diff --git a/Core/build.xml b/Core/build.xml index 0c83b8158f..df8bf56464 100644 --- a/Core/build.xml +++ b/Core/build.xml @@ -136,12 +136,12 @@ tofile="${ext.dir}/sleuthkit-${TSK_VERSION}.jar"/> - + - + release/modules/ext/logback-core-1.2.10.jar - ext/mchange-commons-java-0.2.20.jar - release/modules/ext/mchange-commons-java-0.2.20.jar + ext/mchange-commons-java-0.3.0.jar + release/modules/ext/mchange-commons-java-00.3.0.jar ext/metadata-extractor-2.18.0.jar @@ -698,8 +698,8 @@ release/modules/ext/okio-1.6.0.jar - ext/postgresql-42.3.5.jar - release/modules/ext/postgresql-42.3.5.jar + ext/postgresql-42.7.3.jar + release/modules/ext/postgresql-42.7.3.jar ext/Rejistry-1.1-SNAPSHOT.jar diff --git a/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java b/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java index ff3dc08e04..564499680c 100644 --- a/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java +++ b/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java @@ -239,7 +239,7 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup { */ private JMenuItem createMenutItem(TagName tagName) { String tagDisplayName = tagName.getDisplayName(); - String notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tagName.getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; JMenuItem tagNameItem = new JMenuItem(tagDisplayName + notableString); if (tagDisplayName.equals(TagsManager.getBookmarkTagDisplayName())) { diff --git a/Core/src/org/sleuthkit/autopsy/actions/GetTagNameDialog.java b/Core/src/org/sleuthkit/autopsy/actions/GetTagNameDialog.java index 2617d08df3..c6b1e7b9c4 100644 --- a/Core/src/org/sleuthkit/autopsy/actions/GetTagNameDialog.java +++ b/Core/src/org/sleuthkit/autopsy/actions/GetTagNameDialog.java @@ -174,10 +174,10 @@ public class GetTagNameDialog extends JDialog { private final String name; private final String description; - private final TskData.FileKnown status; + private final TskData.TagType status; private final TagName.HTML_COLOR color; - AddTagNameWorker(String name, String description, TskData.FileKnown status, TagName.HTML_COLOR color) { + AddTagNameWorker(String name, String description, TskData.TagType status, TagName.HTML_COLOR color) { this.name = name; this.description = description; this.status = status; @@ -375,7 +375,7 @@ public class GetTagNameDialog extends JDialog { private void okButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_okButtonActionPerformed String tagDisplayName = tagNameField.getText(); String userTagDescription = descriptionTextArea.getText(); - TskData.FileKnown status = notableCheckbox.isSelected() ? TskData.FileKnown.BAD : TskData.FileKnown.UNKNOWN; + TskData.TagType status = notableCheckbox.isSelected() ? TskData.TagType.BAD : TskData.TagType.SUSPICIOUS; if (tagDisplayName.isEmpty()) { JOptionPane.showMessageDialog(this, NbBundle.getMessage(this.getClass(), diff --git a/Core/src/org/sleuthkit/autopsy/actions/ReplaceTagAction.java b/Core/src/org/sleuthkit/autopsy/actions/ReplaceTagAction.java index 34ed836e3e..1d263bc407 100644 --- a/Core/src/org/sleuthkit/autopsy/actions/ReplaceTagAction.java +++ b/Core/src/org/sleuthkit/autopsy/actions/ReplaceTagAction.java @@ -226,7 +226,7 @@ abstract class ReplaceTagAction extends AbstractAction implements */ private JMenuItem createMenutItem(TagName tagName, Set tagNamesToDisable, Collection selectedTags) { String tagDisplayName = tagName.getDisplayName(); - String notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tagName.getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; JMenuItem tagNameItem = new JMenuItem(tagDisplayName + notableString); if (tagDisplayName.equals(TagsManager.getBookmarkTagDisplayName())) { diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED index ce1fb9aa70..1f9719688f 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED @@ -107,6 +107,9 @@ Case.servicesException.notificationTitle={0} Error Case.servicesException.serviceResourcesCloseError=Could not close case resources for {0} service: {1} Case_caseType_multiUser=Multi-user case Case_caseType_singleUser=Single-user case +Case_checkImagePaths_exceptionOccurred=An exception occurred while checking if image paths are present +# {0} - paths +Case_checkImagePaths_noPaths=The following images had no associated paths: {0} CaseDetailsPanel.casePanel.border.title=Case