From e9f9dd87d9d8c72e69dfbedda12815fc4985e8e2 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Mon, 3 May 2021 15:38:52 -0400 Subject: [PATCH] migration to blackboard artifact types --- .../autopsy/datamodel/Artifacts.java | 44 ++++++++++--------- .../autopsy/datamodel/EmailExtracted.java | 8 ++-- .../autopsy/datamodel/HashsetHits.java | 13 +++--- .../autopsy/datamodel/InterestingHits.java | 26 +++++------ .../autopsy/datamodel/KeywordHits.java | 10 ++--- .../autopsy/datamodel/accounts/Accounts.java | 30 ++++++------- .../DirectoryTreeTopComponent.java | 17 +++---- 7 files changed, 76 insertions(+), 72 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/Artifacts.java b/Core/src/org/sleuthkit/autopsy/datamodel/Artifacts.java index cc78991c95..d39bef3ee9 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/Artifacts.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/Artifacts.java @@ -36,7 +36,6 @@ import org.openide.nodes.Node; import org.openide.nodes.Sheet; import org.openide.util.Lookup; import org.openide.util.NbBundle; -import org.openide.util.NbBundle.Messages; import org.openide.util.lookup.Lookups; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -46,21 +45,22 @@ import org.sleuthkit.autopsy.datamodel.utils.IconsUtil; import org.sleuthkit.autopsy.ingest.IngestManager; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.BlackboardArtifact; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DOWNLOAD_SOURCE; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.autopsy.guiutils.RefreshThrottler; import org.sleuthkit.datamodel.BlackboardArtifact.Category; import org.python.google.common.collect.Sets; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_ACCOUNT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_DATA_SOURCE_USAGE; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_EMAIL_MSG; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_HASHSET_HIT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_GEN_INFO; +import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DOWNLOAD_SOURCE; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_TL_EVENT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_ASSOCIATED_OBJECT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_KEYWORD_HIT; /** * Classes for creating nodes for BlackboardArtifacts. @@ -215,12 +215,12 @@ public class Artifacts { @SuppressWarnings("deprecation") private static final Set IGNORED_TYPES = Sets.newHashSet( // these are shown in other parts of the UI (and different node types) - new BlackboardArtifact.Type(TSK_DATA_SOURCE_USAGE), - new BlackboardArtifact.Type(TSK_GEN_INFO), + TSK_DATA_SOURCE_USAGE, + TSK_GEN_INFO, new BlackboardArtifact.Type(TSK_DOWNLOAD_SOURCE), - new BlackboardArtifact.Type(TSK_TL_EVENT), + TSK_TL_EVENT, //This is not meant to be shown in the UI at all. It is more of a meta artifact. - new BlackboardArtifact.Type(TSK_ASSOCIATED_OBJECT) + TSK_ASSOCIATED_OBJECT ); /** @@ -238,24 +238,28 @@ public class Artifacts { int typeId = type.getTypeID(); if (TSK_EMAIL_MSG.getTypeID() == typeId) { EmailExtracted.RootNode emailNode = new EmailExtracted(skCase, dsObjId).new RootNode(); - return new TypeNodeKey(emailNode, new BlackboardArtifact.Type(TSK_EMAIL_MSG)); + return new TypeNodeKey(emailNode, TSK_EMAIL_MSG); } else if (TSK_ACCOUNT.getTypeID() == typeId) { Accounts.AccountsRootNode accountsNode = new Accounts(skCase, dsObjId).new AccountsRootNode(); - return new TypeNodeKey(accountsNode, new BlackboardArtifact.Type(TSK_ACCOUNT)); + return new TypeNodeKey(accountsNode, TSK_ACCOUNT); } else if (TSK_KEYWORD_HIT.getTypeID() == typeId) { KeywordHits.RootNode keywordsNode = new KeywordHits(skCase, dsObjId).new RootNode(); - return new TypeNodeKey(keywordsNode, new BlackboardArtifact.Type(TSK_KEYWORD_HIT)); + return new TypeNodeKey(keywordsNode, TSK_KEYWORD_HIT); } else if (TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == typeId || TSK_INTERESTING_FILE_HIT.getTypeID() == typeId) { InterestingHits.RootNode interestingHitsNode = new InterestingHits(skCase, dsObjId).new RootNode(); return new TypeNodeKey(interestingHitsNode, - new BlackboardArtifact.Type(TSK_INTERESTING_ARTIFACT_HIT), - new BlackboardArtifact.Type(TSK_INTERESTING_FILE_HIT)); + TSK_INTERESTING_ARTIFACT_HIT, + TSK_INTERESTING_FILE_HIT); + } else if (TSK_HASHSET_HIT.getTypeID() == typeId) { + HashsetHits.RootNode hashsetHits = new HashsetHits(skCase, dsObjId).new RootNode(); + return new TypeNodeKey(hashsetHits, TSK_HASHSET_HIT); + } else { return new TypeNodeKey(type, dsObjId); } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/EmailExtracted.java b/Core/src/org/sleuthkit/autopsy/datamodel/EmailExtracted.java index 06ed408976..845fdf8798 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/EmailExtracted.