diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 37f0f595cb..58bf031359 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -171,7 +171,8 @@ public class IngestEventsListener { } /** - * Configure the listener to flag previously seen devices or not. + * Configure the listener to flag devices previously seen in other cases or + * not. * * @param value True to flag seen devices; otherwise false. */ @@ -318,7 +319,7 @@ public class IngestEventsListener { LOGGER.log(Level.SEVERE, "Failed to connect to Central Repository database.", ex); return; } - + switch (IngestManager.IngestJobEvent.valueOf(evt.getPropertyName())) { case DATA_SOURCE_ANALYSIS_COMPLETED: { jobProcessingExecutor.submit(new AnalysisCompleteTask(dbManager, evt)); @@ -332,10 +333,10 @@ public class IngestEventsListener { } private final class AnalysisCompleteTask implements Runnable { - + private final EamDb dbManager; private final PropertyChangeEvent event; - + private AnalysisCompleteTask(EamDb db, PropertyChangeEvent evt) { dbManager = db; event = evt; @@ -361,15 +362,15 @@ public class IngestEventsListener { long dataSourceObjectId = -1; try { dataSource = ((DataSourceAnalysisCompletedEvent) event).getDataSource(); - + /* - * We only care about Images for the purpose of - * updating hash values. + * We only care about Images for the purpose of updating hash + * values. */ if (!(dataSource instanceof Image)) { return; } - + dataSourceName = dataSource.getName(); dataSourceObjectId = dataSource.getId(); @@ -397,7 +398,7 @@ public class IngestEventsListener { if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false) { correlationDataSource.setMd5(imageMd5Hash); } - + String imageSha1Hash = image.getSha1(); if (imageSha1Hash == null) { imageSha1Hash = ""; @@ -406,7 +407,7 @@ public class IngestEventsListener { if (StringUtils.equals(imageSha1Hash, crSha1Hash) == false) { correlationDataSource.setSha1(imageSha1Hash); } - + String imageSha256Hash = image.getSha256(); if (imageSha256Hash == null) { imageSha256Hash = ""; @@ -489,9 +490,13 @@ public class IngestEventsListener { || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.IMSI_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.MAC_TYPE_ID)) { try { - Long countPreviousOccurences = dbManager.getCountArtifactInstancesByTypeValue(eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue()); - if (countPreviousOccurences > 0) { - postCorrelatedPreviousArtifactToBlackboard(bbArtifact); + //only alert to previous instances when they were in another case + List previousOccurences = dbManager.getArtifactInstancesByTypeValue(eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue()); + for (CorrelationAttributeInstance instance : previousOccurences) { + if (!instance.getCorrelationCase().getCaseUUID().equals(eamArtifact.getCorrelationCase().getCaseUUID())) { + postCorrelatedPreviousArtifactToBlackboard(bbArtifact); + break; + } } } catch (CorrelationAttributeNormalizationException ex) { LOGGER.log(Level.INFO, String.format("Unable to flag notable item: %s.", eamArtifact.toString()), ex); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties index 8b12289af0..8ca571695b 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties @@ -1,4 +1,4 @@ IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable -IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag previously seen devices +IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases IngestSettingsPanel.createCorrelationPropertiesCheckbox.text=Save items to the Central Repository diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED index 876bfe7086..2e709858d8 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED @@ -12,5 +12,5 @@ CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable -IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag previously seen devices +IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases IngestSettingsPanel.createCorrelationPropertiesCheckbox.text=Save items to the Central Repository diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java index 454a2c3628..c48f2811a0 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java @@ -70,7 +70,7 @@ final class IngestSettings implements IngestModuleIngestJobSettings { } /** - * Are previously seen devices to be flagged? + * Are devices previously seen in other cases to be flagged? * * @return True if flagging; otherwise false. */