CaseDetailsPanel.examinerLabel.text=Name: CaseDetailsPanel.examinerPanel.border.title=Examiner diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index 79e91535eb..cf702e1647 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -42,6 +42,7 @@ import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.text.SimpleDateFormat; +import java.util.ArrayList; import java.util.Collection; import java.util.Date; import java.util.HashMap; @@ -65,6 +66,7 @@ import javax.annotation.concurrent.GuardedBy; import javax.annotation.concurrent.ThreadSafe; import javax.swing.JOptionPane; import javax.swing.SwingUtilities; +import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; import org.openide.util.Lookup; import org.openide.util.NbBundle; @@ -195,8 +197,6 @@ public class Case { private final SleuthkitEventListener sleuthkitEventListener; private CollaborationMonitor collaborationMonitor; private Services caseServices; - // matches something like '\\.\PHYSICALDRIVE0' - private static final String PLACEHOLDER_DS_PATH_REGEX = "^\\s*\\\\\\\\\\.\\\\PHYSICALDRIVE\\d*\\s*$"; private volatile boolean hasDataSource = false; private volatile boolean hasData = false; @@ -1310,13 +1310,6 @@ public class Case { String path = entry.getValue(); boolean fileExists = (new File(path).exists()|| DriveUtils.driveExists(path)); if (!fileExists) { - // CT-7336: ignore relocating datasources if file provider is present and placeholder path is used. - if (newCurrentCase.getMetadata() != null - && !StringUtils.isBlank(newCurrentCase.getMetadata().getContentProviderName()) - && (path == null || path.matches(PLACEHOLDER_DS_PATH_REGEX))) { - continue; - } - try { DataSource ds = newCurrentCase.getSleuthkitCase().getDataSource(obj_id); String hostName = StringUtils.defaultString(ds.getHost() == null ? "" : ds.getHost().getName()); @@ -2296,6 +2289,8 @@ public class Case { checkForCancellation(); openCommunicationChannels(progressIndicator); checkForCancellation(); + checkImagePaths(); + checkForCancellation(); openFileSystemsInBackground(); return null; @@ -2314,6 +2309,40 @@ public class Case { throw ex; } } + + /** + * Check if content provider is present, all images have paths, or throw an error. + * @throws CaseActionException + */ + @Messages({ + "# {0} - paths", + "Case_checkImagePaths_noPaths=The following images had no associated paths: {0}", + "Case_checkImagePaths_exceptionOccurred=An exception occurred while checking if image paths are present" + }) + private void checkImagePaths() throws CaseActionException { + // if there is a content provider, images don't necessarily need paths + if (StringUtils.isNotBlank(this.metadata.getContentProviderName())) { + return; + } + + // identify images without paths + try { + List noPathImages = new ArrayList<>(); + List images = this.caseDb.getImages(); + for (Image img: images) { + if (ArrayUtils.isEmpty(img.getPaths())) { + noPathImages.add(img); + } + } + + if (!noPathImages.isEmpty()) { + String imageListStr = noPathImages.stream().map(Image::getName).collect(Collectors.joining(", ")); + throw new CaseActionException(Bundle.Case_checkImagePaths_noPaths(imageListStr)); + } + } catch (TskCoreException ex) { + throw new CaseActionException(Bundle.Case_checkImagePaths_exceptionOccurred(), ex); + } + } /** * Starts a background task that reads a sector from each file system of diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDefinition.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDefinition.java index 24f208f421..4dce91c0ba 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDefinition.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDefinition.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2011-2018 Basis Technology Corp. + * Copyright 2011-2024 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -54,20 +54,20 @@ final public class TagNameDefinition implements Comparable { private static final String TAGS_SETTINGS_NAME = "Tags"; //NON-NLS private static final String TAG_NAMES_SETTING_KEY = "TagNames"; //NON-NLS private static final String TAG_SETTING_VERSION_KEY = "CustomTagNameVersion"; - private static final int TAG_SETTINGS_VERSION = 1; + private static final int TAG_SETTINGS_VERSION = 2; // Changed tag type from TskData.FileKnown to TskData.TagType private final String displayName; private final String