diff --git a/bindings/java/src/org/sleuthkit/datamodel/AbstractAttribute.java b/bindings/java/src/org/sleuthkit/datamodel/AbstractAttribute.java index 48a40d5f7a90219f0b654adec313dc8e1ef0ffa6..7cc17d6e0633fb6d129f758fd33e0ec7aaaebe46 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/AbstractAttribute.java +++ b/bindings/java/src/org/sleuthkit/datamodel/AbstractAttribute.java @@ -24,11 +24,10 @@ /** * Attributes are a name-value pairs. Abstract Attribute provides the base * functionality for a name value pair with type safety (analogous to a C union) - * */ public abstract class AbstractAttribute { - private static final char[] HEX_ARRAY = "0123456789ABCDEF".toCharArray(); + private static final char[] HEX_ARRAY = "0123456789ABCDEF".toCharArray(); private BlackboardAttribute.Type attributeType; @@ -40,7 +39,6 @@ public abstract class AbstractAttribute { private SleuthkitCase sleuthkitCase; - /** * Constructs an attribute with an integer value. The attribute should be * added to an appropriate artifact. @@ -64,7 +62,6 @@ public AbstractAttribute(BlackboardAttribute.Type attributeType, int valueInt) { this.valueBytes = new byte[0]; } - /** * Constructs an attribute with a long/datetime value. The attribute should * be added to an appropriate artifact. @@ -91,7 +88,6 @@ public AbstractAttribute(BlackboardAttribute.Type attributeType, long valueLong) this.valueBytes = new byte[0]; } - /** * Constructs an attribute with a double value. The attribute should be * added to an appropriate artifact. @@ -115,7 +111,6 @@ public AbstractAttribute(BlackboardAttribute.Type attributeType, double valueDou this.valueBytes = new byte[0]; } - /** * Constructs an attribute with a string value. The attribute should be * added to an appropriate artifact. @@ -144,7 +139,6 @@ public AbstractAttribute(BlackboardAttribute.Type attributeType, String valueStr this.valueBytes = new byte[0]; } - /** * Constructs an attribute with a byte array value. The attribute should be * added to an appropriate artifact. @@ -177,15 +171,15 @@ public AbstractAttribute(BlackboardAttribute.Type attributeType, byte[] valueByt * based on a query of the blackboard _attributes table in the case * database. * - * @param attributeTypeID The attribute type id. - * @param valueType The attribute value type. - * @param valueInt The value from the the value_int32 column. - * @param valueLong The value from the the value_int64 column. - * @param valueDouble The value from the the value_double column. - * @param valueString The value from the the value_text column. - * @param valueBytes The value from the the value_byte column. - * @param sleuthkitCase A reference to the SleuthkitCase object - * representing the case database. + * @param attributeTypeID The attribute type id. + * @param valueType The attribute value type. + * @param valueInt The value from the the value_int32 column. + * @param valueLong The value from the the value_int64 column. + * @param valueDouble The value from the the value_double column. + * @param valueString The value from the the value_text column. + * @param valueBytes The value from the the value_byte column. + * @param sleuthkitCase A reference to the SleuthkitCase object + * representing the case database. */ AbstractAttribute(BlackboardAttribute.Type attributeType, int valueInt, long valueLong, double valueDouble, String valueString, byte[] valueBytes, @@ -226,13 +220,13 @@ public String getDisplayString() { } } return Integer.toString(getValueInt()); - case LONG: + case LONG: return Long.toString(getValueLong()); case DOUBLE: return Double.toString(getValueDouble()); case BYTE: return bytesToHexString(getValueBytes()); - case DATETIME: + case DATETIME: // once we have TSK timezone, that should be used here. return TimeUtilities.epochToTime(getValueLong()); case JSON: { @@ -311,11 +305,10 @@ public byte[] getValueBytes() { return Arrays.copyOf(valueBytes, valueBytes.length); } - SleuthkitCase getCaseDatabase() { return this.sleuthkitCase; } - + /** * Sets the reference to the SleuthkitCase object that represents the case * database. @@ -343,7 +336,7 @@ static String bytesToHexString(byte[] bytes) { } return new String(hexChars); } - + /** * Replace all NUL characters in the string with the SUB character * @@ -355,7 +348,6 @@ final String replaceNulls(String text) { return text.replace((char) 0x00, (char) 0x1A); } - boolean isAttributeEquals(Object that) { if (that instanceof AbstractAttribute) { AbstractAttribute other = (AbstractAttribute) that; diff --git a/bindings/java/src/org/sleuthkit/datamodel/AggregateScoresChangedEvent.java b/bindings/java/src/org/sleuthkit/datamodel/AggregateScoresChangedEvent.java index 2165989c9d7a08b355394953d6777eddf34db3c9..4ef0c97d3941894a061c8c306c39680ad331874f 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/AggregateScoresChangedEvent.java +++ b/bindings/java/src/org/sleuthkit/datamodel/AggregateScoresChangedEvent.java @@ -1,22 +1,21 @@ /* * Sleuth Kit Data Model - * - * Copyright 2020 Basis Technology Corp. + * + * Copyright 2020-2021 Basis Technology Corp. * Contact: carrier <at> sleuthkit <dot> org - * + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ - package org.sleuthkit.datamodel; import com.google.common.collect.ImmutableSet; @@ -30,7 +29,7 @@ final public class AggregateScoresChangedEvent implements TskDataSourceEvent, Ts AggregateScoresChangedEvent(Long dataSourceId, ImmutableSet<ScoreChange> scoreChanges) { this.dataSourceId = dataSourceId; this.scoreChanges = scoreChanges; - + // ensure that all score changes have the same data source as the one in the event. scoreChanges.stream() .forEach(chg -> { diff --git a/bindings/java/src/org/sleuthkit/datamodel/AnalysisResult.java b/bindings/java/src/org/sleuthkit/datamodel/AnalysisResult.java index 6f744e5c4eec816e412312ca2bfe02166df006f8..4632c2233959beda3338b2a7a878a8ec82e264f2 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/AnalysisResult.java +++ b/bindings/java/src/org/sleuthkit/datamodel/AnalysisResult.java @@ -19,13 +19,11 @@ package org.sleuthkit.datamodel; /** - * An AnalysisResult represents the outcome of some analysis technique - * that was applied to some data (i.e. Content) to determine the data's - * relevance. The result should have a conclusion and a relevance - * score. The score of the AnalysisResult will be used to calculate - * the aggregate score of the parent data. Additional metadata can be - * stored as BlackboardAttributes. - * + * An AnalysisResult represents the outcome of some analysis technique that was + * applied to some data (i.e. Content) to determine the data's relevance. The + * result should have a conclusion and a relevance score. The score of the + * AnalysisResult will be used to calculate the aggregate score of the parent + * data. Additional metadata can be stored as BlackboardAttributes. */ public class AnalysisResult extends BlackboardArtifact { @@ -37,7 +35,7 @@ public class AnalysisResult extends BlackboardArtifact { private boolean ignoreResult = false; // ignore this analysis result when computing score of the parent object. /** - * Constructs an analysis result. + * Constructs an analysis result. * * @param sleuthkitCase The SleuthKit case (case database) that contains * the artifact data. @@ -57,7 +55,7 @@ public class AnalysisResult extends BlackboardArtifact { * @param configuration Configuration used for analysis. May be null. * @param justification Justification for the analysis. May be null. */ - AnalysisResult( SleuthkitCase sleuthkitCase, long artifactID, long sourceObjId, long artifactObjId, Long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus, Score score, String conclusion, String configuration, String justification) { + AnalysisResult(SleuthkitCase sleuthkitCase, long artifactID, long sourceObjId, long artifactObjId, Long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus, Score score, String conclusion, String configuration, String justification) { super(sleuthkitCase, artifactID, sourceObjId, artifactObjId, dataSourceObjId, artifactTypeID, artifactTypeName, displayName, reviewStatus); this.score = score; this.conclusion = (conclusion != null) ? conclusion : ""; @@ -65,9 +63,8 @@ public class AnalysisResult extends BlackboardArtifact { this.justification = (justification != null) ? justification : ""; } - /** - * Constructs an analysis result. + * Constructs an analysis result. * * @param sleuthkitCase The SleuthKit case (case database) that contains * the artifact data. @@ -88,7 +85,6 @@ public class AnalysisResult extends BlackboardArtifact { * @param configuration Configuration used for analysis. May be null. * @param justification Justification for the analysis. May be null. */ - AnalysisResult(SleuthkitCase sleuthkitCase, long artifactID, long sourceObjId, long artifactObjID, Long dataSourceObjID, int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus, boolean isNew, Score score, String conclusion, String configuration, String justification) { super(sleuthkitCase, artifactID, sourceObjId, artifactObjID, dataSourceObjID, artifactTypeID, artifactTypeName, displayName, reviewStatus, isNew); this.score = score; @@ -134,8 +130,8 @@ public String getJustification() { } /** - * Sets if this result is to be ignored when calculating - * the aggregate score of the parent object. + * Sets if this result is to be ignored when calculating the aggregate score + * of the parent object. * * @param ignore if the result should be ignored or not. */ diff --git a/bindings/java/src/org/sleuthkit/datamodel/AnalysisResultAdded.java b/bindings/java/src/org/sleuthkit/datamodel/AnalysisResultAdded.java index a58cb9580185c90105b43cd0cdfd2d43aa0354c6..8280d8d1e0a63a2692611bf3913c1adc023e427f 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/AnalysisResultAdded.java +++ b/bindings/java/src/org/sleuthkit/datamodel/AnalysisResultAdded.java @@ -1,7 +1,7 @@ /* * Sleuth Kit Data Model * - * Copyright 2020 Basis Technology Corp. + * Copyright 2020-2021 Basis Technology Corp. * Contact: carrier <at> sleuthkit <dot> org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -19,19 +19,19 @@ package org.sleuthkit.datamodel; /** - * This class encapsulates an analysis result added to Content, and the content's - * aggregate score upon adding the analysis result. + * This class encapsulates an analysis result added to Content, and the + * content's aggregate score upon adding the analysis result. */ public class AnalysisResultAdded { - + private final AnalysisResult analysisResult; private final Score score; - + AnalysisResultAdded(AnalysisResult analysisResult, Score score) { this.analysisResult = analysisResult; this.score = score; } - + public AnalysisResult getAnalysisResult() { return analysisResult; } @@ -39,5 +39,5 @@ public AnalysisResult getAnalysisResult() { public Score getAggregateScore() { return score; } - + } diff --git a/bindings/java/src/org/sleuthkit/datamodel/Blackboard.java b/bindings/java/src/org/sleuthkit/datamodel/Blackboard.java index c76c875ae0bac91f1c52ee01a5bbd91c55a00b73..05d76668299d0cdec80715e6a771cfbf543f7779 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/Blackboard.java +++ b/bindings/java/src/org/sleuthkit/datamodel/Blackboard.java @@ -307,35 +307,37 @@ private Score deleteAnalysisResult(AnalysisResult analysisResult, CaseDbTransact /** * Get all analysis results for a given object. * - * @param objId Object id. + * @param sourceObjId Object id. * * @return list of analysis results. * * @throws TskCoreException exception thrown if a critical error occurs * within TSK core. */ - public List<AnalysisResult> getAnalysisResults(long objId) throws TskCoreException { - return getAnalysisResultsWhere(" arts.obj_id = " + objId); + public List<AnalysisResult> getAnalysisResults(long sourceObjId) throws TskCoreException { + return getAnalysisResultsWhere(" arts.obj_id = " + sourceObjId); } /** * Get all analysis results for a given object. * - * @param objId Object id. - * @param connection Database connection to use. * + * @param sourceObjId Object id. + * @param connection Database connection to use. + * + * * @return list of analysis results. * * @throws TskCoreException exception thrown if a critical error occurs * within TSK core. */ - List<AnalysisResult> getAnalysisResults(long objId, CaseDbConnection connection) throws TskCoreException { - return getAnalysisResultsWhere(" arts.obj_id = " + objId, connection); + List<AnalysisResult> getAnalysisResults(long sourceObjId, CaseDbConnection connection) throws TskCoreException { + return getAnalysisResultsWhere(" arts.obj_id = " + sourceObjId, connection); } /** * Get analysis results of the given type, for the given object. * - * @param objId Object id. + * @param sourceObjId Object id. * @param artifactTypeId Result type to get. * * @return list of analysis results. @@ -343,8 +345,7 @@ List<AnalysisResult> getAnalysisResults(long objId, CaseDbConnection connection) * @throws TskCoreException exception thrown if a critical error occurs * within TSK core. */ - public List<AnalysisResult> getAnalysisResults(long objId, int artifactTypeId) throws TskCoreException { - + public List<AnalysisResult> getAnalysisResults(long sourceObjId, int artifactTypeId) throws TskCoreException { // Get the artifact type to check that it in the analysis result category. BlackboardArtifact.Type artifactType = caseDb.getArtifactType(artifactTypeId); if (artifactType.getCategory() != BlackboardArtifact.Category.ANALYSIS_RESULT) { @@ -352,38 +353,10 @@ public List<AnalysisResult> getAnalysisResults(long objId, int artifactTypeId) t } String whereClause = " types.artifact_type_id = " + artifactTypeId - + " AND arts.obj_id = " + objId; - + + " AND arts.obj_id = " + sourceObjId; return getAnalysisResultsWhere(whereClause); } -// /** -// * Get all analysis results of a given type, for a given data source. -// * -// * @param dataSourceObjId Data source to look under. -// * @param artifactTypeId Type of results to get. -// * -// * @return list of analysis results. -// * -// * @throws TskCoreException exception thrown if a critical error occurs -// * within TSK core. -// */ -// To keep the public API footprint minimal and necessary, this API is commented out -// till Autopsy implements and intgerates the concept of AnalysisResults. -// At that time, this api could be uncommented or deleted if it is not needed. -// public List<AnalysisResult> getAnalysisResultsForDataSource(long dataSourceObjId, int artifactTypeId) throws TskCoreException { -// -// // Get the artifact type to check that it in the analysis result category. -// BlackboardArtifact.Type artifactType = caseDb.getArtifactType(artifactTypeId); -// if (artifactType.getCategory() != BlackboardArtifact.Category.ANALYSIS_RESULT) { -// throw new TskCoreException(String.format("Artifact type id %d is not in analysis result catgeory.", artifactTypeId)); -// } -// -// String whereClause = " types.artifact_type_id = " + artifactTypeId -// + " AND arts.data_source_obj_id = " + dataSourceObjId; // NON-NLS -// -// return getAnalysisResultsWhere(whereClause); -// } /** * Get all analysis results matching the given where sub-clause. * @@ -884,7 +857,6 @@ private boolean attributesMatch(Collection<BlackboardAttribute> fileAttributesLi boolean match = false; for (BlackboardAttribute fileAttribute : fileAttributesList) { BlackboardAttribute.Type attributeType = fileAttribute.getAttributeType(); - if (attributeType.getTypeID() != expectedAttribute.getAttributeType().getTypeID()) { continue; } @@ -978,68 +950,6 @@ public static final class BlackboardException extends Exception { } } - /** - * Add a new blackboard artifact with the given type. - * - * This api executes in the context of a transaction if one is provided. - * - * @param artifactType The type of the artifact. - * @param sourceObjId The content that is the source of this artifact. - * @param dataSourceObjId The data source the artifact source content - * belongs to, may be the same as the sourceObjId. - * @param attributes The attributes. May be empty or null. - * @param transaction The transaction in the scope of which the - * operation is to be performed. Null may be - * provided, if one is not available. - * - * @return a new blackboard artifact - * - * @throws TskCoreException exception thrown if a critical error occurs - * within tsk core - * - * @deprecated Use the newDataArtifact() API to create an artifact with - * attributes. - */ - @Deprecated - public BlackboardArtifact newBlackboardArtifact(BlackboardArtifact.Type artifactType, long sourceObjId, long dataSourceObjId, - Collection<BlackboardAttribute> attributes, final CaseDbTransaction transaction) throws TskCoreException { - - CaseDbTransaction localTrans = null; - boolean isNewLocalTx = false; - if (transaction == null) { - localTrans = caseDb.beginTransaction(); - isNewLocalTx = true; - } else { - localTrans = transaction; - } - - try { - BlackboardArtifact blackboardArtifact = caseDb.newBlackboardArtifact(artifactType.getTypeID(), sourceObjId, - artifactType.getTypeName(), artifactType.getDisplayName(), - dataSourceObjId, localTrans.getConnection()); - - if (Objects.nonNull(attributes) && !attributes.isEmpty()) { - blackboardArtifact.addAttributes(attributes, localTrans); - } - - if (isNewLocalTx) { - localTrans.commit(); - } - return blackboardArtifact; - - } catch (TskCoreException ex) { - try { - if (isNewLocalTx) { - localTrans.rollback(); - } - } catch (TskCoreException ex2) { - LOGGER.log(Level.SEVERE, "Failed to rollback transaction after exception. " - + "Error invoking newBlackboardArtifact with dataSourceObjId: " + dataSourceObjId + ", sourceObjId: " + sourceObjId, ex2); - } - throw ex; - } - } - /** * Add a new data artifact with the given type. * @@ -1182,7 +1092,7 @@ private ArtifactsPostedEvent(Collection<BlackboardArtifact> artifacts, String mo } public Collection<BlackboardArtifact> getArtifacts() { - return artifacts; + return ImmutableSet.copyOf(artifacts); } public Collection<BlackboardArtifact> getArtifacts(BlackboardArtifact.Type artifactType) { @@ -1197,7 +1107,7 @@ public String getModuleName() { } public Collection<BlackboardArtifact.Type> getArtifactTypes() { - return artifactTypes; + return ImmutableSet.copyOf(artifactTypes); } } } diff --git a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java index 909dd529ae1d46d0a3bb7c776fca68f14fe9d9de..6c240972f8fedf91c73ee73ab5569fc860676ada 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java +++ b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java @@ -197,7 +197,6 @@ public String getArtifactTypeName() { return this.artifactTypeName; } - /** * Gets the artifact type display name for this artifact. * @@ -399,18 +398,17 @@ public void addAttributes(Collection<BlackboardAttribute> attributes) throws Tsk * operation is to be performed, managed by the * caller. Null is not permitted. * - * @throws TskCoreException If an error occurs and the attributes - * were not added to the artifact. - If <code>caseDbTransaction</code> is - * null or if <code>attributes</code> is - * null or empty. + * @throws TskCoreException If an error occurs and the attributes were not + * added to the artifact. If + * <code>caseDbTransaction</code> is null or if + * <code>attributes</code> is null or empty. */ public void addAttributes(Collection<BlackboardAttribute> attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException { if (Objects.isNull(attributes) || attributes.isEmpty()) { throw new TskCoreException("Illegal argument passed to addAttributes: null or empty attributes passed to addAttributes"); } - if (Objects.isNull(caseDbTransaction) ) { + if (Objects.isNull(caseDbTransaction)) { throw new TskCoreException("Illegal argument passed to addAttributes: null caseDbTransaction passed to addAttributes"); } try { @@ -425,7 +423,6 @@ public void addAttributes(Collection<BlackboardAttribute> attributes, final Sleu } } - /** * This overiding implementation returns the unique path of the parent. It * does not include the Artifact name in the unique path. @@ -490,7 +487,6 @@ public Score getAggregateScore() throws TskCoreException { } - @Override public List<AnalysisResult> getAnalysisResults(BlackboardArtifact.Type artifactType) throws TskCoreException { return sleuthkitCase.getBlackboard().getAnalysisResults(artifactObjId, artifactType.getTypeID()); //NON-NLS @@ -897,8 +893,6 @@ private void loadArtifactContent() throws TskCoreException { } - - /** * An artifact type. */ @@ -1408,11 +1402,8 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem { */ TSK_GPS_AREA(67, "TSK_GPS_AREA", bundle.getString("BlackboardArtifact.tskGPSArea.text"), Category.DATA_ARTIFACT), - TSK_WEB_CATEGORIZATION(68, "TSK_WEB_CATEGORIZATION", - bundle.getString("BlackboardArtifact.tskWebCategorization.text"), Category.ANALYSIS_RESULT), - - ; + bundle.getString("BlackboardArtifact.tskWebCategorization.text"), Category.ANALYSIS_RESULT),; /* * To developers: For each new artifact, ensure that: - The enum value @@ -1441,7 +1432,7 @@ private ARTIFACT_TYPE(int typeId, String label, String displayName) { * @param typeId The type id. * @param label The type name. * @param displayName The type display name. - * @param category The type category. + * @param category The type category. */ private ARTIFACT_TYPE(int typeId, String label, String displayName, Category category) { this.typeId = typeId; @@ -1548,7 +1539,7 @@ public <T> T accept(SleuthkitItemVisitor<T> visitor) { * data. */ public enum Category { - // NOTE: The schema code defaults to '0', so that code must be updated too if DATA_ARTIFACT changes from being 0 + // NOTE: The schema code defaults to '0', so that code must be updated too if DATA_ARTIFACT changes from being 0 DATA_ARTIFACT(0, "DATA_ARTIFACT", ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle").getString("CategoryType.DataArtifact")), // artifact is data that is directly/indirectly extracted from a data source. ANALYSIS_RESULT(1, "ANALYSIS_RESULT", ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle").getString("CategoryType.AnalysisResult")); // artifacts represents outcome of analysis of data. diff --git a/bindings/java/src/org/sleuthkit/datamodel/DataArtifact.java b/bindings/java/src/org/sleuthkit/datamodel/DataArtifact.java index 864f214455c2c8aa10e220164159c6a510f5de17..ad1ea7d7107c942bdfd026a5c8e0df2051bf8ced 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/DataArtifact.java +++ b/bindings/java/src/org/sleuthkit/datamodel/DataArtifact.java @@ -20,21 +20,18 @@ import java.util.Optional; - /** * DataArtifact is a category of artifact types that are simply data directly * extracted from a data source. - * */ public final class DataArtifact extends BlackboardArtifact { - + // data artifacts may have a OS Account associated with them. private final Long osAccountObjId; - - + /** - * Constructs a DataArtifact. - * + * Constructs a DataArtifact. + * * @param sleuthkitCase The SleuthKit case (case database) that contains * the artifact data. * @param artifactID The unique id for this artifact. @@ -47,7 +44,7 @@ public final class DataArtifact extends BlackboardArtifact { * @param artifactTypeName The type name of this artifact. * @param displayName The display name of this artifact. * @param reviewStatus The review status of this artifact. - * @param osAccountObjId OsAccount associated with this artifact, may be + * @param osAccountObjId OsAccount associated with this artifact, may be * null. * @param isNew The object is newly created. */ @@ -55,8 +52,7 @@ public final class DataArtifact extends BlackboardArtifact { super(sleuthkitCase, artifactID, sourceObjId, artifactObjId, dataSourceObjId, artifactTypeID, artifactTypeName, displayName, reviewStatus, isNew); this.osAccountObjId = osAccountObjId; } - - + /** * Gets the OS Account for this artifact. * @@ -67,6 +63,5 @@ public final class DataArtifact extends BlackboardArtifact { public Optional<Long> getOsAccountObjectId() throws TskCoreException { return Optional.ofNullable(osAccountObjId); } - - + } diff --git a/bindings/java/src/org/sleuthkit/datamodel/Host.java b/bindings/java/src/org/sleuthkit/datamodel/Host.java index 3be378369c1ca93f77c4c12f4101ed19960e5a60..37292e4960faace8f8b79d90cddbe305d1b44b3a 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/Host.java +++ b/bindings/java/src/org/sleuthkit/datamodel/Host.java @@ -21,7 +21,6 @@ import java.util.Objects; /** - * * Encapsulates a host. */ public final class Host { @@ -57,7 +56,7 @@ public long getHostId() { public String getName() { return name; } - + /** * Gets the status for the host. * @@ -66,7 +65,7 @@ public String getName() { HostDbStatus getStatus() { return status; } - + @Override public int hashCode() { int hash = 5; @@ -106,7 +105,6 @@ public enum HostDbStatus { ACTIVE(0, "Active"), MERGED(1, "Merged"), DELETED(2, "Deleted"); - private final int id; private final String name; @@ -133,5 +131,5 @@ public static HostDbStatus fromID(int typeId) { return null; } } - + } diff --git a/bindings/java/src/org/sleuthkit/datamodel/HostAddressManager.java b/bindings/java/src/org/sleuthkit/datamodel/HostAddressManager.java index 307fafa0977210a1d354c3ecaf0fb979c18ef61e..1dafb3da80f74d84370ae35a6318aabd5d2f1e24 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/HostAddressManager.java +++ b/bindings/java/src/org/sleuthkit/datamodel/HostAddressManager.java @@ -39,14 +39,13 @@ /** * Responsible for creating/updating/retrieving host addresses. - * */ public class HostAddressManager { private static final Logger LOGGER = Logger.getLogger(HostAddressManager.class.getName()); private final SleuthkitCase db; - + /** * An HostAddress Object Id entry is maintained in this cache when a * hostaddress and ip mapping is added. This is here to improve the @@ -62,7 +61,6 @@ public class HostAddressManager { */ private final Cache<String, Long> recentHostAddresstCache = CacheBuilder.newBuilder().maximumSize(200000).build(); - /** * Construct a HostAddressManager for the given SleuthkitCase. * @@ -72,7 +70,7 @@ public class HostAddressManager { HostAddressManager(SleuthkitCase skCase) { this.db = skCase; } - + /** * Gets an address record with given type and address. * @@ -193,7 +191,7 @@ private HostAddress newHostAddress(HostAddress.HostAddressType type, String addr preparedStatement.setString(3, address.toLowerCase()); connection.executeUpdate(preparedStatement); - recentHostAddresstCache.put(addressType.getId()+"#"+address.toLowerCase(), objId); + recentHostAddresstCache.put(addressType.getId() + "#" + address.toLowerCase(), objId); return new HostAddress(db, objId, addressType, address); } catch (SQLException ex) { throw new TskCoreException(String.format("Error adding host address of type = %s, with address = %s", type.getName(), address), ex); @@ -254,7 +252,7 @@ List<HostAddress> getHostAddressesAssignedTo(Host host) throws TskCoreException + " WHERE host_id = " + host.getHostId(); List<HostAddress> addresses = new ArrayList<>(); - + db.acquireSingleUserCaseReadLock(); try (CaseDbConnection connection = this.db.getConnection(); Statement s = connection.createStatement(); @@ -267,8 +265,7 @@ List<HostAddress> getHostAddressesAssignedTo(Host host) throws TskCoreException return addresses; } catch (SQLException ex) { throw new TskCoreException(String.format("Error getting host addresses for host " + host.getName()), ex); - } - finally { + } finally { db.releaseSingleUserCaseReadLock(); } } @@ -291,7 +288,7 @@ public HostAddress getHostAddress(long id) throws TskCoreException { /** * Gets an address for the given object id. * - * @param id Id of the host address. + * @param id Id of the host address. * @param connection Current connection * * @return The corresponding HostAddress. @@ -311,9 +308,9 @@ private HostAddress getHostAddress(long id, CaseDbConnection connection) throws } else { long objId = rs.getLong("id"); int type = rs.getInt("address_type"); - String address = rs.getString("address"); - recentHostAddresstCache.put(type+"#"+address, objId); - return new HostAddress(db, objId, HostAddress.HostAddressType.fromID(type),address); + String address = rs.getString("address"); + recentHostAddresstCache.put(type + "#" + address, objId); + return new HostAddress(db, objId, HostAddress.HostAddressType.fromID(type), address); } } catch (SQLException ex) { throw new TskCoreException(String.format("Error getting host address with id = %d", id), ex); @@ -338,9 +335,9 @@ public void addHostNameAndIpMapping(HostAddress dnsNameAddress, HostAddress ipAd addHostNameAndIpMapping(dnsNameAddress, ipAddress, time, source, connection); } catch (SQLException ex) { throw new TskCoreException(String.format("Error adding host DNS address mapping for DNS name = %s, and IP address = %s", dnsNameAddress.getAddress(), ipAddress.getAddress()), ex); - } + } } - + /** * Adds a row to the host address dns ip map table. * @@ -363,9 +360,9 @@ public void addHostNameAndIpMapping(HostAddress dnsNameAddress, HostAddress ipAd addHostNameAndIpMapping(dnsNameAddress, ipAddress, time, source, caseDbTransaction.getConnection()); } catch (SQLException ex) { throw new TskCoreException(String.format("Error adding host DNS address mapping for DNS name = %s, and IP address = %s", dnsNameAddress.getAddress(), ipAddress.getAddress()), ex); - } + } } - + /** * Adds a row to the host address dns ip map table. * @@ -377,7 +374,7 @@ public void addHostNameAndIpMapping(HostAddress dnsNameAddress, HostAddress ipAd * * @throws TskCoreException */ - private void addHostNameAndIpMapping(HostAddress dnsNameAddress, HostAddress ipAddress, Long time, Content source, final CaseDbConnection connection) throws SQLException, TskCoreException { + private void addHostNameAndIpMapping(HostAddress dnsNameAddress, HostAddress ipAddress, Long time, Content source, final CaseDbConnection connection) throws SQLException, TskCoreException { if (dnsNameAddress.getAddressType() != HostAddress.HostAddressType.HOSTNAME) { throw new TskCoreException("IllegalArguments passed to addHostNameAndIpMapping: A host name address is expected."); @@ -416,22 +413,25 @@ private void addHostNameAndIpMapping(HostAddress dnsNameAddress, HostAddress ipA /** * Returns true if addressObjectId is used as either IP or host name * <br> - * <b>Note:</b> This api call uses a database connection. Do not invoke within a transaction. - * + * <b>Note:</b> This api call uses a database connection. Do not invoke + * within a transaction. + * * @param addressObjectId - * @return + * + * @return + * * @throws TskCoreException */ public boolean hostNameAndIpMappingExists(long addressObjectId) throws TskCoreException { Byte isPresent = recentHostNameAndIpMappingCache.getIfPresent(addressObjectId); - - if(Objects.nonNull(isPresent)){ + + if (Objects.nonNull(isPresent)) { return true; } - + String queryString = "SELECT count(*) as mappingCount FROM tsk_host_address_dns_ip_map WHERE ip_address_id = ? OR dns_address_id = ? "; - + db.acquireSingleUserCaseReadLock(); try (CaseDbConnection connection = this.db.getConnection(); PreparedStatement ps = connection.getPreparedStatement(queryString, Statement.NO_GENERATED_KEYS);) { @@ -443,8 +443,8 @@ public boolean hostNameAndIpMappingExists(long addressObjectId) throws TskCoreEx return false; } else { boolean status = rs.getLong("mappingCount") > 0; - if(status){ - recentHostNameAndIpMappingCache.put(addressObjectId, new Byte((byte)1)); + if (status) { + recentHostNameAndIpMappingCache.put(addressObjectId, new Byte((byte) 1)); } return status; } @@ -455,9 +455,7 @@ public boolean hostNameAndIpMappingExists(long addressObjectId) throws TskCoreEx db.releaseSingleUserCaseReadLock(); } } - - /** * Returns ObjectId of HostAddress if it exists. * <br> @@ -472,12 +470,12 @@ public boolean hostNameAndIpMappingExists(long addressObjectId) throws TskCoreEx * @throws TskCoreException */ public Optional<Long> hostAddressExists(HostAddress.HostAddressType type, String address) throws TskCoreException { - - Long id = recentHostAddresstCache.getIfPresent(type.getId()+"#"+address.toLowerCase()); - if(Objects.nonNull(id)){ + + Long id = recentHostAddresstCache.getIfPresent(type.getId() + "#" + address.toLowerCase()); + if (Objects.nonNull(id)) { return Optional.of(id); } - + String queryString = "SELECT id, address_type FROM tsk_host_addresses" + " WHERE LOWER(address) = LOWER(?)"; if (type.equals(HostAddress.HostAddressType.DNS_AUTO)) { @@ -498,7 +496,7 @@ public Optional<Long> hostAddressExists(HostAddress.HostAddressType type, String } else { long objId = rs.getLong("id"); int addrType = rs.getInt("address_type"); - recentHostAddresstCache.put(addrType + "#" + address.toLowerCase(), objId); + recentHostAddresstCache.put(addrType + "#" + address.toLowerCase(), objId); return Optional.of(objId); } } @@ -526,7 +524,7 @@ public List<HostAddress> getIpAddress(String hostname) throws TskCoreException { + " AND LOWER( addresses.address) = LOWER(?)"; db.acquireSingleUserCaseReadLock(); - try (CaseDbConnection connection = this.db.getConnection()){ + try (CaseDbConnection connection = this.db.getConnection()) { List<HostAddress> IpAddresses = new ArrayList<>(); PreparedStatement query = connection.getPreparedStatement(queryString, Statement.NO_GENERATED_KEYS); query.clearParameters(); @@ -535,14 +533,13 @@ public List<HostAddress> getIpAddress(String hostname) throws TskCoreException { while (rs.next()) { long ipAddressObjId = rs.getLong("ip_address_id"); IpAddresses.add(HostAddressManager.this.getHostAddress(ipAddressObjId, connection)); - recentHostNameAndIpMappingCache.put(ipAddressObjId, new Byte((byte)1)); + recentHostNameAndIpMappingCache.put(ipAddressObjId, new Byte((byte) 1)); } return IpAddresses; } } catch (SQLException ex) { throw new TskCoreException(String.format("Error getting host addresses for host name: " + hostname), ex); - } - finally { + } finally { db.releaseSingleUserCaseReadLock(); } } @@ -565,7 +562,7 @@ List<HostAddress> getHostNameByIp(String ipAddress) throws TskCoreException { + " AND LOWER( addresses.address) = LOWER(?)"; db.acquireSingleUserCaseReadLock(); - try (CaseDbConnection connection = this.db.getConnection()){ + try (CaseDbConnection connection = this.db.getConnection()) { List<HostAddress> dnsNames = new ArrayList<>(); PreparedStatement query = connection.getPreparedStatement(queryString, Statement.NO_GENERATED_KEYS); query.clearParameters(); @@ -574,14 +571,13 @@ List<HostAddress> getHostNameByIp(String ipAddress) throws TskCoreException { while (rs.next()) { long dnsAddressId = rs.getLong("dns_address_id"); dnsNames.add(HostAddressManager.this.getHostAddress(dnsAddressId, connection)); - recentHostNameAndIpMappingCache.put(dnsAddressId, new Byte((byte)1)); + recentHostNameAndIpMappingCache.put(dnsAddressId, new Byte((byte) 1)); } return dnsNames; } } catch (SQLException ex) { throw