From d6f3e79b47816217c8baafb1e7eb228506dbd89f Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Tue, 24 Jul 2018 15:50:02 -0700 Subject: [PATCH 01/17] 4070 wip --- .../datamodel/AbstractSqlEamDb.java | 41 ++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index a81e336fac..4b7b49f7e8 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -1898,12 +1898,51 @@ abstract class AbstractSqlEamDb implements EamDb { /** * Process the Artifact instance in the EamDb * + * @param type EamArtifact.Type to search for + * @param instanceTableCallback callback to process the instance + * + * @throws EamDbException + */ + @Override + public void processInstanceTable(CorrelationAttribute.Type type, InstanceTableCallback instanceTableCallback) throws EamDbException { + if (type == null) { + throw new EamDbException("Correlation type is null"); + } + + if (instanceTableCallback == null) { + throw new EamDbException("Callback interface is null"); + } + + Connection conn = connect(); + PreparedStatement preparedStatement = null; + ResultSet resultSet = null; + String tableName = EamDbUtil.correlationTypeToInstanceTableName(type); + StringBuilder sql = new StringBuilder(); + sql.append("select * from "); + sql.append(tableName); + + try { + preparedStatement = conn.prepareStatement(sql.toString()); + resultSet = preparedStatement.executeQuery(); + instanceTableCallback.process(resultSet); + } catch (SQLException ex) { + throw new EamDbException("Error getting all artifact instances from instances table", ex); + } finally { + EamDbUtil.closeStatement(preparedStatement); + EamDbUtil.closeResultSet(resultSet); + EamDbUtil.closeConnection(conn); + } + } + + /** + * Process the Artifact instance in the EamDb + * * @param type EamArtifact.Type to search for * @param instanceTableCallback callback to process the instance * @throws EamDbException */ @Override - public void processInstanceTableRow(CorrelationAttribute.Type type, int id, InstanceTableCallback instanceTableCallback) throws EamDbException { + public void processInstanceTableWhere(CorrelationAttribute.Type type, String whereClause, InstanceTableCallback instanceTableCallback) throws EamDbException { if (type == null) { throw new EamDbException("Correlation type is null"); } From 23f48b0d33774ad3c0ea35e82845d6b1c7c0bb29 Mon Sep 17 00:00:00 2001 From: Brian Sweeney Date: Thu, 26 Jul 2018 08:29:09 -0600 Subject: [PATCH 02/17] cleanup --- .../InterCaseCommonAttributeSearcher.java | 42 +++++++------------ 1 file changed, 16 insertions(+), 26 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java index 6a1ffb5114..835a5e467b 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java @@ -22,11 +22,9 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.HashMap; import java.util.List; import java.util.Map; -import java.util.logging.Level; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; -import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.LOGGER; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.HashUtility; @@ -72,33 +70,25 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS continue; } Map fileCache = new HashMap<>(); + + // we don't *have* all the information for the rows in the CR, + // so we need to consult the present case via the SleuthkitCase object + // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. - try { - int caseId = commonFileCases.get(commonAttrId); - CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); - final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); - // we don't *have* all the information for the rows in the CR, - // so we need to consult the present case via the SleuthkitCase object - // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. + if (interCaseCommonFiles.containsKey(md5)) { + //Add to intercase metaData + final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); - if (interCaseCommonFiles.containsKey(md5)) { - //Add to intercase metaData - final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); - - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); - commonAttributeValue.addFileInstanceMetadata(searchResult); + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); + commonAttributeValue.addFileInstanceMetadata(searchResult); - } else { - CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); - interCaseCommonFiles.put(md5, commonAttributeValue); - - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); - commonAttributeValue.addFileInstanceMetadata(searchResult); - - } - } catch (Exception ex) { - LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS - } + } else { + CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); + interCaseCommonFiles.put(md5, commonAttributeValue); + + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); + commonAttributeValue.addFileInstanceMetadata(searchResult); + } } Map> instanceCollatedCommonFiles = collateMatchesByNumberOfInstances(interCaseCommonFiles); From c30ed1f25113e595f32e9bee5df8fe57d021621c Mon Sep 17 00:00:00 2001 From: Brian Sweeney Date: Thu, 26 Jul 2018 08:56:46 -0600 Subject: [PATCH 03/17] build script modified to include intercase correleation test data --- Core/build.xml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Core/build.xml b/Core/build.xml index af90bfdbba..14a6a5a28c 100644 --- a/Core/build.xml +++ b/Core/build.xml @@ -97,12 +97,12 @@ - + + + + + + From 08ad7eeba13c4780e30d2a63316cf4f26b106894 Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Thu, 26 Jul 2018 12:07:27 -0700 Subject: [PATCH 04/17] remove EamDb publicly accessible methods, replace with a single generic processInstanceTableWhere mmethod which takes a query string. --- .../datamodel/AbstractSqlEamDb.java | 151 +----------------- .../centralrepository/datamodel/EamDb.java | 26 +-- .../datamodel/SqliteEamDb.java | 47 +----- .../InterCaseSearchResultsProcessor.java | 23 ++- 4 files changed, 32 insertions(+), 215 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index 4b7b49f7e8..e6dd3a0ccd 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -752,6 +752,7 @@ abstract class AbstractSqlEamDb implements EamDb { return artifactInstances; } + /** * Retrieves eamArtifact instances from the database that are associated * with the aType and filePath @@ -1894,51 +1895,13 @@ abstract class AbstractSqlEamDb implements EamDb { EamDbUtil.closeConnection(conn); } } - - /** - * Process the Artifact instance in the EamDb - * - * @param type EamArtifact.Type to search for - * @param instanceTableCallback callback to process the instance - * - * @throws EamDbException - */ - @Override - public void processInstanceTable(CorrelationAttribute.Type type, InstanceTableCallback instanceTableCallback) throws EamDbException { - if (type == null) { - throw new EamDbException("Correlation type is null"); - } - if (instanceTableCallback == null) { - throw new EamDbException("Callback interface is null"); - } - - Connection conn = connect(); - PreparedStatement preparedStatement = null; - ResultSet resultSet = null; - String tableName = EamDbUtil.correlationTypeToInstanceTableName(type); - StringBuilder sql = new StringBuilder(); - sql.append("select * from "); - sql.append(tableName); - - try { - preparedStatement = conn.prepareStatement(sql.toString()); - resultSet = preparedStatement.executeQuery(); - instanceTableCallback.process(resultSet); - } catch (SQLException ex) { - throw new EamDbException("Error getting all artifact instances from instances table", ex); - } finally { - EamDbUtil.closeStatement(preparedStatement); - EamDbUtil.closeResultSet(resultSet); - EamDbUtil.closeConnection(conn); - } - } - /** - * Process the Artifact instance in the EamDb + * Process the Artifact instance in the EamDb give a where clause * * @param type EamArtifact.Type to search for * @param instanceTableCallback callback to process the instance + * @param whereClause query string to execute * @throws EamDbException */ @Override @@ -1958,115 +1921,11 @@ abstract class AbstractSqlEamDb implements EamDb { StringBuilder sql = new StringBuilder(3); sql.append("select * from "); sql.append(tableName); - sql.append(" WHERE id = ?"); + sql.append(" WHERE "); + sql.append(whereClause); try { preparedStatement = conn.prepareStatement(sql.toString()); - preparedStatement.setInt(1, id); - resultSet = preparedStatement.executeQuery(); - instanceTableCallback.process(resultSet); - } catch (SQLException ex) { - throw new EamDbException("Error getting all artifact instances from instances table", ex); - } finally { - EamDbUtil.closeStatement(preparedStatement); - EamDbUtil.closeResultSet(resultSet); - EamDbUtil.closeConnection(conn); - } - } - - /** - * Process the Artifact instance in the EamDb - * - * @param type EamArtifact.Type to search for - * @param correlationCase CorrelationCase to filter by - * @param instanceTableCallback callback to process the instance - * @throws EamDbException - */ - @Override - public void processCaseInstancesTable(CorrelationAttribute.Type type, CorrelationCase correlationCase, InstanceTableCallback instanceTableCallback) throws EamDbException { - if (type == null) { - throw new EamDbException("Correlation type is null"); - } - - if (instanceTableCallback == null) { - throw new EamDbException("Callback interface is null"); - } - - if(correlationCase == null) { - throw new EamDbException("Correlation Case is null"); - } - - Connection conn = connect(); - PreparedStatement preparedStatement = null; - ResultSet resultSet = null; - String tableName = EamDbUtil.correlationTypeToInstanceTableName(type); - StringBuilder sql = new StringBuilder(7); - sql.append("SELECT id, value, case_id FROM "); - sql.append(tableName); - sql.append(" WHERE value IN (SELECT value FROM "); // TODO should this select * so any field is available? - sql.append(tableName); - sql.append(" WHERE value IN (SELECT value FROM "); - sql.append(tableName); - sql.append(" WHERE case_id=? AND (known_status !=? OR known_status IS NULL) GROUP BY value) GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value"); - - try { - preparedStatement = conn.prepareStatement(sql.toString()); - preparedStatement.setInt(1, correlationCase.getID()); - preparedStatement.setByte(2, TskData.FileKnown.KNOWN.getFileKnownValue()); - resultSet = preparedStatement.executeQuery(); - instanceTableCallback.process(resultSet); - } catch (SQLException ex) { - throw new EamDbException("Error getting all artifact instances from instances table", ex); - } finally { - EamDbUtil.closeStatement(preparedStatement); - EamDbUtil.closeResultSet(resultSet); - EamDbUtil.closeConnection(conn); - } - } - - /** - * Process the Artifact instance in the EamDb - * - * @param type EamArtifact.Type to search for - * @param correlationCase CorrelationCase to filter by - * @param singleCase Single Case to filter by - * @param instanceTableCallback callback to process the instance - * @throws EamDbException - */ - @Override - public void processSingleCaseInstancesTable(CorrelationAttribute.Type type, CorrelationCase correlationCase, CorrelationCase singleCase,InstanceTableCallback instanceTableCallback) throws EamDbException { - if (type == null) { - throw new EamDbException("Correlation type is null"); - } - - if (instanceTableCallback == null) { - throw new EamDbException("Callback interface is null"); - } - - if(correlationCase == null) { - throw new EamDbException("Correlation Case is null"); - } - - Connection conn = connect(); - PreparedStatement preparedStatement = null; - ResultSet resultSet = null; - String tableName = EamDbUtil.correlationTypeToInstanceTableName(type); - StringBuilder sql = new StringBuilder(8); - sql.append("SELECT id, value, case_id FROM "); - sql.append(tableName); - sql.append(" WHERE value IN (SELECT value FROM "); // TODO should this select * so any field is available? - sql.append(tableName); - sql.append(" WHERE value IN (SELECT value FROM "); - sql.append(tableName); - sql.append(" WHERE case_id=? AND (known_status !=? OR known_status IS NULL) GROUP BY value)"); - sql.append(" AND (case_id=? OR case_id=?) GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value"); - - try { - preparedStatement = conn.prepareStatement(sql.toString()); - preparedStatement.setInt(1, correlationCase.getID()); - preparedStatement.setByte(2, TskData.FileKnown.KNOWN.getFileKnownValue()); - preparedStatement.setInt(3, correlationCase.getID()); - preparedStatement.setInt(4, singleCase.getID()); resultSet = preparedStatement.executeQuery(); instanceTableCallback.process(resultSet); } catch (SQLException ex) { diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java index f9f37a86f0..e4fb30583e 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java @@ -706,34 +706,14 @@ public interface EamDb { */ void processInstanceTable(CorrelationAttribute.Type type, InstanceTableCallback instanceTableCallback) throws EamDbException; - /** - * Process a single Artifact instance in the EamDb - * - * @param type EamArtifact.Type to search for - * @param id the id of the row to return - * @param instanceTableCallback callback to process the instance - * @throws EamDbException - */ - void processInstanceTableRow(CorrelationAttribute.Type type, int id, InstanceTableCallback instanceTableCallback) throws EamDbException; - - /** - * Process the Artifact md5s in the EamDb for matches of case files which are not known - * @param type EamArtifact.Type to search for - * @param correlationCase CorrelationCase to filter by - * @param instanceTableCallback callback to process the instance - * @throws EamDbException - */ - void processCaseInstancesTable(CorrelationAttribute.Type type, CorrelationCase correlationCase, InstanceTableCallback instanceTableCallback) throws EamDbException; - /** * Process the Artifact instance in the EamDb * * @param type EamArtifact.Type to search for - * @param correlationCase CorrelationCase to filter by - * @param singleCase Single Case to filter by * @param instanceTableCallback callback to process the instance + * @param whereClause query string to execute * @throws EamDbException */ - void processSingleCaseInstancesTable(CorrelationAttribute.Type type, CorrelationCase correlationCase, CorrelationCase singleCase,InstanceTableCallback instanceTableCallback) throws EamDbException; - + void processInstanceTableWhere(CorrelationAttribute.Type type, String whereClause, InstanceTableCallback instanceTableCallback) throws EamDbException; + } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java index a9f930fd0c..300451cdbd 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java @@ -735,62 +735,23 @@ final class SqliteEamDb extends AbstractSqlEamDb { releaseSharedLock(); } } - - /** - * Process a single Artifact instance row in the EamDb - * - * @param type EamArtifact.Type to search for - * @param id the id of the row to return - * @param instanceTableCallback callback to process the instance - * @throws EamDbException - */ - @Override - public void processInstanceTableRow(CorrelationAttribute.Type type, int id, InstanceTableCallback instanceTableCallback) throws EamDbException { - try { - acquireSharedLock(); - super.processInstanceTableRow(type, id, instanceTableCallback); - } finally { - releaseSharedLock(); - } - } - - /** - * Process the Artifact md5s in the EamDb for matches of case files which - * are not known - * - * @param type EamArtifact.Type to search for - * @param correlationCase CorrelationCase to filter by - * @param instanceTableCallback callback to process the instance - * @throws EamDbException - */ - @Override - public void processCaseInstancesTable(CorrelationAttribute.Type type, CorrelationCase correlationCase, InstanceTableCallback instanceTableCallback) throws EamDbException { - try { - acquireSharedLock(); - super.processCaseInstancesTable(type, correlationCase, instanceTableCallback); - } finally { - releaseSharedLock(); - } - } /** * Process the Artifact instance in the EamDb * * @param type EamArtifact.Type to search for - * @param correlationCase CorrelationCase to filter by - * @param singleCase Single Case to filter by * @param instanceTableCallback callback to process the instance * @throws EamDbException */ @Override - public void processSingleCaseInstancesTable(CorrelationAttribute.Type type, CorrelationCase correlationCase, CorrelationCase singleCase,InstanceTableCallback instanceTableCallback) throws EamDbException { - try { + public void processInstanceTableWhere(CorrelationAttribute.Type type, String whereClause, InstanceTableCallback instanceTableCallback) throws EamDbException { + try { acquireSharedLock(); - super.processSingleCaseInstancesTable(type, correlationCase, singleCase, instanceTableCallback); + super.processInstanceTable(type, instanceTableCallback); } finally { releaseSharedLock(); } - } + } /** * Check whether a reference set with the given name/version is in the diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java index 8416bbd856..498cfb36a7 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java @@ -33,6 +33,7 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.InstanceTableCallback; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.datamodel.TskData; /** * Used to process and return CorrelationCase md5s from the EamDB for @@ -46,6 +47,15 @@ final class InterCaseSearchResultsProcessor { private final Map intercaseCommonValuesMap = new HashMap<>(); // maps row ID to case ID private final Map intercaseCommonCasesMap = new HashMap<>(); + private final String interCaseWhereClause = "value IN (SELECT value FROM file_instances" + + " WHERE value IN (SELECT value FROM file_instances" + + " WHERE case_id=%s AND (known_status !=%s OR known_status IS NULL) GROUP BY value)" + + " GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value"; + private final String singleInterCaseWhereClause = "value IN (SELECT value FROM file_instances " + + "WHERE value IN (SELECT value FROM file_instances " + + "WHERE case_id=%s AND (known_status !=%s OR known_status IS NULL) GROUP BY value) " + + "AND (case_id=%s OR case_id=%s) GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value"; + /** * Finds a single CorrelationAttribute given an id. @@ -58,7 +68,7 @@ final class InterCaseSearchResultsProcessor { InterCaseCommonAttributeRowCallback instancetableCallback = new InterCaseCommonAttributeRowCallback(); EamDb DbManager = EamDb.getInstance(); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); - DbManager.processInstanceTableRow(fileType, attrbuteId, instancetableCallback); + DbManager.processInstanceTableWhere(fileType, String.format("id = %s", attrbuteId), instancetableCallback); return instancetableCallback.getCorrelationAttribute(); @@ -80,7 +90,11 @@ final class InterCaseSearchResultsProcessor { InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback(); EamDb DbManager = EamDb.getInstance(); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); - DbManager.processCaseInstancesTable(fileType, DbManager.getCase(currentCase), instancetableCallback); + int caseId = DbManager.getCase(currentCase).getID(); + + DbManager.processInstanceTableWhere(fileType, String.format(interCaseWhereClause, caseId, + TskData.FileKnown.KNOWN.getFileKnownValue()), + instancetableCallback); } catch (EamDbException ex) { LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); @@ -101,7 +115,10 @@ final class InterCaseSearchResultsProcessor { InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback(); EamDb DbManager = EamDb.getInstance(); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); - DbManager.processSingleCaseInstancesTable(fileType, DbManager.getCase(currentCase), singleCase, instancetableCallback); + int caseId = DbManager.getCase(currentCase).getID(); + int targetCaseId = singleCase.getID(); + DbManager.processInstanceTableWhere(fileType, String.format(singleInterCaseWhereClause, caseId, + TskData.FileKnown.KNOWN.getFileKnownValue(), caseId, targetCaseId), instancetableCallback); } catch (EamDbException ex) { LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); } From 9ee4f8d44fe43904de4a3f10f0d743d07e418872 Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Thu, 26 Jul 2018 12:38:25 -0700 Subject: [PATCH 05/17] fix bug where intracase datasource was not initialized. --- .../sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java index c88537cb17..397cf04098 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java @@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.Collections; +import java.util.HashMap; import java.util.Map; import java.util.Map.Entry; import javax.swing.ComboBoxModel; @@ -40,7 +41,7 @@ public class IntraCasePanel extends javax.swing.JPanel { private boolean singleDataSource; private String selectedDataSource; private ComboBoxModel dataSourcesList = new DataSourceComboBoxModel(); - private Map dataSourceMap; + private final Map dataSourceMap; private CommonAttributePanel parent; private String errorMessage; @@ -51,6 +52,7 @@ public class IntraCasePanel extends javax.swing.JPanel { public IntraCasePanel() { initComponents(); this.errorMessage = ""; + this.dataSourceMap = new HashMap<>(); } public void setParent(CommonAttributePanel parent){ From 5bad6cff780c7957fb74647850d28daf1886a345 Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Thu, 26 Jul 2018 12:57:24 -0700 Subject: [PATCH 06/17] Cleanup and add tests, add null check. --- .../datamodel/AbstractSqlEamDb.java | 4 + .../datamodel/CentralRepoDatamodelTest.java | 84 +++++++------------ 2 files changed, 33 insertions(+), 55 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java index e6dd3a0ccd..c2e4651808 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java @@ -1913,6 +1913,10 @@ abstract class AbstractSqlEamDb implements EamDb { if (instanceTableCallback == null) { throw new EamDbException("Callback interface is null"); } + + if(whereClause == null) { + throw new EamDbException("Where clause is null"); + } Connection conn = connect(); PreparedStatement preparedStatement = null; diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java index 030f53ed31..6efee65f71 100755 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java @@ -852,50 +852,6 @@ public class CentralRepoDatamodelTest extends TestCase { Exceptions.printStackTrace(ex); Assert.fail(ex); } - - // Test getting common instances with expected results - try { - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash)); - assertTrue("getArtifactInstancesByCaseValues returned " + instances.size() + " results - expected 5", instances.size() == 5); - - // This test works because all the instances of this hash were set to the same path - for (CentralRepositoryFile inst : instances) { - if(inst.getValue().equals(inAllDataSourcesHash)) { - assertTrue("getArtifactInstancesByCaseValues returned instance with unexpected path " + inst.getFilePath(), - inAllDataSourcesPath.equalsIgnoreCase(inst.getFilePath())); - } - else if(inst.getValue().equals(inDataSource1twiceHash)) { - assertTrue("getArtifactInstancesByCaseValues returned instance with unexpected path " + inst.getFilePath(), - inDataSource1twicePath1.equalsIgnoreCase(inst.getFilePath()) || inDataSource1twicePath2.equalsIgnoreCase(inst.getFilePath())); - } - } - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - - // Test getting instances expecting no results because they are not in the case - try { - CorrelationCase badCase = new CorrelationCase("badCaseUuid", "badCaseName"); - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(badCase, Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash), 0); - - assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty()); - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - - - // Test getting instances expecting no results because of bad hashes - try { - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(Arrays.asList("xyz", "123")); - - assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty()); - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - // Test getting instances expecting no results try { @@ -924,17 +880,7 @@ public class CentralRepoDatamodelTest extends TestCase { Exceptions.printStackTrace(ex); Assert.fail(ex); } - - // Test getting instances with null value - // Should just return nothing - try { - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null); - - assertTrue("getArtifactInstancesByTypeValue returned non-empty list for null value", instances.isEmpty()); - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } + // Test getting instances with path that should produce results try { @@ -1178,6 +1124,34 @@ public class CentralRepoDatamodelTest extends TestCase { } catch (EamDbException ex) { // This is the expected } + + // Test running processinstance which queries all rows from instances table + try { + // Add two instances to the central repository and use the callback query to verify we can see them + CorrelationAttribute attr = new CorrelationAttribute(fileType, callbackTestFileHash); + CorrelationAttributeInstance inst1 = new CorrelationAttributeInstance(case1, dataSource1fromCase1, callbackTestFilePath1); + CorrelationAttributeInstance inst2 = new CorrelationAttributeInstance(case1, dataSource1fromCase1, callbackTestFilePath2); + attr.addInstance(inst1); + attr.addInstance(inst2); + EamDb DbManager = EamDb.getInstance(); + DbManager.addArtifact(attr); + AttributeInstanceTableCallback instancetableCallback = new AttributeInstanceTableCallback(); + DbManager.processInstanceTableWhere(fileType, String.format("id = %s", attr.getID()), instancetableCallback); + int count1 = instancetableCallback.getCounter(); + int count2 = instancetableCallback.getCounterNamingConvention(); + assertTrue("Process Instance count with filepath naming convention: " + count2 + "-expected 2", count2 == 2); + assertTrue("Process Instance count with filepath without naming convention: " + count1 + "-expected greater than 0", count1 > 0); + } catch (EamDbException ex) { + Exceptions.printStackTrace(ex); + } + + try { + //test null inputs + EamDb.getInstance().processInstanceTableWhere(null, null, null); + Assert.fail("processinstance method failed to throw exception for null type value"); + } catch (EamDbException ex) { + // This is the expected + } } /** From f0a87e43e50c01b2c63c9fa38e01f326e5b69955 Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Tue, 31 Jul 2018 08:14:41 -0700 Subject: [PATCH 07/17] Add code commments for IntraCasePanel in conjuction with the previous bugfix. --- .../autopsy/commonfilesearch/IntraCasePanel.java | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java index 397cf04098..5296c89c31 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java @@ -28,8 +28,10 @@ import org.openide.util.NbBundle; import org.sleuthkit.autopsy.coreutils.Logger; /** - * - * @author bsweeney + * UI controls for Common Files Search scenario where the user intends to find + * common files between datasources. It is an inner panel which provides the ability + * to select all datasources or a single datasource from a dropdown list of + * sources in the current case. */ public class IntraCasePanel extends javax.swing.JPanel { @@ -41,6 +43,8 @@ public class IntraCasePanel extends javax.swing.JPanel { private boolean singleDataSource; private String selectedDataSource; private ComboBoxModel dataSourcesList = new DataSourceComboBoxModel(); + + // A map of data source Ids to their string names for the current case. private final Map dataSourceMap; private CommonAttributePanel parent; From 137aae131dfcd8a525f13cf62275ad9be4c162ec Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Tue, 31 Jul 2018 09:17:27 -0700 Subject: [PATCH 08/17] Sqlite where cluase wasn't passed in. --- .../autopsy/centralrepository/datamodel/SqliteEamDb.