codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-08-31 16:33:52 +00:00
Code Issues Releases Wiki Activity

7050 undo content viewer changes

Browse Source
This commit is contained in:
William Schaefer
2020-12-28 10:28:59 -05:00
parent 9051652da0
commit e48136ac20
5 changed files with 100 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
Core/src/org/sleuthkit/autopsy/contentviewers/FileViewer.java
View File

@@ -28,11 +28,8 @@ import org.openide.util.NbBundle;
import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode;
import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Generic Application content viewer
@@ -40,11 +37,11 @@ import org.sleuthkit.datamodel.TskCoreException;
@ServiceProvider(service = DataContentViewer.class, position = 3)
@SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives
public class FileViewer extends javax.swing.JPanel implements DataContentViewer {
private static final int CONFIDENCE_LEVEL = 5;
private static final long serialVersionUID = 1L;
private static final Logger LOGGER = Logger.getLogger(FileViewer.class.getName());
private final Map<String, FileTypeViewer> mimeTypeToViewerMap = new HashMap<>();
// TBD: This hardcoded list of viewers should be replaced with a dynamic lookup
@@ -56,7 +53,7 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
new WindowsRegistryViewer(),
new PDFViewer()
};
private FileTypeViewer lastViewer;
/**
@@ -74,9 +71,9 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
}
});
}
initComponents();
LOGGER.log(Level.INFO, "Created ApplicationContentViewer instance: {0}", this); //NON-NLS
}
@@ -85,7 +82,8 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
*
* @param file
*
* @return FileTypeViewer, null if no known content viewer supports the file
* @return FileTypeViewer, null if no known content viewer supports the
* file
*/
private FileTypeViewer getSupportingViewer(AbstractFile file) {
FileTypeViewer viewer = mimeTypeToViewerMap.get(file.getMIMEType());
@@ -112,18 +110,18 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
// End of variables declaration//GEN-END:variables
@Override
public void setNode(Node selectedNode) {
resetComponent();
if (selectedNode == null || !isSupported(selectedNode)) {
if (selectedNode == null) {
return;
}
AbstractFile file = selectedNode.getLookup().lookup(AbstractFile.class);
if ((file == null) || (file.isDir())) {
return;
}
String mimeType = file.getMIMEType();
if (Strings.isNullOrEmpty(mimeType)) {
LOGGER.log(Level.INFO, "Mimetype not known for file: {0}", file.getName()); //NON-NLS
@@ -135,81 +133,67 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
return;
}
}
if (mimeType.equalsIgnoreCase("application/octet-stream")) {
return;
} else {
FileTypeViewer viewer = getSupportingViewer(file);
if (viewer != null) {
lastViewer = viewer;
viewer.setFile(file);
this.removeAll();
this.add(viewer.getComponent());
this.validate();
}
}
}
@Override
@NbBundle.Messages("ApplicationContentViewer.title=Application")
public String getTitle() {
return Bundle.ApplicationContentViewer_title();
}
@Override
@NbBundle.Messages("ApplicationContentViewer.toolTip=Displays file contents.")
public String getToolTip() {
return Bundle.ApplicationContentViewer_toolTip();
}
@Override
public DataContentViewer createInstance() {
return new FileViewer();
}
@Override
public Component getComponent() {
return this;
}
@Override
public void resetComponent() {
if (lastViewer != null) {
lastViewer.resetComponent();
}
this.removeAll();
lastViewer = null;
}
@Override
public boolean isSupported(Node node) {
if (node == null) {
return false;
}
AbstractFile aFile = node.getLookup().lookup(AbstractFile.class);
if ((aFile == null) || (aFile.isDir())) {
return false;
}
if (node instanceof BlackboardArtifactNode) {
BlackboardArtifact theArtifact = ((BlackboardArtifactNode) node).getArtifact();
//disable the content viewer when a download or cached file does not exist instead of displaying its parent
try {
if ((theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
|| theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID())
&& aFile.getId() == theArtifact.getParent().getId()) {
return false;
}
} catch (TskCoreException ex) {
LOGGER.log(Level.WARNING, String.format("Error getting parent of artifact with type %s and objID = %d can not confirm file with name %s and objId = %d is not the parent. File content viewer will not be supported.",
theArtifact.getArtifactTypeName(), theArtifact.getObjectID(), aFile.getName(), aFile.getId()), ex);
return false;
}
}
String mimeType = aFile.getMIMEType();
if (Strings.isNullOrEmpty(mimeType)) {
LOGGER.log(Level.INFO, "Mimetype not known for file: {0}", aFile.getName()); //NON-NLS
@@ -221,20 +205,20 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
return false;
}
}
if (mimeType.equalsIgnoreCase("application/octet-stream")) {
return false;
} else {
return (getSupportingViewer(aFile) != null);
}
}
@Override
public int isPreferred(Node node) {
AbstractFile file = node.getLookup().lookup(AbstractFile.class);
String mimeType = file.getMIMEType();
if (Strings.isNullOrEmpty(mimeType)) {
LOGGER.log(Level.INFO, "Mimetype not known for file: {0}", file.getName()); //NON-NLS
try {
@@ -245,7 +229,7 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
return 0;
}
}
if (mimeType.equalsIgnoreCase("application/octet-stream")) {
return 0;
} else {
@@ -253,7 +237,7 @@ public class FileViewer extends javax.swing.JPanel implements DataContentViewer
return CONFIDENCE_LEVEL;
}
}
return 0;
}
}

