diff --git a/bindings/java/jni/dataModel_SleuthkitJNI.cpp b/bindings/java/jni/dataModel_SleuthkitJNI.cpp index ddb9fdd364a712ba65230d28b4a1817706b4d7e8..5ce1cfc3988c070464c5dc552f54242a00f46c23 100644 --- a/bindings/java/jni/dataModel_SleuthkitJNI.cpp +++ b/bindings/java/jni/dataModel_SleuthkitJNI.cpp @@ -1232,7 +1232,6 @@ Java_org_sleuthkit_datamodel_SleuthkitJNI_runAddImgNat(JNIEnv * env, env->ReleaseStringUTFChars(deviceId, (const char *)device_id); // Must call finishAddImgNat to free the TskAutoDb - setThrowTskDataError(env, "Just verifying that this is the Java DB build"); } diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java index d9b56ecdc3c854746f8129155c4e7c89e528c1fe..6be1b4e196123753a5df80f2229ae7b9d1187775 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java +++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java @@ -11248,7 +11248,7 @@ long addFileJNI(long parentObjId, (short)metaFlags, size, ctime, crtime, atime, mtime, null, null, escaped_path, null, parentObjId, null, null, extension); - timelineManager.addEventsForNewFileJNI(derivedFile, connection); + timelineManager.addEventsForNewFileQuiet(derivedFile, connection); } return objectId; diff --git a/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java b/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java index 1eb1d90636be2af4ec47b5f6e8bb1cefb176b98a..d2b7e4081501417ea4baa66eb51107cd795482dd 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java +++ b/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java @@ -487,56 +487,7 @@ private long addEventDescription(long dataSourceObjId, long fileObjId, Long arti } Collection<TimelineEvent> addEventsForNewFile(AbstractFile file, CaseDbConnection connection) throws TskCoreException { - //gather time stamps into map - Map<TimelineEventType, Long> timeMap = ImmutableMap.of(TimelineEventType.FILE_CREATED, file.getCrtime(), - TimelineEventType.FILE_ACCESSED, file.getAtime(), - TimelineEventType.FILE_CHANGED, file.getCtime(), - TimelineEventType.FILE_MODIFIED, file.getMtime()); - List<TimelineEventType> tempList = ImmutableList.of(TimelineEventType.FILE_MODIFIED, - TimelineEventType.FILE_ACCESSED, TimelineEventType.FILE_CREATED, TimelineEventType.FILE_CHANGED); - - /* - * If there are no legitimate ( greater than zero ) time stamps skip the - * rest of the event generation. - */ - if (Collections.max(timeMap.values()) <= 0) { - return Collections.emptySet(); - } - - String description = file.getParentPath() + file.getName(); - long fileObjId = file.getId(); - Set<TimelineEvent> events = new HashSet<>(); - caseDB.acquireSingleUserCaseWriteLock(); - try { - long descriptionID = addEventDescription(file.getDataSourceObjectId(), fileObjId, null, - description, null, null, false, false, connection); - - //for (Map.Entry<TimelineEventType, Long> timeEntry : timeMap.entrySet()) { - for (TimelineEventType type : tempList) { - //Map.Entry<TimelineEventType, Long> timeEntry = timeMap.get(type); - Long time = timeMap.get(type); - //Long time = timeEntry.getValue(); - if (time > 0 && time < MAX_TIMESTAMP_TO_ADD) {// if the time is legitimate ( greater than zero and less then 12 years from current date) insert it - //TimelineEventType type = timeEntry.getKey(); - long eventID = addEventWithExistingDescription(time, type, descriptionID, connection); - - /* - * Last two flags indicating hasTags and hasHashHits are - * both set to false with the assumption that this is not - * possible for a new file. See JIRA-5407 - */ - events.add(new TimelineEvent(eventID, descriptionID, fileObjId, null, time, type, - description, null, null, false, false)); - } else { - if (time >= MAX_TIMESTAMP_TO_ADD) { - //logger.log(Level.WARNING, String.format("Date/Time discarded from Timeline for %s for file %s with Id %d", timeEntry.getKey().getDisplayName(), file.getParentPath() + file.getName(), file.getId())); - } - } - } - - } finally { - caseDB.releaseSingleUserCaseWriteLock(); - } + Set<TimelineEvent> events = addEventsForNewFileQuiet(file, connection); events.stream() .map(TimelineEventAddedEvent::new) .forEach(caseDB::fireTSKEvent); @@ -544,7 +495,21 @@ Collection<TimelineEvent> addEventsForNewFile(AbstractFile file, CaseDbConnectio return events; } - Set<TimelineEvent> addEventsForNewFileJNI(AbstractFile file, CaseDbConnection connection) throws TskCoreException { + /** + * Adds timeline events for the new file to the database. + * Does not fire TSKEvents for each addition. This method should only be used if an + * update event will be sent later. For example, a data source processor may + * send out a single event that a data source has been added rather than an event + * for each timeline event. + * + * @param file The new file + * @param connection Database connection to use + * + * @return Set of new events + * + * @throws TskCoreException + */ + Set<TimelineEvent> addEventsForNewFileQuiet(AbstractFile file, CaseDbConnection connection) throws TskCoreException { //gather time stamps into map Map<TimelineEventType, Long> timeMap = ImmutableMap.of(TimelineEventType.FILE_CREATED, file.getCrtime(), TimelineEventType.FILE_ACCESSED, file.getAtime(),