new TskCoreException(String.format("Error getting host addresses for IP address: " + ipAddress), ex); - } - finally { + } finally { db.releaseSingleUserCaseReadLock(); } } @@ -589,7 +585,7 @@ List<HostAddress> getHostNameByIp(String ipAddress) throws TskCoreException { /** * Associate the given artifact with a HostAddress. * - * @param content The content/item using the address. + * @param content The content/item using the address. * @param hostAddress The host address. */ public void addUsage(Content content, HostAddress hostAddress) throws TskCoreException { diff --git a/bindings/java/src/org/sleuthkit/datamodel/HostManager.java b/bindings/java/src/org/sleuthkit/datamodel/HostManager.java index 71c1b56166b976836c05b3eacda10b4a907b593a..ec51ef899a43a8afa96c9b1c7eeee7a0a9b0afd0 100755 --- a/bindings/java/src/org/sleuthkit/datamodel/HostManager.java +++ b/bindings/java/src/org/sleuthkit/datamodel/HostManager.java @@ -1,7 +1,7 @@ /* * Sleuth Kit Data Model * - * Copyright 2020 Basis Technology Corp. + * Copyright 2020-2021 Basis Technology Corp. * Contact: carrier <at> sleuthkit <dot> org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -37,7 +37,6 @@ /** * Responsible for creating/updating/retrieving Hosts. - * */ public final class HostManager { @@ -155,7 +154,7 @@ Host newHost(String name, CaseDbTransaction trans) throws TskCoreException { /** * Updates the name of the provided host. * - * @param host The host to be updated. + * @param host The host to be updated. * @param newName The new name of the host. * * @return The updated host. @@ -330,7 +329,7 @@ public Optional<Host> getHostByName(String name) throws TskCoreException { private Optional<Host> getHostByName(String name, CaseDbConnection connection) throws TskCoreException { String queryString = "SELECT * FROM tsk_hosts" - + " WHERE LOWER(name) = LOWER(?)" + + " WHERE LOWER(name) = LOWER(?)" + " AND db_status = " + Host.HostDbStatus.ACTIVE.getId(); db.acquireSingleUserCaseReadLock(); @@ -458,68 +457,68 @@ public Host getHostByDataSource(DataSource dataSource) throws TskCoreException { db.releaseSingleUserCaseReadLock(); } } - + /** - * Merge source host into destination host. - * When complete: - * - All realms will have been moved into the destination host or merged with existing realms in the destination host. - * - All references to the source host will be updated to reference the destination host. - * - The source host will be updated so that it will no longer be returned by any methods - * apart from get by host id. - * + * Merge source host into destination host. When complete: - All realms will + * have been moved into the destination host or merged with existing realms + * in the destination host. - All references to the source host will be + * updated to reference the destination host. - The source host will be + * updated so that it will no longer be returned by any methods apart from + * get by host id. + * * @param sourceHost The source host. * @param destHost The destination host. - * - * @throws TskCoreException + * + * @throws TskCoreException */ public void mergeHosts(Host sourceHost, Host destHost) throws TskCoreException { String query = ""; CaseDbTransaction trans = null; try { trans = db.beginTransaction(); - + // Merge or move any realms associated with the source host List<OsAccountRealm> realms = db.getOsAccountRealmManager().getRealmsByHost(sourceHost, trans.getConnection()); for (OsAccountRealm realm : realms) { db.getOsAccountRealmManager().moveOrMergeRealm(realm, destHost, trans); } - + try (Statement s = trans.getConnection().createStatement()) { // Update references to the source host - + // tsk_host_address_map has a unique constraint on host_id, addr_obj_id, time, // so delete any rows that would be duplicates. - query = "DELETE FROM tsk_host_address_map " + - "WHERE id IN ( " + - "SELECT " + - " sourceMapRow.id " + - "FROM " + - " tsk_host_address_map destMapRow " + - "INNER JOIN tsk_host_address_map sourceMapRow ON destMapRow.addr_obj_id = sourceMapRow.addr_obj_id AND destMapRow.time = sourceMapRow.time " + - "WHERE destMapRow.host_id = " + destHost.getHostId() + - " AND sourceMapRow.host_id = " + sourceHost.getHostId() + " )"; + query = "DELETE FROM tsk_host_address_map " + + "WHERE id IN ( " + + "SELECT " + + " sourceMapRow.id " + + "FROM " + + " tsk_host_address_map destMapRow " + + "INNER JOIN tsk_host_address_map sourceMapRow ON destMapRow.addr_obj_id = sourceMapRow.addr_obj_id AND destMapRow.time = sourceMapRow.time " + + "WHERE destMapRow.host_id = " + destHost.getHostId() + + " AND sourceMapRow.host_id = " + sourceHost.getHostId() + " )"; s.executeUpdate(query); query = makeOsAccountUpdateQuery("tsk_host_address_map", "host_id", sourceHost, destHost); s.executeUpdate(query); - + query = makeOsAccountUpdateQuery("tsk_os_account_attributes", "host_id", sourceHost, destHost); s.executeUpdate(query); - + query = makeOsAccountUpdateQuery("data_source_info", "host_id", sourceHost, destHost); s.executeUpdate(query); - + // Mark the source host as merged and change the name to a random string. String mergedName = makeMergedHostName(); query = "UPDATE tsk_hosts SET merged_into = " + destHost.getHostId() + ", db_status = " + Host.HostDbStatus.MERGED.getId() - + ", name = '" + mergedName + "' " + + ", name = '" + mergedName + "' " + " WHERE id = " + sourceHost.getHostId(); - s.executeUpdate(query); + s.executeUpdate(query); } - + trans.commit(); trans = null; - + // Fire events for updated and deleted hosts fireChangeEvent(sourceHost); fireDeletedEvent(destHost); @@ -531,33 +530,33 @@ public void mergeHosts(Host sourceHost, Host destHost) throws TskCoreException { } } } - + /** * Create the query to update the host id column to the merged host. - * + * * @param tableName Name of table to update. * @param columnName Name of the column containing the host id. - * @param sourceHost The source host. - * @param destHost The destination host. - * + * @param sourceHost The source host. + * @param destHost The destination host. + * * @return The query. */ private String makeOsAccountUpdateQuery(String tableName, String columnName, Host sourceHost, Host destHost) { return "UPDATE " + tableName + " SET " + columnName + " = " + destHost.getHostId() + " WHERE " + columnName + " = " + sourceHost.getHostId(); } - + /** * Create a random name for hosts that have been merged. - * + * * @return The random signature. */ private String makeMergedHostName() { - return "MERGED " + UUID.randomUUID().toString(); + return "MERGED " + UUID.randomUUID().toString(); } /** - * Fires an event that a host has changed. - * Do not call this with an open transaction. + * Fires an event that a host has changed. Do not call this with an open + * transaction. * * @param newValue The new value for the host. */ @@ -566,8 +565,8 @@ private void fireChangeEvent(Host newValue) { } /** - * Fires an event that a host has been deleted. - * Do not call this with an open transaction. + * Fires an event that a host has been deleted. Do not call this with an + * open transaction. * * @param deleted The deleted host. */ diff --git a/bindings/java/src/org/sleuthkit/datamodel/OsAccount.java b/bindings/java/src/org/sleuthkit/datamodel/OsAccount.java index 74170cb6c52b9f54a6898b820b73f6f67e4302b6..b9fd37885012b07b9f5f969e3d78fd8dba87423a 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/OsAccount.java +++ b/bindings/java/src/org/sleuthkit/datamodel/OsAccount.java @@ -220,7 +220,7 @@ public static OsAccountType fromID(int typeId) { * @param accountStatus Account status. * @param dbStatus Status of row in database. */ - OsAccount(SleuthkitCase sleuthkitCase, long osAccountobjId, long realmId, String loginName, String uniqueId, String signature, + OsAccount(SleuthkitCase sleuthkitCase, long osAccountobjId, long realmId, String loginName, String uniqueId, String signature, String fullName, Long creationTime, OsAccountType accountType, OsAccountStatus accountStatus, OsAccountDbStatus accountDbStatus) { super(sleuthkitCase, osAccountobjId, signature); @@ -244,7 +244,7 @@ public static OsAccountType fromID(int typeId) { * * @param osAccountAttributes The osAccount attributes that are to be added. */ - synchronized void setAttributesInternal(List<OsAccountAttribute> osAccountAttributes) { + synchronized void setAttributesInternal(List<OsAccountAttribute> osAccountAttributes) { this.osAccountAttributes = osAccountAttributes; } @@ -254,10 +254,10 @@ synchronized void setAttributesInternal(List<OsAccountAttribute> osAccountAttri * * @param osAccountInstanes The osAccount instances that are to be added. */ - synchronized void setInstancesInternal(List<OsAccountInstance> osAccountInstances) { + synchronized