76
Core/src/org/sleuthkit/autopsy/contentviewers/Metadata.java
View File

@@ -29,7 +29,6 @@ import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
import org.sleuthkit.autopsy.datamodel.ContentUtils;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
@@ -51,7 +50,7 @@ import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
public class Metadata extends javax.swing.JPanel implements DataContentViewer {
private static final Logger LOGGER = Logger.getLogger(Metadata.class.getName());
/**
* Creates new form Metadata
*/
@@ -149,10 +148,6 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
"Metadata.nodeText.none=None"})
@Override
public void setNode(Node node) {
if ((node == null) || (!isSupported(node))) {
resetComponent();
return;
}
AbstractFile file = node.getLookup().lookup(AbstractFile.class);
Image image = node.getLookup().lookup(Image.class);
DataSource dataSource = node.getLookup().lookup(DataSource.class);
@@ -181,6 +176,7 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.created"), ContentUtils.getStringTime(file.getCrtime(), file));
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.changed"), ContentUtils.getStringTime(file.getCtime(), file));
String md5 = file.getMd5Hash();
if (md5 == null) {
md5 = NbBundle.getMessage(this.getClass(), "Metadata.tableRowContent.md5notCalc");
@@ -193,12 +189,12 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.sha256"), sha256);
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.hashLookupResults"), file.getKnown().toString());
addAcquisitionDetails(sb, dataSource);
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.internalid"), Long.toString(file.getId()));
if (file.getType().compareTo(TSK_DB_FILES_TYPE_ENUM.LOCAL) == 0) {
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.localPath"), file.getLocalAbsPath());
}
try {
List<BlackboardArtifact> associatedObjectArtifacts = file.getArtifacts(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT);
if (!associatedObjectArtifacts.isEmpty()) {
@@ -211,14 +207,14 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
}
}
} catch (TskCoreException ex) {
sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.exceptionNotice.text")).append(ex.getLocalizedMessage());
sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.exceptionNotice.text")).append(ex.getLocalizedMessage());
}
endTable(sb);
/*
* If we have a file system file, grab the more detailed metadata
* text too
* If we have a file system file, grab the more detailed metadata text
* too
*/
try {
if (file instanceof FsContent) {
@@ -230,11 +226,11 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
for (String str : fsFile.getMetaDataText()) {
sb.append(str).append("<br />"); //NON-NLS
/*
* Very long results can cause the UI to hang before
* displaying, so truncate the results if necessary.
/*
* Very long results can cause the UI to hang before displaying,
* so truncate the results if necessary.
*/
if (sb.length() > 50000) {
if(sb.length() > 50000){
sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.truncated"));
break;
}
@@ -250,7 +246,7 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
} catch (TskCoreException ex) {
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.name"), image.getName());
}
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.imageType"), image.getType().getName());
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.imageType"), image.getType().getName());
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.size"), Long.toString(image.getSize()));
try {
@@ -286,46 +282,46 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
StringBuilder pathValues = new StringBuilder("<div>");
pathValues.append(imagePaths[0]);
pathValues.append("</div>");
for (int i = 1; i < imagePaths.length; i++) {
for (int i=1; i < imagePaths.length; i++) {
pathValues.append("<div>");
pathValues.append(imagePaths[i]);
pathValues.append("</div>");
}
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.localPath"), pathValues.toString());
} else {
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.localPath"),
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.localPath"),
NbBundle.getMessage(this.getClass(), "Metadata.nodeText.none"));
}
}
setText(sb.toString());
jTextPane1.setCaretPosition(0);
this.setCursor(null);
}
/**
* Adds a row for download source from the given associated artifact, if the
* associated artifacts specifies a source.
*
* @param sb string builder.
* Adds a row for download source from the given associated artifact,
* if the associated artifacts specifies a source.
*
* @param sb string builder.
* @param associatedArtifact
*
*
* @throws TskCoreException if there is an error
*/
private void addDownloadSourceRow(StringBuilder sb, BlackboardArtifact associatedArtifact) throws TskCoreException {
if (associatedArtifact != null
&& ((associatedArtifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID())
|| (associatedArtifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID()))) {
private void addDownloadSourceRow(StringBuilder sb, BlackboardArtifact associatedArtifact ) throws TskCoreException {
if (associatedArtifact != null &&
((associatedArtifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) ||
(associatedArtifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID())) ) {
BlackboardAttribute urlAttr = associatedArtifact.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_URL));
if (urlAttr != null) {
addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.downloadSource"), urlAttr.getValueString());
}
}
}
/**
* Add the acquisition details to the results (if applicable)
*
*
* @param sb The output StringBuilder object
* @param dataSource The data source (may be null)
*/
@@ -373,22 +369,6 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer {
public boolean isSupported(Node node) {
Image image = node.getLookup().lookup(Image.class);
AbstractFile file = node.getLookup().lookup(AbstractFile.class);
if (file != null && node instanceof BlackboardArtifactNode) {
BlackboardArtifact theArtifact = ((BlackboardArtifactNode) node).getArtifact();
//disable the content viewer when a download or cached file does not exist instead of displaying its parent
try {
if ((theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
|| theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID())
&& file.getId() == theArtifact.getParent().getId()) {
return false;
}
} catch (TskCoreException ex) {
LOGGER.log(Level.WARNING, String.format("Error getting parent of artifact with type %s and objID = %d can not confirm file with name %s and objId = %d is not the parent. Metadata viewer will not be supported.",
theArtifact.getArtifactTypeName(), theArtifact.getObjectID(), file.getName(), file.getId()), ex);
return false;
}
}
return (file != null) || (image != null);
}

