/*
* Autopsy Forensic Browser
*
* Copyright 2011-2016 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.ingest.events;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.logging.Level;
import java.util.stream.Collectors;
import javax.annotation.concurrent.Immutable;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.events.AutopsyEvent;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Event published when new data is posted to the blackboard of a case. The
* "old" value is a legacy ModuleDataEvent object. The "new" value is null.
*/
public final class BlackboardPostEvent extends AutopsyEvent implements Serializable {
private static final long serialVersionUID = 1L;
private static final Logger logger = Logger.getLogger(BlackboardPostEvent.class.getName());
private transient ModuleDataEvent eventData;
/**
* Constructs an event to be published when new content is added to a case
* or there is a change a recorded attribute of existing content.
*
* @param eventData A ModuleDataEvent object containing the data associated
* with the blackboard post.
*/
public BlackboardPostEvent(ModuleDataEvent eventData) {
/**
* Putting a serializable data holding object into oldValue to allow for
* lazy loading of the ModuleDataEvent object for remote events. This
* bypasses the issues related to the serialization and de-serialization
* of BlackboardArtifact objects when the event is published over a
* network.
*/
super(
IngestManager.IngestModuleEvent.DATA_ADDED.toString(),
new SerializableEventData(eventData.getModuleName(), eventData.getBlackboardArtifactType(), eventData.getArtifacts() != null
? eventData.getArtifacts()
.stream()
.map(BlackboardArtifact::getArtifactID)
.collect(Collectors.toList()) : Collections.emptyList()),
null
);
this.eventData = eventData;
}
/**
* Gets the legacy ModuleDataEvent object associated with this event.
*
* @return The ModuleDataEvent.
*/
@Override
public Object getOldValue() {
/**
* The eventData field is set in the constructor, but it is transient so
* it will become null when the event is serialized for publication over
* a network. Doing a lazy load of the ModuleDataEvent object bypasses
* the issues related to the serialization and de-serialization of
* BlackboardArtifact objects and may also save database round trips
* from other nodes since subscribers to this event are often not
* interested in the event data.
*/
if (null != eventData) {
return eventData;
}
try {
SerializableEventData data = (SerializableEventData) super.getOldValue();
Collection<BlackboardArtifact> artifacts = new ArrayList<>();
for (Long id : data.artifactIds) {
artifacts.add(Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(id));
}
eventData = new ModuleDataEvent(data.moduleName, data.artifactTypeId, !artifacts.isEmpty() ? artifacts : null);
return eventData;
} catch (IllegalStateException | TskCoreException ex) {
logger.log(Level.SEVERE, "Error doing lazy load for remote event", ex); //NON-NLS
return null;
}
}
/**
* Data holder class.
*/
@Immutable
private static final class SerializableEventData implements Serializable {
private static final long serialVersionUID = 1L;
private final String moduleName;
private BlackboardArtifact.Type artifactTypeId;
private Collection<Long> artifactIds;
private SerializableEventData(String moduleName, BlackboardArtifact.Type artifactTypeId, Collection<Long> artifactIds) {
this.moduleName = moduleName;
this.artifactTypeId = artifactTypeId;
this.artifactIds = new ArrayList<>(artifactIds);
}
}
}