void setInstancesInternal(List<OsAccountInstance> osAccountInstances) { this.osAccountInstances = osAccountInstances; } - + /** * Get the account Object Id that is unique within the scope of the case. * @@ -279,8 +279,8 @@ public Optional<String> getAddr() { /** * Get the ID for the account realm. Get the Realm via - * OsAccountRealmManager.getRealmByRealmId() NOTE: The realm may get updated as - * more data is parsed, so listen for events to update as needed. + * OsAccountRealmManager.getRealmByRealmId() NOTE: The realm may get updated + * as more data is parsed, so listen for events to update as needed. * * @return */ @@ -439,9 +439,10 @@ public final class OsAccountAttribute extends AbstractAttribute { * @param valueInt Int value. * @param osAccount Account which the attribute pertains to. * @param host Host on which the attribute applies to. Pass - * Null if the attribute applies to all the hosts in - * the realm. - * @param sourceObj Source where the attribute was found, may be null. + * Null if the attribute applies to all the hosts + * in the realm. + * @param sourceObj Source where the attribute was found, may be + * null. */ public OsAccountAttribute(BlackboardAttribute.Type attributeType, int valueInt, OsAccount osAccount, Host host, Content sourceObj) { super(attributeType, valueInt); diff --git a/bindings/java/src/org/sleuthkit/datamodel/OsAccountInstance.java b/bindings/java/src/org/sleuthkit/datamodel/OsAccountInstance.java index 935b2217ba6eb4f97cafe421da2a76fc5d3256ec..aa9aa302c84ea27ba57981b4700a4b77fd65013f 100755 --- a/bindings/java/src/org/sleuthkit/datamodel/OsAccountInstance.java +++ b/bindings/java/src/org/sleuthkit/datamodel/OsAccountInstance.java @@ -61,7 +61,7 @@ public class OsAccountInstance implements Comparable<OsAccountInstance> { this.dataSourceId = dataSourceObjId; this.instanceType = instanceType; } - + /** * Construct the OsAccountInstance doing a lazy construction on the data * source object. @@ -174,16 +174,17 @@ public int hashCode() { */ public enum OsAccountInstanceType { LAUNCHED(0, bundle.getString("OsAccountInstanceType.Launched.text"), bundle.getString("OsAccountInstanceType.Launched.descr.text")), // the user launched a program on the host - ACCESSED(1, bundle.getString("OsAccountInstanceType.Accessed.text"), bundle.getString("OsAccountInstanceType.Accessed.descr.text")), // user accesed a resource for read/write - REFERENCED(2, bundle.getString("OsAccountInstanceType.Referenced.text"), bundle.getString("OsAccountInstanceType.Referenced.descr.text") ); // user was referenced, e.g. in a event log. + ACCESSED(1, bundle.getString("OsAccountInstanceType.Accessed.text"), bundle.getString("OsAccountInstanceType.Accessed.descr.text")), // user accesed a resource for read/write + REFERENCED(2, bundle.getString("OsAccountInstanceType.Referenced.text"), bundle.getString("OsAccountInstanceType.Referenced.descr.text")); // user was referenced, e.g. in a event log. private final int id; private final String name; private final String description; - OsAccountInstanceType(int id, String name, String description) { this.id = id; + OsAccountInstanceType(int id, String name, String description) { + this.id = id; this.name = name; - this.description = description ; + this.description = description; } /** @@ -203,7 +204,7 @@ public int getId() { public String getName() { return name; } - + /** * Get account instance type description. * diff --git a/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java b/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java index 8f59fc26639a2162ae3fe53d13ace997fdf781da..24d2ffcb41debf3a9389f042453b4460f5a26c69 100755 --- a/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java +++ b/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java @@ -45,7 +45,6 @@ /** * Responsible for creating/updating/retrieving the OS accounts for files and * artifacts. - * */ public final class OsAccountManager { @@ -162,7 +161,7 @@ public OsAccount newWindowsOsAccount(String sid, String loginName, String realmN if (!StringUtils.isBlank(sid) && !WindowsAccountUtils.isWindowsUserSid(sid)) { throw new OsAccountManager.NotUserSIDException(String.format("SID = %s is not a user SID.", sid)); } - + // get the realm for the account, and update it if it is missing addr or name. Optional<OsAccountRealm> realmOptional; try (CaseDbConnection connection = db.getConnection()) { @@ -270,9 +269,9 @@ private OsAccount newOsAccount(String uniqueId, String loginName, OsAccountRealm preparedStatement.setInt(6, accountStatus.getId()); connection.executeUpdate(preparedStatement); - - account = new OsAccount(db, osAccountObjId, realm.getRealmId(), loginName, uniqueId, signature, - null, null, null, accountStatus, OsAccount.OsAccountDbStatus.ACTIVE); + + account = new OsAccount(db, osAccountObjId, realm.getRealmId(), loginName, uniqueId, signature, + null, null, null, accountStatus, OsAccount.OsAccountDbStatus.ACTIVE); } finally { db.releaseSingleUserCaseWriteLock(); } @@ -604,7 +603,7 @@ void newOsAccountInstance(OsAccount osAccount, long dataSourceObjId, OsAccountIn List<OsAccountInstance> currentInstancesList = getOsAccountInstances(osAccount, connection); currentInstancesList.add(accountInstance); osAccount.setInstancesInternal(currentInstancesList); - + } catch (SQLException ex) { throw new TskCoreException(String.format("Error adding os account instance for account = %s, data source object id = %d", osAccount.getAddr().orElse(osAccount.getLoginName().orElse("UNKNOWN")), dataSourceObjId), ex); } finally { @@ -742,7 +741,7 @@ void mergeOsAccountsForRealms(OsAccountRealm sourceRealm, OsAccountRealm destRea * @throws TskCoreException */ private void mergeOsAccounts(OsAccount sourceAccount, OsAccount destAccount, CaseDbTransaction trans) throws TskCoreException { - + String query = ""; try (Statement s = trans.getConnection().createStatement()) { @@ -780,7 +779,7 @@ private void mergeOsAccounts(OsAccount sourceAccount, OsAccount destAccount, Cas + ", signature = '" + mergedSignature + "' " + " WHERE os_account_obj_id = " + sourceAccount.getId(); - s.executeUpdate(query); + s.executeUpdate(query); trans.registerDeletedOsAccount(sourceAccount.getId()); // Merge and update the destination account. Note that this must be done after updating @@ -815,25 +814,23 @@ private String makeOsAccountUpdateQuery(String tableName, OsAccount sourceAccoun } /** - * Copy all fields from sourceAccount that are not set in - * destAccount. - * + * Copy all fields from sourceAccount that are not set in destAccount. + * * Updates the dest account in the database. * * @param sourceAccount The source account. * @param destAccount The destination account. - * @param trans Transaction to use for database operations. - * + * @param trans Transaction to use for database operations. + * * @return OsAccount Updated account. */ - private OsAccount mergeOsAccountObjectsAndUpdateDestAccount(OsAccount sourceAccount, OsAccount destAccount, CaseDbTransaction trans) throws TskCoreException { - + private OsAccount mergeOsAccountObjectsAndUpdateDestAccount(OsAccount sourceAccount, OsAccount destAccount, CaseDbTransaction trans) throws TskCoreException { + OsAccount mergedDestAccount = destAccount; - + String destLoginName = null; String destAddr = null; - - + // Copy any fields that aren't set in the destination to the value from the source account. if (!destAccount.getLoginName().isPresent() && sourceAccount.getLoginName().isPresent()) { destLoginName = sourceAccount.getLoginName().get(); @@ -845,11 +842,11 @@ private OsAccount mergeOsAccountObjectsAndUpdateDestAccount(OsAccount sourceAcc // update the dest account core OsAccountUpdateResult updateStatus = this.updateOsAccountCore(destAccount, destAddr, destLoginName, trans); - + if (updateStatus.getUpdateStatusCode() == OsAccountUpdateStatus.UPDATED && updateStatus.getUpdatedAccount().isPresent()) { mergedDestAccount = updateStatus.getUpdatedAccount().get(); } - + String destFullName = null; Long destCreationTime = null; if (!destAccount.getFullName().isPresent() && sourceAccount.getFullName().isPresent()) { @@ -859,14 +856,14 @@ private OsAccount mergeOsAccountObjectsAndUpdateDestAccount(OsAccount sourceAcc if (!destAccount.getCreationTime().isPresent() && sourceAccount.getCreationTime().isPresent()) { destCreationTime = sourceAccount.getCreationTime().get(); } - + // update the dest account properties updateStatus = this.updateStandardOsAccountAttributes(destAccount, destFullName, null, null, destCreationTime, trans); - + if (updateStatus.getUpdateStatusCode() == OsAccountUpdateStatus.UPDATED && updateStatus.getUpdatedAccount().isPresent()) { mergedDestAccount = updateStatus.getUpdatedAccount().get(); } - + return