diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java index ef4f43d7103e6d2720e00de4e32e940e66736702..d78349f58b3cbbb7c2afb11435055feb892ba36d 100755 --- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java +++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java @@ -6218,7 +6218,7 @@ public DerivedFile addDerivedFile(String fileName, String localPath, DerivedFile derivedFile = new DerivedFile(this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, null, null, parentPath, localPath, parentId, null, encodingType, extension); - timelineManager.addAbstractFileEvents(derivedFile, connection); + timelineManager.addEventsForNewFile(derivedFile, connection); transaction.commit(); //TODO add derived method to tsk_files_derived and tsk_files_derived_method return derivedFile; @@ -6523,7 +6523,7 @@ public LocalFile addLocalFile(String fileName, String localPath, dataSourceObjId, localPath, encodingType, extension); - getTimelineManager().addAbstractFileEvents(localFile, connection); + getTimelineManager().addEventsForNewFile(localFile, connection); return localFile; } catch (SQLException ex) { diff --git a/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java b/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java index 1297a907e4cf443a06b4a39d6ad6bdf58f43b382..8ec78fd2004121e409f92846b0e5d73eeab5caae 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java +++ b/bindings/java/src/org/sleuthkit/datamodel/TimelineManager.java @@ -517,7 +517,7 @@ private long addEventDescription(long dataSourceObjId, long fileObjId, Long arti } } - Collection<TimelineEvent> addAbstractFileEvents(AbstractFile file, CaseDbConnection connection) throws TskCoreException { + Collection<TimelineEvent> addEventsForNewFile(AbstractFile file, CaseDbConnection connection) throws TskCoreException { //gather time stamps into map Map<TimelineEventType, Long> timeMap = ImmutableMap.of(TimelineEventType.FILE_CREATED, file.getCrtime(), TimelineEventType.FILE_ACCESSED, file.getAtime(), @@ -525,17 +525,13 @@ Collection<TimelineEvent> addAbstractFileEvents(AbstractFile file, CaseDbConnect TimelineEventType.FILE_MODIFIED, file.getMtime()); /* - * If there are no legitimate ( greater than zero ) time stamps ( eg, - * logical/local files) skip the rest of the event generation: this - * should result in dropping logical files, since they do not have - * legitimate time stamps. + * If there are no legitimate ( greater than zero ) time stamps skip the + * rest of the event generation. */ if (Collections.max(timeMap.values()) <= 0) { return Collections.emptySet(); } - boolean hashHashHits = CollectionUtils.isNotEmpty(file.getHashSetNames()); - boolean hasTags = CollectionUtils.isNotEmpty(sleuthkitCase.getContentTagsByContent(file)); String description = file.getParentPath() + file.getName(); long fileObjId = file.getId(); Set<TimelineEvent> events = new HashSet<>(); @@ -550,8 +546,13 @@ Collection<TimelineEvent> addAbstractFileEvents(AbstractFile file, CaseDbConnect TimelineEventType type = timeEntry.getKey(); long eventID = addEventWithExistingDescription(time, type, descriptionID, connection); + /* + * Last two flags indicating hasTags and hasHashHits are + * both set to false with the assumption that this is not + * possible for a new file. See JIRA-5407 + */ events.add(new TimelineEvent(eventID, descriptionID, fileObjId, null, time, type, - description, null, null, hashHashHits, hasTags)); + description, null, null, false, false)); } }