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/EmailExtracted.java @@ -44,7 +44,7 @@ import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.ingest.IngestManager; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.BlackboardArtifact; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_EMAIL_MSG; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery; @@ -59,7 +59,7 @@ import org.sleuthkit.autopsy.datamodel.Artifacts.UpdatableCountTypeNode; */ public class EmailExtracted implements AutopsyVisitableItem { - private static final String LABEL_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getLabel(); + private static final String LABEL_NAME = BlackboardArtifact.Type.TSK_EMAIL_MSG.getLabel(); private static final Logger logger = Logger.getLogger(EmailExtracted.class.getName()); private static final String MAIL_ACCOUNT = NbBundle.getMessage(EmailExtracted.class, "EmailExtracted.mailAccount.text"); private static final String MAIL_FOLDER = NbBundle.getMessage(EmailExtracted.class, "EmailExtracted.mailFolder.text"); @@ -157,7 +157,7 @@ public class EmailExtracted implements AutopsyVisitableItem { } // get artifact id and path (if present) of all email artifacts - int emailArtifactId = BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID(); + int emailArtifactId = BlackboardArtifact.Type.TSK_EMAIL_MSG.getTypeID(); int pathAttrId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID(); String query = "SELECT \n" @@ -279,7 +279,7 @@ public class EmailExtracted implements AutopsyVisitableItem { * for the event to have a null oldValue. */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); - if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) { + if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.Type.TSK_EMAIL_MSG.getTypeID()) { emailResults.update(); } } catch (NoCurrentCaseException notUsed) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/HashsetHits.java b/Core/src/org/sleuthkit/autopsy/datamodel/HashsetHits.java index 150a52e3da..5318a99a00 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/HashsetHits.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/HashsetHits.java @@ -46,8 +46,7 @@ import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.ingest.IngestManager; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.BlackboardArtifact; -import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_HASHSET_HIT; import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery; @@ -59,8 +58,8 @@ import org.sleuthkit.autopsy.datamodel.Artifacts.UpdatableCountTypeNode; */ public class HashsetHits implements AutopsyVisitableItem { - private static final String HASHSET_HITS = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getLabel(); - private static final String DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(); + private static final String HASHSET_HITS = BlackboardArtifact.Type.TSK_HASHSET_HIT.getTypeName(); + private static final String DISPLAY_NAME = BlackboardArtifact.Type.TSK_HASHSET_HIT.getDisplayName(); private static final Logger logger = Logger.getLogger(HashsetHits.class.getName()); private static final Set INGEST_JOB_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestJobEvent.COMPLETED, IngestManager.IngestJobEvent.CANCELLED); private static final Set INGEST_MODULE_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestModuleEvent.DATA_ADDED); @@ -136,7 +135,7 @@ public class HashsetHits implements AutopsyVisitableItem { } int setNameId = ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(); - int artId = ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID(); + int artId = TSK_HASHSET_HIT.getTypeID(); String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS + "attribute_type_id=" + setNameId //NON-NLS @@ -177,7 +176,7 @@ public class HashsetHits implements AutopsyVisitableItem { Lookups.singleton(DISPLAY_NAME), DISPLAY_NAME, filteringDSObjId, - new BlackboardArtifact.Type(TSK_HASHSET_HIT)); + TSK_HASHSET_HIT); super.setName(HASHSET_HITS); super.setDisplayName(DISPLAY_NAME); @@ -246,7 +245,7 @@ public class HashsetHits implements AutopsyVisitableItem { * oldValue if the event is a remote event. */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); - if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) { + if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == TSK_HASHSET_HIT.getTypeID()) { hashsetResults.update(); } } catch (NoCurrentCaseException notUsed) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/InterestingHits.java b/Core/src/org/sleuthkit/autopsy/datamodel/InterestingHits.java index 28bfb3e8dc..22525854ca 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/InterestingHits.