mergedDestAccount; } @@ -972,8 +969,6 @@ public Optional<OsAccount> getWindowsOsAccount(String sid, String loginName, Str return this.getOsAccountByLoginName(loginName, realm.get()); } - - /** * Adds a rows to the tsk_os_account_attributes table for the given set of * attribute. @@ -984,7 +979,7 @@ public Optional<OsAccount> getWindowsOsAccount(String sid, String loginName, Str * @throws TskCoreException */ public void addExtendedOsAccountAttributes(OsAccount account, List<OsAccountAttribute> accountAttributes) throws TskCoreException { - + synchronized (account) { // synchronized to prevent multiple threads trying to add osAccount attributes concurrently to the same osAccount. db.acquireSingleUserCaseWriteLock(); @@ -1124,9 +1119,9 @@ List<OsAccountAttribute> getOsAccountAttributes(OsAccount account) throws TskCor List<OsAccountInstance> getOsAccountInstances(OsAccount account) throws TskCoreException { try (CaseDbConnection connection = db.getConnection()) { return getOsAccountInstances(account, connection); - } + } } - + /** * Get a list of OsAccountInstances for the give OsAccount. * @@ -1138,12 +1133,12 @@ List<OsAccountInstance> getOsAccountInstances(OsAccount account) throws TskCoreE * * @throws TskCoreException */ - private List<OsAccountInstance> getOsAccountInstances(OsAccount account, CaseDbConnection connection ) throws TskCoreException { + private List<OsAccountInstance> getOsAccountInstances(OsAccount account, CaseDbConnection connection) throws TskCoreException { List<OsAccountInstance> instanceList = new ArrayList<>(); String queryString = String.format("SELECT * FROM tsk_os_account_instances WHERE os_account_obj_id = %d", account.getId()); db.acquireSingleUserCaseReadLock(); - try ( Statement s = connection.createStatement(); + try (Statement s = connection.createStatement(); ResultSet rs = connection.executeQuery(s, queryString)) { while (rs.next()) { @@ -1160,8 +1155,7 @@ private List<OsAccountInstance> getOsAccountInstances(OsAccount account, CaseDbC return instanceList; } - - + /** * Updates the properties of the specified account in the database. * @@ -1183,10 +1177,10 @@ public OsAccountUpdateResult updateStandardOsAccountAttributes(OsAccount osAccou CaseDbTransaction trans = db.beginTransaction(); try { OsAccountUpdateResult updateStatus = updateStandardOsAccountAttributes(osAccount, fullName, accountType, accountStatus, creationTime, trans); - + trans.commit(); trans = null; - + return updateStatus; } finally { if (trans != null) { @@ -1196,8 +1190,7 @@ public OsAccountUpdateResult updateStandardOsAccountAttributes(OsAccount osAccou } /** - * Updates the properties of the specified account in the - * database. + * Updates the properties of the specified account in the database. * * A column is updated only if a non-null value has been specified. * @@ -1258,18 +1251,18 @@ OsAccountUpdateResult updateStandardOsAccountAttributes(OsAccount osAccount, Str } } - /** - * Updates specified column in the tsk_os_accounts table to the specified value. - * - * @param <T> Type of value - must be a String, Long or an Integer. + * Updates specified column in the tsk_os_accounts table to the specified + * value. + * + * @param <T> Type of value - must be a String, Long or an Integer. * @param accountObjId Object id of the account to be updated. - * @param colName Name of column o be updated. - * @param colValue New column value. - * @param connection Database connection to use. - * - * @throws SQLException If there is an error updating the database. - * @throws TskCoreException If the value type is not handled. + * @param colName Name of column o be updated. + * @param colValue New column value. + * @param connection Database connection to use. + * + * @throws SQLException If there is an error updating the database. + * @throws TskCoreException If the value type is not handled. */ private <T> void updateAccountColumn(long accountObjId, String colName, T colValue, CaseDbConnection connection) throws SQLException, TskCoreException { @@ -1303,7 +1296,7 @@ private <T> void updateAccountColumn(long accountObjId, String colName, T colVal db.releaseSingleUserCaseWriteLock(); } } - + /** * Updates the signature of the specified account, if the db status of the * account is active. @@ -1317,25 +1310,25 @@ private <T> void updateAccountColumn(long accountObjId, String colName, T colVal private void updateAccountSignature(long accountObjId, String signature, CaseDbConnection connection) throws SQLException { String updateSQL = "UPDATE tsk_os_accounts SET " - + " signature = " - + " CASE WHEN db_status = " + OsAccount.OsAccountDbStatus.ACTIVE.getId() + " THEN ? ELSE signature END " - + " WHERE os_account_obj_id = ?"; // 8 + + " signature = " + + " CASE WHEN db_status = " + OsAccount.OsAccountDbStatus.ACTIVE.getId() + " THEN ? ELSE signature END " + + " WHERE os_account_obj_id = ?"; // 8 PreparedStatement preparedStatement = connection.getPreparedStatement(updateSQL, Statement.NO_GENERATED_KEYS); preparedStatement.clearParameters(); preparedStatement.setString(1, signature); preparedStatement.setLong(2, accountObjId); - + connection.executeUpdate(preparedStatement); } - + /** * Update the address and/or login name for the specified account in the * database. Also update the realm addr/name if needed. - * - * A column is updated only if its current value is null and a - * non-null value has been specified. + * + * A column is updated only if its current value is null and a non-null + * value has been specified. * * * @param osAccount OsAccount that needs to be updated in the database. @@ -1345,7 +1338,7 @@ private void updateAccountSignature(long accountObjId, String signature, CaseDbC * @param referringHost Host. * * @return OsAccountUpdateResult Account update status, and the updated - account. + * account. * * @throws TskCoreException If there is a database error or if the updated * information conflicts with an existing account. @@ -1364,9 +1357,7 @@ public OsAccountUpdateResult updateCoreWindowsOsAccountAttributes(OsAccount osAc } } } - - - + /** * Update the address and/or login name for the specified account in the * database. Also update the realm addr/name if needed. @@ -1374,31 +1365,31 @@ public OsAccountUpdateResult updateCoreWindowsOsAccountAttributes(OsAccount osAc * A column is updated only if it's current value is null and a non-null * value has been specified. * - * @param osAccount OsAccount that needs to be updated in the database. + * @param osAccount OsAccount that needs to be updated in the database. * @param accountSid Account SID, may be null. - * @param loginName Login name, may be null. - * @param realmName Account realm name. May be null if accountSid is not null. + * @param loginName Login name, may be null. + * @param realmName Account realm name. May be null if accountSid is not + * null. * * @return OsAccountUpdateResult Account update status, and the updated - account. + * account. * * @throws TskCoreException If there is a database error or if the updated * information conflicts with an existing account. */ private OsAccountUpdateResult updateCoreWindowsOsAccountAttributes(OsAccount osAccount, String accountSid, String loginName, String realmName, Host referringHost, CaseDbTransaction trans) throws TskCoreException, NotUserSIDException { - + // first get and update the realm - if we have the info to find the realm - if ( !StringUtils.isBlank(accountSid) || !StringUtils.isBlank(realmName) ) { + if (!StringUtils.isBlank(accountSid) || !StringUtils.isBlank(realmName)) { db.getOsAccountRealmManager().getAndUpdateWindowsRealm(accountSid, realmName, referringHost, trans.getConnection()); } - + // now update the account core data OsAccountUpdateResult updateStatus = this.updateOsAccountCore(osAccount, accountSid, loginName, trans); - + return updateStatus; } - /** * Update the address and/or login name for the specified account in the * database. @@ -1416,7 +1407,7 @@ private OsAccountUpdateResult updateCoreWindowsOsAccountAttributes(OsAccount osA * @param loginName Login name, may be null. * * @return OsAccountUpdateResult Account update status, and the updated - account. + * account. * * @throws TskCoreException If there is a database error or if the updated * information conflicts with an existing account. @@ -1521,7 +1512,7 @@ public List<Host> getHosts(OsAccount account) throws TskCoreException { * @throws SQLException */ private OsAccount osAccountFromResultSet(ResultSet rs) throws SQLException { - + OsAccountType accountType = null; int typeId = rs.getInt("type"); if (!rs.wasNull()) { @@ -1534,8 +1525,8 @@ private OsAccount osAccountFromResultSet(ResultSet rs) throws SQLException { } return