16
Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/Bundle.properties-MERGED
View File

@@ -46,24 +46,10 @@ DataContentViewerArtifact.failedToGetSourcePath.message=Failed to get source fil
DefaultTableArtifactContentViewer.attrsTableHeader.sources=Source(s)
DefaultTableArtifactContentViewer.attrsTableHeader.type=Type
DefaultTableArtifactContentViewer.attrsTableHeader.value=Value
GeneralPurposeArtifactViewer.dates.created=Created
GeneralPurposeArtifactViewer.dates.end=End
GeneralPurposeArtifactViewer.dates.start=Start
GeneralPurposeArtifactViewer.dates.time=Time
GeneralPurposeArtifactViewer.details.attrHeader=Details
GeneralPurposeArtifactViewer.details.bookmarkHeader=Bookmark Details
GeneralPurposeArtifactViewer.details.cachedHeader=Cached File
GeneralPurposeArtifactViewer.details.cookieHeader=Cookie Details
GeneralPurposeArtifactViewer.details.attrHeader=Attributes
GeneralPurposeArtifactViewer.details.dataSource=Data Source
GeneralPurposeArtifactViewer.details.datesHeader=Dates
GeneralPurposeArtifactViewer.details.downloadHeader=Downloaded File
GeneralPurposeArtifactViewer.details.file=File
GeneralPurposeArtifactViewer.details.historyHeader=Visit Details
GeneralPurposeArtifactViewer.details.otherHeader=Other
GeneralPurposeArtifactViewer.details.searchHeader=Web Search
GeneralPurposeArtifactViewer.details.sourceHeader=Source
GeneralPurposeArtifactViewer.noFile.text=\ (no longer exists)
GeneralPurposeArtifactViewer.term.label=Term
GeneralPurposeArtifactViewer.unknown.text=Unknown
GeneralPurposeArtifactViewer_menuitem_copy=Copy
MessageAccountPanel.account.justification=Account found in Message artifact