description; private final TagName.HTML_COLOR color; - private final TskData.FileKnown knownStatus; + private final TskData.TagType tagType; private static final List STANDARD_TAGS_DEFINITIONS = new ArrayList<>(); private static final List PROJECT_VIC_NAMES_NO_LONGER_USED = new ArrayList<>(); static { - STANDARD_TAGS_DEFINITIONS.add(new TagNameDefinition(Bundle.TagNameDefinition_predefTagNames_bookmark_text(), "", TagName.HTML_COLOR.NONE, TskData.FileKnown.UNKNOWN)); - STANDARD_TAGS_DEFINITIONS.add(new TagNameDefinition(Bundle.TagNameDefinition_predefTagNames_followUp_text(), "", TagName.HTML_COLOR.NONE, TskData.FileKnown.UNKNOWN)); - STANDARD_TAGS_DEFINITIONS.add(new TagNameDefinition(Bundle.TagNameDefinition_predefTagNames_notableItem_text(), "", TagName.HTML_COLOR.NONE, TskData.FileKnown.BAD)); + STANDARD_TAGS_DEFINITIONS.add(new TagNameDefinition(Bundle.TagNameDefinition_predefTagNames_bookmark_text(), "", TagName.HTML_COLOR.NONE, TskData.TagType.SUSPICIOUS)); + STANDARD_TAGS_DEFINITIONS.add(new TagNameDefinition(Bundle.TagNameDefinition_predefTagNames_followUp_text(), "", TagName.HTML_COLOR.NONE, TskData.TagType.SUSPICIOUS)); + STANDARD_TAGS_DEFINITIONS.add(new TagNameDefinition(Bundle.TagNameDefinition_predefTagNames_notableItem_text(), "", TagName.HTML_COLOR.NONE, TskData.TagType.BAD)); PROJECT_VIC_NAMES_NO_LONGER_USED.add("CAT-1: Child Exploitation (Illegal)"); PROJECT_VIC_NAMES_NO_LONGER_USED.add("CAT-2: Child Exploitation (Non-Illegal/Age Difficult)"); @@ -79,18 +79,27 @@ final public class TagNameDefinition implements Comparable { /** * Constructs a tag name definition consisting of a display name, - * description, color and knownStatus. + * description, color and tag type. * * @param displayName The display name for the tag name. * @param description The description for the tag name. * @param color The color for the tag name. * @param status The status denoted by the tag name. + * @deprecated TagNameDefinition(String displayName, String description, TagName.HTML_COLOR color, TskData.TagType status) should be used instead. */ + @Deprecated public TagNameDefinition(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown status) { this.displayName = displayName; this.description = description; this.color = color; - this.knownStatus = status; + this.tagType = TskData.TagType.convertFileKnownToTagType(status); + } + + public TagNameDefinition(String displayName, String description, TagName.HTML_COLOR color, TskData.TagType status) { + this.displayName = displayName; + this.description = description; + this.color = color; + this.tagType = status; } static Collection getStandardTagNameDefinitions() { @@ -164,10 +173,21 @@ final public class TagNameDefinition implements Comparable { /** * The status which will be applied to items with this tag. * - * @return a value of TskData.FileKnown which is associated with this tag + * @return a value of TskData.TagType which is associated with this tag */ + public TskData.TagType getTagType() { + return tagType; + } + + /** + * The status which will be applied to items with this tag. + * + * @return a value of TskData.FileKnown which is associated with this tag + * @deprecated getTagType() should be used instead. + */ + @Deprecated public TskData.FileKnown getKnownStatus() { - return knownStatus; + return TskData.TagType.convertTagTypeToFileKnown(tagType); } /** @@ -212,7 +232,7 @@ final public class TagNameDefinition implements Comparable { return false; } boolean sameName = this.getDisplayName().equals(((TagNameDefinition) obj).getDisplayName()); - boolean sameStatus = this.getKnownStatus().equals(((TagNameDefinition) obj).getKnownStatus()); + boolean sameStatus = this.getTagType().equals(((TagNameDefinition) obj).getTagType()); return sameName && sameStatus; } @@ -231,13 +251,13 @@ final public class TagNameDefinition implements Comparable { * that is used by the tags settings file. */ private String toSettingsFormat() { - return displayName + "," + description + "," + color.name() + "," + knownStatus.toString(); + return displayName + "," + description + "," + color.name() + "," + tagType.toString(); } TagName saveToCase(SleuthkitCase caseDb) { TagName tagName = null; try { - tagName = caseDb.getTaggingManager().addOrUpdateTagName(displayName, description, color, knownStatus); + tagName = caseDb.getTaggingManager().addOrUpdateTagName(displayName, description, color, tagType); } catch (TskCoreException ex) { LOGGER.log(Level.SEVERE, "Error saving tag name definition", ex); } @@ -251,7 +271,7 @@ final public class TagNameDefinition implements Comparable { * The currently custom tags properties are stored in one string property * value separated by ;. The properties of an individual tag are comma * separated in the format of: - * tag_name,tag_description,tag_color,known_status + * tag_name,tag_description,tag_color,tag_type * * In prior versions of autopsy the known_status was stored in the central * repository, therefore the properties file only had three values. @@ -279,7 +299,7 @@ final public class TagNameDefinition implements Comparable { String[] attributes = tagProps.split(","); definitions.add(new TagNameDefinition(attributes[0], attributes[1], - TagName.HTML_COLOR.valueOf(attributes[2]), TskData.FileKnown.valueOf(attributes[3]))); + TagName.HTML_COLOR.valueOf(attributes[2]), TskData.TagType.valueOf(attributes[3]))); } return definitions; @@ -316,7 +336,7 @@ final public class TagNameDefinition implements Comparable { Integer version = getPropertyFileVersion(); List definitions = new ArrayList<>(); - if (version == null) { + if (version == null || version == 1) { String tagsProperty = ModuleSettings.getConfigSetting(TAGS_SETTINGS_NAME, TAG_NAMES_SETTING_KEY); if (tagsProperty == null || tagsProperty.isEmpty()) { ModuleSettings.setConfigSetting(TAGS_SETTINGS_NAME, TAG_SETTING_VERSION_KEY, Integer.toString(TAG_SETTINGS_VERSION)); @@ -332,22 +352,27 @@ final public class TagNameDefinition implements Comparable { List notableTagList = null; for (String tagProps : individualTags) { String[] attributes = tagProps.split(","); - TskData.FileKnown fileKnown = TskData.FileKnown.UNKNOWN; + TskData.TagType tagType = TskData.TagType.SUSPICIOUS; if (attributes.length == 3) { // If notableTagList is null load it from the CR. if (notableTagList == null) { notableTagList = getCRNotableList(); } else { if (notableTagList.contains(attributes[0])) { - fileKnown = TskData.FileKnown.BAD; + tagType = TskData.TagType.BAD; } } } else { - fileKnown = TskData.FileKnown.valueOf(attributes[3]); + if (version == 1) { + // handle backwards compatibility + tagType = TskData.TagType.convertFileKnownToTagType(TskData.FileKnown.valueOf(attributes[3])); + } else { + tagType = TskData.TagType.valueOf(attributes[3]); + } } definitions.add(new TagNameDefinition(attributes[0], attributes[1], - TagName.HTML_COLOR.valueOf(attributes[2]), fileKnown)); + TagName.HTML_COLOR.valueOf(attributes[2]), tagType)); } } diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDialog.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDialog.java index 79207aaaaa..dccd8ae38a 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDialog.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagNameDialog.java @@ -62,7 +62,7 @@ final class TagNameDialog extends javax.swing.JDialog { initComponents(); tagNameTextField.setText(tagNameToEdit.getDisplayName()); descriptionTextArea.setText(tagNameToEdit.getDescription()); - notableCheckbox.setSelected(tagNameToEdit.getKnownStatus() == TskData.FileKnown.BAD); + notableCheckbox.setSelected(tagNameToEdit.getTagType() == TskData.TagType.BAD); tagNameTextField.setEnabled(false); this.display(); } diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagOptionsPanel.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagOptionsPanel.java index 2ef9869adc..a0947b468b 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagOptionsPanel.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagOptionsPanel.java @@ -314,7 +314,7 @@ final class TagOptionsPanel extends javax.swing.JPanel implements OptionsPanel { TagNameDialog dialog = new TagNameDialog(); TagNameDialog.BUTTON_PRESSED result = dialog.getResult(); if (result == TagNameDialog.BUTTON_PRESSED.OK) { - TskData.FileKnown status = dialog.isTagNotable() ? TskData.FileKnown.BAD : TskData.FileKnown.UNKNOWN; + TskData.TagType status = dialog.isTagNotable() ? TskData.TagType.BAD : TskData.TagType.SUSPICIOUS; TagNameDefinition newTagType = new TagNameDefinition(dialog.getTagName(), dialog.getTagDesciption(), DEFAULT_COLOR, status); /* * If tag name already exists, don't add the tag name. @@ -348,7 +348,7 @@ final class TagOptionsPanel extends