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java index 300451cdbd..74d0c36a66 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/SqliteEamDb.java @@ -747,7 +747,7 @@ final class SqliteEamDb extends AbstractSqlEamDb { public void processInstanceTableWhere(CorrelationAttribute.Type type, String whereClause, InstanceTableCallback instanceTableCallback) throws EamDbException { try { acquireSharedLock(); - super.processInstanceTable(type, instanceTableCallback); + super.processInstanceTableWhere(type, whereClause, instanceTableCallback); } finally { releaseSharedLock(); } From 8d3aeff77fcf24ffc04fb451e2497f4a732a7cbc Mon Sep 17 00:00:00 2001 From: Brian Sweeney Date: Tue, 31 Jul 2018 11:00:13 -0600 Subject: [PATCH 09/17] codacy suggestions --- .../commonfilesearch/CentralRepoCommonAttributeInstance.java | 2 +- .../org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java index 9babcbb831..0e70722b6d 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java @@ -45,7 +45,7 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName()); private final Integer crFileId; private CorrelationAttribute currentAttribute; - private Map dataSourceNameToIdMap; + private final Map dataSourceNameToIdMap; CentralRepoCommonAttributeInstance(Integer attrInstId, Map dataSourceIdToNameMap) { super(); diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java index 89036d1824..9f9335104c 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java @@ -41,7 +41,7 @@ public class IntraCasePanel extends javax.swing.JPanel { private boolean singleDataSource; private String selectedDataSource; private ComboBoxModel dataSourcesList = new DataSourceComboBoxModel(); - private Map dataSourceMap; + private final Map dataSourceMap; private String errorMessage; From 075b76e8bf6d0b274b35da38678c172d06a04d0c Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Tue, 31 Jul 2018 11:46:44 -0700 Subject: [PATCH 10/17] logic overhaul to reduce manipulation and building of hashmaps. --- .../AbstractCommonAttributeInstance.java | 5 ++- .../CentralRepoCommonAttributeInstance.java | 4 +- .../InterCaseSearchResultsProcessor.java | 45 ++++++++++++++++++- 3 files changed, 48 insertions(+), 6 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java index 6f445ca0a3..96741efc0d 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java @@ -19,6 +19,7 @@ */ package org.sleuthkit.autopsy.commonfilesearch; +import java.util.HashMap; import java.util.Map; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; @@ -70,9 +71,9 @@ public abstract class AbstractCommonAttributeInstance { * @param cachedFiles storage for abstract files which have been used * already so we can avoid extra roundtrips to the case db */ - AbstractCommonAttributeInstance(Map cachedFiles) { + AbstractCommonAttributeInstance() { this.abstractFileObjectId = -1L; - this.cachedFiles = cachedFiles; + this.cachedFiles = new HashMap<>(); this.caseName = ""; this.dataSource = ""; } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java index e720cef635..dd2ff9e2b7 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java @@ -45,8 +45,8 @@ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttr private final Integer crFileId; private CorrelationAttributeInstance currentAttributeInstance; - CentralRepoCommonAttributeInstance(Integer attrInstId, Map cachedFiles) { - super(cachedFiles); + CentralRepoCommonAttributeInstance(Integer attrInstId) { + super(); this.crFileId = attrInstId; } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java index 8416bbd856..8298089d4e 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java @@ -20,8 +20,10 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.sql.ResultSet; import java.sql.SQLException; +import java.util.ArrayList; import java.util.Collections; import java.util.HashMap; +import java.util.List; import java.util.Map; import java.util.logging.Level; import org.openide.util.Exceptions; @@ -32,7 +34,11 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.InstanceTableCallback; +import static org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher.collateMatchesByNumberOfInstances; import org.sleuthkit.autopsy.coreutils.Logger; +import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.LOGGER; +import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.HashUtility; /** * Used to process and return CorrelationCase md5s from the EamDB for @@ -123,14 +129,49 @@ final class InterCaseSearchResultsProcessor { @Override public void process(ResultSet resultSet) { + Map> instanceCollatedCommonFiles = new HashMap<>(); + try { + String previousRowMd5 = ""; + EamDb dbManager = EamDb.getInstance(); + CommonAttributeValue commonAttributeValue = null; while (resultSet.next()) { int resultId = InstanceTableCallback.getId(resultSet); - intercaseCommonValuesMap.put(resultId, InstanceTableCallback.getValue(resultSet)); - intercaseCommonCasesMap.put(resultId, InstanceTableCallback.getCaseId(resultSet)); + String md5Value = InstanceTableCallback.getValue(resultSet); + if (md5Value == null || HashUtility.isNoDataMd5(md5Value)) { + continue; + } + int caseId = InstanceTableCallback.getCaseId(resultSet); + CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); + final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); + + if(commonAttributeValue == null) { + commonAttributeValue = new CommonAttributeValue(md5Value); + } + // we don't *have* all the information for the rows in the CR, + // so we need to consult the present case via the SleuthkitCase object + // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. + if (!md5Value.equals(previousRowMd5)) { + int size = commonAttributeValue.getInstanceCount(); + if (instanceCollatedCommonFiles.containsKey(size)) { + instanceCollatedCommonFiles.get(size).add(commonAttributeValue); + } else { + ArrayList value = new ArrayList<>(); + value.add(commonAttributeValue); + instanceCollatedCommonFiles.put(size, value); + } + + commonAttributeValue = new CommonAttributeValue(md5Value); + previousRowMd5 = md5Value; + } + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(resultId); + commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); + } } catch (SQLException ex) { Exceptions.printStackTrace(ex); + } catch (EamDbException ex) { + LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS } } From 6ee9ed54bd30c5c2b244b291f8789fe46a16ed3c Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Tue, 31 Jul 2018 15:20:35 -0700 Subject: [PATCH 11/17] cleanup logic, functionally complete --- .../AllInterCaseCommonAttributeSearcher.java | 4 +- .../InterCaseCommonAttributeSearcher.java | 52 ------------------- .../InterCaseSearchResultsProcessor.java | 26 +++++++--- .../commonfilesearch/IntraCasePanel.java | 4 +- ...ingleInterCaseCommonAttributeSearcher.java | 6 +-- 5 files changed, 24 insertions(+), 68 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java index 74e3aabb2a..f1ae2781f1 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java @@ -40,9 +40,7 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut @Override public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); - eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase()); - Map> interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap()); - + Map> interCaseCommonFiles = eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase()); return new CommonAttributeSearchResults(interCaseCommonFiles); } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java index a5c5f642b7..f6307c0158 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java @@ -54,58 +54,6 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS dbManager = EamDb.getInstance(); } - /** - * @param artifactInstances all 'common files' in central repo - * @param commonValues matches must ultimately have appeared in this - * collection - * @return collated map of instance counts to lists of matches - */ - Map> gatherIntercaseResults(Map commonValues, Map commonFileCases) { - - // keyis string of value - Map interCaseCommonFiles = new HashMap<>(); - - for (int commonAttrId : commonValues.keySet()) { - - String md5 = commonValues.get(commonAttrId); - if (md5 == null || HashUtility.isNoDataMd5(md5)) { - continue; - } - Map fileCache = new HashMap<>(); - - try { - int caseId = commonFileCases.get(commonAttrId); - CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); - final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); - // we don't *have* all the information for the rows in the CR, - // so we need to consult the present case via the SleuthkitCase object - // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. - - if (interCaseCommonFiles.containsKey(md5)) { - //Add to intercase metaData - final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); - - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); - commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); - - } else { - CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); - interCaseCommonFiles.put(md5, commonAttributeValue); - - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); - commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); - - } - } catch (Exception ex) { - LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS - } - } - - Map> instanceCollatedCommonFiles = collateMatchesByNumberOfInstances(interCaseCommonFiles); - - return instanceCollatedCommonFiles; - } - protected CorrelationCase getCorrelationCaseFromId(int correlationCaseId) throws EamDbException { for (CorrelationCase cCase : this.dbManager.getCases()) { if (cCase.getID() == correlationCaseId) { diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java index 8298089d4e..b12b4b1b57 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java @@ -34,10 +34,7 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.InstanceTableCallback; -import static org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher.collateMatchesByNumberOfInstances; import org.sleuthkit.autopsy.coreutils.Logger; -import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.LOGGER; -import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.HashUtility; /** @@ -81,17 +78,17 @@ final class InterCaseSearchResultsProcessor { * * @param currentCase The current TSK Case. */ - void findInterCaseCommonAttributeValues(Case currentCase) { + Map> findInterCaseCommonAttributeValues(Case currentCase) { try { InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback(); EamDb DbManager = EamDb.getInstance(); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); DbManager.processCaseInstancesTable(fileType, DbManager.getCase(currentCase), instancetableCallback); - + return instancetableCallback.getInstanceCollatedCommonFiles(); } catch (EamDbException ex) { LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); } - + return new HashMap<>(); } /** @@ -102,15 +99,17 @@ final class InterCaseSearchResultsProcessor { * @param currentCase The current TSK Case. * @param singleCase The case of interest. Matches must exist in this case. */ - void findSingleInterCaseCommonAttributeValues(Case currentCase, CorrelationCase singleCase) { + Map> findSingleInterCaseCommonAttributeValues(Case currentCase, CorrelationCase singleCase) { try { InterCaseCommonAttributesCallback instancetableCallback = new InterCaseCommonAttributesCallback(); EamDb DbManager = EamDb.getInstance(); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); DbManager.processSingleCaseInstancesTable(fileType, DbManager.getCase(currentCase), singleCase, instancetableCallback); + return instancetableCallback.getInstanceCollatedCommonFiles(); } catch (EamDbException ex) { LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); } + return new HashMap<>(); } Map getIntercaseCommonValuesMap() { @@ -127,17 +126,23 @@ final class InterCaseSearchResultsProcessor { */ private class InterCaseCommonAttributesCallback implements InstanceTableCallback { + final Map> instanceCollatedCommonFiles = new HashMap<>(); + @Override public void process(ResultSet resultSet) { - Map> instanceCollatedCommonFiles = new HashMap<>(); + try { String previousRowMd5 = ""; EamDb dbManager = EamDb.getInstance(); CommonAttributeValue commonAttributeValue = null; while (resultSet.next()) { + int resultId = InstanceTableCallback.getId(resultSet); String md5Value = InstanceTableCallback.getValue(resultSet); + if(previousRowMd5.isEmpty()) { + previousRowMd5 = md5Value; + } if (md5Value == null || HashUtility.isNoDataMd5(md5Value)) { continue; } @@ -173,6 +178,11 @@ final class InterCaseSearchResultsProcessor { } catch (EamDbException ex) { LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS } + + } + + Map> getInstanceCollatedCommonFiles() { + return Collections.unmodifiableMap(instanceCollatedCommonFiles); } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java index c88537cb17..9b243445ca 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java @@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.Collections; +import java.util.HashMap; import java.util.Map; import java.util.Map.Entry; import javax.swing.ComboBoxModel; @@ -40,7 +41,7 @@ public class IntraCasePanel extends javax.swing.JPanel { private boolean singleDataSource; private String selectedDataSource; private ComboBoxModel dataSourcesList = new DataSourceComboBoxModel(); - private Map dataSourceMap; + private final Map dataSourceMap; private CommonAttributePanel parent; private String errorMessage; @@ -51,6 +52,7 @@ public class IntraCasePanel extends javax.swing.JPanel { public IntraCasePanel() { initComponents(); this.errorMessage = ""; + dataSourceMap = new HashMap<>(); } public void setParent(CommonAttributePanel parent){ diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java index 9486a9e43c..5c5954d431 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java @@ -70,11 +70,9 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri return this.findFiles(cCase); } - protected CommonAttributeSearchResults findFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { - + CommonAttributeSearchResults findFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); - eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase); - Map> interCaseCommonFiles = gatherIntercaseResults(eamDbAttrInst.getIntercaseCommonValuesMap(), eamDbAttrInst.getIntercaseCommonCasesMap()); + Map> interCaseCommonFiles = eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase); return new CommonAttributeSearchResults(interCaseCommonFiles); } From 35d5df5ebc7940ca0cf81cd48f9ed2dce833ad57 Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Tue, 31 Jul 2018 15:32:32 -0700 Subject: [PATCH 12/17] Cleanup excess fields. --- .../InterCaseSearchResultsProcessor.java | 40 +++++-------------- 1 file changed, 11 insertions(+), 29 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java index b12b4b1b57..31dccb80ef 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java @@ -26,7 +26,6 @@ import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.logging.Level; -import org.openide.util.Exceptions; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; @@ -45,11 +44,6 @@ final class InterCaseSearchResultsProcessor { private static final Logger LOGGER = Logger.getLogger(CommonAttributePanel.class.getName()); - // maps row ID to value - private final Map intercaseCommonValuesMap = new HashMap<>(); - // maps row ID to case ID - private final Map intercaseCommonCasesMap = new HashMap<>(); - /** * Finds a single CorrelationAttribute given an id. * @@ -112,14 +106,6 @@ final class InterCaseSearchResultsProcessor { return new HashMap<>(); } - Map getIntercaseCommonValuesMap() { - return Collections.unmodifiableMap(intercaseCommonValuesMap); - } - - Map getIntercaseCommonCasesMap() { - return Collections.unmodifiableMap(intercaseCommonCasesMap); - } - /** * Callback to use with findInterCaseCommonAttributeValues which generates a * list of md5s for common files search @@ -127,11 +113,9 @@ final class InterCaseSearchResultsProcessor { private class InterCaseCommonAttributesCallback implements InstanceTableCallback { final Map> instanceCollatedCommonFiles = new HashMap<>(); - + @Override public void process(ResultSet resultSet) { - - try { String previousRowMd5 = ""; EamDb dbManager = EamDb.getInstance(); @@ -140,7 +124,7 @@ final class InterCaseSearchResultsProcessor { int resultId = InstanceTableCallback.getId(resultSet); String md5Value = InstanceTableCallback.getValue(resultSet); - if(previousRowMd5.isEmpty()) { + if (previousRowMd5.isEmpty()) { previousRowMd5 = md5Value; } if (md5Value == null || HashUtility.isNoDataMd5(md5Value)) { @@ -149,13 +133,10 @@ final class InterCaseSearchResultsProcessor { int caseId = InstanceTableCallback.getCaseId(resultSet); CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); - - if(commonAttributeValue == null) { + + if (commonAttributeValue == null) { commonAttributeValue = new CommonAttributeValue(md5Value); } - // we don't *have* all the information for the rows in the CR, - // so we need to consult the present case via the SleuthkitCase object - // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. if (!md5Value.equals(previousRowMd5)) { int size = commonAttributeValue.getInstanceCount(); if (instanceCollatedCommonFiles.containsKey(size)) { @@ -169,18 +150,19 @@ final class InterCaseSearchResultsProcessor { commonAttributeValue = new CommonAttributeValue(md5Value); previousRowMd5 = md5Value; } + // we don't *have* all the information for the rows in the CR, + // so we need to consult the present case via the SleuthkitCase object + // Later, when the FileInstanceNode is built. Therefore, build node generators for now. AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(resultId); commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); } - } catch (SQLException ex) { - Exceptions.printStackTrace(ex); - } catch (EamDbException ex) { + } catch (SQLException | EamDbException ex) { LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS } - + } - + Map> getInstanceCollatedCommonFiles() { return Collections.unmodifiableMap(instanceCollatedCommonFiles); } @@ -212,7 +194,7 @@ final class InterCaseSearchResultsProcessor { } } catch (SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); + LOGGER.log(Level.WARNING, "Error getting single correlation artifact instance from database.", ex); // NON-NLS } } From 9163256cd33769532ed06ae2b8754139ba2fd652 Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Tue, 31 Jul 2018 15:54:33 -0700 Subject: [PATCH 13/17] Refactoring --- .../InterCaseSearchResultsProcessor.java | 53 +++++++++++-------- 1 file changed, 30 insertions(+), 23 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java index 31dccb80ef..2a1845a36a 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java @@ -114,12 +114,15 @@ final class InterCaseSearchResultsProcessor { final Map> instanceCollatedCommonFiles = new HashMap<>(); + private CommonAttributeValue commonAttributeValue = null; + private String previousRowMd5 = ""; + @Override public void process(ResultSet resultSet) { try { - String previousRowMd5 = ""; + EamDb dbManager = EamDb.getInstance(); - CommonAttributeValue commonAttributeValue = null; + while (resultSet.next()) { int resultId = InstanceTableCallback.getId(resultSet); @@ -134,27 +137,7 @@ final class InterCaseSearchResultsProcessor { CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); - if (commonAttributeValue == null) { - commonAttributeValue = new CommonAttributeValue(md5Value); - } - if (!md5Value.equals(previousRowMd5)) { - int size = commonAttributeValue.getInstanceCount(); - if (instanceCollatedCommonFiles.containsKey(size)) { - instanceCollatedCommonFiles.get(size).add(commonAttributeValue); - } else { - ArrayList value = new ArrayList<>(); - value.add(commonAttributeValue); - instanceCollatedCommonFiles.put(size, value); - } - - commonAttributeValue = new CommonAttributeValue(md5Value); - previousRowMd5 = md5Value; - } - // we don't *have* all the information for the rows in the CR, - // so we need to consult the present case via the SleuthkitCase object - // Later, when the FileInstanceNode is built. Therefore, build node generators for now. - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(resultId); - commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); + countAndAddCommonAttributes(md5Value, resultId, correlationCaseDisplayName); } } catch (SQLException | EamDbException ex) { @@ -163,6 +146,30 @@ final class InterCaseSearchResultsProcessor { } + private void countAndAddCommonAttributes(String md5Value, int resultId, String correlationCaseDisplayName) { + if (commonAttributeValue == null) { + commonAttributeValue = new CommonAttributeValue(md5Value); + } + if (!md5Value.equals(previousRowMd5)) { + int size = commonAttributeValue.getInstanceCount(); + if (instanceCollatedCommonFiles.containsKey(size)) { + instanceCollatedCommonFiles.get(size).add(commonAttributeValue); + } else { + ArrayList value = new ArrayList<>(); + value.add(commonAttributeValue); + instanceCollatedCommonFiles.put(size, value); + } + + commonAttributeValue = new CommonAttributeValue(md5Value); + previousRowMd5 = md5Value; + } + // we don't *have* all the information for the rows in the CR, + // so we need to consult the present case via the SleuthkitCase object + // Later, when the FileInstanceNode is built. Therefore, build node generators for now. + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(resultId); + commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); + } + Map> getInstanceCollatedCommonFiles() { return Collections.unmodifiableMap(instanceCollatedCommonFiles); } From cde3d8dd1f2384f1aa0e81467b9c5153dee443c5 Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Fri, 3 Aug 2018 11:03:02 -0400 Subject: [PATCH 14/17] Revert "4072 remove cache" --- .../AbstractCommonAttributeInstance.java | 71 ++- .../AbstractCommonAttributeSearcher.java | 9 +- .../AllInterCaseCommonAttributeSearcher.java | 12 +- .../CaseDBCommonAttributeInstance.java | 7 +- .../CaseDBCommonAttributeInstanceNode.java | 4 +- .../CentralRepoCommonAttributeInstance.java | 102 ++-- ...entralRepoCommonAttributeInstanceNode.java | 29 +- .../CommonAttributePanel.java | 4 +- .../CommonAttributeSearchResultRootNode.java | 2 +- .../CommonAttributeSearchResults.java | 26 +- .../CommonAttributeValue.java | 5 + .../InterCaseCommonAttributeSearcher.java | 46 +- .../commonfilesearch/InterCasePanel.java | 7 +- .../IntraCaseCommonAttributeSearcher.java | 15 +- .../commonfilesearch/IntraCasePanel.java | 15 +- ...ingleInterCaseCommonAttributeSearcher.java | 4 +- .../datamodel/CentralRepoDatamodelTest.java | 55 +++ .../IngestedWithHashAndFileType.java | 466 ++++++++++++++++++ ...stedWithHashAndFileTypeInterCaseTests.java | 109 +--- ...stedWithHashAndFileTypeIntraCaseTests.java | 50 +- ...IngestedWithNoFileTypesIntraCaseTests.java | 14 +- ...CaseTestUtils.java => InterCaseUtils.java} | 174 +++---- ...CaseTestUtils.java => IntraCaseUtils.java} | 4 +- ...s.java => MatchesInAtLeastTwoSources.java} | 30 +- .../NoCentralRepoEnabledInterCaseTests.java | 85 ++++ .../UningestedCasesIntraCaseTests.java | 8 +- 26 files changed, 923 insertions(+), 430 deletions(-) create mode 100644 Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java rename Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/{InterCaseTestUtils.java => InterCaseUtils.java} (65%) rename Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/{IntraCaseTestUtils.java => IntraCaseUtils.java} (98%) rename Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/{MatchesInAtLeastTwoSourcesIntraCaseTests.java => MatchesInAtLeastTwoSources.java} (74%) create mode 100644 Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java index 61e8aee1f4..6f445ca0a3 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java @@ -19,7 +19,7 @@ */ package org.sleuthkit.autopsy.commonfilesearch; -import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute; +import java.util.Map; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.datamodel.AbstractFile; @@ -27,9 +27,9 @@ import org.sleuthkit.datamodel.TskCoreException; /** * Represents an instance in either the CaseDB or CR that had a common match. - * Different implementations know how to get the instance details from either + * Different implementations know how to get the instance details from either * CaseDB or CR. - * + * * Defines leaf-type nodes used in the Common Files Search results tree. Leaf * nodes, may describe common attributes which exist in the current case DB or * in the Central Repo. When a reference to the AbstractFile is lacking (such as @@ -41,6 +41,8 @@ import org.sleuthkit.datamodel.TskCoreException; public abstract class AbstractCommonAttributeInstance { private final Long abstractFileObjectId; + // maps object ID to file + private final Map cachedFiles; private final String caseName; private final String dataSource; @@ -54,8 +56,9 @@ public abstract class AbstractCommonAttributeInstance { * @param dataSource datasource where this attribute appears * @param caseName case where this attribute appears */ - AbstractCommonAttributeInstance(Long abstractFileReference, String dataSource, String caseName) { + AbstractCommonAttributeInstance(Long abstractFileReference, Map cachedFiles, String dataSource, String caseName) { this.abstractFileObjectId = abstractFileReference; + this.cachedFiles = cachedFiles; this.caseName = caseName; this.dataSource = dataSource; } @@ -67,18 +70,38 @@ public abstract class AbstractCommonAttributeInstance { * @param cachedFiles storage for abstract files which have been used * already so we can avoid extra roundtrips to the case db */ - AbstractCommonAttributeInstance() { + AbstractCommonAttributeInstance(Map cachedFiles) { this.abstractFileObjectId = -1L; + this.cachedFiles = cachedFiles; this.caseName = ""; this.dataSource = ""; } /** - * Get an AbstractFile for this instance if it can be retrieved from the - * CaseDB. + * Grab a cached instance of the AbstractFile or grab one from the + * SleuthkitCase. Use this in implementations of generateNodes. * - * @return AbstractFile corresponding to this common attribute or null if it - * cannot be found (for example, in the event that this is a central repo file) + * @return AbstractFile which is identical to the file instance generated by + * implementations of this object + */ + protected AbstractFile lookupOrLoadAbstractFile() { + if (this.cachedFiles.containsKey(this.getAbstractFileObjectId())) { + return this.cachedFiles.get(this.getAbstractFileObjectId()); + } else { + AbstractFile file = this.getAbstractFile(); + final long abstractFileId = file.getId(); + this.cachedFiles.put(abstractFileId, file); + return file; + } + } + + /** + * Get an AbstractFile for this instance if it can be retrieved from + * the CaseDB. + * + * @return AbstractFile corresponding to this common attribute or null if + * it cannot be found + * @@@ Consider throwing exception instead of NULL */ abstract AbstractFile getAbstractFile(); @@ -139,24 +162,36 @@ public abstract class AbstractCommonAttributeInstance { * * @param attributeInstance common file attribute instance form the central * repo - * @param abstractFile an AbstractFile from which the attribute instance was - * found - applies to CaseDbCommonAttributeInstance only + * @param equivalentAbstractFile an AbstractFile which is equivalent to the + * file in which the attribute instance was found * @param currentCaseName * @return the appropriate leaf node for the results tree * @throws TskCoreException */ - static DisplayableItemNode createNode(CorrelationAttribute attribute, AbstractFile abstractFile, String currentCaseName) throws TskCoreException { + static DisplayableItemNode createInstance(CorrelationAttributeInstance attributeInstance, AbstractFile equivalentAbstractFile, String currentCaseName) throws TskCoreException { DisplayableItemNode leafNode; - CorrelationAttributeInstance attributeInstance = attribute.getInstances().get(0); - if (abstractFile == null) { - leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance); + final String attributeDataSourceName = attributeInstance.getCorrelationDataSource().getName(); + final String abstractFileDataSourceName = equivalentAbstractFile.getDataSource().getName(); + + final String attributeInstanceCaseName = attributeInstance.getCorrelationCase().getDisplayName(); + + final String attributeInstanceFullPath = attributeInstance.getFilePath().replace("\\", "/"); + + final String currentAbstractFileParentPath = equivalentAbstractFile.getParentPath(); + final String currentAbstractFileName = equivalentAbstractFile.getName(); + final String abstractFileFullPath = (currentAbstractFileParentPath + currentAbstractFileName).replace("\\", "/"); + + final boolean sameCase = attributeInstanceCaseName.equalsIgnoreCase(currentCaseName); + final boolean sameFileName = attributeInstanceFullPath.equalsIgnoreCase(abstractFileFullPath); + final boolean sameDataSource = attributeDataSourceName.equalsIgnoreCase(abstractFileDataSourceName); + + if (sameCase && sameFileName && sameDataSource) { + leafNode = new CaseDBCommonAttributeInstanceNode(equivalentAbstractFile, currentCaseName, abstractFileDataSourceName); } else { - final String abstractFileDataSourceName = abstractFile.getDataSource().getName(); - leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName); + leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance, equivalentAbstractFile); } - return leafNode; } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java index 97456bda04..fb8cbd312d 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java @@ -21,7 +21,6 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.sql.SQLException; import java.util.ArrayList; -import java.util.Collections; import java.util.List; import java.util.Map; import java.util.Set; @@ -39,18 +38,12 @@ import org.sleuthkit.datamodel.TskCoreException; */ public abstract class AbstractCommonAttributeSearcher { - private final Map dataSourceIdToNameMap; private boolean filterByMedia; private boolean filterByDoc; - AbstractCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMedia, boolean filterByDoc){ + AbstractCommonAttributeSearcher(boolean filterByMedia, boolean filterByDoc){ this.filterByDoc = filterByDoc; this.filterByMedia = filterByMedia; - this.dataSourceIdToNameMap = dataSourceIdMap; - } - - Map getDataSourceIdToNameMap(){ - return Collections.unmodifiableMap(this.dataSourceIdToNameMap); } /** diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java index 7e039a9419..74e3aabb2a 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java @@ -33,16 +33,8 @@ import org.sleuthkit.datamodel.TskCoreException; */ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttributeSearcher { - /** - * - * @param filterByMediaMimeType match only on files whose mime types can be - * broadly categorized as media types - * @param filterByDocMimeType match only on files whose mime types can be - * broadly categorized as document types - * @throws EamDbException - */ - public AllInterCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); + public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(filterByMediaMimeType, filterByDocMimeType); } @Override diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java index 994df4c66a..74363a869b 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java @@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.Arrays; +import java.util.Map; import java.util.logging.Level; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -44,13 +45,13 @@ final public class CaseDBCommonAttributeInstance extends AbstractCommonAttribute * @param objectId id of abstract file to find * @param dataSourceName name of datasource where the object is found */ - CaseDBCommonAttributeInstance(Long abstractFileReference, String dataSource, String caseName) { - super(abstractFileReference, dataSource, caseName); + CaseDBCommonAttributeInstance(Long abstractFileReference, Map cachedFiles, String dataSource, String caseName) { + super(abstractFileReference, cachedFiles, dataSource, caseName); } @Override public DisplayableItemNode[] generateNodes() { - final CaseDBCommonAttributeInstanceNode intraCaseCommonAttributeInstanceNode = new CaseDBCommonAttributeInstanceNode(this.getAbstractFile(), this.getCaseName(), this.getDataSource()); + final CaseDBCommonAttributeInstanceNode intraCaseCommonAttributeInstanceNode = new CaseDBCommonAttributeInstanceNode(this.lookupOrLoadAbstractFile(), this.getCaseName(), this.getDataSource()); return Arrays.asList(intraCaseCommonAttributeInstanceNode).toArray(new DisplayableItemNode[1]); } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java index f321b7a72a..59e5318801 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java @@ -58,11 +58,11 @@ public class CaseDBCommonAttributeInstanceNode extends FileNode { return visitor.visit(this); } - public String getCase(){ + String getCase(){ return this.caseName; } - public String getDataSource() { + String getDataSource() { return this.dataSource; } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java index 0e70722b6d..d154e6f1df 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java @@ -21,7 +21,6 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.io.File; import java.util.ArrayList; -import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.logging.Level; @@ -36,102 +35,75 @@ import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskCoreException; /** - * Represents that a row in the CR was found in multiple cases. - * + * Represents that a row in the CR was found in multiple cases. + * * Generates a DisplayableItmeNode using a CentralRepositoryFile. */ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttributeInstance { private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName()); private final Integer crFileId; - private CorrelationAttribute currentAttribute; - private final Map dataSourceNameToIdMap; + private CorrelationAttributeInstance currentAttributeInstance; - CentralRepoCommonAttributeInstance(Integer attrInstId, Map dataSourceIdToNameMap) { - super(); + CentralRepoCommonAttributeInstance(Integer attrInstId, Map cachedFiles) { + super(cachedFiles); this.crFileId = attrInstId; - this.dataSourceNameToIdMap = invertMap(dataSourceIdToNameMap); } - - void setCurrentAttributeInst(CorrelationAttribute attribute) { - this.currentAttribute = attribute; + + void setCurrentAttributeInst(CorrelationAttributeInstance attributeInstance) { + this.currentAttributeInstance = attributeInstance; } @Override AbstractFile getAbstractFile() { Case currentCase; - if (this.currentAttribute != null) { - - final CorrelationAttributeInstance currentAttributeInstance = this.currentAttribute.getInstances().get(0); - - String currentFullPath = currentAttributeInstance.getFilePath(); - String currentDataSource = currentAttributeInstance.getCorrelationDataSource().getName(); - - - if(this.dataSourceNameToIdMap.containsKey(currentDataSource)){ - Long dataSourceObjectId = this.dataSourceNameToIdMap.get(currentDataSource); - - try { - currentCase = Case.getCurrentCaseThrows(); + // @@@ Need to CHeck for NULL. This seems to depend on generateNodes to be called first + String currentFullPath = this.currentAttributeInstance.getFilePath(); - SleuthkitCase tskDb = currentCase.getSleuthkitCase(); + try { + currentCase = Case.getCurrentCaseThrows(); - File fileFromPath = new File(currentFullPath); - String fileName = fileFromPath.getName(); - String parentPath = (fileFromPath.getParent() + File.separator).replace("\\", "/"); + SleuthkitCase tskDb = currentCase.getSleuthkitCase(); + File fileFromPath = new File(currentFullPath); + String fileName = fileFromPath.getName(); + //TODO this seems like a flaw - we maybe need to look at all of these not just the first + //i think we should search by md5 and return all of them + AbstractFile abstractFile = tskDb.findAllFilesWhere(String.format("lower(name) = '%s'", fileName)).get(0); - final String whereClause = String.format("lower(name) = '%s' AND md5 = '%s' AND lower(parent_path) = '%s' AND data_source_obj_id = %s", fileName, currentAttribute.getCorrelationValue(), parentPath, dataSourceObjectId); - List potentialAbstractFiles = tskDb.findAllFilesWhere(whereClause); + return abstractFile; - if(potentialAbstractFiles.isEmpty()){ - return null; - } else if(potentialAbstractFiles.size() > 1){ - LOGGER.log(Level.WARNING, String.format("Unable to find an exact match for AbstractFile for record with filePath: %s. May have returned the wrong file.", new Object[]{currentFullPath})); - return potentialAbstractFiles.get(0); - } else { - return potentialAbstractFiles.get(0); - } - - } catch (TskCoreException | NoCurrentCaseException ex) { - LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex); - return null; - } - } else { - return null; - } + } catch (TskCoreException | NoCurrentCaseException ex) { + LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex); + return null; } - return null; } @Override public DisplayableItemNode[] generateNodes() { - + // @@@ We should be doing more of this work in teh generateKeys method. We want to do as little as possible in generateNodes + InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); CorrelationAttribute corrAttr = eamDbAttrInst.findSingleCorrelationAttribute(crFileId); List attrInstNodeList = new ArrayList<>(0); String currCaseDbName = Case.getCurrentCase().getDisplayName(); + + // @@@ This seems wrong that we are looping here, but only setting one attrInst in the class, which is then used by getAbstractFile(). + for (CorrelationAttributeInstance attrInst : corrAttr.getInstances()) { + try { + this.setCurrentAttributeInst(attrInst); + + AbstractFile equivalentAbstractFile = this.lookupOrLoadAbstractFile(); + + DisplayableItemNode generatedInstNode = AbstractCommonAttributeInstance.createInstance(attrInst, equivalentAbstractFile, currCaseDbName); - try { - this.setCurrentAttributeInst(corrAttr); + attrInstNodeList.add(generatedInstNode); - AbstractFile abstractFileForAttributeInstance = this.getAbstractFile(); - DisplayableItemNode generatedInstNode = AbstractCommonAttributeInstance.createNode(corrAttr, abstractFileForAttributeInstance, currCaseDbName); - attrInstNodeList.add(generatedInstNode); - - } catch (TskCoreException ex) { - LOGGER.log(Level.SEVERE, String.format("Unable to get DataSource for record with md5: %s. Node not created.", new Object[]{corrAttr.getCorrelationValue()}), ex); + } catch (TskCoreException ex) { + LOGGER.log(Level.SEVERE, String.format("Unable to get DataSource for record with filePath: %s. Node not created.", new Object[]{attrInst.getFilePath()}), ex); + } } - return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]); } - - private Map invertMap(Map dataSourceIdToNameMap) { - HashMap invertedMap = new HashMap<>(); - for (Map.Entry entry : dataSourceIdToNameMap.entrySet()){ - invertedMap.put(entry.getValue(), entry.getKey()); - } - return invertedMap; - } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java index e0b8e928d7..ea5b19950c 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java @@ -31,6 +31,8 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeIns import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor; import org.sleuthkit.autopsy.datamodel.NodeProperty; +import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.Content; /** * Used by the Common Files search feature to encapsulate instances of a given @@ -44,16 +46,25 @@ public class CentralRepoCommonAttributeInstanceNode extends DisplayableItemNode private final CorrelationAttributeInstance crFile; - CentralRepoCommonAttributeInstanceNode(CorrelationAttributeInstance content) { - super(Children.LEAF, Lookups.fixed(content)); + //this may not be the same file, but at least it is identical, + // and we can use this to support certain actions in the tree table and crFile viewer + private final AbstractFile md5Reference; + + CentralRepoCommonAttributeInstanceNode(CorrelationAttributeInstance content, AbstractFile md5Reference) { + super(Children.LEAF, Lookups.fixed(content)); // Using md5Reference enables Other Occurances, but for the current file path this.crFile = content; this.setDisplayName(new File(this.crFile.getFilePath()).getName()); + this.md5Reference = md5Reference; } - public CorrelationAttributeInstance getCorrelationAttributeInstance(){ + public CorrelationAttributeInstance getCentralRepoFile(){ return this.crFile; } + public Content getContent(){ + return this.md5Reference; + } + @Override public Action[] getActions(boolean context){ List actionsList = new ArrayList<>(); @@ -90,24 +101,24 @@ public class CentralRepoCommonAttributeInstanceNode extends DisplayableItemNode sheet.put(sheetSet); } - final CorrelationAttributeInstance centralRepoFile = this.getCorrelationAttributeInstance(); + final CorrelationAttributeInstance centralRepoFile = this.getCentralRepoFile(); final String fullPath = centralRepoFile.getFilePath(); final File file = new File(fullPath); - + final String caseName = centralRepoFile.getCorrelationCase().getDisplayName(); - + final String name = file.getName(); final String parent = file.getParent(); - - final String dataSourceName = centralRepoFile.getCorrelationDataSource().getName(); + + final String caseQualifiedDataSource = centralRepoFile.getCorrelationDataSource().getName(); final String NO_DESCR = Bundle.CommonFilesSearchResultsViewerTable_noDescText(); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_filesColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_filesColLbl(), NO_DESCR, name)); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_pathColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_pathColLbl(), NO_DESCR, parent)); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_hashsetHitsColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_hashsetHitsColLbl(), NO_DESCR, "")); - sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), NO_DESCR, dataSourceName)); + sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), NO_DESCR, caseQualifiedDataSource)); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_mimeTypeColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_mimeTypeColLbl(), NO_DESCR, "")); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_caseColLbl1(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_caseColLbl1(), NO_DESCR, caseName)); diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java index 1b33bb9422..c83876f3ce 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java @@ -157,9 +157,9 @@ public final class CommonAttributePanel extends javax.swing.JDialog { if (CommonAttributePanel.this.interCaseRadio.isSelected()) { if (caseId == InterCasePanel.NO_CASE_SELECTED) { - builder = new AllInterCaseCommonAttributeSearcher(intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments); + builder = new AllInterCaseCommonAttributeSearcher(filterByMedia, filterByDocuments); } else { - builder = new SingleInterCaseCommonAttributeSearcher(caseId, intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments); + builder = new SingleInterCaseCommonAttributeSearcher(caseId, filterByMedia, filterByDocuments); } } else { if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) { diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java index 8e33401af7..066a780afb 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java @@ -86,6 +86,6 @@ final public class CommonAttributeSearchResultRootNode extends DisplayableItemNo protected Node createNodeForKey(Integer instanceCount){ List attributeValues = this.searchResults.getAttributeValuesForInstanceCount(instanceCount); return new InstanceCountNode(instanceCount, attributeValues); - } + } } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java index 8ff13e87f1..b46cde1316 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java @@ -33,41 +33,35 @@ final public class CommonAttributeSearchResults { private final Map> instanceCountToAttributeValues; /** - * Create a values object which can be handed off to the node factories. + * Create a metadata object which can be handed off to the node + * factories. * - * @param values list of CommonAttributeValue indexed by size of - * CommonAttributeValue + * @param metadata list of CommonAttributeValue indexed by size of CommonAttributeValue */ CommonAttributeSearchResults(Map> metadata){ this.instanceCountToAttributeValues = metadata; } /** - * Find the child node whose children have the specified number of children. + * Find the meta data for the given md5. * * This is a convenience method - you can also iterate over - * getValues(). + * getMetadata(). * - * @param isntanceCound key - * @return list of values which represent matches + * @param md5 key + * @return */ List getAttributeValuesForInstanceCount(Integer instanceCount) { return this.instanceCountToAttributeValues.get(instanceCount); } - /** - * Get an unmodifiable collection of values, indexed by number of - * grandchildren, which represents the common attributes found in the - * search. - * @return map of sizes of children to list of matches - */ -public Map> getMetadata() { + public Map> getMetadata() { return Collections.unmodifiableMap(this.instanceCountToAttributeValues); } /** - * How many distinct common files exist for this search results? - * @return number of common files + * How many distinct file instances exist for this metadata? + * @return number of file instances */ public int size() { diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java index fa33df6aab..3ed386ab10 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java @@ -74,6 +74,11 @@ final public class CommonAttributeValue { this.fileInstances.add(metadata); } + void addFileInstanceMetadata(AbstractCommonAttributeInstance metadata, String caseName) { + this.fileInstances.add(metadata); + // @@@ Why are we ignoring caseName? + } + public Collection getInstances() { return Collections.unmodifiableCollection(this.fileInstances); } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java index fcdb4a319c..a5c5f642b7 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java @@ -22,9 +22,12 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.HashMap; import java.util.List; import java.util.Map; +import java.util.logging.Level; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; +import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.LOGGER; +import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.HashUtility; /** @@ -46,8 +49,8 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS * * @throws EamDbException */ - InterCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); + InterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(filterByMediaMimeType, filterByDocMimeType); dbManager = EamDb.getInstance(); } @@ -68,24 +71,33 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS if (md5 == null || HashUtility.isNoDataMd5(md5)) { continue; } + Map fileCache = new HashMap<>(); - // we don't *have* all the information for the rows in the CR, - // so we need to consult the present case via the SleuthkitCase object - // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. + try { + int caseId = commonFileCases.get(commonAttrId); + CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); + final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); + // we don't *have* all the information for the rows in the CR, + // so we need to consult the present case via the SleuthkitCase object + // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. - if (interCaseCommonFiles.containsKey(md5)) { - //Add to intercase metaData - final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); + if (interCaseCommonFiles.containsKey(md5)) { + //Add to intercase metaData + final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); + + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); + commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap()); - commonAttributeValue.addInstance(searchResult); - - } else { - CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); - interCaseCommonFiles.put(md5, commonAttributeValue); - - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap()); - commonAttributeValue.addInstance(searchResult); + } else { + CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); + interCaseCommonFiles.put(md5, commonAttributeValue); + + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); + commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); + + } + } catch (Exception ex) { + LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java index 2959c51078..05a7032252 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java @@ -37,9 +37,10 @@ public class InterCasePanel extends javax.swing.JPanel { static final int NO_CASE_SELECTED = -1; private ComboBoxModel casesList = new DataSourceComboBoxModel(); - private final Map caseMap; + private CommonAttributePanel parent; + private String errorMessage; /** @@ -59,6 +60,10 @@ public class InterCasePanel extends javax.swing.JPanel { } } + void setParent(CommonAttributePanel parent) { + this.parent = parent; + } + String getErrorMessage(){ return this.errorMessage; } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java index 0967041b30..60a89fb5e5 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java @@ -28,6 +28,7 @@ import java.util.Map; import java.util.Set; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; +import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.HashUtility; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery; @@ -44,6 +45,7 @@ import org.sleuthkit.datamodel.TskCoreException; @SuppressWarnings("PMD.AbstractNaming") public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher { + private final Map dataSourceIdToNameMap; private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on /** @@ -56,7 +58,8 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt * broadly categorized as document types */ IntraCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) { - super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); + super(filterByMediaMimeType, filterByDocMimeType); + dataSourceIdToNameMap = dataSourceIdMap; } /** @@ -94,6 +97,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt */ @Override public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException { + //TODO do we need all those exceptions or can we differentiate when they are caught? Map commonFiles = new HashMap<>(); final Case currentCase = Case.getCurrentCaseThrows(); @@ -102,6 +106,8 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt SleuthkitCase sleuthkitCase = currentCase.getSleuthkitCase(); String selectStatement = this.buildSqlSelectStatement(); + + Map fileCache = new HashMap<>(); try ( CaseDbQuery query = sleuthkitCase.executeQuery(selectStatement); @@ -111,7 +117,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt Long objectId = resultSet.getLong(1); String md5 = resultSet.getString(2); Long dataSourceId = resultSet.getLong(3); - String dataSource = this.getDataSourceIdToNameMap().get(dataSourceId); + String dataSource = this.dataSourceIdToNameMap.get(dataSourceId); if (md5 == null || HashUtility.isNoDataMd5(md5)) { continue; @@ -119,10 +125,10 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt if (commonFiles.containsKey(md5)) { final CommonAttributeValue commonAttributeValue = commonFiles.get(md5); - commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, dataSource, caseName)); + commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, fileCache, dataSource, caseName)); } else { final CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); - commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, dataSource, caseName)); + commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, fileCache, dataSource, caseName)); commonFiles.put(md5, commonAttributeValue); } } @@ -163,4 +169,5 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt } return mimeTypeString; } + } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java index 9f9335104c..c88537cb17 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java @@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.Collections; -import java.util.HashMap; import java.util.Map; import java.util.Map.Entry; import javax.swing.ComboBoxModel; @@ -41,7 +40,8 @@ public class IntraCasePanel extends javax.swing.JPanel { private boolean singleDataSource; private String selectedDataSource; private ComboBoxModel dataSourcesList = new DataSourceComboBoxModel(); - private final Map dataSourceMap; + private Map dataSourceMap; + private CommonAttributePanel parent; private String errorMessage; @@ -51,7 +51,10 @@ public class IntraCasePanel extends javax.swing.JPanel { public IntraCasePanel() { initComponents(); this.errorMessage = ""; - this.dataSourceMap = new HashMap<>(); + } + + public void setParent(CommonAttributePanel parent){ + this.parent = parent; } public boolean isSingleDataSource(){ @@ -63,7 +66,7 @@ public class IntraCasePanel extends javax.swing.JPanel { return selectedDataSource; } else { return ""; - } + } } public Map getDataSourceMap(){ @@ -207,10 +210,10 @@ public class IntraCasePanel extends javax.swing.JPanel { return false; } else { return true; - } + } } String getErrorMessage() { return this.errorMessage; } -} \ No newline at end of file +} diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java index 66a7106c63..9486a9e43c 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java @@ -44,8 +44,8 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri * @param filterByDocMimeType * @throws EamDbException */ - public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(dataSourceIdMap,filterByMediaMimeType, filterByDocMimeType); + public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(filterByMediaMimeType, filterByDocMimeType); this.corrleationCaseId = correlationCaseId; this.correlationCaseName = ""; diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java index a117e487e1..030f53ed31 100755 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java @@ -852,6 +852,50 @@ public class CentralRepoDatamodelTest extends TestCase { Exceptions.printStackTrace(ex); Assert.fail(ex); } + + // Test getting common instances with expected results + try { + List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash)); + assertTrue("getArtifactInstancesByCaseValues returned " + instances.size() + " results - expected 5", instances.size() == 5); + + // This test works because all the instances of this hash were set to the same path + for (CentralRepositoryFile inst : instances) { + if(inst.getValue().equals(inAllDataSourcesHash)) { + assertTrue("getArtifactInstancesByCaseValues returned instance with unexpected path " + inst.getFilePath(), + inAllDataSourcesPath.equalsIgnoreCase(inst.getFilePath())); + } + else if(inst.getValue().equals(inDataSource1twiceHash)) { + assertTrue("getArtifactInstancesByCaseValues returned instance with unexpected path " + inst.getFilePath(), + inDataSource1twicePath1.equalsIgnoreCase(inst.getFilePath()) || inDataSource1twicePath2.equalsIgnoreCase(inst.getFilePath())); + } + } + } catch (EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + + // Test getting instances expecting no results because they are not in the case + try { + CorrelationCase badCase = new CorrelationCase("badCaseUuid", "badCaseName"); + List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(badCase, Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash), 0); + + assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty()); + } catch (EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + + + // Test getting instances expecting no results because of bad hashes + try { + List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(Arrays.asList("xyz", "123")); + + assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty()); + } catch (EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + // Test getting instances expecting no results try { @@ -880,6 +924,17 @@ public class CentralRepoDatamodelTest extends TestCase { Exceptions.printStackTrace(ex); Assert.fail(ex); } + + // Test getting instances with null value + // Should just return nothing + try { + List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null); + + assertTrue("getArtifactInstancesByTypeValue returned non-empty list for null value", instances.isEmpty()); + } catch (EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } // Test getting instances with path that should produce results try { diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java new file mode 100644 index 0000000000..754e96dd0f --- /dev/null +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java @@ -0,0 +1,466 @@ +/* + * + * Autopsy Forensic Browser + * + * Copyright 2018 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.commonfilessearch; + +import java.sql.SQLException; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; +import junit.framework.Test; +import org.netbeans.junit.NbModuleSuite; +import org.netbeans.junit.NbTestCase; +import org.openide.util.Exceptions; +import org.python.icu.impl.Assert; +import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; +import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; +import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; +import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher; +import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; +import org.sleuthkit.autopsy.commonfilesearch.SingleIntraCaseCommonAttributeSearcher; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.*; +import org.sleuthkit.autopsy.ingest.IngestJobSettings; +import org.sleuthkit.autopsy.ingest.IngestJobSettings.IngestType; +import org.sleuthkit.autopsy.ingest.IngestModuleTemplate; +import org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory; +import org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory; +import org.sleuthkit.autopsy.testutils.IngestUtils; +import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.TskCoreException; + +/** + * Add set 1, set 2, set 3, and set 4 to case and ingest with hash algorithm. + */ +public class IngestedWithHashAndFileType extends NbTestCase { + + public static Test suite() { + NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(IngestedWithHashAndFileType.class). + clusters(".*"). + enableModules(".*"); + return conf.suite(); + } + + private final IntraCaseUtils utils; + + public IngestedWithHashAndFileType(String name) { + super(name); + + this.utils = new IntraCaseUtils(this, "IngestedWithHashAndFileTypeTests"); + } + + @Override + public void setUp() { + this.utils.setUp(); + + IngestModuleTemplate hashLookupTemplate = IngestUtils.getIngestModuleTemplate(new HashLookupModuleFactory()); + IngestModuleTemplate mimeTypeLookupTemplate = IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()); + + ArrayList templates = new ArrayList<>(); + templates.add(hashLookupTemplate); + templates.add(mimeTypeLookupTemplate); + + IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestedWithHashAndFileType.class.getCanonicalName(), IngestType.FILES_ONLY, templates); + + try { + IngestUtils.runIngestJob(Case.getCurrentCaseThrows().getDataSources(), ingestJobSettings); + } catch (NoCurrentCaseException | TskCoreException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + @Override + public void tearDown() { + this.utils.tearDown(); + } + + /** + * Find all matches & all file types. Confirm file.jpg is found on all three + * and file.docx is found on two. + */ + public void testOneA() { + try { + Map dataSources = this.utils.getDataSourceMap(); + + AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); + CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); + + Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); + + List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find all matches & only image types. Confirm file.jpg is found on all + * three. + */ + public void testOneB() { + try { + Map dataSources = this.utils.getDataSourceMap(); + + AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); + CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find all matches & only image types. Confirm file.jpg is found on all + * three. + */ + public void testOneC() { + try { + Map dataSources = this.utils.getDataSourceMap(); + + AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, true); + CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find matches on set 1 & all file types. Confirm same results. + * + */ + public void testTwoA() { + try { + Map dataSources = this.utils.getDataSourceMap(); + Long first = getDataSourceIdByName(SET1, dataSources); + + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, false); + CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find matches on set 1 & only media types. Confirm same results. + * + */ + public void testTwoB() { + try { + Map dataSources = this.utils.getDataSourceMap(); + Long first = getDataSourceIdByName(SET1, dataSources); + + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, true, false); + CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find matches on set 1 & all file types. Confirm same results. + * + */ + public void testTwoC() { + try { + Map dataSources = this.utils.getDataSourceMap(); + Long first = getDataSourceIdByName(SET1, dataSources); + + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, true); + CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find matches on set 2 & all file types: Confirm file.jpg. + * + */ + public void testThree() { + try { + Map dataSources = this.utils.getDataSourceMap(); + Long second = getDataSourceIdByName(SET2, dataSources); + + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(second, dataSources, false, false); + CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find matches on set 4 & all file types: Confirm nothing is found. + */ + public void testFour() { + try { + Map dataSources = this.utils.getDataSourceMap(); + Long last = getDataSourceIdByName(SET4, dataSources); + + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(last, dataSources, false, false); + CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Find matches on set 3 & all file types: Confirm file.jpg and file.docx. + */ + public void testFive() { + try { + Map dataSources = this.utils.getDataSourceMap(); + Long third = getDataSourceIdByName(SET3, dataSources); + + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, false, false); + CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); + + Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); + + List files = getFiles(objectIdToDataSource.keySet()); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); + + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); + assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); + + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } +} diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java index d758e8c935..411f7cda19 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java @@ -19,21 +19,17 @@ */ package org.sleuthkit.autopsy.commonfilessearch; -import java.util.Map; import junit.framework.Test; import org.netbeans.junit.NbModuleSuite; import org.netbeans.junit.NbTestCase; import org.openide.util.Exceptions; import org.python.icu.impl.Assert; +import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.AllInterCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; -import org.sleuthkit.autopsy.commonfilesearch.SingleInterCaseCommonAttributeSearcher; -import static org.sleuthkit.autopsy.commonfilessearch.InterCaseTestUtils.*; /** - * Tests with case 3 as the current case. - * * If I use the search all cases option: One node for Hash A (1_1_A.jpg, * 1_2_A.jpg, 3_1_A.jpg) If I search for matches only in Case 1: One node for * Hash A (1_1_A.jpg, 1_2_A.jpg, 3_1_A.jpg) If I search for matches only in Case @@ -42,8 +38,10 @@ import static org.sleuthkit.autopsy.commonfilessearch.InterCaseTestUtils.*; */ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { - private final InterCaseTestUtils utils; - + private final InterCaseUtils utils; + + private Case currentCase; + public static Test suite() { NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(IngestedWithHashAndFileTypeInterCaseTests.class). clusters(".*"). @@ -53,7 +51,7 @@ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { public IngestedWithHashAndFileTypeInterCaseTests(String name) { super(name); - this.utils = new InterCaseTestUtils(this); + this.utils = new InterCaseUtils(this); } @Override @@ -61,7 +59,7 @@ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { this.utils.clearTestDir(); try { this.utils.enableCentralRepo(); - this.utils.createCases(this.utils.getIngestSettingsForHashAndFileType(), InterCaseTestUtils.CASE3); + this.currentCase = this.utils.createCases(this.utils.getIngestSettingsForHashAndFileType(), InterCaseUtils.CASE3); } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); @@ -70,107 +68,24 @@ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { @Override public void tearDown(){ - this.utils.clearTestDir(); this.utils.tearDown(); } /** - * Search All cases with no file type filtering. + * Search All + * + * One node for Hash A (1_1_A.jpg, 1_2_A.jpg, 3_1_A.jpg) */ public void testOne() { try { - Map dataSources = this.utils.getDataSourceMap(); - //note that the params false and false are presently meaningless because that feature is not supported yet - AbstractCommonAttributeSearcher builder = new AllInterCaseCommonAttributeSearcher(dataSources, false, false); + AbstractCommonAttributeSearcher builder = new AllInterCaseCommonAttributeSearcher(false, false); CommonAttributeSearchResults metadata = builder.findFiles(); assertTrue("Results should not be empty", metadata.size() != 0); - //case 1 data set 1 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_1, CASE1, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_1, CASE1, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_1, CASE1, 1)); - - //case 1 data set 2 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_2, CASE1, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_2, CASE1, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_2, CASE1, 1)); - - //case 2 data set 1 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_PDF, CASE2_DATASET_1, CASE2, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_JPG, CASE2_DATASET_1, CASE2, 0)); - - //case 2 data set 2 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE2_DATASET_2, CASE2, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE2_DATASET_2, CASE2, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE2_DATASET_2, CASE2, 1)); - - //case 3 data set 1 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE3_DATASET_1, CASE3, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE3_DATASET_1, CASE3, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_1, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_1, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_JPG, CASE3_DATASET_1, CASE3, 0)); - - //case 3 data set 2 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_2, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_2, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE3_DATASET_2, CASE3, 1)); - - - } catch (Exception ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Search All cases with no file type filtering. - */ - public void testTwo() { - try { - Map dataSources = this.utils.getDataSourceMap(); - - int matchesMustAlsoBeFoundInThisCase = this.utils.getCaseMap().get(CASE2); - - AbstractCommonAttributeSearcher builder = new SingleInterCaseCommonAttributeSearcher(matchesMustAlsoBeFoundInThisCase, dataSources, false, false); - - CommonAttributeSearchResults metadata = builder.findFiles(); - - assertTrue("Results should not be empty", metadata.size() != 0); - - //case 1 data set 1 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_1, CASE1, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_1, CASE1, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_1, CASE1, 1)); - - //case 1 data set 2 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_2, CASE1, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_2, CASE1, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_2, CASE1, 1)); - - //case 2 data set 1 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_PDF, CASE2_DATASET_1, CASE2, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_JPG, CASE2_DATASET_1, CASE2, 0)); - - //case 2 data set 2 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE2_DATASET_2, CASE2, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE2_DATASET_2, CASE2, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE2_DATASET_2, CASE2, 1)); - - //case 3 data set 1 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE3_DATASET_1, CASE3, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE3_DATASET_1, CASE3, 1)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_1, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_1, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_JPG, CASE3_DATASET_1, CASE3, 0)); - - //case 3 data set 2 - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_2, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_2, CASE3, 0)); - assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE3_DATASET_2, CASE3, 1)); + //assertTrue("") } catch (Exception ex) { diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java index d1a004d281..dbef8cd6ca 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java @@ -19,7 +19,6 @@ */ package org.sleuthkit.autopsy.commonfilessearch; -import java.sql.SQLException; import java.util.ArrayList; import java.util.List; import java.util.Map; @@ -30,12 +29,11 @@ import org.openide.util.Exceptions; import org.python.icu.impl.Assert; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; -import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; -import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; +import org.sleuthkit.autopsy.commonfilesearch.IntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.SingleIntraCaseCommonAttributeSearcher; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.*; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.