90
Core/src/org/sleuthkit/autopsy/contentviewers/contextviewer/ContextViewer.java
View File

@@ -36,7 +36,6 @@ import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT;
@@ -226,21 +225,6 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
// check if the node has an abstract file and the file has any context defining artifacts.
if (node.getLookup().lookup(AbstractFile.class) != null) {
AbstractFile abstractFile = node.getLookup().lookup(AbstractFile.class);
if (node instanceof BlackboardArtifactNode) {
BlackboardArtifact theArtifact = ((BlackboardArtifactNode) node).getArtifact();
//disable the content viewer when a download or cached file does not exist instead of displaying its parent
try {
if ((theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
|| theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID())
&& abstractFile.getId() == theArtifact.getParent().getId()) {
return false;
}
} catch (TskCoreException ex) {
logger.log(Level.WARNING, String.format("Error getting parent of artifact with type %s and objID = %d can not confirm file with name %s and objId = %d is not the parent. Context content viewer will not be supported.",
theArtifact.getArtifactTypeName(), theArtifact.getObjectID(), abstractFile.getName(), abstractFile.getId()), ex);
return false;
}
}
for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
List<BlackboardArtifact> artifactsList;
try {
@@ -265,7 +249,8 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
}
@NbBundle.Messages({
"ContextViewer.unknownSource=Unknown ",})
"ContextViewer.unknownSource=Unknown ",
})
/**
* Looks for context providing artifacts for the given file and populates
* the source context.
@@ -278,7 +263,7 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
private void populatePanels(AbstractFile sourceFile) throws NoCurrentCaseException, TskCoreException {
SleuthkitCase tskCase = Case.getCurrentCaseThrows().getSleuthkitCase();
// Check for all context artifacts
boolean foundASource = false;
for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
@@ -307,7 +292,7 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
contextContainer.add(usagePanel);
}
}
contextContainer.setBackground(javax.swing.UIManager.getDefaults().getColor("window"));
contextContainer.setEnabled(foundASource);
contextContainer.setVisible(foundASource);
@@ -316,12 +301,12 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
jScrollPane.setVisible(foundASource);
jScrollPane.repaint();
jScrollPane.revalidate();
}
/**
* Resolves an TSK_ASSOCIATED_OBJECT artifact and adds it to the appropriate
* panel
* Resolves an TSK_ASSOCIATED_OBJECT artifact and adds it to the appropriate panel
*
* @param artifact Artifact that may provide context.
*
@@ -373,16 +358,16 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
} else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == associatedArtifact.getArtifactTypeID()) {
String sourceName = Bundle.ContextViewer_recentDocs();
String sourceText = recentDocArtifactToString(associatedArtifact);
ContextUsagePanel usagePanel = new ContextUsagePanel(sourceName, sourceText, associatedArtifact, dateTime);
ContextUsagePanel usagePanel = new ContextUsagePanel(sourceName, sourceText, associatedArtifact, dateTime);
contextUsagePanels.add(usagePanel);
} else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == associatedArtifact.getArtifactTypeID()) {
String sourceName = Bundle.ContextViewer_programExecution();
String sourceText = programExecArtifactToString(associatedArtifact);
ContextUsagePanel usagePanel = new ContextUsagePanel(sourceName, sourceText, associatedArtifact, dateTime);
ContextUsagePanel usagePanel = new ContextUsagePanel(sourceName, sourceText, associatedArtifact, dateTime);
contextUsagePanels.add(usagePanel);
}
Collections.sort(contextSourcePanels, new SortByDateTime());
Collections.sort(contextUsagePanels, new SortByDateTime());
}
@@ -414,7 +399,8 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
}
/**
* Returns a display string with recent Doc artifact.
* Returns a display string with recent Doc
* artifact.
*
* @param artifact artifact to get doc from.
*
@@ -429,9 +415,9 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
private String recentDocArtifactToString(BlackboardArtifact artifact) throws TskCoreException {
StringBuilder sb = new StringBuilder(ARTIFACT_STR_MAX_LEN);
Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifact.getArtifactTypeID()) {
if (attribute != null && attribute.getValueLong() > 0) {
appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_on());
@@ -443,7 +429,8 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
}
/**
* Returns a display string with Program Execution artifact.
* Returns a display string with Program Execution
* artifact.
*
* @param artifact artifact to get doc from.
*
@@ -458,9 +445,9 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
private String programExecArtifactToString(BlackboardArtifact artifact) throws TskCoreException {
StringBuilder sb = new StringBuilder(ARTIFACT_STR_MAX_LEN);
Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifact.getArtifactTypeID()) {
if (attribute != null && attribute.getValueLong() > 0) {
appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_runOn());
@@ -551,9 +538,8 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
return attributeMap;
}
interface DateTimePanel {
/**
* Return the date time value for this panel.
*
@@ -561,28 +547,28 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
*/
Long getDateTime();
}
/**
/**
* Return the dateTime value for the given message artifact.
*
* @param artifact
*
*
* @param artifact
*
* @return Long dateTime value or null if the attribute was not found.
*
* @throws TskCoreException
*
* @throws TskCoreException
*/
private Long getArtifactDateTime(BlackboardArtifact artifact) throws TskCoreException {
BlackboardAttribute attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME));
BlackboardAttribute attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME));
if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifact.getArtifactTypeID()) {
attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT));
attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT));
} else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifact.getArtifactTypeID()
|| BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == artifact.getArtifactTypeID()) {
attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED));
attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED));
}
return (attribute != null ? attribute.getValueLong() : null);
}
/**
* Class for sorting lists of DateTimePanels.
*/
@@ -592,18 +578,18 @@ public final class ContextViewer extends javax.swing.JPanel implements DataConte
public int compare(DateTimePanel panel1, DateTimePanel panel2) {
Long dateTime1 = panel1.getDateTime();
Long dateTime2 = panel2.getDateTime();
if (dateTime1 == null && dateTime2 == null) {
if(dateTime1 == null && dateTime2 == null) {
return 0;
} else if (dateTime1 == null) {
} else if(dateTime1 == null) {
return -1;
} else if (dateTime2 == null) {
} else if(dateTime2 == null) {
return 1;
}
return dateTime1.compareTo(dateTime2);
}
}