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/InterestingHits.java @@ -111,8 +111,8 @@ public class InterestingHits implements AutopsyVisitableItem { synchronized (interestingItemsMap) { interestingItemsMap.clear(); } - loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); - loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT); + loadArtifacts(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT); + loadArtifacts(BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT); setChanged(); notifyObservers(); } @@ -122,7 +122,7 @@ public class InterestingHits implements AutopsyVisitableItem { * the interestingItemsMap */ @SuppressWarnings("deprecation") - private void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType) { + private void loadArtifacts(BlackboardArtifact.Type artType) { if (skCase == null) { return; } @@ -146,8 +146,8 @@ public class InterestingHits implements AutopsyVisitableItem { long artifactId = resultSet.getLong("artifact_id"); //NON-NLS if (!interestingItemsMap.containsKey(value)) { interestingItemsMap.put(value, new LinkedHashMap<>()); - interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName(), new HashSet<>()); - interestingItemsMap.get(value).put(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(), new HashSet<>()); + interestingItemsMap.get(value).put(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getDisplayName(), new HashSet<>()); + interestingItemsMap.get(value).put(BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(), new HashSet<>()); } interestingItemsMap.get(value).get(artType.getDisplayName()).add(artifactId); } @@ -173,8 +173,8 @@ public class InterestingHits implements AutopsyVisitableItem { Lookups.singleton(DISPLAY_NAME), DISPLAY_NAME, filteringDSObjId, - new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT), - new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)); + BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT, + BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT); super.setName(INTERESTING_ITEMS); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS } @@ -237,8 +237,8 @@ public class InterestingHits implements AutopsyVisitableItem { * event to have a null oldValue. */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); - if (null != eventData && (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() - || eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID())) { + if (null != eventData && (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() + || eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getTypeID())) { interestingResults.update(); } } catch (NoCurrentCaseException notUsed) { @@ -319,8 +319,8 @@ public class InterestingHits implements AutopsyVisitableItem { } private void updateDisplayName() { - int sizeOfSet = interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size() - + interestingResults.getArtifactIds(setName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName()).size(); + int sizeOfSet = interestingResults.getArtifactIds(setName, BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()).size() + + interestingResults.getArtifactIds(setName, BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getDisplayName()).size(); super.setDisplayName(setName + " (" + sizeOfSet + ")"); } @@ -379,8 +379,8 @@ public class InterestingHits implements AutopsyVisitableItem { @Override protected boolean createKeys(List list) { - list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getDisplayName()); - list.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()); + list.add(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getDisplayName()); + list.add(BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName()); return true; } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java b/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java index 845c87d5ea..396cbea57e 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java @@ -55,7 +55,7 @@ import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery; import org.sleuthkit.datamodel.TskCoreException; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_KEYWORD_HIT; import org.sleuthkit.autopsy.datamodel.Artifacts.UpdatableCountTypeNode; /** @@ -73,7 +73,7 @@ public class KeywordHits implements AutopsyVisitableItem { @NbBundle.Messages("KeywordHits.singleRegexSearch.text=Single Regular Expression Search") private static final String SIMPLE_REGEX_SEARCH = KeywordHits_singleRegexSearch_text(); - public static final String NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getLabel(); + public static final String NAME = BlackboardArtifact.Type.TSK_KEYWORD_HIT.getLabel(); private SleuthkitCase skCase; private final KeywordResults keywordResults; @@ -95,7 +95,7 @@ public class KeywordHits implements AutopsyVisitableItem { + "blackboard_attributes.attribute_type_id "//NON-NLS + "FROM blackboard_attributes, blackboard_artifacts "//NON-NLS + "WHERE blackboard_attributes.artifact_id = blackboard_artifacts.artifact_id "//NON-NLS - + " AND blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() //NON-NLS + + " AND blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_KEYWORD_HIT.getTypeID() //NON-NLS + " AND (attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()//NON-NLS + " OR attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()//NON-NLS + " OR attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_TYPE.getTypeID()//NON-NLS @@ -384,7 +384,7 @@ public class KeywordHits implements AutopsyVisitableItem { Lookups.singleton(KEYWORD_HITS), KEYWORD_HITS, filteringDSObjId, - new BlackboardArtifact.Type(TSK_KEYWORD_HIT)); + TSK_KEYWORD_HIT); super.setName(NAME); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/keyword_hits.png"); //NON-NLS @@ -470,7 +470,7 @@ public class KeywordHits implements AutopsyVisitableItem { * for the event to have a null oldValue. */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); - if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) { + if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.Type.TSK_KEYWORD_HIT.getTypeID()) { keywordResults.update(); } } catch (NoCurrentCaseException notUsed) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/accounts/Accounts.java b/Core/src/org/sleuthkit/autopsy/datamodel/accounts/Accounts.java index 8559d45d51..18136db99e 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/accounts/Accounts.