diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index 60cbb519e6..f8fdbadc4e 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -1245,6 +1245,55 @@ public abstract class AbstractSqlEamDb implements EamDb { return artifactInstances; } + + + @Override + public List getArtifactInstancesKnownBad(CorrelationAttribute.Type aType) throws EamDbException { + if (aType == null) { + throw new EamDbException("Correlation type is null"); + } + + Connection conn = connect(); + + List artifactInstances = new ArrayList<>(); + + CorrelationAttributeInstance artifactInstance; + PreparedStatement preparedStatement = null; + ResultSet resultSet = null; + + String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType); + StringBuilder sql = new StringBuilder(); + sql.append("SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id FROM "); + sql.append(tableName); + sql.append(" LEFT JOIN cases ON "); + sql.append(tableName); + sql.append(".case_id=cases.id"); + sql.append(" LEFT JOIN data_sources ON "); + sql.append(tableName); + sql.append(".data_source_id=data_sources.id"); + sql.append(" WHERE known_status=?"); + sql.append(" GROUP BY "); + sql.append(tableName); + sql.append(".value"); + + try { + preparedStatement = conn.prepareStatement(sql.toString()); + preparedStatement.setByte(1, TskData.FileKnown.BAD.getFileKnownValue()); + resultSet = preparedStatement.executeQuery(); + while (resultSet.next()) { + artifactInstance = getEamArtifactInstanceFromResultSet(resultSet); + artifactInstances.add(artifactInstance); + } + } catch (SQLException ex) { + throw new EamDbException("Error getting notable artifact instances.", ex); // NON-NLS + } finally { + EamDbUtil.closePreparedStatement(preparedStatement); + EamDbUtil.closeResultSet(resultSet); + EamDbUtil.closeConnection(conn); + } + + return artifactInstances; + } /** * Count matching eamArtifacts instances that have knownStatus = "Bad". diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java index 2b05cb1d70..22aae11f48 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java @@ -329,6 +329,7 @@ public interface EamDb { */ List getArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value) throws EamDbException; + List getArtifactInstancesKnownBad(CorrelationAttribute.Type aType) throws EamDbException; /** * Count matching eamArtifacts instances that have knownStatus = "Bad". * diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java index d9d1ea2fa3..25d80be8a0 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java @@ -590,6 +590,16 @@ public class SqliteEamDb extends AbstractSqlEamDb { } } + @Override + public List getArtifactInstancesKnownBad(CorrelationAttribute.Type aType) throws EamDbException { + try{ + acquireSharedLock(); + return super.getArtifactInstancesKnownBad(aType); + } finally { + releaseSharedLock(); + } + } + /** * Count matching eamArtifacts instances that have knownStatus = "Bad". *