new OsAccount(db, rs.getLong("os_account_obj_id"), rs.getLong("realm_id"), rs.getString("login_name"), rs.getString("addr"), - rs.getString("signature"), rs.getString("full_name"), creationTime, accountType, OsAccount.OsAccountStatus.fromID(rs.getInt("status")), - OsAccount.OsAccountDbStatus.fromID(rs.getInt("db_status"))); + rs.getString("signature"), rs.getString("full_name"), creationTime, accountType, OsAccount.OsAccountStatus.fromID(rs.getInt("status")), + OsAccount.OsAccountDbStatus.fromID(rs.getInt("db_status"))); } @@ -1610,25 +1601,26 @@ public NotUserSIDException(String msg, Exception ex) { super(msg, ex); } } - + /** * Status of an account update. */ public enum OsAccountUpdateStatus { - NO_CHANGE, /// no change was made to account. - UPDATED, /// account was updated + NO_CHANGE, /// no change was made to account. + UPDATED, /// account was updated MERGED /// account update triggered a merge } - + /** - * Container that encapsulates the account update status and the updated account. + * Container that encapsulates the account update status and the updated + * account. */ public final static class OsAccountUpdateResult { - + private final OsAccountUpdateStatus updateStatus; private final OsAccount updatedAccount; - + OsAccountUpdateResult(OsAccountUpdateStatus updateStatus, OsAccount updatedAccount) { this.updateStatus = updateStatus; this.updatedAccount = updatedAccount; diff --git a/bindings/java/src/org/sleuthkit/datamodel/Person.java b/bindings/java/src/org/sleuthkit/datamodel/Person.java index cf3b366dd43c700f83bf59a19d79961a4c423dfc..0d3e94230f92d3c37dc80408742d1cf2cd00d4a1 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/Person.java +++ b/bindings/java/src/org/sleuthkit/datamodel/Person.java @@ -50,17 +50,16 @@ public long getPersonId() { public String getName() { return name; } - + /** - * Sets the name for the person. - * Does not update the database. + * Sets the name for the person. Does not update the database. * * @param newName The new name. */ public void setName(String newName) { this.name = newName; - } - + } + @Override public int hashCode() { int hash = 5; @@ -93,5 +92,4 @@ public boolean equals(Object obj) { return true; } - } diff --git a/bindings/java/src/org/sleuthkit/datamodel/PersonManager.java b/bindings/java/src/org/sleuthkit/datamodel/PersonManager.java index a0153c78a50b424acf09c3ad401dd385702c27dc..0b7c568cc7c1f815810eadd73d6e4ad39876b8d7 100755 --- a/bindings/java/src/org/sleuthkit/datamodel/PersonManager.java +++ b/bindings/java/src/org/sleuthkit/datamodel/PersonManager.java @@ -32,7 +32,6 @@ /** * Responsible for creating/updating/retrieving Persons. - * */ public final class PersonManager { @@ -270,7 +269,7 @@ public Person newPerson(String name) throws TskCoreException { */ public List<Host> getHostsForPerson(Person person) throws TskCoreException { String whereStatement = (person == null) ? " WHERE person_id IS NULL " : " WHERE person_id = " + person.getPersonId(); - whereStatement += " AND db_status = " + Host.HostDbStatus.ACTIVE.getId(); + whereStatement += " AND db_status = " + Host.HostDbStatus.ACTIVE.getId(); String queryString = "SELECT * FROM tsk_hosts " + whereStatement; @@ -323,7 +322,7 @@ private Optional<Person> getPerson(String name, CaseDbConnection connection) thr throw new TskCoreException(String.format("Error getting person with name = %s", name), ex); } } - + /** * Get person for the given host or empty if no associated person. * @@ -356,7 +355,7 @@ public Optional<Person> getPerson(Host host) throws TskCoreException { db.releaseSingleUserCaseReadLock(); } } - + /** * Set host's parent person. * @@ -386,7 +385,7 @@ public void setPerson(Host host, Person person) throws TskCoreException { } db.getPersonManager().fireChangeEvent(person); - } + } /** * Fires an event when a person is created. diff --git a/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java b/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java index 2d7c98265b8b3cd6c24b30943cc7633d2552b82a..3b36df70a98bc1761ff2282b74c218a03b4dae5f 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java +++ b/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java @@ -125,7 +125,7 @@ default SortedSet<? extends TimelineEventType> getSiblings() { @Override default int compareTo(TimelineEventType otherType) { - return Comparator.comparing(TimelineEventType::getTypeID).compare(this, otherType); + return Comparator.comparing(TimelineEventType::getDisplayName).compare(this, otherType); } /** @@ -181,9 +181,18 @@ private HierarchyLevel(String displayName) { TimelineEventType ROOT_EVENT_TYPE = new TimelineEventTypeImpl(0, getBundle().getString("RootEventType.eventTypes.name"), // NON-NLS HierarchyLevel.ROOT, null) { + @Override public SortedSet< TimelineEventType> getChildren() { - return ImmutableSortedSet.of(FILE_SYSTEM, WEB_ACTIVITY, MISC_TYPES, CUSTOM_TYPES); + ImmutableSortedSet.Builder<TimelineEventType> builder = ImmutableSortedSet.orderedBy(new Comparator<TimelineEventType>() { + @Override + public int compare(TimelineEventType o1, TimelineEventType o2) { + return ((Long) o1.getTypeID()).compareTo(o2.getTypeID()); + } + }); + + builder.add(FILE_SYSTEM, WEB_ACTIVITY, MISC_TYPES, CUSTOM_TYPES); + return builder.build(); } }; @@ -218,14 +227,7 @@ public SortedSet< TimelineEventType> getChildren() { HierarchyLevel.CATEGORY, ROOT_EVENT_TYPE) { @Override public SortedSet<TimelineEventType> getChildren() { - ImmutableSortedSet.Builder<TimelineEventType> builder = ImmutableSortedSet.orderedBy(new Comparator<TimelineEventType>() { - @Override - public int compare(TimelineEventType o1, TimelineEventType o2) { - return o1.getDisplayName().compareTo(o2.getDisplayName()); - } - }); - - builder.add(CALL_LOG, CALL_LOG_END, DEVICES_ATTACHED, EMAIL, EMAIL_RCVD, + return ImmutableSortedSet.of(CALL_LOG, CALL_LOG_END, DEVICES_ATTACHED, EMAIL, EMAIL_RCVD, EXIF, GPS_BOOKMARK, GPS_LAST_KNOWN_LOCATION, GPS_TRACKPOINT, GPS_ROUTE, GPS_SEARCH, GPS_TRACK, INSTALLED_PROGRAM, LOG_ENTRY, MESSAGE, METADATA_LAST_PRINTED, METADATA_LAST_SAVED, METADATA_CREATED, PROGRAM_EXECUTION, @@ -236,7 +238,6 @@ public int compare(TimelineEventType o1, TimelineEventType o2) { SERVICE_ACCOUNT, SCREEN_SHOT, PROGRAM_NOTIFICATION, BLUETOOTH_PAIRING_ACCESSED, BLUETOOTH_ADAPTER); - return builder.build(); } }; diff --git a/bindings/java/src/org/sleuthkit/datamodel/TskDataSourceEvent.java b/bindings/java/src/org/sleuthkit/datamodel/TskDataSourceEvent.java index f276502a142d4d8e69a07b12c0ffef390a4ca42f..f27c48a54144a3e168bc19071d687463ef7fc3ec 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/TskDataSourceEvent.java +++ b/bindings/java/src/org/sleuthkit/datamodel/TskDataSourceEvent.java @@ -1,15 +1,15 @@ /* * Sleuth Kit Data Model - * - * Copyright 2020 Basis Technology Corp. + * + * Copyright 2020-2021 Basis Technology Corp. * Contact: carrier <at> sleuthkit <dot> org - * + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -21,7 +21,6 @@ import java.util.Optional; /** - * * Defines an interface implemented by data source specific events published by * Sleuthkit. These events are applicable to single data source. */ diff --git a/bindings/java/src/org/sleuthkit/datamodel/UnsupportedContent.java b/bindings/java/src/org/sleuthkit/datamodel/UnsupportedContent.java index 2c49f6b66f37f50765fa4eadd1943a6fb7eb8f20..d9bbca1bdd7b59ada02ad29b51d762789b4ceedd 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/UnsupportedContent.java +++ b/bindings/java/src/org/sleuthkit/datamodel/UnsupportedContent.java @@ -1,15 +1,15 @@ /* * Sleuth Kit Data Model - * + * * Copyright 2021 Basis Technology Corp. * Contact: carrier <at> sleuthkit <dot> org - * + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -19,18 +19,18 @@ package org.sleuthkit.datamodel; /** - * This content type is used as a default when the object type from the tsk_objects - * table is not present in the TskData.ObjectType enum. This should only come into play - * when loading case databases created by a newer version of Autopsy. + * This content type is used as a default when the object type from the + * tsk_objects table is not present in the TskData.ObjectType enum. This should + * only come into play when loading case databases created by a newer version of + * Autopsy. */ public class UnsupportedContent extends AbstractContent { - + /** - * Create an UnsupportedContent object. - * Only store the object id. + * Create an UnsupportedContent object. Only store the object id. * - * @param db case database handle - * @param obj_id object id + * @param db case database handle + * @param obj_id object id */ protected UnsupportedContent(SleuthkitCase db, long obj_id) { super(db, obj_id, "Unsupported Content");