From f50bb3ba2de7cd2b5aa2a133e8fd8592edbf2a95 Mon Sep 17 00:00:00 2001 From: jmillman Date: Fri, 15 Jul 2016 13:53:19 -0400 Subject: [PATCH] add BIN level to tree. hide accounts from extracted content --- .../sleuthkit/autopsy/datamodel/Accounts.java | 102 ++++++++++++++---- .../datamodel/DisplayableItemNodeVisitor.java | 11 +- .../autopsy/datamodel/ExtractedContent.java | 23 +--- .../src/org/sleuthkit/autopsy/images/bank.png | Bin 0 -> 663 bytes 4 files changed, 94 insertions(+), 42 deletions(-) create mode 100644 Core/src/org/sleuthkit/autopsy/images/bank.png diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/Accounts.java b/Core/src/org/sleuthkit/autopsy/datamodel/Accounts.java index 2c7a924e23..39eaa17737 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/Accounts.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/Accounts.java @@ -62,6 +62,57 @@ public class Accounts implements AutopsyVisitableItem { return v.visit(this); } + class BINNode extends DisplayableItemNode { + + BINNode(Integer key) { + super(Children.create(new AccountFactory(key), true)); + setName(key.toString()); + setDisplayName(key.toString()); + this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/bank.png"); //NON-NLS + } + + @Override + public boolean isLeafTypeNode() { + return true; + } + + @Override + public T accept(DisplayableItemNodeVisitor v) { + return v.visit(this); + } + } + + private class BINFactory extends ChildFactory.Detachable { + + @Override + protected boolean createKeys(List list) { + String query = + "select substr(blackboard_attributes.value_text,1,6) as BIN" + // + " count(blackboard_artifacts.artifact_type_id) as count " + + " from blackboard_artifacts," + + " blackboard_attributes " + + " where blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() + + " and blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id " + + " and blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER.getTypeID() + + " GROUP BY BIN " + + " ORDER BY BIN "; + try (SleuthkitCase.CaseDbQuery results = skCase.executeQuery(query)) { + ResultSet rs = results.getResultSet(); + while (rs.next()) { + list.add(rs.getInt("BIN")); + } + } catch (TskCoreException | SQLException ex) { + Exceptions.printStackTrace(ex); + } + return true; + } + + @Override + protected Node createNodeForKey(Integer key) { + return new BINNode(key); + } + } + /** * Top-level node for all accounts */ @@ -169,7 +220,7 @@ public class Accounts implements AutopsyVisitableItem { enum CreditCardViewMode { BY_FILE, - BY_ARTIFACT; + BY_BIN; } private class ViewModeFactory extends ChildFactory { @@ -177,15 +228,15 @@ public class Accounts implements AutopsyVisitableItem { @Override protected boolean createKeys(List list) { list.add(CreditCardViewMode.BY_FILE); - list.add(CreditCardViewMode.BY_ARTIFACT); + list.add(CreditCardViewMode.BY_BIN); return true; } @Override protected Node createNodeForKey(CreditCardViewMode key) { switch (key) { - case BY_ARTIFACT: - return new ByArtifactNode(); + case BY_BIN: + return new ByBINNode(); case BY_FILE: return new ByFileNode(); default: @@ -222,19 +273,19 @@ public class Accounts implements AutopsyVisitableItem { } } - class ByArtifactNode extends DisplayableItemNode { + class ByBINNode extends DisplayableItemNode { - private ByArtifactNode() { - super(Children.create(new AccountFactory(), true)); - setName("By Account"); + private ByBINNode() { + super(Children.create(new BINFactory(), true)); + setName("By BIN"); updateDisplayName(); - this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/credit-card.png"); //NON-NLS + this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/bank.png"); //NON-NLS } @Override public boolean isLeafTypeNode() { - return true; + return false; } @Override @@ -246,7 +297,7 @@ public class Accounts implements AutopsyVisitableItem { * TODO: Update the count in the display name */ private void updateDisplayName() { - setDisplayName("By Account"); + setDisplayName("By BIN"); } } @@ -323,15 +374,14 @@ public class Accounts implements AutopsyVisitableItem { @Override protected boolean createKeys(List list) { String query = - "select blackboard_artifacts.obj_id as obj_id," + "select distinct blackboard_artifacts.obj_id as obj_id," + " blackboard_attributes.value_int32 as chunk_id," + " group_concat(blackboard_artifacts.artifact_id)," + " count(blackboard_artifacts.artifact_id) as hits " // + " count (case when blackboard_artifacts.status like \"accepted\" then 1 else Null end) as accepted" - + " from t blackboard_artifacts, " + + " from blackboard_artifacts, " + " blackboard_attributes " - + " where tsk_files.obj_id = blackboard_artifacts.obj_id " - + " and blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() + + " where blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() // + " and not (blackboard_artifacts.status like \"rejected\") " + " and blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id " + " and blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CHUNK_ID.getTypeID() @@ -411,11 +461,25 @@ public class Accounts implements AutopsyVisitableItem { */ private class AccountFactory extends ChildFactory.Detachable { + private final Integer bin; + + private AccountFactory(Integer bin) { + this.bin = bin; + } + @Override protected boolean createKeys(List list) { - String query = "select artifact_id from blackboard_artifacts where artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID(); - try (SleuthkitCase.CaseDbQuery results = skCase.executeQuery(query)) { - ResultSet rs = results.getResultSet(); + String query = + "select blackboard_artifacts.artifact_id " + + " from blackboard_artifacts, " + + " blackboard_attributes " + + " where blackboard_artifacts.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID() + + " and blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id " + + " and blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER.getTypeID() + + " and blackboard_attributes.value_text LIKE \"" + bin + "%\" " + + " ORDER BY blackboard_attributes.value_text"; + try (SleuthkitCase.CaseDbQuery results = skCase.executeQuery(query); + ResultSet rs = results.getResultSet();) { while (rs.next()) { list.add(rs.getLong("artifact_id")); } @@ -433,7 +497,7 @@ public class Accounts implements AutopsyVisitableItem { try { BlackboardArtifact art = skCase.getBlackboardArtifact(id); - return new BlackboardArtifactNode(art); + return new BlackboardArtifactNode(art,"org/sleuthkit/autopsy/images/credit-card.png" ); } catch (TskCoreException ex) { LOGGER.log(Level.WARNING, "TSK Exception occurred", ex); //NON-NLS } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java b/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java index 72e4ffe2a7..d94532686d 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java @@ -129,12 +129,14 @@ public interface DisplayableItemNodeVisitor { T visit(Accounts.AccountTypeNode accountTypeNode); - T visit(Accounts.ByArtifactNode byArtifactNode); + T visit(Accounts.ByBINNode byArtifactNode); T visit(Accounts.ByFileNode byFileNode); T visit(Accounts.FileWithCCNNode byFileNode); + T visit(Accounts.BINNode binNode); + /** * Visitor with an implementable default behavior for all types. Override * specific visit types to not use the default behavior. @@ -358,7 +360,7 @@ public interface DisplayableItemNodeVisitor { } @Override - public T visit(Accounts.ByArtifactNode node) { + public T visit(Accounts.ByBINNode node) { return defaultVisit(node); } @@ -371,5 +373,10 @@ public interface DisplayableItemNodeVisitor { public T visit(Accounts.FileWithCCNNode node) { return defaultVisit(node); } + + @Override + public T visit(Accounts.BINNode node) { + return defaultVisit(node); + } } } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java index 8a9b31936f..0d944b7928 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java @@ -37,27 +37,6 @@ import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.ingest.IngestManager; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.BlackboardArtifact; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY; -import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskException; @@ -221,6 +200,8 @@ public class ExtractedContent implements AutopsyVisitableItem { BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)); doNotShow.add(new BlackboardArtifact.Type( BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT)); + doNotShow.add(new BlackboardArtifact.Type( + BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT)); } private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> { diff --git a/Core/src/org/sleuthkit/autopsy/images/bank.png b/Core/src/org/sleuthkit/autopsy/images/bank.png new file mode 100644 index 0000000000000000000000000000000000000000..4d1cca358caa53068c5c8e358edb887916c38461 GIT binary patch literal 663 zcmV;I0%-k-P)_D&3VkZFHNB*|iYij?hv9JeQKQk|lgZ?r zYPISrm&<0fe?@!$(g!fhEuBvHIFU%iH5!e(QmMdty@qbL%ZEatr#74IcClEz-tYH6 zqkDTF$5|{E>i3@C??1+DFURAtrPXSI!{Gq8+YM^98k)@};G3zLk z|HLDr4zJgHM95pMR&Y9CG2*@*)?hHu#cFTFals*-{3%Wb(dBYI%Vx80(I8M+v=^h%2>zxco#t}6H|=)& zBR`!^Z+bi);ld}9$4O@zBW|EPO8QJVFOferGOB<=+P_j5LzePDJV{x|&=U;xG=C63cw56%Dp002ovPDHLkV1l3hDii