From 34a2fb13940ae9e8cc8bfcb4282e17c6e1810268 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 23 May 2019 15:37:45 -0400 Subject: [PATCH 1/5] 5056 adjust comments and messages to reflect limit to other cases --- .../centralrepository/eventlisteners/IngestEventsListener.java | 2 +- .../autopsy/centralrepository/ingestmodule/Bundle.properties | 2 +- .../autopsy/centralrepository/ingestmodule/IngestSettings.java | 2 +- .../centralrepository/ingestmodule/IngestSettingsPanel.form | 2 +- .../centralrepository/ingestmodule/IngestSettingsPanel.java | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 37f0f595cb..5e600a7cb0 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -171,7 +171,7 @@ public class IngestEventsListener { } /** - * Configure the listener to flag previously seen devices or not. + * Configure the listener to flag devices previously seen in other cases or not. * * @param value True to flag seen devices; otherwise false. */ diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties index 8b12289af0..8ca571695b 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties @@ -1,4 +1,4 @@ IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable -IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag previously seen devices +IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases IngestSettingsPanel.createCorrelationPropertiesCheckbox.text=Save items to the Central Repository diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java index 454a2c3628..c48f2811a0 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java @@ -70,7 +70,7 @@ final class IngestSettings implements IngestModuleIngestJobSettings { } /** - * Are previously seen devices to be flagged? + * Are devices previously seen in other cases to be flagged? * * @return True if flagging; otherwise false. */ diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form index 82383f135f..b7c9224fd1 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form @@ -29,7 +29,7 @@ - + diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java index 6438b399e7..602d47fc83 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java @@ -88,7 +88,7 @@ final class IngestSettingsPanel extends IngestModuleIngestJobSettingsPanel { .addComponent(flagTaggedNotableItemsCheckbox, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) .addComponent(flagPreviouslySeenDevicesCheckbox, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) .addComponent(createCorrelationPropertiesCheckbox, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)))) - .addContainerGap(65, Short.MAX_VALUE)) + .addContainerGap(47, Short.MAX_VALUE)) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) From 6b3b2b5cf58c9c786320be51644bb6824274f4dc Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 23 May 2019 15:43:20 -0400 Subject: [PATCH 2/5] 5056 initial condition modification to prevent devices seen in current case from being flagged --- .../centralrepository/eventlisteners/IngestEventsListener.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 5e600a7cb0..4f937e30bf 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -482,7 +482,7 @@ public class IngestEventsListener { LOGGER.log(Level.INFO, String.format("Unable to flag notable item: %s.", eamArtifact.toString()), ex); } } - if (flagPreviousItemsEnabled + if (flagPreviousItemsEnabled && !eamArtifact.getCorrelationCase().getCaseUUID().equals(Case.getCurrentCase().getName()) && (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.USBID_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.ICCID_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.IMEI_TYPE_ID From 7b9840867a127a4a55f4761472cffdea9fa8cf87 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 23 May 2019 16:20:41 -0400 Subject: [PATCH 3/5] 5056 add updated merged bundle file --- .../centralrepository/ingestmodule/Bundle.properties-MERGED | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED index 876bfe7086..2e709858d8 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/Bundle.properties-MERGED @@ -12,5 +12,5 @@ CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine IngestSettingsPanel.ingestSettingsLabel.text=Ingest Settings IngestSettingsPanel.flagTaggedNotableItemsCheckbox.text=Flag items previously tagged as notable -IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag previously seen devices +IngestSettingsPanel.flagPreviouslySeenDevicesCheckbox.text=Flag devices previously seen in other cases IngestSettingsPanel.createCorrelationPropertiesCheckbox.text=Save items to the Central Repository From d0446c604e126495f58f5391f0b8cdb8b75945e5 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 23 May 2019 16:51:37 -0400 Subject: [PATCH 4/5] 5056 second try at limiting alerts for previously seen items to other cases --- .../eventlisteners/IngestEventsListener.java | 33 +++++++++++-------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 4f937e30bf..58bf031359 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -171,7 +171,8 @@ public class IngestEventsListener { } /** - * Configure the listener to flag devices previously seen in other cases or not. + * Configure the listener to flag devices previously seen in other cases or + * not. * * @param value True to flag seen devices; otherwise false. */ @@ -318,7 +319,7 @@ public class IngestEventsListener { LOGGER.log(Level.SEVERE, "Failed to connect to Central Repository database.", ex); return; } - + switch (IngestManager.IngestJobEvent.valueOf(evt.getPropertyName())) { case DATA_SOURCE_ANALYSIS_COMPLETED: { jobProcessingExecutor.submit(new AnalysisCompleteTask(dbManager, evt)); @@ -332,10 +333,10 @@ public class IngestEventsListener { } private final class AnalysisCompleteTask implements Runnable { - + private final EamDb dbManager; private final PropertyChangeEvent event; - + private AnalysisCompleteTask(EamDb db, PropertyChangeEvent evt) { dbManager = db; event = evt; @@ -361,15 +362,15 @@ public class IngestEventsListener { long dataSourceObjectId = -1; try { dataSource = ((DataSourceAnalysisCompletedEvent) event).getDataSource(); - + /* - * We only care about Images for the purpose of - * updating hash values. + * We only care about Images for the purpose of updating hash + * values. */ if (!(dataSource instanceof Image)) { return; } - + dataSourceName = dataSource.getName(); dataSourceObjectId = dataSource.getId(); @@ -397,7 +398,7 @@ public class IngestEventsListener { if (StringUtils.equals(imageMd5Hash, crMd5Hash) == false) { correlationDataSource.setMd5(imageMd5Hash); } - + String imageSha1Hash = image.getSha1(); if (imageSha1Hash == null) { imageSha1Hash = ""; @@ -406,7 +407,7 @@ public class IngestEventsListener { if (StringUtils.equals(imageSha1Hash, crSha1Hash) == false) { correlationDataSource.setSha1(imageSha1Hash); } - + String imageSha256Hash = image.getSha256(); if (imageSha256Hash == null) { imageSha256Hash = ""; @@ -482,16 +483,20 @@ public class IngestEventsListener { LOGGER.log(Level.INFO, String.format("Unable to flag notable item: %s.", eamArtifact.toString()), ex); } } - if (flagPreviousItemsEnabled && !eamArtifact.getCorrelationCase().getCaseUUID().equals(Case.getCurrentCase().getName()) + if (flagPreviousItemsEnabled && (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.USBID_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.ICCID_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.IMEI_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.IMSI_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.MAC_TYPE_ID)) { try { - Long countPreviousOccurences = dbManager.getCountArtifactInstancesByTypeValue(eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue()); - if (countPreviousOccurences > 0) { - postCorrelatedPreviousArtifactToBlackboard(bbArtifact); + //only alert to previous instances when they were in another case + List previousOccurences = dbManager.getArtifactInstancesByTypeValue(eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue()); + for (CorrelationAttributeInstance instance : previousOccurences) { + if (!instance.getCorrelationCase().getCaseUUID().equals(eamArtifact.getCorrelationCase().getCaseUUID())) { + postCorrelatedPreviousArtifactToBlackboard(bbArtifact); + break; + } } } catch (CorrelationAttributeNormalizationException ex) { LOGGER.log(Level.INFO, String.format("Unable to flag notable item: %s.", eamArtifact.toString()), ex); From f756cc540ecc007dbd2d12254db464ff7b6147b8 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Thu, 23 May 2019 17:48:40 -0400 Subject: [PATCH 5/5] 5056 undo accidental changes to settings panel size --- .../centralrepository/ingestmodule/IngestSettingsPanel.form | 2 +- .../centralrepository/ingestmodule/IngestSettingsPanel.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form index b7c9224fd1..82383f135f 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.form @@ -29,7 +29,7 @@ - + diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java index 602d47fc83..6438b399e7 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettingsPanel.java @@ -88,7 +88,7 @@ final class IngestSettingsPanel extends IngestModuleIngestJobSettingsPanel { .addComponent(flagTaggedNotableItemsCheckbox, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) .addComponent(flagPreviouslySeenDevicesCheckbox, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) .addComponent(createCorrelationPropertiesCheckbox, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)))) - .addContainerGap(47, Short.MAX_VALUE)) + .addContainerGap(65, Short.MAX_VALUE)) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)