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/accounts/Accounts.java @@ -77,8 +77,8 @@ import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.Account; import org.sleuthkit.datamodel.BlackboardArtifact; -import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT; +import org.sleuthkit.datamodel.BlackboardArtifact.Type; +import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_ACCOUNT; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.SleuthkitCase; @@ -241,7 +241,7 @@ final public class Accounts implements AutopsyVisitableItem { Lookups.singleton(Accounts.this), DISPLAY_NAME, filteringDSObjId, - new BlackboardArtifact.Type(TSK_ACCOUNT)); + TSK_ACCOUNT); setName(Accounts.NAME); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/accounts.png"); //NON-NLS @@ -384,7 +384,7 @@ final public class Accounts implements AutopsyVisitableItem { */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); if (null != eventData - && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) { + && eventData.getBlackboardArtifactType().getTypeID() == Type.TSK_ACCOUNT.getTypeID()) { accountTypeResults.update(); reviewStatusBus.post(eventData); } @@ -519,7 +519,7 @@ final public class Accounts implements AutopsyVisitableItem { */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); if (null != eventData - && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) { + && eventData.getBlackboardArtifactType().getTypeID() == Type.TSK_ACCOUNT.getTypeID()) { reviewStatusBus.post(eventData); } } catch (NoCurrentCaseException notUsed) { @@ -572,7 +572,7 @@ final public class Accounts implements AutopsyVisitableItem { = "SELECT blackboard_artifacts.artifact_id " //NON-NLS + " FROM blackboard_artifacts " //NON-NLS + " JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id " //NON-NLS - + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS + + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID() //NON-NLS + " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE.getTypeID() //NON-NLS + " AND blackboard_attributes.value_text = '" + accountType.getTypeName() + "'" //NON-NLS + getFilterByDataSourceClause() @@ -696,7 +696,7 @@ final public class Accounts implements AutopsyVisitableItem { */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); if (null != eventData - && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) { + && eventData.getBlackboardArtifactType().getTypeID() == Type.TSK_ACCOUNT.getTypeID()) { reviewStatusBus.post(eventData); } } catch (NoCurrentCaseException notUsed) { @@ -850,7 +850,7 @@ final public class Accounts implements AutopsyVisitableItem { */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); if (null != eventData - && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) { + && eventData.getBlackboardArtifactType().getTypeID() == Type.TSK_ACCOUNT.getTypeID()) { reviewStatusBus.post(eventData); } } catch (NoCurrentCaseException notUsed) { @@ -928,7 +928,7 @@ final public class Accounts implements AutopsyVisitableItem { + " LEFT JOIN blackboard_attributes as account_type ON blackboard_artifacts.artifact_id = account_type.artifact_id " //NON-NLS + " AND account_type.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE.getTypeID() //NON-NLS + " AND account_type.value_text = '" + Account.Type.CREDIT_CARD.getTypeName() + "'" //NON-NLS - + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS + + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID() //NON-NLS + getFilterByDataSourceClause() + getRejectedArtifactFilterClause() + " GROUP BY blackboard_artifacts.obj_id, solr_document_id " //NON-NLS @@ -997,7 +997,7 @@ final public class Accounts implements AutopsyVisitableItem { + " LEFT JOIN blackboard_attributes as account_type ON blackboard_artifacts.artifact_id = account_type.artifact_id " //NON-NLS + " AND account_type.