagTypeNode.displayName.text");
/**
* Node for the content tags. Children are specific tags.
* Instances of this class are are elements of a directory tree sub-tree
* consisting of content and blackboard artifact tags, grouped first by tag
* type, then by tag name.
* Node for the content tags. Children are specific tags. Instances of this
* class are are elements of a directory tree sub-tree consisting of content
* and blackboard artifact tags, grouped first by tag type, then by tag
* name.
*/
public class ContentTagTypeNode extends DisplayableItemNode implements Observer {
private final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
private TagName tagName;
public ContentTagTypeNode(TagName tagName) {
super(Children.create(new ContentTagNodeFactory(tagName), true), Lookups.singleton(tagName.getDisplayName() + " " + CONTENT_DISPLAY_NAME));
this.tagName = tagName;
@ -345,6 +380,7 @@ public class Tags implements AutopsyVisitableItem {
}
private class ContentTagNodeFactory extends ChildFactory<ContentTag> implements Observer {
private final TagName tagName;
ContentTagNodeFactory(TagName tagName) {
@ -380,10 +416,12 @@ public class Tags implements AutopsyVisitableItem {
/**
* Instances of this class are elements in a sub-tree of the Autopsy
* presentation of the SleuthKit data model. The sub-tree consists of content
* and blackboard artifact tags, grouped first by tag type, then by tag name.
* presentation of the SleuthKit data model. The sub-tree consists of
* content and blackboard artifact tags, grouped first by tag type, then by
* tag name.
*/
public class BlackboardArtifactTagTypeNode extends DisplayableItemNode implements Observer {
private TagName tagName;
private final String ICON_PATH = "org/sleuthkit/autopsy/images/tag-folder-blue-icon-16.png"; //NON-NLS
@ -435,28 +473,29 @@ public class Tags implements AutopsyVisitableItem {
}
private class BlackboardArtifactTagNodeFactory extends ChildFactory<BlackboardArtifactTag> {
private final TagName tagName;
BlackboardArtifactTagNodeFactory(TagName tagName) {
super();
this.tagName = tagName;
}
private final TagName tagName;
@Override
protected boolean createKeys(List<BlackboardArtifactTag> keys) {
try {
// Use the blackboard artifact tags bearing the specified tag name as the keys.
keys.addAll(Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsByTagName(tagName));
} catch (TskCoreException ex) {
Logger.getLogger(BlackboardArtifactTagNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
BlackboardArtifactTagNodeFactory(TagName tagName) {
super();
this.tagName = tagName;
}
@Override
protected Node createNodeForKey(BlackboardArtifactTag key) {
// The blackboard artifact tags to be wrapped are used as the keys.
return new BlackboardArtifactTagNode(key);
}
}
@Override
protected boolean createKeys(List<BlackboardArtifactTag> keys) {
try {
// Use the blackboard artifact tags bearing the specified tag name as the keys.
keys.addAll(Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsByTagName(tagName));
} catch (TskCoreException ex) {
Logger.getLogger(BlackboardArtifactTagNodeFactory.class.getName()).log(Level.SEVERE, "Failed to get tag names", ex); //NON-NLS
}
return true;
}
@Override
protected Node createNodeForKey(BlackboardArtifactTag key) {
// The blackboard artifact tags to be wrapped are used as the keys.
return new BlackboardArtifactTagNode(key);
}
}
}

