From ea43721e325d685ce585bd75fe73e512892e3958 Mon Sep 17 00:00:00 2001
From: "U-BASIS\\dgrove" <dgrove@WIN-DGROV-4999.basistech.net>
Date: Thu, 3 Aug 2017 16:56:34 -0400
Subject: [PATCH] Modified queries to handle known/slack settings.

---
 .../autopsy/datamodel/DeletedContent.java     | 10 ++++++--
 .../sleuthkit/autopsy/datamodel/FileSize.java | 23 +++++++++++++++----
 .../datamodel/FileTypesByMimeType.java        |  9 ++++++--
 3 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java
index 673486db93..88f36972ec 100644
--- a/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java
+++ b/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java
@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  * 
- * Copyright 2013-2015 Basis Technology Corp.
+ * Copyright 2013-2017 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -37,6 +37,7 @@ import org.openide.util.NbBundle;
 import org.openide.util.lookup.Lookups;
 import org.openide.windows.WindowManager;
 import org.sleuthkit.autopsy.casemodule.Case;
+import org.sleuthkit.autopsy.core.UserPreferences;
 import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.autopsy.ingest.IngestManager;
 import org.sleuthkit.datamodel.AbstractFile;
@@ -425,10 +426,15 @@ public class DeletedContent implements AutopsyVisitableItem {
 
                     default:
                         logger.log(Level.SEVERE, "Unsupported filter type to get deleted content: {0}", filter); //NON-NLS
-
                 }
 
+                if(UserPreferences.hideKnownFilesInViewsTree()) {
+                    query += " AND (known != " + TskData.FileKnown.KNOWN.getFileKnownValue() //NON-NLS
+                            + " OR known IS NULL)"; //NON-NLS
+                }
+                
                 query += " LIMIT " + MAX_OBJECTS; //NON-NLS
+                
                 return query;
             }
 
diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/FileSize.java b/Core/src/org/sleuthkit/autopsy/datamodel/FileSize.java
index b31d2e4fd4..1960cf9719 100644
--- a/Core/src/org/sleuthkit/autopsy/datamodel/FileSize.java
+++ b/Core/src/org/sleuthkit/autopsy/datamodel/FileSize.java
@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  * 
- * Copyright 2013-2015 Basis Technology Corp.
+ * Copyright 2013-2017 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -34,6 +34,7 @@ import org.openide.nodes.Sheet;
 import org.openide.util.NbBundle;
 import org.openide.util.lookup.Lookups;
 import org.sleuthkit.autopsy.casemodule.Case;
+import org.sleuthkit.autopsy.core.UserPreferences;
 import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.autopsy.ingest.IngestManager;
 import org.sleuthkit.datamodel.AbstractFile;
@@ -305,8 +306,8 @@ public class FileSize implements AutopsyVisitableItem {
             }
 
             private void updateDisplayName() {
-                final long count = FileSizeChildren.calculateItems(skCase, filter);
-                super.setDisplayName(filter.getDisplayName() + " (" + count + ")");
+                final long numVisibleChildren = FileSizeChildren.calculateItems(skCase, filter);
+                super.setDisplayName(filter.getDisplayName() + " (" + numVisibleChildren + ")");
             }
 
             @Override
@@ -408,8 +409,20 @@ public class FileSize implements AutopsyVisitableItem {
                     default:
                         throw new IllegalArgumentException("Unsupported filter type to get files by size: " + filter); //NON-NLS
                 }
-                // ignore unalloc block files
-                query = query + " AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType() + ")"; //NON-NLS
+                
+                // Ignore unallocated block files.
+                query += " AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType() + ")"; //NON-NLS
+                
+                // Hide known files if indicated in the user preferences.
+                if(UserPreferences.hideKnownFilesInViewsTree()) {
+                    query += " AND (known != " + TskData.FileKnown.KNOWN.getFileKnownValue() //NON-NLS
+                            + " OR known IS NULL)"; //NON-NLS
+                }
+                
+                // Hide slack files if indicated in the user preferences.
+                if(UserPreferences.hideSlackFilesInViewsTree()) {
+                    query += " AND (type != " + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType() + ")"; //NON-NLS
+                }
 
                 return query;
             }
diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/FileTypesByMimeType.java b/Core/src/org/sleuthkit/autopsy/datamodel/FileTypesByMimeType.java
index 7f3de1cd21..8579369199 100644
--- a/Core/src/org/sleuthkit/autopsy/datamodel/FileTypesByMimeType.java
+++ b/Core/src/org/sleuthkit/autopsy/datamodel/FileTypesByMimeType.java
@@ -90,8 +90,13 @@ public final class FileTypesByMimeType extends Observable implements AutopsyVisi
                 + TskData.TSK_DB_FILES_TYPE_ENUM.DERIVED.ordinal() + ","
                 + TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL.ordinal()
                 + ((UserPreferences.hideSlackFilesInViewsTree()) ? ""
-                : ("," + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.ordinal()))
-                + "))" + " GROUP BY mime_type";
+                    : ("," + TskData.TSK_DB_FILES_TYPE_ENUM.SLACK.ordinal()))
+                + "))"
+                + ((UserPreferences.hideKnownFilesInViewsTree()) ?
+                    (" AND (known != " + TskData.FileKnown.KNOWN.getFileKnownValue()
+                        + " OR known IS NULL)")
+                    : "")
+                + " GROUP BY mime_type";
         synchronized (existingMimeTypeCounts) {
             existingMimeTypeCounts.clear();