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE.getTypeID() //NON-NLS + " AND account_type.value_text = '" + Account.Type.CREDIT_CARD.getTypeName() + "'" //NON-NLS - + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS + + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID() //NON-NLS + getFilterByDataSourceClause() + getRejectedArtifactFilterClause() + " GROUP BY blackboard_artifacts.obj_id, solr_attribute.value_text ) AS foo"; @@ -1065,7 +1065,7 @@ final public class Accounts implements AutopsyVisitableItem { */ ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue(); if (null != eventData - && eventData.getBlackboardArtifactType().getTypeID() == ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) { + && eventData.getBlackboardArtifactType().getTypeID() == Type.TSK_ACCOUNT.getTypeID()) { reviewStatusBus.post(eventData); } } catch (NoCurrentCaseException notUsed) { //NOPMD empy catch clause @@ -1133,7 +1133,7 @@ final public class Accounts implements AutopsyVisitableItem { + " COUNT(blackboard_artifacts.artifact_id) AS count " //NON-NLS + " FROM blackboard_artifacts " //NON-NLS + " JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id" //NON-NLS - + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS + + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID() //NON-NLS + " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CARD_NUMBER.getTypeID() //NON-NLS + getFilterByDataSourceClause() + getRejectedArtifactFilterClause() @@ -1200,7 +1200,7 @@ final public class Accounts implements AutopsyVisitableItem { = "SELECT count(distinct SUBSTR(blackboard_attributes.value_text,1,8)) AS BINs " //NON-NLS + " FROM blackboard_artifacts " //NON-NLS + " JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id" //NON-NLS - + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS + + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID() //NON-NLS + " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CARD_NUMBER.getTypeID() //NON-NLS + getFilterByDataSourceClause() + getRejectedArtifactFilterClause(); //NON-NLS @@ -1495,7 +1495,7 @@ final public class Accounts implements AutopsyVisitableItem { = "SELECT blackboard_artifacts.artifact_id " //NON-NLS + " FROM blackboard_artifacts " //NON-NLS + " JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id " //NON-NLS - + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS + + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID() //NON-NLS + " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CARD_NUMBER.getTypeID() //NON-NLS + " AND blackboard_attributes.value_text >= '" + bin.getBINStart() + "' AND blackboard_attributes.value_text < '" + (bin.getBINEnd() + 1) + "'" //NON-NLS + getFilterByDataSourceClause() @@ -1569,7 +1569,7 @@ final public class Accounts implements AutopsyVisitableItem { = "SELECT count(blackboard_artifacts.artifact_id ) AS count" //NON-NLS + " FROM blackboard_artifacts " //NON-NLS + " JOIN blackboard_attributes ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id " //NON-NLS - + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() //NON-NLS + + " WHERE blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID() //NON-NLS + " AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CARD_NUMBER.getTypeID() //NON-NLS + " AND blackboard_attributes.value_text >= '" + bin.getBINStart() + "' AND blackboard_attributes.value_text < '" + (bin.getBINEnd() + 1) + "'" //NON-NLS + getFilterByDataSourceClause() diff --git a/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java b/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java index 6d90e9b821..d5fe55d358 100644 --- a/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java +++ b/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java @@ -1261,16 +1261,16 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat Children typesChildren = categoryChildrenOpt.get(); Node treeNode = null; - if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) { + if (typeID == BlackboardArtifact.Type.TSK_HASHSET_HIT.getTypeID()) { treeNode = getHashsetNode(typesChildren, art); - } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) { + } else if (typeID == BlackboardArtifact.Type.TSK_KEYWORD_HIT.getTypeID()) { treeNode = getKeywordHitNode(typesChildren, art); - } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() - || typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) { + } else if (typeID == BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getTypeID() + || typeID == BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) { treeNode = getInterestingItemNode(typesChildren, art); - } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) { + } else if (typeID == BlackboardArtifact.Type.TSK_EMAIL_MSG.getTypeID()) { treeNode = getEmailNode(typesChildren, art); - } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) { + } else if (typeID == BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID()) { treeNode = getAccountNode(typesChildren, art); } else { treeNode = typesChildren.findChild(typeName); @@ -1371,7 +1371,8 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat return null; } if (regex != null) { //For support of regex nodes such as URLs, IPs, Phone Numbers, and Email Addrs as they are down another level - Node regexNode = listChildren.findChild(regex); + Node regexNode = listChildren.findChild(listName); + regexNode = (regexNode == null) ? listChildren.findChild(listName + "_" + regex) : regexNode; if (regexNode == null) { return null; } @@ -1423,7 +1424,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat return null; } - return (art.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID()) + return (art.getArtifactTypeID() == BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT.getTypeID()) ? fileArtifactNodes[0] : fileArtifactNodes[1]; } catch (TskCoreException ex) {