*; import org.sleuthkit.autopsy.ingest.IngestJobSettings; import org.sleuthkit.autopsy.ingest.IngestJobSettings.IngestType; import org.sleuthkit.autopsy.ingest.IngestModuleTemplate; @@ -57,12 +55,12 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { return conf.suite(); } - private final IntraCaseTestUtils utils; + private final IntraCaseUtils utils; public IngestedWithHashAndFileTypeIntraCaseTests(String name) { super(name); - this.utils = new IntraCaseTestUtils(this, "IngestedWithHashAndFileTypeTests"); + this.utils = new IntraCaseUtils(this, "IngestedWithHashAndFileTypeTests"); } @Override @@ -99,12 +97,12 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { try { Map dataSources = this.utils.getDataSourceMap(); - AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); + IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); @@ -126,7 +124,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -140,7 +138,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { try { Map dataSources = this.utils.getDataSourceMap(); - AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); + IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -167,7 +165,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -181,7 +179,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { try { Map dataSources = this.utils.getDataSourceMap(); - AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, true); + IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, true); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -208,7 +206,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -223,7 +221,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long first = getDataSourceIdByName(SET1, dataSources); - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, false); + IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -250,7 +248,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -265,7 +263,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long first = getDataSourceIdByName(SET1, dataSources); - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, true, false); + IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, true, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -292,7 +290,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -307,7 +305,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long first = getDataSourceIdByName(SET1, dataSources); - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, true); + IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, true); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -334,7 +332,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -349,7 +347,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long second = getDataSourceIdByName(SET2, dataSources); - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(second, dataSources, false, false); + IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(second, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -376,7 +374,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -390,7 +388,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long last = getDataSourceIdByName(SET4, dataSources); - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(last, dataSources, false, false); + IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(last, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -417,7 +415,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -431,7 +429,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long third = getDataSourceIdByName(SET3, dataSources); - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, false, false); + IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -458,7 +456,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { + } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java index ce56385c61..c8f289ab72 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java @@ -59,12 +59,12 @@ public class IngestedWithNoFileTypesIntraCaseTests extends NbTestCase { return conf.suite(); } - private final IntraCaseTestUtils utils; + private final IntraCaseUtils utils; public IngestedWithNoFileTypesIntraCaseTests(String name) { super(name); - this.utils = new IntraCaseTestUtils(this, "IngestedWithNoFileTypes"); + this.utils = new IntraCaseUtils(this, "IngestedWithNoFileTypes"); } @Override @@ -102,9 +102,9 @@ public class IngestedWithNoFileTypesIntraCaseTests extends NbTestCase { IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); assertTrue(files.isEmpty()); @@ -121,14 +121,14 @@ public class IngestedWithNoFileTypesIntraCaseTests extends NbTestCase { public void testTwo() { try { Map dataSources = this.utils.getDataSourceMap(); - Long third = IntraCaseTestUtils.getDataSourceIdByName(IntraCaseTestUtils.SET3, dataSources); + Long third = IntraCaseUtils.getDataSourceIdByName(IntraCaseUtils.SET3, dataSources); IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, true, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); assertTrue(files.isEmpty()); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseUtils.java similarity index 65% rename from Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java rename to Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseUtils.java index cf6bd36fbc..bc626b6459 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseUtils.java @@ -6,7 +6,7 @@ * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this testFile except in compliance with the License. + * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 @@ -25,6 +25,7 @@ import java.nio.file.Path; import java.nio.file.Paths; import java.sql.SQLException; import java.util.ArrayList; +import java.util.Collection; import java.util.HashMap; import java.util.List; import java.util.Map; @@ -47,62 +48,50 @@ import org.sleuthkit.autopsy.testutils.IngestUtils; import org.sleuthkit.datamodel.TskCoreException; import org.python.icu.impl.Assert; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; -import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; -import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeInstance; -import org.sleuthkit.autopsy.commonfilesearch.CaseDBCommonAttributeInstanceNode; -import org.sleuthkit.autopsy.commonfilesearch.CentralRepoCommonAttributeInstance; -import org.sleuthkit.autopsy.commonfilesearch.CentralRepoCommonAttributeInstanceNode; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; import org.sleuthkit.autopsy.commonfilesearch.DataSourceLoader; +import org.sleuthkit.autopsy.commonfilesearch.CaseDBCommonAttributeInstance; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeValue; -import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; -import org.sleuthkit.datamodel.AbstractFile; /** * Utilities for testing intercase correlation feature. * - * This will be more useful when we add more flush out the intercase - * correlation features and need to add more tests. In particular, - * testing scenarios where we need different cases to be the current case - * will suggest that we create additional test classes, and we will want to - * import this utility in each new intercase test file. - * * Description of Test Data: - (Note: files of the same name and extension are identical; - files of the same name and differing extension are not identical.) - - Case 1 - +Data Set 1 - - Hash-0.dat [testFile of size 0] - - Hash-A.jpg - - Hash-A.pdf - +Data Set2 - - Hash-0.dat [testFile of size 0] - - Hash-A.jpg - - Hash-A.pdf - Case 2 - +Data Set 1 - - Hash-B.jpg - - Hash-B.pdf - +Data Set 2 - - Hash-A.jpg - - Hash-A.pdf - - Hash_D.doc - Case 3 - +Data Set 1 - - Hash-A.jpg - - Hash-A.pdf - - Hash-C.jpg - - Hash-C.pdf - - Hash-D.jpg - +Data Set 2 - - Hash-C.jpg - - Hash-C.pdf - - Hash-D.doc + * (Note: files of the same name and extension are identical; + * files of the same name and differing extension are not identical.) + * + * Case 1 + * +Data Set 1 + * - Hash-0.dat [file of size 0] + * - Hash-A.jpg + * - Hash-A.pdf + * +Data Set2 + * - Hash-0.dat [file of size -0] + * - Hash-A.jpg + * - Hash-A.pdf + * Case 2 + * +Data Set 1 + * - Hash-A.jpg + * - Hash-A.pdf + * +Data Set 2 + * - Hash-A.jpg + * - Hash-A.pdf + * - Hash_D.doc + * Case 3 + * +Data Set 1 + * - Hash-A.jpg + * - Hash-A.pdf + * - Hash-C.jpg [we should never find these!] + * - Hash-C.pdf [we should never find these!] + * - Hash-D.jpg + * +Data Set 2 + * - Hash-C.jpg [we should never find these!] + * - Hash-C.pdf + * - Hash.D-doc */ -class InterCaseTestUtils { +class InterCaseUtils { private static final Path CASE_DIRECTORY_PATH = Paths.get(System.getProperty("java.io.tmpdir"), "InterCaseCommonFilesSearchTest"); private static final String CR_DB_NAME = "testcentralrepo.db"; @@ -142,7 +131,7 @@ class InterCaseTestUtils { private final IngestJobSettings hashAndNoFileType; private final DataSourceLoader dataSourceLoader; - InterCaseTestUtils(NbTestCase testCase) { + InterCaseUtils(NbTestCase testCase) { this.case1DataSet1Path = Paths.get(testCase.getDataDir().toString(), CASE1_DATASET_1); this.case1DataSet2Path = Paths.get(testCase.getDataDir().toString(), CASE1_DATASET_2); @@ -162,13 +151,13 @@ class InterCaseTestUtils { hashAndMimeTemplate.add(mimeTypeLookupTemplate); hashAndMimeTemplate.add(eamDbTemplate); - this.hashAndFileType = new IngestJobSettings(InterCaseTestUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndMimeTemplate); + this.hashAndFileType = new IngestJobSettings(InterCaseUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndMimeTemplate); ArrayList hashAndNoMimeTemplate = new ArrayList<>(1); hashAndNoMimeTemplate.add(hashLookupTemplate); hashAndMimeTemplate.add(eamDbTemplate); - this.hashAndNoFileType = new IngestJobSettings(InterCaseTestUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndNoMimeTemplate); + this.hashAndNoFileType = new IngestJobSettings(InterCaseUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndNoMimeTemplate); this.dataSourceLoader = new DataSourceLoader(); } @@ -176,12 +165,8 @@ class InterCaseTestUtils { void clearTestDir(){ if(CASE_DIRECTORY_PATH.toFile().exists()){ try{ - if(EamDb.isEnabled()) { - EamDb.getInstance().shutdownConnections(); - } FileUtils.deleteDirectory(CASE_DIRECTORY_PATH.toFile()); - } catch(IOException | EamDbException ex){ - Exceptions.printStackTrace(ex); + } catch(IOException ex){ Assert.fail(ex); } } @@ -192,13 +177,13 @@ class InterCaseTestUtils { return this.dataSourceLoader.getDataSourceMap(); } - Map getCaseMap() throws EamDbException { + Map getCaseMap() throws EamDbException { if (EamDb.isEnabled()) { - Map mapOfCaseIdsToCase = new HashMap<>(); + Map mapOfCaseIdsToCase = new HashMap<>(); for (CorrelationCase caze : EamDb.getInstance().getCases()) { - mapOfCaseIdsToCase.put(caze.getDisplayName(), caze.getID()); + mapOfCaseIdsToCase.put(caze.getID(), caze.getDisplayName()); } return mapOfCaseIdsToCase; } else { @@ -258,7 +243,7 @@ class InterCaseTestUtils { String lastCaseName = null; Path[] lastPathsForCase = null; - //iterate over the collections above, creating cases, and storing + //iterate over the collecitons above, creating cases, and storing // just one of them for future reference for (int i = 0; i < cases.length; i++) { String caseName = cases[i]; @@ -304,71 +289,30 @@ class InterCaseTestUtils { } } - //TODO refactor static boolean verifyInstanceExistanceAndCount(CommonAttributeSearchResults searchDomain, String fileName, String dataSource, String crCase, int instanceCount){ int tally = 0; - for(Map.Entry> entry : searchDomain.getMetadata().entrySet()){ + for(Map.Entry> file : searchDomain.getMetadata().entrySet()){ - for(CommonAttributeValue value : entry.getValue()){ - - for(AbstractCommonAttributeInstance commonAttribute : value.getInstances()){ - - if(commonAttribute instanceof CentralRepoCommonAttributeInstance){ - CentralRepoCommonAttributeInstance results = (CentralRepoCommonAttributeInstance) commonAttribute; - for (DisplayableItemNode din : results.generateNodes()){ - - if(din instanceof CentralRepoCommonAttributeInstanceNode){ - - CentralRepoCommonAttributeInstanceNode node = (CentralRepoCommonAttributeInstanceNode) din; - CorrelationAttributeInstance instance = node.getCorrelationAttributeInstance(); - - final String fullPath = instance.getFilePath(); - final File testFile = new File(fullPath); - - final String testCaseName = instance.getCorrelationCase().getDisplayName(); - - final String testFileName = testFile.getName(); - - final String testDataSource = instance.getCorrelationDataSource().getName(); - - boolean sameFileName = testFileName.equalsIgnoreCase(fileName); - boolean sameDataSource = testDataSource.equalsIgnoreCase(dataSource); - boolean sameCrCase = testCaseName.equalsIgnoreCase(crCase); - - if( sameFileName && sameDataSource && sameCrCase){ - tally++; - } - } - - if(din instanceof CaseDBCommonAttributeInstanceNode){ - - CaseDBCommonAttributeInstanceNode node = (CaseDBCommonAttributeInstanceNode) din; - AbstractFile file = node.getContent(); - - final String testFileName = file.getName(); - final String testCaseName = node.getCase(); - final String testDataSource = node.getDataSource(); - - boolean sameFileName = testFileName.equalsIgnoreCase(fileName); - boolean sameCaseName = testCaseName.equalsIgnoreCase(crCase); - boolean sameDataSource = testDataSource.equalsIgnoreCase(dataSource); - - if(sameFileName && sameDataSource && sameCaseName){ - tally++; - } - } - } - } else { - Assert.fail("Unable to cast AbstractCommonAttributeInstanceNode to InterCaseCommonAttributeSearchResults."); - } - } - } + //Collection fileInstances = file.getValue(); + +// for(IntraCaseCommonAttributeSearchResults fileInstance : fileInstances){ +// +// +// } } - return tally == instanceCount; + return false; } + + static Map mapFileInstancesToDataSource(CommonAttributeSearchResults metadata){ + return IntraCaseUtils.mapFileInstancesToDataSources(metadata); + } + +// static List getFiles(Set md5s){ +// +// } /** * Close the currently open case, delete the case directory, delete the diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseTestUtils.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseUtils.java similarity index 98% rename from Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseTestUtils.java rename to Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseUtils.java index 82c38cdf56..035a16a0ed 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseTestUtils.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseUtils.java @@ -68,7 +68,7 @@ import org.sleuthkit.datamodel.TskCoreException; * set 4 * - file.dat (empty file) */ -class IntraCaseTestUtils { +class IntraCaseUtils { private static final String CASE_NAME = "IntraCaseCommonFilesSearchTest"; static final Path CASE_DIRECTORY_PATH = Paths.get(System.getProperty("java.io.tmpdir"), CASE_NAME); @@ -92,7 +92,7 @@ class IntraCaseTestUtils { private final String caseName; - IntraCaseTestUtils(NbTestCase nbTestCase, String caseName){ + IntraCaseUtils(NbTestCase nbTestCase, String caseName){ this.imagePath1 = Paths.get(nbTestCase.getDataDir().toString(), SET1); this.imagePath2 = Paths.get(nbTestCase.getDataDir().toString(), SET2); this.imagePath3 = Paths.get(nbTestCase.getDataDir().toString(), SET3); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSourcesIntraCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSources.java similarity index 74% rename from Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSourcesIntraCaseTests.java rename to Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSources.java index f4c397af8d..4f5fbee9fb 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSourcesIntraCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSources.java @@ -35,7 +35,7 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.*; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.*; import org.sleuthkit.autopsy.ingest.IngestJobSettings; import org.sleuthkit.autopsy.ingest.IngestModuleTemplate; import org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory; @@ -53,21 +53,21 @@ import org.sleuthkit.datamodel.TskCoreException; * * None of the test files should be found in the results of this test. */ -public class MatchesInAtLeastTwoSourcesIntraCaseTests extends NbTestCase { +public class MatchesInAtLeastTwoSources extends NbTestCase { public static Test suite() { - NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(MatchesInAtLeastTwoSourcesIntraCaseTests.class). + NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(MatchesInAtLeastTwoSources.class). clusters(".*"). enableModules(".*"); return conf.suite(); } - private final IntraCaseTestUtils utils; + private final IntraCaseUtils utils; - public MatchesInAtLeastTwoSourcesIntraCaseTests(String name) { + public MatchesInAtLeastTwoSources(String name) { super(name); - this.utils = new IntraCaseTestUtils(this, "MatchesInAtLeastTwoSources"); + this.utils = new IntraCaseUtils(this, "MatchesInAtLeastTwoSources"); } @Override @@ -86,7 +86,7 @@ public class MatchesInAtLeastTwoSourcesIntraCaseTests extends NbTestCase { templates.add(hashLookupTemplate); templates.add(mimeTypeLookupTemplate); - IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestedWithHashAndFileTypeIntraCaseTests.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates); + IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestedWithHashAndFileType.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates); try { IngestUtils.runIngestJob(Case.getCurrentCaseThrows().getDataSources(), ingestJobSettings); @@ -108,18 +108,18 @@ public class MatchesInAtLeastTwoSourcesIntraCaseTests extends NbTestCase { AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); - assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET1, 0)); - assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET4, 0)); + assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET1, 0)); + assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET4, 0)); - assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET1, 0)); - assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET4, 0)); + assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET1, 0)); + assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET4, 0)); - assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET1, 0)); - assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET4, 0)); + assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET1, 0)); + assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET4, 0)); } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java new file mode 100644 index 0000000000..03b12c83c3 --- /dev/null +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java @@ -0,0 +1,85 @@ +/* + * + * Autopsy Forensic Browser + * + * Copyright 2018 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.commonfilessearch; + +import junit.framework.Test; +import org.netbeans.junit.NbModuleSuite; +import org.netbeans.junit.NbTestCase; +import org.openide.util.Exceptions; +import org.sleuthkit.datamodel.TskCoreException; +import org.python.icu.impl.Assert; +import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; +import org.sleuthkit.autopsy.commonfilesearch.AllInterCaseCommonAttributeSearcher; +import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; + +/** + * + * Just make sure nothing explodes when we run the feature in the absence of + * the Central Repo. This should be considered 'defensive' as it should not be + * possible to even run the feature if the CR is not available. + * + */ +public class NoCentralRepoEnabledInterCaseTests extends NbTestCase { + + private final InterCaseUtils utils; + + private Case currentCase; + + public static Test suite() { + NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(NoCentralRepoEnabledInterCaseTests.class). + clusters(".*"). + enableModules(".*"); + return conf.suite(); + } + + public NoCentralRepoEnabledInterCaseTests(String name) { + super(name); + this.utils = new InterCaseUtils(this); + } + + @Override + public void setUp() { + try { + this.currentCase = this.utils.createCases(this.utils.getIngestSettingsForHashAndFileType(), InterCaseUtils.CASE1); + } catch (TskCoreException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + @Override + public void tearDown() { + this.utils.tearDown(); + } + + public void testOne() { + try { + AbstractCommonAttributeSearcher builder = new AllInterCaseCommonAttributeSearcher(false, false); + + CommonAttributeSearchResults metadata = builder.findFiles(); + + assertTrue("Should be no results.", metadata.size() == 0); + } catch (Exception ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } +} diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java index 26c0d66296..015ee9d4b3 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java @@ -30,8 +30,8 @@ import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearche import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; import org.sleuthkit.autopsy.commonfilesearch.IntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.SingleIntraCaseCommonAttributeSearcher; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.SET1; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.getDataSourceIdByName; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.SET1; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.getDataSourceIdByName; /** * Test that cases which are created but have not run any ingest modules turn up @@ -51,12 +51,12 @@ public class UningestedCasesIntraCaseTests extends NbTestCase { return conf.suite(); } - private final IntraCaseTestUtils utils; + private final IntraCaseUtils utils; public UningestedCasesIntraCaseTests(String name) { super(name); - this.utils = new IntraCaseTestUtils(this, "UningestedCasesTests"); + this.utils = new IntraCaseUtils(this, "UningestedCasesTests"); } @Override From 7a60aba42946e881a20f82d8eb1636203e0b24de Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Fri, 3 Aug 2018 11:15:28 -0400 Subject: [PATCH 15/17] Revert "Revert "4072 remove cache"" --- .../AbstractCommonAttributeInstance.java | 71 +-- .../AbstractCommonAttributeSearcher.java | 9 +- .../AllInterCaseCommonAttributeSearcher.java | 12 +- .../CaseDBCommonAttributeInstance.java | 7 +- .../CaseDBCommonAttributeInstanceNode.java | 4 +- .../CentralRepoCommonAttributeInstance.java | 102 ++-- ...entralRepoCommonAttributeInstanceNode.java | 29 +- .../CommonAttributePanel.java | 4 +- .../CommonAttributeSearchResultRootNode.java | 2 +- .../CommonAttributeSearchResults.java | 26 +- .../CommonAttributeValue.java | 5 - .../InterCaseCommonAttributeSearcher.java | 46 +- .../commonfilesearch/InterCasePanel.java | 7 +- .../IntraCaseCommonAttributeSearcher.java | 15 +- .../commonfilesearch/IntraCasePanel.java | 15 +- ...ingleInterCaseCommonAttributeSearcher.java | 4 +- .../datamodel/CentralRepoDatamodelTest.java | 55 --- .../IngestedWithHashAndFileType.java | 466 ------------------ ...stedWithHashAndFileTypeInterCaseTests.java | 109 +++- ...stedWithHashAndFileTypeIntraCaseTests.java | 50 +- ...IngestedWithNoFileTypesIntraCaseTests.java | 14 +- ...CaseUtils.java => InterCaseTestUtils.java} | 174 ++++--- ...CaseUtils.java => IntraCaseTestUtils.java} | 4 +- ...hesInAtLeastTwoSourcesIntraCaseTests.java} | 30 +- .../NoCentralRepoEnabledInterCaseTests.java | 85 ---- .../UningestedCasesIntraCaseTests.java | 8 +- 26 files changed, 430 insertions(+), 923 deletions(-) delete mode 100644 Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java rename Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/{InterCaseUtils.java => InterCaseTestUtils.java} (65%) rename Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/{IntraCaseUtils.java => IntraCaseTestUtils.java} (98%) rename Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/{MatchesInAtLeastTwoSources.java => MatchesInAtLeastTwoSourcesIntraCaseTests.java} (74%) delete mode 100644 Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java index 6f445ca0a3..61e8aee1f4 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java @@ -19,7 +19,7 @@ */ package org.sleuthkit.autopsy.commonfilesearch; -import java.util.Map; +import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.datamodel.AbstractFile; @@ -27,9 +27,9 @@ import org.sleuthkit.datamodel.TskCoreException; /** * Represents an instance in either the CaseDB or CR that had a common match. - * Different implementations know how to get the instance details from either + * Different implementations know how to get the instance details from either * CaseDB or CR. - * + * * Defines leaf-type nodes used in the Common Files Search results tree. Leaf * nodes, may describe common attributes which exist in the current case DB or * in the Central Repo. When a reference to the AbstractFile is lacking (such as @@ -41,8 +41,6 @@ import org.sleuthkit.datamodel.TskCoreException; public abstract class AbstractCommonAttributeInstance { private final Long abstractFileObjectId; - // maps object ID to file - private final Map cachedFiles; private final String caseName; private final String dataSource; @@ -56,9 +54,8 @@ public abstract class AbstractCommonAttributeInstance { * @param dataSource datasource where this attribute appears * @param caseName case where this attribute appears */ - AbstractCommonAttributeInstance(Long abstractFileReference, Map cachedFiles, String dataSource, String caseName) { + AbstractCommonAttributeInstance(Long abstractFileReference, String dataSource, String caseName) { this.abstractFileObjectId = abstractFileReference; - this.cachedFiles = cachedFiles; this.caseName = caseName; this.dataSource = dataSource; } @@ -70,38 +67,18 @@ public abstract class AbstractCommonAttributeInstance { * @param cachedFiles storage for abstract files which have been used * already so we can avoid extra roundtrips to the case db */ - AbstractCommonAttributeInstance(Map cachedFiles) { + AbstractCommonAttributeInstance() { this.abstractFileObjectId = -1L; - this.cachedFiles = cachedFiles; this.caseName = ""; this.dataSource = ""; } /** - * Grab a cached instance of the AbstractFile or grab one from the - * SleuthkitCase. Use this in implementations of generateNodes. + * Get an AbstractFile for this instance if it can be retrieved from the + * CaseDB. * - * @return AbstractFile which is identical to the file instance generated by - * implementations of this object - */ - protected AbstractFile lookupOrLoadAbstractFile() { - if (this.cachedFiles.containsKey(this.getAbstractFileObjectId())) { - return this.cachedFiles.get(this.getAbstractFileObjectId()); - } else { - AbstractFile file = this.getAbstractFile(); - final long abstractFileId = file.getId(); - this.cachedFiles.put(abstractFileId, file); - return file; - } - } - - /** - * Get an AbstractFile for this instance if it can be retrieved from - * the CaseDB. - * - * @return AbstractFile corresponding to this common attribute or null if - * it cannot be found - * @@@ Consider throwing exception instead of NULL + * @return AbstractFile corresponding to this common attribute or null if it + * cannot be found (for example, in the event that this is a central repo file) */ abstract AbstractFile getAbstractFile(); @@ -162,36 +139,24 @@ public abstract class AbstractCommonAttributeInstance { * * @param attributeInstance common file attribute instance form the central * repo - * @param equivalentAbstractFile an AbstractFile which is equivalent to the - * file in which the attribute instance was found + * @param abstractFile an AbstractFile from which the attribute instance was + * found - applies to CaseDbCommonAttributeInstance only * @param currentCaseName * @return the appropriate leaf node for the results tree * @throws TskCoreException */ - static DisplayableItemNode createInstance(CorrelationAttributeInstance