mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
31 lines
2.6 KiB
Plaintext
Executable File
31 lines
2.6 KiB
Plaintext
Executable File
|
|
<!-- @@@ MOVE THIS SOMEWHERE ELSE -- the directory tree package maybe?? -->
|
|
|
|
The component is by default registered with the ingest manager as an ingest event listener.
|
|
The viewer first loads all the viewer-supported data currently in the blackboard when Autopsy starts.
|
|
During the ingest process the viewer receives events from ingest modules
|
|
(relayed by ingest manager) and it selectively refreshes parts of the tree providing real-time updates to the user.
|
|
When ingest is completed, the viewer responds to the final ingest data event generated by the ingest manager,
|
|
and performs a final refresh of all viewer-supported data in the blackboard.
|
|
|
|
|
|
Node content support capabilities are registered in the node's Lookup.
|
|
|
|
|
|
<!-- @@@ This is too detailed for here, but maybe should be broken up and put into the sections on making a result viewer and such…
|
|
-->
|
|
|
|
\section design_data_flow Data Flow
|
|
|
|
\subsection design_data_flow_create Creating Nodes in DataExplorer
|
|
|
|
Data flows between the UI zones using a NetBeans node. The DataExplorer modules create the NetBeans nodes. They query the SQLite database or do whatever they want to identify the set of files that are of interest. They create the NetBeans nodes based on Sleuthkit data model objects. See the org.sleuthkit.autopsy.datamodel package for more details on this.
|
|
|
|
\subsection design_data_flow_toResult Getting Nodes to DataResult
|
|
|
|
Each DataExplorer TopComponent is responsible for creating its own DataResult TopComponent to display its results. It can choose to re-use the same TopComponent for multiple searches (as DirectoryTree does) or it can choose to make a new one each time (as FileSearch does). The setNode() method on the DataResult object is used to set the root node to display. A dummy root node must be created as the parent if a parent does not already exist.
|
|
|
|
The DataExplorer is responsible for setting the double-click and right-click actions associated with the node. The default single click action is to pass data to DataContent. To override this, you must create a new DataResultViewer instance that overrides the propertyChange() method. The DataExplorer adds actions to wrapping the node in a FilterNode variant. The FilterNode then defines the actions for the node by overriding the getPreferredAction() and getActions() methods. As an example, org.sleuthkit.autopsy.directorytree.DataResultFilterNode and org.sleuthkit.autopsy.directorytree.DataResultFilterChildren wraps the nodes that are passed over by the DirectoryTree DataExplorer.
|
|
|
|
DataResult can send data back to its DataExplorer by making a custom action that looks up it's instance (DataExplorer.getInstance()).
|