javax.swing.JPanel implements OptionsPanel { TagNameDialog dialog = new TagNameDialog(originalTagName); TagNameDialog.BUTTON_PRESSED result = dialog.getResult(); if (result == TagNameDialog.BUTTON_PRESSED.OK) { - TskData.FileKnown status = dialog.isTagNotable() ? TskData.FileKnown.BAD : TskData.FileKnown.UNKNOWN; + TskData.TagType status = dialog.isTagNotable() ? TskData.TagType.BAD : TskData.TagType.SUSPICIOUS; TagNameDefinition newTagType = new TagNameDefinition(dialog.getTagName(), dialog.getTagDesciption(), DEFAULT_COLOR, status); /* * If tag name already exists, don't add the tag name. @@ -359,7 +359,7 @@ final class TagOptionsPanel extends javax.swing.JPanel implements OptionsPanel { tagNamesList.setSelectedValue(newTagType, true); updatePanel(); firePropertyChange(OptionsPanelController.PROP_CHANGED, null, null); - if (originalTagName.getKnownStatus() != newTagType.getKnownStatus() && Case.isCaseOpen()) { + if (originalTagName.getTagType() != newTagType.getTagType() && Case.isCaseOpen()) { updatedStatusTags.add(newTagType.getDisplayName()); } } @@ -449,7 +449,7 @@ final class TagOptionsPanel extends javax.swing.JPanel implements OptionsPanel { deleteTagNameButton.setEnabled(enableEdit); if (isSelected) { descriptionTextArea.setText(tagNamesList.getSelectedValue().getDescription()); - if (tagNamesList.getSelectedValue().getKnownStatus() == TskData.FileKnown.BAD) { + if (tagNamesList.getSelectedValue().getTagType() == TskData.TagType.BAD) { notableYesOrNoLabel.setText("Yes"); } else { notableYesOrNoLabel.setText("No"); diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagsManager.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagsManager.java index a4bd51bcce..fc7a0fc9d8 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagsManager.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagsManager.java @@ -188,7 +188,7 @@ public class TagsManager implements Closeable { } /** - * Gets the set of display names of notable (TskData.FileKnown.BAD) tag + * Gets the set of display names of notable (TskData.TagType.BAD) tag * types. If a case is not open the list will only include only the user * defined custom tags. Otherwise the list will include all notable tags. * @@ -197,7 +197,7 @@ public class TagsManager implements Closeable { public static List getNotableTagDisplayNames() { List tagDisplayNames = new ArrayList<>(); for (TagNameDefinition tagDef : TagNameDefinition.getTagNameDefinitions()) { - if (tagDef.getKnownStatus() == TskData.FileKnown.BAD) { + if (tagDef.getTagType() == TskData.TagType.BAD) { tagDisplayNames.add(tagDef.getDisplayName()); } } @@ -205,7 +205,7 @@ public class TagsManager implements Closeable { try { TagsManager tagsManager = Case.getCurrentCaseThrows().getServices().getTagsManager(); for (TagName tagName : tagsManager.getAllTagNames()) { - if (tagName.getKnownStatus() == TskData.FileKnown.BAD + if (tagName.getTagType() == TskData.TagType.BAD && !tagDisplayNames.contains(tagName.getDisplayName())) { tagDisplayNames.add(tagName.getDisplayName()); } @@ -303,14 +303,14 @@ public class TagsManager implements Closeable { // add the standard tag names for (TagNameDefinition def : TagNameDefinition.getStandardTagNameDefinitions()) { - taggingMgr.addOrUpdateTagName(def.getDisplayName(), def.getDescription(), def.getColor(), def.getKnownStatus()); + taggingMgr.addOrUpdateTagName(def.getDisplayName(), def.getDescription(), def.getColor(), def.getTagType()); } //Assume new case and add all tag sets for (TagSetDefinition setDef : TagSetDefinition.readTagSetDefinitions()) { List tagNamesInSet = new ArrayList<>(); for (TagNameDefinition tagNameDef : setDef.getTagNameDefinitions()) { - tagNamesInSet.add(taggingMgr.addOrUpdateTagName(tagNameDef.getDisplayName(), tagNameDef.getDescription(), tagNameDef.getColor(), tagNameDef.getKnownStatus())); + tagNamesInSet.add(taggingMgr.addOrUpdateTagName(tagNameDef.getDisplayName(), tagNameDef.getDescription(), tagNameDef.getColor(), tagNameDef.getTagType())); } if (!tagNamesInSet.isEmpty()) { @@ -505,7 +505,7 @@ public class TagsManager implements Closeable { * name to the case database. */ public TagName addTagName(String displayName) throws TagNameAlreadyExistsException, TskCoreException { - return addTagName(displayName, "", TagName.HTML_COLOR.NONE, TskData.FileKnown.UNKNOWN); + return