codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-06 02:24:30 +00:00
Code Issues Releases Wiki Activity

add BIN level to tree. hide accounts from extracted content

Browse Source
This commit is contained in:
jmillman
2016-07-15 13:53:19 -04:00
parent 5282056130
commit f50bb3ba2d
4 changed files with 94 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

102
Core/src/org/sleuthkit/autopsy/datamodel/Accounts.java
View File

@@ -62,6 +62,57 @@ public class Accounts implements AutopsyVisitableItem {
return v.visit(this);
}
class BINNode extends DisplayableItemNode {
BINNode(Integer key) {
super(Children.create(new AccountFactory(key), true));
setName(key.toString());
setDisplayName(key.toString());
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/bank.png"); //NON-NLS
}
@Override
public boolean isLeafTypeNode() {
return true;
}
@Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this);
}
}
private class BINFactory extends ChildFactory.Detachable<Integer> {
@Override
protected boolean createKeys(List<Integer> list) {
String query =
"select substr(blackboard_attributes.value_text,1,6) as BIN"
// + " count(blackboard_artifacts.artifact_type_id) as count "
+ " from blackboard_artifacts,"
+ " blackboard_attributes "
+ " where blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()
+ " and blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id "
+ " and blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER.getTypeID()
+ " GROUP BY BIN "
+ " ORDER BY BIN ";
try (SleuthkitCase.CaseDbQuery results = skCase.executeQuery(query)) {
ResultSet rs = results.getResultSet();
while (rs.next()) {
list.add(rs.getInt("BIN"));
}
} catch (TskCoreException | SQLException ex) {
Exceptions.printStackTrace(ex);
}
return true;
}
@Override
protected Node createNodeForKey(Integer key) {
return new BINNode(key);
}
}
/**
* Top-level node for all accounts
*/
@@ -169,7 +220,7 @@ public class Accounts implements AutopsyVisitableItem {
enum CreditCardViewMode {
BY_FILE,
BY_ARTIFACT;
BY_BIN;
}
private class ViewModeFactory extends ChildFactory<CreditCardViewMode> {
@@ -177,15 +228,15 @@ public class Accounts implements AutopsyVisitableItem {
@Override
protected boolean createKeys(List<CreditCardViewMode> list) {
list.add(CreditCardViewMode.BY_FILE);
list.add(CreditCardViewMode.BY_ARTIFACT);
list.add(CreditCardViewMode.BY_BIN);
return true;
}
@Override
protected Node createNodeForKey(CreditCardViewMode key) {
switch (key) {
case BY_ARTIFACT:
return new ByArtifactNode();
case BY_BIN:
return new ByBINNode();
case BY_FILE:
return new ByFileNode();
default:
@@ -222,19 +273,19 @@ public class Accounts implements AutopsyVisitableItem {
}
}
class ByArtifactNode extends DisplayableItemNode {
class ByBINNode extends DisplayableItemNode {
private ByArtifactNode() {
super(Children.create(new AccountFactory(), true));
setName("By Account");
private ByBINNode() {
super(Children.create(new BINFactory(), true));
setName("By BIN");
updateDisplayName();
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/credit-card.png"); //NON-NLS
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/bank.png"); //NON-NLS
}
@Override
public boolean isLeafTypeNode() {
return true;
return false;
}
@Override
@@ -246,7 +297,7 @@ public class Accounts implements AutopsyVisitableItem {
* TODO: Update the count in the display name
*/
private void updateDisplayName() {
setDisplayName("By Account");
setDisplayName("By BIN");
}
}
@@ -323,15 +374,14 @@ public class Accounts implements AutopsyVisitableItem {
@Override
protected boolean createKeys(List<FileWithCCN> list) {
String query =
"select blackboard_artifacts.obj_id as obj_id,"
"select distinct blackboard_artifacts.obj_id as obj_id,"
+ " blackboard_attributes.value_int32 as chunk_id,"
+ " group_concat(blackboard_artifacts.artifact_id),"
+ " count(blackboard_artifacts.artifact_id) as hits "
// + " count (case when blackboard_artifacts.status like \"accepted\" then 1 else Null end) as accepted"
+ " from t blackboard_artifacts, "
+ " from blackboard_artifacts, "
+ " blackboard_attributes "
+ " where tsk_files.obj_id = blackboard_artifacts.obj_id "
+ " and blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()
+ " where blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()
// + " and not (blackboard_artifacts.status like \"rejected\") "
+ " and blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id "
+ " and blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CHUNK_ID.getTypeID()
@@ -411,11 +461,25 @@ public class Accounts implements AutopsyVisitableItem {
*/
private class AccountFactory extends ChildFactory.Detachable<Long> {
private final Integer bin;
private AccountFactory(Integer bin) {
this.bin = bin;
}
@Override
protected boolean createKeys(List<Long> list) {
String query = "select artifact_id from blackboard_artifacts where artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID();
try (SleuthkitCase.CaseDbQuery results = skCase.executeQuery(query)) {
ResultSet rs = results.getResultSet();
String query =
"select blackboard_artifacts.artifact_id "
+ " from blackboard_artifacts, "
+ " blackboard_attributes "
+ " where blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()
+ " and blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id "
+ " and blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER.getTypeID()
+ " and blackboard_attributes.value_text LIKE \"" + bin + "%\" "
+ " ORDER BY blackboard_attributes.value_text";
try (SleuthkitCase.CaseDbQuery results = skCase.executeQuery(query);
ResultSet rs = results.getResultSet();) {
while (rs.next()) {
list.add(rs.getLong("artifact_id"));
}
@@ -433,7 +497,7 @@ public class Accounts implements AutopsyVisitableItem {
try {
BlackboardArtifact art = skCase.getBlackboardArtifact(id);
return new BlackboardArtifactNode(art);
return new BlackboardArtifactNode(art,"org/sleuthkit/autopsy/images/credit-card.png" );
} catch (TskCoreException ex) {
LOGGER.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS
}

11
Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java
View File

@@ -129,12 +129,14 @@ public interface DisplayableItemNodeVisitor<T> {
T visit(Accounts.AccountTypeNode accountTypeNode);
T visit(Accounts.ByArtifactNode byArtifactNode);
T visit(Accounts.ByBINNode byArtifactNode);
T visit(Accounts.ByFileNode byFileNode);
T visit(Accounts.FileWithCCNNode byFileNode);
T visit(Accounts.BINNode binNode);
/**
* Visitor with an implementable default behavior for all types. Override
* specific visit types to not use the default behavior.
@@ -358,7 +360,7 @@ public interface DisplayableItemNodeVisitor<T> {
}
@Override
public T visit(Accounts.ByArtifactNode node) {
public T visit(Accounts.ByBINNode node) {
return defaultVisit(node);
}
@@ -371,5 +373,10 @@ public interface DisplayableItemNodeVisitor<T> {
public T visit(Accounts.FileWithCCNNode node) {
return defaultVisit(node);
}
@Override
public T visit(Accounts.BINNode node) {
return defaultVisit(node);
}
}
}

23
Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java
View File

@@ -37,27 +37,6 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskException;
@@ -221,6 +200,8 @@ public class ExtractedContent implements AutopsyVisitableItem {
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT));
doNotShow.add(new BlackboardArtifact.Type(
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT));
doNotShow.add(new BlackboardArtifact.Type(
BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT));
}
private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {

BIN
Core/src/org/sleuthkit/autopsy/images/bank.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 663 B