28
Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/TextContentViewer.java
View File

@@ -19,16 +19,11 @@
package org.sleuthkit.autopsy.contentviewers.textcontentviewer;
import java.awt.Component;
import java.util.logging.Level;
import org.openide.nodes.Node;
import org.openide.util.NbBundle.Messages;
import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.TskCoreException;
/**
* A DataContentViewer that displays text with the TextViewers available.
@@ -38,7 +33,6 @@ public class TextContentViewer implements DataContentViewer {
private final TextContentViewerPanel panel;
private volatile Node currentNode = null;
private static final Logger logger = Logger.getLogger(TextContentViewer.class.getName());
/**
* No arg constructor for creating the main instance of this Content Viewer.
@@ -58,10 +52,6 @@ public class TextContentViewer implements DataContentViewer {
@Override
public void setNode(Node selectedNode) {
if ((selectedNode == null) || (!isSupported(selectedNode))) {
resetComponent();
return;
}
currentNode = selectedNode;
panel.setNode(currentNode);
@@ -106,26 +96,12 @@ public class TextContentViewer implements DataContentViewer {
if (file == null) {
return false;
}
if (node instanceof BlackboardArtifactNode) {
BlackboardArtifact theArtifact = ((BlackboardArtifactNode) node).getArtifact();
//disable the content viewer when a download or cached file does not exist instead of displaying its parent
try {
if ((theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
|| theArtifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID())
&& file.getId() == theArtifact.getParent().getId()) {
return false;
}
} catch (TskCoreException ex) {
logger.log(Level.WARNING, String.format("Error getting parent of artifact with type %s and objID = %d can not confirm file with name %s and objId = %d is not the parent. Text content viewer will not be supported.",
theArtifact.getArtifactTypeName(), theArtifact.getObjectID(), file.getName(), file.getId()), ex);
return false;
}
}
// disable the text content viewer for directories and empty files
if (file.isDir() || file.getSize() == 0) {
return false;
}
return panel.isSupported(node);
}