attributeInstance, AbstractFile equivalentAbstractFile, String currentCaseName) throws TskCoreException { + static DisplayableItemNode createNode(CorrelationAttribute attribute, AbstractFile abstractFile, String currentCaseName) throws TskCoreException { DisplayableItemNode leafNode; + CorrelationAttributeInstance attributeInstance = attribute.getInstances().get(0); - final String attributeDataSourceName = attributeInstance.getCorrelationDataSource().getName(); - final String abstractFileDataSourceName = equivalentAbstractFile.getDataSource().getName(); - - final String attributeInstanceCaseName = attributeInstance.getCorrelationCase().getDisplayName(); - - final String attributeInstanceFullPath = attributeInstance.getFilePath().replace("\\", "/"); - - final String currentAbstractFileParentPath = equivalentAbstractFile.getParentPath(); - final String currentAbstractFileName = equivalentAbstractFile.getName(); - final String abstractFileFullPath = (currentAbstractFileParentPath + currentAbstractFileName).replace("\\", "/"); - - final boolean sameCase = attributeInstanceCaseName.equalsIgnoreCase(currentCaseName); - final boolean sameFileName = attributeInstanceFullPath.equalsIgnoreCase(abstractFileFullPath); - final boolean sameDataSource = attributeDataSourceName.equalsIgnoreCase(abstractFileDataSourceName); - - if (sameCase && sameFileName && sameDataSource) { - leafNode = new CaseDBCommonAttributeInstanceNode(equivalentAbstractFile, currentCaseName, abstractFileDataSourceName); + if (abstractFile == null) { + leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance); } else { - leafNode = new CentralRepoCommonAttributeInstanceNode(attributeInstance, equivalentAbstractFile); + final String abstractFileDataSourceName = abstractFile.getDataSource().getName(); + leafNode = new CaseDBCommonAttributeInstanceNode(abstractFile, currentCaseName, abstractFileDataSourceName); } + return leafNode; } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java index fb8cbd312d..97456bda04 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java @@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.sql.SQLException; import java.util.ArrayList; +import java.util.Collections; import java.util.List; import java.util.Map; import java.util.Set; @@ -38,12 +39,18 @@ import org.sleuthkit.datamodel.TskCoreException; */ public abstract class AbstractCommonAttributeSearcher { + private final Map dataSourceIdToNameMap; private boolean filterByMedia; private boolean filterByDoc; - AbstractCommonAttributeSearcher(boolean filterByMedia, boolean filterByDoc){ + AbstractCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMedia, boolean filterByDoc){ this.filterByDoc = filterByDoc; this.filterByMedia = filterByMedia; + this.dataSourceIdToNameMap = dataSourceIdMap; + } + + Map getDataSourceIdToNameMap(){ + return Collections.unmodifiableMap(this.dataSourceIdToNameMap); } /** diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java index 74e3aabb2a..7e039a9419 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java @@ -33,8 +33,16 @@ import org.sleuthkit.datamodel.TskCoreException; */ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttributeSearcher { - public AllInterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(filterByMediaMimeType, filterByDocMimeType); + /** + * + * @param filterByMediaMimeType match only on files whose mime types can be + * broadly categorized as media types + * @param filterByDocMimeType match only on files whose mime types can be + * broadly categorized as document types + * @throws EamDbException + */ + public AllInterCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); } @Override diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java index 74363a869b..994df4c66a 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstance.java @@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.Arrays; -import java.util.Map; import java.util.logging.Level; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -45,13 +44,13 @@ final public class CaseDBCommonAttributeInstance extends AbstractCommonAttribute * @param objectId id of abstract file to find * @param dataSourceName name of datasource where the object is found */ - CaseDBCommonAttributeInstance(Long abstractFileReference, Map cachedFiles, String dataSource, String caseName) { - super(abstractFileReference, cachedFiles, dataSource, caseName); + CaseDBCommonAttributeInstance(Long abstractFileReference, String dataSource, String caseName) { + super(abstractFileReference, dataSource, caseName); } @Override public DisplayableItemNode[] generateNodes() { - final CaseDBCommonAttributeInstanceNode intraCaseCommonAttributeInstanceNode = new CaseDBCommonAttributeInstanceNode(this.lookupOrLoadAbstractFile(), this.getCaseName(), this.getDataSource()); + final CaseDBCommonAttributeInstanceNode intraCaseCommonAttributeInstanceNode = new CaseDBCommonAttributeInstanceNode(this.getAbstractFile(), this.getCaseName(), this.getDataSource()); return Arrays.asList(intraCaseCommonAttributeInstanceNode).toArray(new DisplayableItemNode[1]); } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java index 59e5318801..f321b7a72a 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CaseDBCommonAttributeInstanceNode.java @@ -58,11 +58,11 @@ public class CaseDBCommonAttributeInstanceNode extends FileNode { return visitor.visit(this); } - String getCase(){ + public String getCase(){ return this.caseName; } - String getDataSource() { + public String getDataSource() { return this.dataSource; } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java index d154e6f1df..0e70722b6d 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstance.java @@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.io.File; import java.util.ArrayList; +import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.logging.Level; @@ -35,75 +36,102 @@ import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskCoreException; /** - * Represents that a row in the CR was found in multiple cases. - * + * Represents that a row in the CR was found in multiple cases. + * * Generates a DisplayableItmeNode using a CentralRepositoryFile. */ final public class CentralRepoCommonAttributeInstance extends AbstractCommonAttributeInstance { private static final Logger LOGGER = Logger.getLogger(CentralRepoCommonAttributeInstance.class.getName()); private final Integer crFileId; - private CorrelationAttributeInstance currentAttributeInstance; + private CorrelationAttribute currentAttribute; + private final Map dataSourceNameToIdMap; - CentralRepoCommonAttributeInstance(Integer attrInstId, Map cachedFiles) { - super(cachedFiles); + CentralRepoCommonAttributeInstance(Integer attrInstId, Map dataSourceIdToNameMap) { + super(); this.crFileId = attrInstId; + this.dataSourceNameToIdMap = invertMap(dataSourceIdToNameMap); } - - void setCurrentAttributeInst(CorrelationAttributeInstance attributeInstance) { - this.currentAttributeInstance = attributeInstance; + + void setCurrentAttributeInst(CorrelationAttribute attribute) { + this.currentAttribute = attribute; } @Override AbstractFile getAbstractFile() { Case currentCase; - // @@@ Need to CHeck for NULL. This seems to depend on generateNodes to be called first - String currentFullPath = this.currentAttributeInstance.getFilePath(); + if (this.currentAttribute != null) { + + final CorrelationAttributeInstance currentAttributeInstance = this.currentAttribute.getInstances().get(0); + + String currentFullPath = currentAttributeInstance.getFilePath(); + String currentDataSource = currentAttributeInstance.getCorrelationDataSource().getName(); + + + if(this.dataSourceNameToIdMap.containsKey(currentDataSource)){ + Long dataSourceObjectId = this.dataSourceNameToIdMap.get(currentDataSource); + + try { + currentCase = Case.getCurrentCaseThrows(); - try { - currentCase = Case.getCurrentCaseThrows(); + SleuthkitCase tskDb = currentCase.getSleuthkitCase(); - SleuthkitCase tskDb = currentCase.getSleuthkitCase(); - File fileFromPath = new File(currentFullPath); - String fileName = fileFromPath.getName(); - //TODO this seems like a flaw - we maybe need to look at all of these not just the first - //i think we should search by md5 and return all of them - AbstractFile abstractFile = tskDb.findAllFilesWhere(String.format("lower(name) = '%s'", fileName)).get(0); + File fileFromPath = new File(currentFullPath); + String fileName = fileFromPath.getName(); + String parentPath = (fileFromPath.getParent() + File.separator).replace("\\", "/"); - return abstractFile; + final String whereClause = String.format("lower(name) = '%s' AND md5 = '%s' AND lower(parent_path) = '%s' AND data_source_obj_id = %s", fileName, currentAttribute.getCorrelationValue(), parentPath, dataSourceObjectId); + List potentialAbstractFiles = tskDb.findAllFilesWhere(whereClause); - } catch (TskCoreException | NoCurrentCaseException ex) { - LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex); - return null; + if(potentialAbstractFiles.isEmpty()){ + return null; + } else if(potentialAbstractFiles.size() > 1){ + LOGGER.log(Level.WARNING, String.format("Unable to find an exact match for AbstractFile for record with filePath: %s. May have returned the wrong file.", new Object[]{currentFullPath})); + return potentialAbstractFiles.get(0); + } else { + return potentialAbstractFiles.get(0); + } + + } catch (TskCoreException | NoCurrentCaseException ex) { + LOGGER.log(Level.SEVERE, String.format("Unable to find AbstractFile for record with filePath: %s. Node not created.", new Object[]{currentFullPath}), ex); + return null; + } + } else { + return null; + } } + return null; } @Override public DisplayableItemNode[] generateNodes() { - + // @@@ We should be doing more of this work in teh generateKeys method. We want to do as little as possible in generateNodes - InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); CorrelationAttribute corrAttr = eamDbAttrInst.findSingleCorrelationAttribute(crFileId); List attrInstNodeList = new ArrayList<>(0); String currCaseDbName = Case.getCurrentCase().getDisplayName(); - - // @@@ This seems wrong that we are looping here, but only setting one attrInst in the class, which is then used by getAbstractFile(). - for (CorrelationAttributeInstance attrInst : corrAttr.getInstances()) { - try { - this.setCurrentAttributeInst(attrInst); - - AbstractFile equivalentAbstractFile = this.lookupOrLoadAbstractFile(); - - DisplayableItemNode generatedInstNode = AbstractCommonAttributeInstance.createInstance(attrInst, equivalentAbstractFile, currCaseDbName); - attrInstNodeList.add(generatedInstNode); + try { + this.setCurrentAttributeInst(corrAttr); - } catch (TskCoreException ex) { - LOGGER.log(Level.SEVERE, String.format("Unable to get DataSource for record with filePath: %s. Node not created.", new Object[]{attrInst.getFilePath()}), ex); - } + AbstractFile abstractFileForAttributeInstance = this.getAbstractFile(); + DisplayableItemNode generatedInstNode = AbstractCommonAttributeInstance.createNode(corrAttr, abstractFileForAttributeInstance, currCaseDbName); + attrInstNodeList.add(generatedInstNode); + + } catch (TskCoreException ex) { + LOGGER.log(Level.SEVERE, String.format("Unable to get DataSource for record with md5: %s. Node not created.", new Object[]{corrAttr.getCorrelationValue()}), ex); } + return attrInstNodeList.toArray(new DisplayableItemNode[attrInstNodeList.size()]); } + + private Map invertMap(Map dataSourceIdToNameMap) { + HashMap invertedMap = new HashMap<>(); + for (Map.Entry entry : dataSourceIdToNameMap.entrySet()){ + invertedMap.put(entry.getValue(), entry.getKey()); + } + return invertedMap; + } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java index ea5b19950c..e0b8e928d7 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CentralRepoCommonAttributeInstanceNode.java @@ -31,8 +31,6 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeIns import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor; import org.sleuthkit.autopsy.datamodel.NodeProperty; -import org.sleuthkit.datamodel.AbstractFile; -import org.sleuthkit.datamodel.Content; /** * Used by the Common Files search feature to encapsulate instances of a given @@ -46,25 +44,16 @@ public class CentralRepoCommonAttributeInstanceNode extends DisplayableItemNode private final CorrelationAttributeInstance crFile; - //this may not be the same file, but at least it is identical, - // and we can use this to support certain actions in the tree table and crFile viewer - private final AbstractFile md5Reference; - - CentralRepoCommonAttributeInstanceNode(CorrelationAttributeInstance content, AbstractFile md5Reference) { - super(Children.LEAF, Lookups.fixed(content)); // Using md5Reference enables Other Occurances, but for the current file path + CentralRepoCommonAttributeInstanceNode(CorrelationAttributeInstance content) { + super(Children.LEAF, Lookups.fixed(content)); this.crFile = content; this.setDisplayName(new File(this.crFile.getFilePath()).getName()); - this.md5Reference = md5Reference; } - public CorrelationAttributeInstance getCentralRepoFile(){ + public CorrelationAttributeInstance getCorrelationAttributeInstance(){ return this.crFile; } - public Content getContent(){ - return this.md5Reference; - } - @Override public Action[] getActions(boolean context){ List actionsList = new ArrayList<>(); @@ -101,24 +90,24 @@ public class CentralRepoCommonAttributeInstanceNode extends DisplayableItemNode sheet.put(sheetSet); } - final CorrelationAttributeInstance centralRepoFile = this.getCentralRepoFile(); + final CorrelationAttributeInstance centralRepoFile = this.getCorrelationAttributeInstance(); final String fullPath = centralRepoFile.getFilePath(); final File file = new File(fullPath); - + final String caseName = centralRepoFile.getCorrelationCase().getDisplayName(); - + final String name = file.getName(); final String parent = file.getParent(); - - final String caseQualifiedDataSource = centralRepoFile.getCorrelationDataSource().getName(); + + final String dataSourceName = centralRepoFile.getCorrelationDataSource().getName(); final String NO_DESCR = Bundle.CommonFilesSearchResultsViewerTable_noDescText(); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_filesColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_filesColLbl(), NO_DESCR, name)); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_pathColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_pathColLbl(), NO_DESCR, parent)); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_hashsetHitsColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_hashsetHitsColLbl(), NO_DESCR, "")); - sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), NO_DESCR, caseQualifiedDataSource)); + sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_dataSourceColLbl(), NO_DESCR, dataSourceName)); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_mimeTypeColLbl(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_mimeTypeColLbl(), NO_DESCR, "")); sheetSet.put(new NodeProperty<>(org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_caseColLbl1(), org.sleuthkit.autopsy.commonfilesearch.Bundle.CommonFilesSearchResultsViewerTable_caseColLbl1(), NO_DESCR, caseName)); diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java index c83876f3ce..1b33bb9422 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java @@ -157,9 +157,9 @@ public final class CommonAttributePanel extends javax.swing.JDialog { if (CommonAttributePanel.this.interCaseRadio.isSelected()) { if (caseId == InterCasePanel.NO_CASE_SELECTED) { - builder = new AllInterCaseCommonAttributeSearcher(filterByMedia, filterByDocuments); + builder = new AllInterCaseCommonAttributeSearcher(intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments); } else { - builder = new SingleInterCaseCommonAttributeSearcher(caseId, filterByMedia, filterByDocuments); + builder = new SingleInterCaseCommonAttributeSearcher(caseId, intraCasePanel.getDataSourceMap(), filterByMedia, filterByDocuments); } } else { if (dataSourceId == CommonAttributePanel.NO_DATA_SOURCE_SELECTED) { diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java index 066a780afb..8e33401af7 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResultRootNode.java @@ -86,6 +86,6 @@ final public class CommonAttributeSearchResultRootNode extends DisplayableItemNo protected Node createNodeForKey(Integer instanceCount){ List attributeValues = this.searchResults.getAttributeValuesForInstanceCount(instanceCount); return new InstanceCountNode(instanceCount, attributeValues); - } + } } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java index b46cde1316..8ff13e87f1 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeSearchResults.java @@ -33,35 +33,41 @@ final public class CommonAttributeSearchResults { private final Map> instanceCountToAttributeValues; /** - * Create a metadata object which can be handed off to the node - * factories. + * Create a values object which can be handed off to the node factories. * - * @param metadata list of CommonAttributeValue indexed by size of CommonAttributeValue + * @param values list of CommonAttributeValue indexed by size of + * CommonAttributeValue */ CommonAttributeSearchResults(Map> metadata){ this.instanceCountToAttributeValues = metadata; } /** - * Find the meta data for the given md5. + * Find the child node whose children have the specified number of children. * * This is a convenience method - you can also iterate over - * getMetadata(). + * getValues(). * - * @param md5 key - * @return + * @param isntanceCound key + * @return list of values which represent matches */ List getAttributeValuesForInstanceCount(Integer instanceCount) { return this.instanceCountToAttributeValues.get(instanceCount); } - public Map> getMetadata() { + /** + * Get an unmodifiable collection of values, indexed by number of + * grandchildren, which represents the common attributes found in the + * search. + * @return map of sizes of children to list of matches + */ +public Map> getMetadata() { return Collections.unmodifiableMap(this.instanceCountToAttributeValues); } /** - * How many distinct file instances exist for this metadata? - * @return number of file instances + * How many distinct common files exist for this search results? + * @return number of common files */ public int size() { diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java index 3ed386ab10..fa33df6aab 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributeValue.java @@ -74,11 +74,6 @@ final public class CommonAttributeValue { this.fileInstances.add(metadata); } - void addFileInstanceMetadata(AbstractCommonAttributeInstance metadata, String caseName) { - this.fileInstances.add(metadata); - // @@@ Why are we ignoring caseName? - } - public Collection getInstances() { return Collections.unmodifiableCollection(this.fileInstances); } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java index a5c5f642b7..fcdb4a319c 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java @@ -22,12 +22,9 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.HashMap; import java.util.List; import java.util.Map; -import java.util.logging.Level; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; -import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.LOGGER; -import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.HashUtility; /** @@ -49,8 +46,8 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS * * @throws EamDbException */ - InterCaseCommonAttributeSearcher(boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(filterByMediaMimeType, filterByDocMimeType); + InterCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); dbManager = EamDb.getInstance(); } @@ -71,33 +68,24 @@ abstract class InterCaseCommonAttributeSearcher extends AbstractCommonAttributeS if (md5 == null || HashUtility.isNoDataMd5(md5)) { continue; } - Map fileCache = new HashMap<>(); - try { - int caseId = commonFileCases.get(commonAttrId); - CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); - final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); - // we don't *have* all the information for the rows in the CR, - // so we need to consult the present case via the SleuthkitCase object - // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. + // we don't *have* all the information for the rows in the CR, + // so we need to consult the present case via the SleuthkitCase object + // Later, when the FileInstanceNodde is built. Therefore, build node generators for now. - if (interCaseCommonFiles.containsKey(md5)) { - //Add to intercase metaData - final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); - - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); - commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); + if (interCaseCommonFiles.containsKey(md5)) { + //Add to intercase metaData + final CommonAttributeValue commonAttributeValue = interCaseCommonFiles.get(md5); - } else { - CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); - interCaseCommonFiles.put(md5, commonAttributeValue); - - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, fileCache); - commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); - - } - } catch (Exception ex) { - LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap()); + commonAttributeValue.addInstance(searchResult); + + } else { + CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); + interCaseCommonFiles.put(md5, commonAttributeValue); + + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(commonAttrId, this.getDataSourceIdToNameMap()); + commonAttributeValue.addInstance(searchResult); } } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java index 05a7032252..2959c51078 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCasePanel.java @@ -37,9 +37,8 @@ public class InterCasePanel extends javax.swing.JPanel { static final int NO_CASE_SELECTED = -1; private ComboBoxModel casesList = new DataSourceComboBoxModel(); - private final Map caseMap; - private CommonAttributePanel parent; + private final Map caseMap; private String errorMessage; @@ -60,10 +59,6 @@ public class InterCasePanel extends javax.swing.JPanel { } } - void setParent(CommonAttributePanel parent) { - this.parent = parent; - } - String getErrorMessage(){ return this.errorMessage; } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java index 60a89fb5e5..0967041b30 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java @@ -28,7 +28,6 @@ import java.util.Map; import java.util.Set; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; -import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.HashUtility; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery; @@ -45,7 +44,6 @@ import org.sleuthkit.datamodel.TskCoreException; @SuppressWarnings("PMD.AbstractNaming") public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher { - private final Map dataSourceIdToNameMap; private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on /** @@ -58,8 +56,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt * broadly categorized as document types */ IntraCaseCommonAttributeSearcher(Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) { - super(filterByMediaMimeType, filterByDocMimeType); - dataSourceIdToNameMap = dataSourceIdMap; + super(dataSourceIdMap, filterByMediaMimeType, filterByDocMimeType); } /** @@ -97,7 +94,6 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt */ @Override public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException { - //TODO do we need all those exceptions or can we differentiate when they are caught? Map commonFiles = new HashMap<>(); final Case currentCase = Case.getCurrentCaseThrows(); @@ -106,8 +102,6 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt SleuthkitCase sleuthkitCase = currentCase.getSleuthkitCase(); String selectStatement = this.buildSqlSelectStatement(); - - Map fileCache = new HashMap<>(); try ( CaseDbQuery query = sleuthkitCase.executeQuery(selectStatement); @@ -117,7 +111,7 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt Long objectId = resultSet.getLong(1); String md5 = resultSet.getString(2); Long dataSourceId = resultSet.getLong(3); - String dataSource = this.dataSourceIdToNameMap.get(dataSourceId); + String dataSource = this.getDataSourceIdToNameMap().get(dataSourceId); if (md5 == null || HashUtility.isNoDataMd5(md5)) { continue; @@ -125,10 +119,10 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt if (commonFiles.containsKey(md5)) { final CommonAttributeValue commonAttributeValue = commonFiles.get(md5); - commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, fileCache, dataSource, caseName)); + commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, dataSource, caseName)); } else { final CommonAttributeValue commonAttributeValue = new CommonAttributeValue(md5); - commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, fileCache, dataSource, caseName)); + commonAttributeValue.addInstance(new CaseDBCommonAttributeInstance(objectId, dataSource, caseName)); commonFiles.put(md5, commonAttributeValue); } } @@ -169,5 +163,4 