View File

@ -34,7 +34,6 @@ import java.util.logging.Level;
import java.util.prefs.PreferenceChangeEvent;
import java.util.prefs.PreferenceChangeListener;
import javax.swing.Action;
import javax.swing.JPanel;
import javax.swing.SwingUtilities;
import javax.swing.tree.TreeSelectionModel;
import org.openide.explorer.ExplorerManager;
@ -524,60 +523,83 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
*/
@Override
public void propertyChange(PropertyChangeEvent evt) {
String changed = evt.getPropertyName();
Object oldValue = evt.getOldValue();
Object newValue = evt.getNewValue();
if (changed.equals(Case.Events.CURRENT_CASE.toString())) { // changed current case
// When a case is closed, the old value of this property is the
// closed Case object and the new value is null. When a case is
// opened, the old value is null and the new value is the new Case
// object.
// @@@ This needs to be revisited. Perhaps case closed and case
// opened events instead of property change events would be a better
// solution. Either way, more probably needs to be done to clean up
// data model objects when a case is closed.
if (oldValue != null && newValue == null) {
// The current case has been closed. Reset the ExplorerManager.
SwingUtilities.invokeLater(() -> {
Node emptyNode = new AbstractNode(Children.LEAF);
em.setRootContext(emptyNode);
});
} else if (newValue != null) {
// A new case has been opened. Reset the ExplorerManager.
Case newCase = (Case) newValue;
final String newCaseName = newCase.getName();
SwingUtilities.invokeLater(() -> {
em.getRootContext().setName(newCaseName);
em.getRootContext().setDisplayName(newCaseName);
if (IngestManager.getInstance().isRunningInteractively()) {
String changed = evt.getPropertyName();
if (changed.equals(Case.Events.CURRENT_CASE.toString())) { // changed current case
// When a case is closed, the old value of this property is the
// closed Case object and the new value is null. When a case is
// opened, the old value is null and the new value is the new Case
// object.
// @@@ This needs to be revisited. Perhaps case closed and case
// opened events instead of property change events would be a better
// solution. Either way, more probably needs to be done to clean up
// data model objects when a case is closed.
if (evt.getOldValue() != null && evt.getNewValue() == null) {
// The current case has been closed. Reset the ExplorerManager.
SwingUtilities.invokeLater(() -> {
Node emptyNode = new AbstractNode(Children.LEAF);
em.setRootContext(emptyNode);
});
} else if (evt.getNewValue() != null) {
// A new case has been opened. Reset the ExplorerManager.
Case newCase = (Case) evt.getNewValue();
final String newCaseName = newCase.getName();
SwingUtilities.invokeLater(() -> {
em.getRootContext().setName(newCaseName);
em.getRootContext().setDisplayName(newCaseName);
// Reset the forward and back
// buttons. Note that a call to CoreComponentControl.openCoreWindows()
// by the new Case object will lead to a componentOpened() call
// that will repopulate the tree.
// @@@ The repopulation of the tree in this fashion also merits
// reconsideration.
resetHistory();
// buttons. Note that a call to CoreComponentControl.openCoreWindows()
// by the new Case object will lead to a componentOpened() call
// that will repopulate the tree.
// @@@ The repopulation of the tree in this fashion also merits
// reconsideration.
resetHistory();
});
}
} // if the image is added to the case
else if (changed.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked out.
* Currently, remote events may be received for a case that is
* already closed.
*/
try {
Case.getCurrentCase();
CoreComponentControl.openCoreWindows();
SwingUtilities.invokeLater(this::componentOpened);
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
} // change in node selection
else if (changed.equals(ExplorerManager.PROP_SELECTED_NODES)) {
SwingUtilities.invokeLater(() -> {
respondSelection((Node[]) evt.getOldValue(), (Node[]) evt.getNewValue());
});
}
} // if the image is added to the case
else if (changed.equals(Case.Events.DATA_SOURCE_ADDED.toString())) {
if (IngestManager.getInstance().isRunningInteractively()) {
CoreComponentControl.openCoreWindows();
}
SwingUtilities.invokeLater(this::componentOpened);
} // change in node selection
else if (changed.equals(ExplorerManager.PROP_SELECTED_NODES)) {
SwingUtilities.invokeLater(() -> {
respondSelection((Node[]) oldValue, (Node[]) newValue);
});
} else if (changed.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
} else if (changed.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
// nothing to do here.
// all nodes should be listening for these events and update accordingly.
} else if (changed.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| changed.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
SwingUtilities.invokeLater(this::refreshDataSourceTree);
} else if (changed.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) {
SwingUtilities.invokeLater(this::refreshDataSourceTree);
// all nodes should be listening for these events and update accordingly.
} else if (changed.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
|| changed.equals(IngestManager.IngestJobEvent.CANCELLED.toString())
|| changed.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) {
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked out.
* Currently, remote events may be received for a case that is
* already closed.
*/
try {
Case.getCurrentCase();
SwingUtilities.invokeLater(this::refreshDataSourceTree);
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
}
}

View File

@ -32,7 +32,9 @@ import javax.jms.ObjectMessage;
import javax.jms.Session;
import javax.jms.Topic;
import org.apache.activemq.ActiveMQConnectionFactory;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestManager;
/**
* Provides thread-safe support for publishing events to registered subscribers
@ -134,21 +136,40 @@ final class RemoteEventPublisher {
*/
@Override
public void onMessage(Message message) {
try {
if (message instanceof ObjectMessage) {
ObjectMessage objectMessage = (ObjectMessage) message;
Object object = objectMessage.getObject();
if (object instanceof AutopsyEvent) {
AutopsyEvent event = (AutopsyEvent) object;
event.setSourceType(AutopsyEvent.SourceType.REMOTE);
localPublisher.publish(event);
}
if (IngestManager.getInstance().isRunningInteractively()) {
/**
* This is a stop gap measure until a different way of handling
* the closing of cases is worked out. Currently,
* Case.currentCase is set to null before
* Case.Event.CURRENT_CASE is published. That means that clients
* of this class have not had the chance to close their remote
* event channels and remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do not publish the event.
*/
return;
}
try {
if (message instanceof ObjectMessage) {
ObjectMessage objectMessage = (ObjectMessage) message;
Object object = objectMessage.getObject();
if (object instanceof AutopsyEvent) {
AutopsyEvent event = (AutopsyEvent) object;
event.setSourceType(AutopsyEvent.SourceType.REMOTE);
localPublisher.publish(event);
}
}
} catch (Exception ex) {
logger.log(Level.SEVERE, "Error receiving message", ex);
}
} catch (Exception ex) {
logger.log(Level.SEVERE, "Error receiving message", ex);
}
}
}
}

View File

@ -253,7 +253,20 @@ class DateSearchFilter extends AbstractFileSearchFilter<DateSearchPanel> {
break;
case DATA_SOURCE_ADDED:
case DATA_SOURCE_DELETED:
SwingUtilities.invokeLater(DateSearchFilter.this::updateTimeZoneList);
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
SwingUtilities.invokeLater(DateSearchFilter.this::updateTimeZoneList);
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
break;
}
}

View File

@ -53,7 +53,7 @@ public final class BlackboardPostEvent extends AutopsyEvent implements Serializa
*/
public BlackboardPostEvent(ModuleDataEvent eventData) {
/**
* Putting a serializable data holding object into newValue to allow for
* Putting a serializable data holding object into oldValue to allow for
* lazy loading of the ModuleDataEvent object for remote events. This
* bypasses the issues related to the serialization and de-serialization
* of BlackboardArtifact objects when the event is published over a

View File

@ -680,10 +680,23 @@ public class TimeLineController {
public void propertyChange(PropertyChangeEvent evt) {
switch (IngestManager.IngestModuleEvent.valueOf(evt.getPropertyName())) {
case FILE_DONE:
Platform.runLater(() -> {
newEventsFlag.set(true);
});
break;
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
Platform.runLater(() -> {
newEventsFlag.set(true);
});
break;
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
}
}
}
@ -696,9 +709,22 @@ public class TimeLineController {
switch (IngestManager.IngestJobEvent.valueOf(evt.getPropertyName())) {
case CANCELLED:
case COMPLETED:
SwingUtilities.invokeLater(() -> {
outOfDatePromptAndRebuild();
});
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
SwingUtilities.invokeLater(() -> {
outOfDatePromptAndRebuild();
});
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
break;
}
}
@ -711,9 +737,22 @@ public class TimeLineController {
public void propertyChange(PropertyChangeEvent evt) {
switch (Case.Events.valueOf(evt.getPropertyName())) {
case DATA_SOURCE_ADDED:
SwingUtilities.invokeLater(() -> {
outOfDatePromptAndRebuild();
});
/**
* Checking for a current case is a stop gap measure until a
* different way of handling the closing of cases is worked
* out. Currently, remote events may be received for a case
* that is already closed.
*/
try {
Case.getCurrentCase();
SwingUtilities.invokeLater(() -> {
outOfDatePromptAndRebuild();
});
} catch (IllegalStateException notUsed) {
/**
* Case is closed, do nothing.
*/
}
break;
case CURRENT_CASE:
SwingUtilities.invokeLater(() -> {

View File

@ -1,5 +1,5 @@
#Updated by build script
#Mon, 08 Jun 2015 11:37:44 -0400
#Fri, 19 Jun 2015 13:59:39 -0400
LBL_splash_window_title=Starting Autopsy
SPLASH_HEIGHT=314
SPLASH_WIDTH=538

View File

@ -1,5 +1,5 @@
#Updated by build script
#Mon, 08 Jun 2015 11:37:44 -0400
#Fri, 19 Jun 2015 13:59:39 -0400
CTL_MainWindow_Title=Autopsy 3.1.2
CTL_MainWindow_Title_No_Project=Autopsy 3.1.2