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt } return mimeTypeString; } - } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java index c88537cb17..9f9335104c 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCasePanel.java @@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.commonfilesearch; import java.util.Collections; +import java.util.HashMap; import java.util.Map; import java.util.Map.Entry; import javax.swing.ComboBoxModel; @@ -40,8 +41,7 @@ public class IntraCasePanel extends javax.swing.JPanel { private boolean singleDataSource; private String selectedDataSource; private ComboBoxModel dataSourcesList = new DataSourceComboBoxModel(); - private Map dataSourceMap; - private CommonAttributePanel parent; + private final Map dataSourceMap; private String errorMessage; @@ -51,10 +51,7 @@ public class IntraCasePanel extends javax.swing.JPanel { public IntraCasePanel() { initComponents(); this.errorMessage = ""; - } - - public void setParent(CommonAttributePanel parent){ - this.parent = parent; + this.dataSourceMap = new HashMap<>(); } public boolean isSingleDataSource(){ @@ -66,7 +63,7 @@ public class IntraCasePanel extends javax.swing.JPanel { return selectedDataSource; } else { return ""; - } + } } public Map getDataSourceMap(){ @@ -210,10 +207,10 @@ public class IntraCasePanel extends javax.swing.JPanel { return false; } else { return true; - } + } } String getErrorMessage() { return this.errorMessage; } -} +} \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java index 9486a9e43c..66a7106c63 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java @@ -44,8 +44,8 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri * @param filterByDocMimeType * @throws EamDbException */ - public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { - super(filterByMediaMimeType, filterByDocMimeType); + public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, Map dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType) throws EamDbException { + super(dataSourceIdMap,filterByMediaMimeType, filterByDocMimeType); this.corrleationCaseId = correlationCaseId; this.correlationCaseName = ""; diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java index 030f53ed31..a117e487e1 100755 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java @@ -852,50 +852,6 @@ public class CentralRepoDatamodelTest extends TestCase { Exceptions.printStackTrace(ex); Assert.fail(ex); } - - // Test getting common instances with expected results - try { - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash)); - assertTrue("getArtifactInstancesByCaseValues returned " + instances.size() + " results - expected 5", instances.size() == 5); - - // This test works because all the instances of this hash were set to the same path - for (CentralRepositoryFile inst : instances) { - if(inst.getValue().equals(inAllDataSourcesHash)) { - assertTrue("getArtifactInstancesByCaseValues returned instance with unexpected path " + inst.getFilePath(), - inAllDataSourcesPath.equalsIgnoreCase(inst.getFilePath())); - } - else if(inst.getValue().equals(inDataSource1twiceHash)) { - assertTrue("getArtifactInstancesByCaseValues returned instance with unexpected path " + inst.getFilePath(), - inDataSource1twicePath1.equalsIgnoreCase(inst.getFilePath()) || inDataSource1twicePath2.equalsIgnoreCase(inst.getFilePath())); - } - } - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - - // Test getting instances expecting no results because they are not in the case - try { - CorrelationCase badCase = new CorrelationCase("badCaseUuid", "badCaseName"); - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(badCase, Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash), 0); - - assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty()); - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - - - // Test getting instances expecting no results because of bad hashes - try { - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(Arrays.asList("xyz", "123")); - - assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty()); - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - // Test getting instances expecting no results try { @@ -924,17 +880,6 @@ public class CentralRepoDatamodelTest extends TestCase { Exceptions.printStackTrace(ex); Assert.fail(ex); } - - // Test getting instances with null value - // Should just return nothing - try { - List instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null); - - assertTrue("getArtifactInstancesByTypeValue returned non-empty list for null value", instances.isEmpty()); - } catch (EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } // Test getting instances with path that should produce results try { diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java deleted file mode 100644 index 754e96dd0f..0000000000 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileType.java +++ /dev/null @@ -1,466 +0,0 @@ -/* - * - * Autopsy Forensic Browser - * - * Copyright 2018 Basis Technology Corp. - * Contact: carrier sleuthkit org - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.sleuthkit.autopsy.commonfilessearch; - -import java.sql.SQLException; -import java.util.ArrayList; -import java.util.List; -import java.util.Map; -import junit.framework.Test; -import org.netbeans.junit.NbModuleSuite; -import org.netbeans.junit.NbTestCase; -import org.openide.util.Exceptions; -import org.python.icu.impl.Assert; -import org.sleuthkit.autopsy.casemodule.Case; -import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; -import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; -import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; -import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher; -import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; -import org.sleuthkit.autopsy.commonfilesearch.SingleIntraCaseCommonAttributeSearcher; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.*; -import org.sleuthkit.autopsy.ingest.IngestJobSettings; -import org.sleuthkit.autopsy.ingest.IngestJobSettings.IngestType; -import org.sleuthkit.autopsy.ingest.IngestModuleTemplate; -import org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory; -import org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory; -import org.sleuthkit.autopsy.testutils.IngestUtils; -import org.sleuthkit.datamodel.AbstractFile; -import org.sleuthkit.datamodel.TskCoreException; - -/** - * Add set 1, set 2, set 3, and set 4 to case and ingest with hash algorithm. - */ -public class IngestedWithHashAndFileType extends NbTestCase { - - public static Test suite() { - NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(IngestedWithHashAndFileType.class). - clusters(".*"). - enableModules(".*"); - return conf.suite(); - } - - private final IntraCaseUtils utils; - - public IngestedWithHashAndFileType(String name) { - super(name); - - this.utils = new IntraCaseUtils(this, "IngestedWithHashAndFileTypeTests"); - } - - @Override - public void setUp() { - this.utils.setUp(); - - IngestModuleTemplate hashLookupTemplate = IngestUtils.getIngestModuleTemplate(new HashLookupModuleFactory()); - IngestModuleTemplate mimeTypeLookupTemplate = IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()); - - ArrayList templates = new ArrayList<>(); - templates.add(hashLookupTemplate); - templates.add(mimeTypeLookupTemplate); - - IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestedWithHashAndFileType.class.getCanonicalName(), IngestType.FILES_ONLY, templates); - - try { - IngestUtils.runIngestJob(Case.getCurrentCaseThrows().getDataSources(), ingestJobSettings); - } catch (NoCurrentCaseException | TskCoreException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - @Override - public void tearDown() { - this.utils.tearDown(); - } - - /** - * Find all matches & all file types. Confirm file.jpg is found on all three - * and file.docx is found on two. - */ - public void testOneA() { - try { - Map dataSources = this.utils.getDataSourceMap(); - - AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); - CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - - Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); - - List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find all matches & only image types. Confirm file.jpg is found on all - * three. - */ - public void testOneB() { - try { - Map dataSources = this.utils.getDataSourceMap(); - - AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); - CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find all matches & only image types. Confirm file.jpg is found on all - * three. - */ - public void testOneC() { - try { - Map dataSources = this.utils.getDataSourceMap(); - - AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, true); - CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find matches on set 1 & all file types. Confirm same results. - * - */ - public void testTwoA() { - try { - Map dataSources = this.utils.getDataSourceMap(); - Long first = getDataSourceIdByName(SET1, dataSources); - - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, false); - CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find matches on set 1 & only media types. Confirm same results. - * - */ - public void testTwoB() { - try { - Map dataSources = this.utils.getDataSourceMap(); - Long first = getDataSourceIdByName(SET1, dataSources); - - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, true, false); - CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find matches on set 1 & all file types. Confirm same results. - * - */ - public void testTwoC() { - try { - Map dataSources = this.utils.getDataSourceMap(); - Long first = getDataSourceIdByName(SET1, dataSources); - - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, true); - CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find matches on set 2 & all file types: Confirm file.jpg. - * - */ - public void testThree() { - try { - Map dataSources = this.utils.getDataSourceMap(); - Long second = getDataSourceIdByName(SET2, dataSources); - - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(second, dataSources, false, false); - CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find matches on set 4 & all file types: Confirm nothing is found. - */ - public void testFour() { - try { - Map dataSources = this.utils.getDataSourceMap(); - Long last = getDataSourceIdByName(SET4, dataSources); - - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(last, dataSources, false, false); - CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - /** - * Find matches on set 3 & all file types: Confirm file.jpg and file.docx. - */ - public void testFive() { - try { - Map dataSources = this.utils.getDataSourceMap(); - Long third = getDataSourceIdByName(SET3, dataSources); - - AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, false, false); - CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - - Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); - - List files = getFiles(objectIdToDataSource.keySet()); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET1, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET3, 1)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, DOC, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, PDF, SET4, 0)); - - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET1, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET2, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); - assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - - } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } -} diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java index 411f7cda19..d758e8c935 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeInterCaseTests.java @@ -19,17 +19,21 @@ */ package org.sleuthkit.autopsy.commonfilessearch; +import java.util.Map; import junit.framework.Test; import org.netbeans.junit.NbModuleSuite; import org.netbeans.junit.NbTestCase; import org.openide.util.Exceptions; import org.python.icu.impl.Assert; -import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.AllInterCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; +import org.sleuthkit.autopsy.commonfilesearch.SingleInterCaseCommonAttributeSearcher; +import static org.sleuthkit.autopsy.commonfilessearch.InterCaseTestUtils.*; /** + * Tests with case 3 as the current case. + * * If I use the search all cases option: One node for Hash A (1_1_A.jpg, * 1_2_A.jpg, 3_1_A.jpg) If I search for matches only in Case 1: One node for * Hash A (1_1_A.jpg, 1_2_A.jpg, 3_1_A.jpg) If I search for matches only in Case @@ -38,10 +42,8 @@ import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; */ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { - private final InterCaseUtils utils; - - private Case currentCase; - + private final InterCaseTestUtils utils; + public static Test suite() { NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(IngestedWithHashAndFileTypeInterCaseTests.class). clusters(".*"). @@ -51,7 +53,7 @@ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { public IngestedWithHashAndFileTypeInterCaseTests(String name) { super(name); - this.utils = new InterCaseUtils(this); + this.utils = new InterCaseTestUtils(this); } @Override @@ -59,7 +61,7 @@ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { this.utils.clearTestDir(); try { this.utils.enableCentralRepo(); - this.currentCase = this.utils.createCases(this.utils.getIngestSettingsForHashAndFileType(), InterCaseUtils.CASE3); + this.utils.createCases(this.utils.getIngestSettingsForHashAndFileType(), InterCaseTestUtils.CASE3); } catch (Exception ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); @@ -68,24 +70,107 @@ public class IngestedWithHashAndFileTypeInterCaseTests extends NbTestCase { @Override public void tearDown(){ + this.utils.clearTestDir(); this.utils.tearDown(); } /** - * Search All - * - * One node for Hash A (1_1_A.jpg, 1_2_A.jpg, 3_1_A.jpg) + * Search All cases with no file type filtering. */ public void testOne() { try { + Map dataSources = this.utils.getDataSourceMap(); - AbstractCommonAttributeSearcher builder = new AllInterCaseCommonAttributeSearcher(false, false); + //note that the params false and false are presently meaningless because that feature is not supported yet + AbstractCommonAttributeSearcher builder = new AllInterCaseCommonAttributeSearcher(dataSources, false, false); CommonAttributeSearchResults metadata = builder.findFiles(); assertTrue("Results should not be empty", metadata.size() != 0); - //assertTrue("") + //case 1 data set 1 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_1, CASE1, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_1, CASE1, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_1, CASE1, 1)); + + //case 1 data set 2 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_2, CASE1, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_2, CASE1, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_2, CASE1, 1)); + + //case 2 data set 1 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_PDF, CASE2_DATASET_1, CASE2, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_JPG, CASE2_DATASET_1, CASE2, 0)); + + //case 2 data set 2 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE2_DATASET_2, CASE2, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE2_DATASET_2, CASE2, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE2_DATASET_2, CASE2, 1)); + + //case 3 data set 1 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE3_DATASET_1, CASE3, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE3_DATASET_1, CASE3, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_1, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_1, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_JPG, CASE3_DATASET_1, CASE3, 0)); + + //case 3 data set 2 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_2, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_2, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE3_DATASET_2, CASE3, 1)); + + + } catch (Exception ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + /** + * Search All cases with no file type filtering. + */ + public void testTwo() { + try { + Map dataSources = this.utils.getDataSourceMap(); + + int matchesMustAlsoBeFoundInThisCase = this.utils.getCaseMap().get(CASE2); + + AbstractCommonAttributeSearcher builder = new SingleInterCaseCommonAttributeSearcher(matchesMustAlsoBeFoundInThisCase, dataSources, false, false); + + CommonAttributeSearchResults metadata = builder.findFiles(); + + assertTrue("Results should not be empty", metadata.size() != 0); + + //case 1 data set 1 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_1, CASE1, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_1, CASE1, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_1, CASE1, 1)); + + //case 1 data set 2 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_0_DAT, CASE1_DATASET_2, CASE1, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE1_DATASET_2, CASE1, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE1_DATASET_2, CASE1, 1)); + + //case 2 data set 1 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_PDF, CASE2_DATASET_1, CASE2, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_B_JPG, CASE2_DATASET_1, CASE2, 0)); + + //case 2 data set 2 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE2_DATASET_2, CASE2, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE2_DATASET_2, CASE2, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE2_DATASET_2, CASE2, 1)); + + //case 3 data set 1 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_JPG, CASE3_DATASET_1, CASE3, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_A_PDF, CASE3_DATASET_1, CASE3, 1)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_1, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_1, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_JPG, CASE3_DATASET_1, CASE3, 0)); + + //case 3 data set 2 + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_JPG, CASE3_DATASET_2, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_C_PDF, CASE3_DATASET_2, CASE3, 0)); + assertTrue(verifyInstanceExistanceAndCount(metadata, HASH_D_DOC, CASE3_DATASET_2, CASE3, 1)); } catch (Exception ex) { diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java index dbef8cd6ca..d1a004d281 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithHashAndFileTypeIntraCaseTests.java @@ -19,6 +19,7 @@ */ package org.sleuthkit.autopsy.commonfilessearch; +import java.sql.SQLException; import java.util.ArrayList; import java.util.List; import java.util.Map; @@ -29,11 +30,12 @@ import org.openide.util.Exceptions; import org.python.icu.impl.Assert; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; +import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; +import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; -import org.sleuthkit.autopsy.commonfilesearch.IntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.SingleIntraCaseCommonAttributeSearcher; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.*; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.*; import org.sleuthkit.autopsy.ingest.IngestJobSettings; import org.sleuthkit.autopsy.ingest.IngestJobSettings.IngestType; import org.sleuthkit.autopsy.ingest.IngestModuleTemplate; @@ -55,12 +57,12 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { return conf.suite(); } - private final IntraCaseUtils utils; + private final IntraCaseTestUtils utils; public IngestedWithHashAndFileTypeIntraCaseTests(String name) { super(name); - this.utils = new IntraCaseUtils(this, "IngestedWithHashAndFileTypeTests"); + this.utils = new IntraCaseTestUtils(this, "IngestedWithHashAndFileTypeTests"); } @Override @@ -97,12 +99,12 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { try { Map dataSources = this.utils.getDataSourceMap(); - IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); + AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET1, 2)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, IMG, SET2, 1)); @@ -124,7 +126,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -138,7 +140,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { try { Map dataSources = this.utils.getDataSourceMap(); - IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); + AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -165,7 +167,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -179,7 +181,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { try { Map dataSources = this.utils.getDataSourceMap(); - IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, true); + AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, true); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -206,7 +208,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -221,7 +223,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long first = getDataSourceIdByName(SET1, dataSources); - IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, false); + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -248,7 +250,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -263,7 +265,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long first = getDataSourceIdByName(SET1, dataSources); - IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, true, false); + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, true, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -290,7 +292,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -305,7 +307,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long first = getDataSourceIdByName(SET1, dataSources); - IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, true); + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(first, dataSources, false, true); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -332,7 +334,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -347,7 +349,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long second = getDataSourceIdByName(SET2, dataSources); - IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(second, dataSources, false, false); + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(second, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -374,7 +376,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -388,7 +390,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long last = getDataSourceIdByName(SET4, dataSources); - IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(last, dataSources, false, false); + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(last, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -415,7 +417,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } @@ -429,7 +431,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { Map dataSources = this.utils.getDataSourceMap(); Long third = getDataSourceIdByName(SET3, dataSources); - IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, false, false); + AbstractCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, false, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); Map objectIdToDataSource = mapFileInstancesToDataSources(metadata); @@ -456,7 +458,7 @@ public class IngestedWithHashAndFileTypeIntraCaseTests extends NbTestCase { assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET3, 0)); assertTrue(verifyInstanceExistanceAndCount(files, objectIdToDataSource, EMPTY, SET4, 0)); - } catch (Exception ex) { + } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); Assert.fail(ex); } diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java index c8f289ab72..ce56385c61 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IngestedWithNoFileTypesIntraCaseTests.java @@ -59,12 +59,12 @@ public class IngestedWithNoFileTypesIntraCaseTests extends NbTestCase { return conf.suite(); } - private final IntraCaseUtils utils; + private final IntraCaseTestUtils utils; public IngestedWithNoFileTypesIntraCaseTests(String name) { super(name); - this.utils = new IntraCaseUtils(this, "IngestedWithNoFileTypes"); + this.utils = new IntraCaseTestUtils(this, "IngestedWithNoFileTypes"); } @Override @@ -102,9 +102,9 @@ public class IngestedWithNoFileTypesIntraCaseTests extends NbTestCase { IntraCaseCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, true, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); assertTrue(files.isEmpty()); @@ -121,14 +121,14 @@ public class IngestedWithNoFileTypesIntraCaseTests extends NbTestCase { public void testTwo() { try { Map dataSources = this.utils.getDataSourceMap(); - Long third = IntraCaseUtils.getDataSourceIdByName(IntraCaseUtils.SET3, dataSources); + Long third = IntraCaseTestUtils.getDataSourceIdByName(IntraCaseTestUtils.SET3, dataSources); IntraCaseCommonAttributeSearcher singleSourceBuilder = new SingleIntraCaseCommonAttributeSearcher(third, dataSources, true, false); CommonAttributeSearchResults metadata = singleSourceBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); assertTrue(files.isEmpty()); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseUtils.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java similarity index 65% rename from Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseUtils.java rename to Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java index bc626b6459..cf6bd36fbc 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseUtils.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java @@ -6,7 +6,7 @@ * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. + * you may not use this testFile except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 @@ -25,7 +25,6 @@ import java.nio.file.Path; import java.nio.file.Paths; import java.sql.SQLException; import java.util.ArrayList; -import java.util.Collection; import java.util.HashMap; import java.util.List; import java.util.Map; @@ -48,50 +47,62 @@ import org.sleuthkit.autopsy.testutils.IngestUtils; import org.sleuthkit.datamodel.TskCoreException; import org.python.icu.impl.Assert; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; +import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; +import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeInstance; +import org.sleuthkit.autopsy.commonfilesearch.CaseDBCommonAttributeInstanceNode; +import org.sleuthkit.autopsy.commonfilesearch.CentralRepoCommonAttributeInstance; +import org.sleuthkit.autopsy.commonfilesearch.CentralRepoCommonAttributeInstanceNode; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; import org.sleuthkit.autopsy.commonfilesearch.DataSourceLoader; -import org.sleuthkit.autopsy.commonfilesearch.CaseDBCommonAttributeInstance; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeValue; +import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; +import org.sleuthkit.datamodel.AbstractFile; /** * Utilities for testing intercase correlation feature. * - * Description of Test Data: - * (Note: files of the same name and extension are identical; - * files of the same name and differing extension are not identical.) + * This will be more useful when we add more flush out the intercase + * correlation features and need to add more tests. In particular, + * testing scenarios where we need different cases to be the current case + * will suggest that we create additional test classes, and we will want to + * import this utility in each new intercase test file. * - * Case 1 - * +Data Set 1 - * - Hash-0.dat [file of size 0] - * - Hash-A.jpg - * - Hash-A.pdf - * +Data Set2 - * - Hash-0.dat [file of size -0] - * - Hash-A.jpg - * - Hash-A.pdf - * Case 2 - * +Data Set 1 - * - Hash-A.jpg - * - Hash-A.pdf - * +Data Set 2 - * - Hash-A.jpg - * - Hash-A.pdf - * - Hash_D.doc - * Case 3 - * +Data Set 1 - * - Hash-A.jpg - * - Hash-A.pdf - * - Hash-C.jpg [we should never find these!] - * - Hash-C.pdf [we should never find these!] - * - Hash-D.jpg - * +Data Set 2 - * - Hash-C.jpg [we should never find these!] - * - Hash-C.pdf - * - Hash.D-doc + * Description of Test Data: + (Note: files of the same name and extension are identical; + files of the same name and differing extension are not identical.) + + Case 1 + +Data Set 1 + - Hash-0.dat [testFile of size 0] + - Hash-A.jpg + - Hash-A.pdf + +Data Set2 + - Hash-0.dat [testFile of size 0] + - Hash-A.jpg + - Hash-A.pdf + Case 2 + +Data Set 1 + - Hash-B.jpg + - Hash-B.pdf + +Data Set 2 + - Hash-A.jpg + - Hash-A.pdf + - Hash_D.doc + Case 3 + +Data Set 1 + - Hash-A.jpg + - Hash-A.pdf + - Hash-C.jpg + - Hash-C.pdf + - Hash-D.jpg + +Data Set 2 + - Hash-C.jpg + - Hash-C.pdf + - Hash-D.doc */ -class InterCaseUtils { +class InterCaseTestUtils { private static final Path CASE_DIRECTORY_PATH = Paths.get(System.getProperty("java.io.tmpdir"), "InterCaseCommonFilesSearchTest"); private static final String CR_DB_NAME = "testcentralrepo.db"; @@ -131,7 +142,7 @@ class InterCaseUtils { private final IngestJobSettings hashAndNoFileType; private final DataSourceLoader dataSourceLoader; - InterCaseUtils(NbTestCase testCase) { + InterCaseTestUtils(NbTestCase testCase) { this.case1DataSet1Path = Paths.get(testCase.getDataDir().toString(), CASE1_DATASET_1); this.case1DataSet2Path = Paths.get(testCase.getDataDir().toString(), CASE1_DATASET_2); @@ -151,13 +162,13 @@ class InterCaseUtils { hashAndMimeTemplate.add(mimeTypeLookupTemplate); hashAndMimeTemplate.add(eamDbTemplate); - this.hashAndFileType = new IngestJobSettings(InterCaseUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndMimeTemplate); + this.hashAndFileType = new IngestJobSettings(InterCaseTestUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndMimeTemplate); ArrayList hashAndNoMimeTemplate = new ArrayList<>(1); hashAndNoMimeTemplate.add(hashLookupTemplate); hashAndMimeTemplate.add(eamDbTemplate); - this.hashAndNoFileType = new IngestJobSettings(InterCaseUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndNoMimeTemplate); + this.hashAndNoFileType = new IngestJobSettings(InterCaseTestUtils.class.getCanonicalName(), IngestType.FILES_ONLY, hashAndNoMimeTemplate); this.dataSourceLoader = new DataSourceLoader(); } @@ -165,8 +176,12 @@ class InterCaseUtils { void clearTestDir(){ if(CASE_DIRECTORY_PATH.toFile().exists()){ try{ + if(EamDb.isEnabled()) { + EamDb.getInstance().shutdownConnections(); + } FileUtils.deleteDirectory(CASE_DIRECTORY_PATH.toFile()); - } catch(IOException ex){ + } catch(IOException | EamDbException ex){ + Exceptions.printStackTrace(ex); Assert.fail(ex); } } @@ -177,13 +192,13 @@ class InterCaseUtils { return this.dataSourceLoader.getDataSourceMap(); } - Map getCaseMap() throws EamDbException { + Map getCaseMap() throws EamDbException { if (EamDb.isEnabled()) { - Map mapOfCaseIdsToCase = new HashMap<>(); + Map mapOfCaseIdsToCase = new HashMap<>(); for (CorrelationCase caze : EamDb.getInstance().getCases()) { - mapOfCaseIdsToCase.put(caze.getID(), caze.getDisplayName()); + mapOfCaseIdsToCase.put(caze.getDisplayName(), caze.getID()); } return mapOfCaseIdsToCase; } else { @@ -243,7 +258,7 @@ class InterCaseUtils { String lastCaseName = null; Path[] lastPathsForCase = null; - //iterate over the collecitons above, creating cases, and storing + //iterate over the collections above, creating cases, and storing // just one of them for future reference for (int i = 0; i < cases.length; i++) { String caseName = cases[i]; @@ -289,30 +304,71 @@ class InterCaseUtils { } } + //TODO refactor static boolean verifyInstanceExistanceAndCount(CommonAttributeSearchResults searchDomain, String fileName, String dataSource, String crCase, int instanceCount){ int tally = 0; - for(Map.Entry> file : searchDomain.getMetadata().entrySet()){ + for(Map.Entry> entry : searchDomain.getMetadata().entrySet()){ - //Collection fileInstances = file.getValue(); - -// for(IntraCaseCommonAttributeSearchResults fileInstance : fileInstances){ -// -// -// } + for(CommonAttributeValue value : entry.getValue()){ + + for(AbstractCommonAttributeInstance commonAttribute : value.getInstances()){ + + if(commonAttribute instanceof CentralRepoCommonAttributeInstance){ + CentralRepoCommonAttributeInstance results = (CentralRepoCommonAttributeInstance) commonAttribute; + for (DisplayableItemNode din : results.generateNodes()){ + + if(din instanceof CentralRepoCommonAttributeInstanceNode){ + + CentralRepoCommonAttributeInstanceNode node = (CentralRepoCommonAttributeInstanceNode) din; + CorrelationAttributeInstance instance = node.getCorrelationAttributeInstance(); + + final String fullPath = instance.getFilePath(); + final File testFile = new File(fullPath); + + final String testCaseName = instance.getCorrelationCase().getDisplayName(); + + final String testFileName = testFile.getName(); + + final String testDataSource = instance.getCorrelationDataSource().getName(); + + boolean sameFileName = testFileName.equalsIgnoreCase(fileName); + boolean sameDataSource = testDataSource.equalsIgnoreCase(dataSource); + boolean sameCrCase = testCaseName.equalsIgnoreCase(crCase); + + if( sameFileName && sameDataSource && sameCrCase){ + tally++; + } + } + + if(din instanceof CaseDBCommonAttributeInstanceNode){ + + CaseDBCommonAttributeInstanceNode node = (CaseDBCommonAttributeInstanceNode) din; + AbstractFile file = node.getContent(); + + final String testFileName = file.getName(); + final String testCaseName = node.getCase(); + final String testDataSource = node.getDataSource(); + + boolean sameFileName = testFileName.equalsIgnoreCase(fileName); + boolean sameCaseName = testCaseName.equalsIgnoreCase(crCase); + boolean sameDataSource = testDataSource.equalsIgnoreCase(dataSource); + + if(sameFileName && sameDataSource && sameCaseName){ + tally++; + } + } + } + } else { + Assert.fail("Unable to cast AbstractCommonAttributeInstanceNode to InterCaseCommonAttributeSearchResults."); + } + } + } } - return false; + return tally == instanceCount; } - - static Map mapFileInstancesToDataSource(CommonAttributeSearchResults metadata){ - return IntraCaseUtils.mapFileInstancesToDataSources(metadata); - } - -// static List getFiles(Set md5s){ -// -// } /** * Close the currently open case, delete the case directory, delete the diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseUtils.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseTestUtils.java similarity index 98% rename from Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseUtils.java rename to Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseTestUtils.java index 035a16a0ed..82c38cdf56 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseUtils.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/IntraCaseTestUtils.java @@ -68,7 +68,7 @@ import org.sleuthkit.datamodel.TskCoreException; * set 4 * - file.dat (empty file) */ -class IntraCaseUtils { +class IntraCaseTestUtils { private static final String CASE_NAME = "IntraCaseCommonFilesSearchTest"; static final Path CASE_DIRECTORY_PATH = Paths.get(System.getProperty("java.io.tmpdir"), CASE_NAME); @@ -92,7 +92,7 @@ class IntraCaseUtils { private final String caseName; - IntraCaseUtils(NbTestCase nbTestCase, String caseName){ + IntraCaseTestUtils(NbTestCase nbTestCase, String caseName){ this.imagePath1 = Paths.get(nbTestCase.getDataDir().toString(), SET1); this.imagePath2 = Paths.get(nbTestCase.getDataDir().toString(), SET2); this.imagePath3 = Paths.get(nbTestCase.getDataDir().toString(), SET3); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSources.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSourcesIntraCaseTests.java similarity index 74% rename from Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSources.java rename to Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSourcesIntraCaseTests.java index 4f5fbee9fb..f4c397af8d 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSources.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/MatchesInAtLeastTwoSourcesIntraCaseTests.java @@ -35,7 +35,7 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.*; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.*; import org.sleuthkit.autopsy.ingest.IngestJobSettings; import org.sleuthkit.autopsy.ingest.IngestModuleTemplate; import org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory; @@ -53,21 +53,21 @@ import org.sleuthkit.datamodel.TskCoreException; * * None of the test files should be found in the results of this test. */ -public class MatchesInAtLeastTwoSources extends NbTestCase { +public class MatchesInAtLeastTwoSourcesIntraCaseTests extends NbTestCase { public static Test suite() { - NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(MatchesInAtLeastTwoSources.class). + NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(MatchesInAtLeastTwoSourcesIntraCaseTests.class). clusters(".*"). enableModules(".*"); return conf.suite(); } - private final IntraCaseUtils utils; + private final IntraCaseTestUtils utils; - public MatchesInAtLeastTwoSources(String name) { + public MatchesInAtLeastTwoSourcesIntraCaseTests(String name) { super(name); - this.utils = new IntraCaseUtils(this, "MatchesInAtLeastTwoSources"); + this.utils = new IntraCaseTestUtils(this, "MatchesInAtLeastTwoSources"); } @Override @@ -86,7 +86,7 @@ public class MatchesInAtLeastTwoSources extends NbTestCase { templates.add(hashLookupTemplate); templates.add(mimeTypeLookupTemplate); - IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestedWithHashAndFileType.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates); + IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestedWithHashAndFileTypeIntraCaseTests.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates); try { IngestUtils.runIngestJob(Case.getCurrentCaseThrows().getDataSources(), ingestJobSettings); @@ -108,18 +108,18 @@ public class MatchesInAtLeastTwoSources extends NbTestCase { AbstractCommonAttributeSearcher allSourcesBuilder = new AllIntraCaseCommonAttributeSearcher(dataSources, false, false); CommonAttributeSearchResults metadata = allSourcesBuilder.findFiles(); - Map objectIdToDataSource = IntraCaseUtils.mapFileInstancesToDataSources(metadata); + Map objectIdToDataSource = IntraCaseTestUtils.mapFileInstancesToDataSources(metadata); - List files = IntraCaseUtils.getFiles(objectIdToDataSource.keySet()); + List files = IntraCaseTestUtils.getFiles(objectIdToDataSource.keySet()); - assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET1, 0)); - assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET4, 0)); + assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET1, 0)); + assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, IMG, SET4, 0)); - assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET1, 0)); - assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET4, 0)); + assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET1, 0)); + assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, DOC, SET4, 0)); - assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET1, 0)); - assertTrue(IntraCaseUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET4, 0)); + assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET1, 0)); + assertTrue(IntraCaseTestUtils.verifyInstanceExistanceAndCount(files, dataSources, EMPTY, SET4, 0)); } catch (NoCurrentCaseException | TskCoreException | SQLException | EamDbException ex) { Exceptions.printStackTrace(ex); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java deleted file mode 100644 index 03b12c83c3..0000000000 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/NoCentralRepoEnabledInterCaseTests.java +++ /dev/null @@ -1,85 +0,0 @@ -/* - * - * Autopsy Forensic Browser - * - * Copyright 2018 Basis Technology Corp. - * Contact: carrier sleuthkit org - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.sleuthkit.autopsy.commonfilessearch; - -import junit.framework.Test; -import org.netbeans.junit.NbModuleSuite; -import org.netbeans.junit.NbTestCase; -import org.openide.util.Exceptions; -import org.sleuthkit.datamodel.TskCoreException; -import org.python.icu.impl.Assert; -import org.sleuthkit.autopsy.casemodule.Case; -import org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher; -import org.sleuthkit.autopsy.commonfilesearch.AllInterCaseCommonAttributeSearcher; -import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; - -/** - * - * Just make sure nothing explodes when we run the feature in the absence of - * the Central Repo. This should be considered 'defensive' as it should not be - * possible to even run the feature if the CR is not available. - * - */ -public class NoCentralRepoEnabledInterCaseTests extends NbTestCase { - - private final InterCaseUtils utils; - - private Case currentCase; - - public static Test suite() { - NbModuleSuite.Configuration conf = NbModuleSuite.createConfiguration(NoCentralRepoEnabledInterCaseTests.class). - clusters(".*"). - enableModules(".*"); - return conf.suite(); - } - - public NoCentralRepoEnabledInterCaseTests(String name) { - super(name); - this.utils = new InterCaseUtils(this); - } - - @Override - public void setUp() { - try { - this.currentCase = this.utils.createCases(this.utils.getIngestSettingsForHashAndFileType(), InterCaseUtils.CASE1); - } catch (TskCoreException ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } - - @Override - public void tearDown() { - this.utils.tearDown(); - } - - public void testOne() { - try { - AbstractCommonAttributeSearcher builder = new AllInterCaseCommonAttributeSearcher(false, false); - - CommonAttributeSearchResults metadata = builder.findFiles(); - - assertTrue("Should be no results.", metadata.size() == 0); - } catch (Exception ex) { - Exceptions.printStackTrace(ex); - Assert.fail(ex); - } - } -} diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java index 015ee9d4b3..26c0d66296 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/UningestedCasesIntraCaseTests.java @@ -30,8 +30,8 @@ import org.sleuthkit.autopsy.commonfilesearch.AllIntraCaseCommonAttributeSearche import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeSearchResults; import org.sleuthkit.autopsy.commonfilesearch.IntraCaseCommonAttributeSearcher; import org.sleuthkit.autopsy.commonfilesearch.SingleIntraCaseCommonAttributeSearcher; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.SET1; -import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseUtils.getDataSourceIdByName; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.SET1; +import static org.sleuthkit.autopsy.commonfilessearch.IntraCaseTestUtils.getDataSourceIdByName; /** * Test that cases which are created but have not run any ingest modules turn up @@ -51,12 +51,12 @@ public class UningestedCasesIntraCaseTests extends NbTestCase { return conf.suite(); } - private final IntraCaseUtils utils; + private final IntraCaseTestUtils utils; public UningestedCasesIntraCaseTests(String name) { super(name); - this.utils = new IntraCaseUtils(this, "UningestedCasesTests"); + this.utils = new IntraCaseTestUtils(this, "UningestedCasesTests"); } @Override From f7d01493db7c5cbadad670f9dec719b0e957af4d Mon Sep 17 00:00:00 2001 From: Brian Sweeney Date: Fri, 3 Aug 2018 11:42:23 -0600 Subject: [PATCH 16/17] merge conflicts --- .../AbstractCommonAttributeInstance.java | 6 +-- .../AllInterCaseCommonAttributeSearcher.java | 2 +- .../InterCaseCommonAttributeSearcher.java | 3 -- .../InterCaseSearchResultsProcessor.java | 38 +++++++++---------- 4 files changed, 21 insertions(+), 28 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java index 8fa50d7ac2..7732c5d393 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeInstance.java @@ -20,8 +20,6 @@ package org.sleuthkit.autopsy.commonfilesearch; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttribute; -import java.util.HashMap; -import java.util.Map; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; import org.sleuthkit.datamodel.AbstractFile; @@ -71,7 +69,6 @@ public abstract class AbstractCommonAttributeInstance { */ AbstractCommonAttributeInstance() { this.abstractFileObjectId = -1L; - this.cachedFiles = new HashMap<>(); this.caseName = ""; this.dataSource = ""; } @@ -81,7 +78,8 @@ public abstract class AbstractCommonAttributeInstance { * CaseDB. * * @return AbstractFile corresponding to this common attribute or null if it - * cannot be found (for example, in the event that this is a central repo file) + * cannot be found (for example, in the event that this is a central repo + * file) */ abstract AbstractFile getAbstractFile(); diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java index 680d31f7dc..ca436b7809 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java @@ -47,7 +47,7 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut @Override public CommonAttributeSearchResults findFiles() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { - InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); + InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(this.getDataSourceIdToNameMap()); Map> interCaseCommonFiles = eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase()); return new CommonAttributeSearchResults(interCaseCommonFiles); } diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java index 1160635b2f..2c745b5271 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseCommonAttributeSearcher.java @@ -19,13 +19,10 @@ */ package org.sleuthkit.autopsy.commonfilesearch; -import java.util.HashMap; -import java.util.List; import java.util.Map; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; -import org.sleuthkit.datamodel.HashUtility; /** * Provides logic for selecting common files from all data sources and all cases diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java index 0b4c2c6d4d..c8d065bff6 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/InterCaseSearchResultsProcessor.java @@ -43,22 +43,26 @@ import org.sleuthkit.datamodel.HashUtility; */ final class InterCaseSearchResultsProcessor { + private Map dataSources; + private static final Logger LOGGER = Logger.getLogger(CommonAttributePanel.class.getName()); - // maps row ID to value - private final Map intercaseCommonValuesMap = new HashMap<>(); - // maps row ID to case ID - private final Map intercaseCommonCasesMap = new HashMap<>(); private final String interCaseWhereClause = "value IN (SELECT value FROM file_instances" + " WHERE value IN (SELECT value FROM file_instances" + " WHERE case_id=%s AND (known_status !=%s OR known_status IS NULL) GROUP BY value)" + " GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value"; + private final String singleInterCaseWhereClause = "value IN (SELECT value FROM file_instances " + "WHERE value IN (SELECT value FROM file_instances " + "WHERE case_id=%s AND (known_status !=%s OR known_status IS NULL) GROUP BY value) " + "AND (case_id=%s OR case_id=%s) GROUP BY value HAVING COUNT(DISTINCT case_id) > 1) ORDER BY value"; - + InterCaseSearchResultsProcessor(Map dataSources){ + this.dataSources = dataSources; + } + + InterCaseSearchResultsProcessor(){} + /** * Finds a single CorrelationAttribute given an id. * @@ -93,11 +97,13 @@ final class InterCaseSearchResultsProcessor { EamDb DbManager = EamDb.getInstance(); CorrelationAttribute.Type fileType = DbManager.getCorrelationTypeById(CorrelationAttribute.FILES_TYPE_ID); int caseId = DbManager.getCase(currentCase).getID(); - return instancetableCallback.getInstanceCollatedCommonFiles(); + DbManager.processInstanceTableWhere(fileType, String.format(interCaseWhereClause, caseId, TskData.FileKnown.KNOWN.getFileKnownValue()), instancetableCallback); - + + return instancetableCallback.getInstanceCollatedCommonFiles(); + } catch (EamDbException ex) { LOGGER.log(Level.SEVERE, "Error accessing EamDb processing CaseInstancesTable.", ex); } @@ -142,9 +148,6 @@ final class InterCaseSearchResultsProcessor { @Override public void process(ResultSet resultSet) { try { - - EamDb dbManager = EamDb.getInstance(); - while (resultSet.next()) { int resultId = InstanceTableCallback.getId(resultSet); @@ -155,20 +158,16 @@ final class InterCaseSearchResultsProcessor { if (md5Value == null || HashUtility.isNoDataMd5(md5Value)) { continue; } - int caseId = InstanceTableCallback.getCaseId(resultSet); - CorrelationCase autopsyCrCase = dbManager.getCaseById(caseId); - final String correlationCaseDisplayName = autopsyCrCase.getDisplayName(); - countAndAddCommonAttributes(md5Value, resultId, correlationCaseDisplayName); + countAndAddCommonAttributes(md5Value, resultId); } - } catch (SQLException | EamDbException ex) { + } catch (SQLException ex) { LOGGER.log(Level.WARNING, "Error getting artifact instances from database.", ex); // NON-NLS } - } - private void countAndAddCommonAttributes(String md5Value, int resultId, String correlationCaseDisplayName) { + private void countAndAddCommonAttributes(String md5Value, int resultId) { if (commonAttributeValue == null) { commonAttributeValue = new CommonAttributeValue(md5Value); } @@ -188,14 +187,13 @@ final class InterCaseSearchResultsProcessor { // we don't *have* all the information for the rows in the CR, // so we need to consult the present case via the SleuthkitCase object // Later, when the FileInstanceNode is built. Therefore, build node generators for now. - AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(resultId); - commonAttributeValue.addFileInstanceMetadata(searchResult, correlationCaseDisplayName); + AbstractCommonAttributeInstance searchResult = new CentralRepoCommonAttributeInstance(resultId, InterCaseSearchResultsProcessor.this.dataSources); + commonAttributeValue.addInstance(searchResult); } Map> getInstanceCollatedCommonFiles() { return Collections.unmodifiableMap(instanceCollatedCommonFiles); } - } /** From 1db7ad6140cbe671b2e8b8ea7ba99f938c645e6b Mon Sep 17 00:00:00 2001 From: Andrew Ziehl Date: Fri, 3 Aug 2018 10:59:29 -0700 Subject: [PATCH 17/17] Pass in datasource map so CR results don't error out. --- .../SingleInterCaseCommonAttributeSearcher.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java index 18d2faf8b7..6c06da8b38 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java @@ -71,7 +71,7 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri } CommonAttributeSearchResults findFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { - InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(); + InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(this.getDataSourceIdToNameMap()); Map> interCaseCommonFiles = eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase); return new CommonAttributeSearchResults(interCaseCommonFiles);