addTagName(displayName, "", TagName.HTML_COLOR.NONE, TskData.TagType.SUSPICIOUS); } /** @@ -524,7 +524,7 @@ public class TagsManager implements Closeable { * name to the case database. */ public TagName addTagName(String displayName, String description) throws TagNameAlreadyExistsException, TskCoreException { - return addTagName(displayName, description, TagName.HTML_COLOR.NONE, TskData.FileKnown.UNKNOWN); + return addTagName(displayName, description, TagName.HTML_COLOR.NONE, TskData.TagType.SUSPICIOUS); } /** @@ -543,7 +543,23 @@ public class TagsManager implements Closeable { * name to the case database. */ public TagName addTagName(String displayName, String description, TagName.HTML_COLOR color) throws TagNameAlreadyExistsException, TskCoreException { - return addTagName(displayName, description, color, TskData.FileKnown.UNKNOWN); + return addTagName(displayName, description, color, TskData.TagType.SUSPICIOUS); + } + + /** + * + * @param displayName + * @param description + * @param color + * @param knownStatus + * @return + * @throws org.sleuthkit.autopsy.casemodule.services.TagsManager.TagNameAlreadyExistsException + * @throws TskCoreException + * @deprecated addTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.TagType tagType) should be used instead + */ + @Deprecated + public TagName addTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus) throws TagNameAlreadyExistsException, TskCoreException { + return addTagName(displayName, description, color, TskData.TagType.convertFileKnownToTagType(knownStatus)); } /** @@ -553,8 +569,8 @@ public class TagsManager implements Closeable { * @param displayName The display name for the new tag type. * @param description The description for the new tag type. * @param color The color to associate with the new tag type. - * @param knownStatus The knownStatus to be used for the tag when - * correlating on the tagged item + * @param tagType The tagType to be used for the tag when + correlating on the tagged item * * @return A TagName object that can be used to add instances of the tag * type to the case database. @@ -563,12 +579,12 @@ public class TagsManager implements Closeable { * @throws TskCoreException If there is an error adding the tag * name to the case database. */ - public TagName addTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus) throws TagNameAlreadyExistsException, TskCoreException { + public TagName addTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.TagType tagType) throws TagNameAlreadyExistsException, TskCoreException { synchronized (lock) { try { - TagName tagName = caseDb.getTaggingManager().addOrUpdateTagName(displayName, description, color, knownStatus); + TagName tagName = caseDb.getTaggingManager().addOrUpdateTagName(displayName, description, color, tagType); Set customTypes = TagNameDefinition.getTagNameDefinitions(); - customTypes.add(new TagNameDefinition(displayName, description, color, knownStatus)); + customTypes.add(new TagNameDefinition(displayName, description, color, tagType)); TagNameDefinition.setTagNameDefinitions(customTypes); return tagName; } catch (TskCoreException ex) { diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java b/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java index ae35d971bf..61997e8de2 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/application/OtherOccurrences.java @@ -167,8 +167,8 @@ public final class OtherOccurrences { if (newNode.getKnown() != TskData.FileKnown.BAD) { List fileMatchTags = autopsyCase.getServices().getTagsManager().getContentTagsByContent(newFile); for (ContentTag tag : fileMatchTags) { - TskData.FileKnown tagKnownStatus = tag.getName().getKnownStatus(); - if (tagKnownStatus.equals(TskData.FileKnown.BAD)) { + TskData.TagType tagType = tag.getName().getTagType(); + if (tagType.equals(TskData.TagType.BAD)) { newNode.updateKnown(TskData.FileKnown.BAD); break; } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUtil.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUtil.java index 410e78e52d..8cc775192c 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUtil.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDbUtil.java @@ -307,7 +307,7 @@ public class CentralRepoDbUtil { } /** - * Conver thte Type's DbTableName string to the *_instances table name. + * Convert the Type's DbTableName string to the *_instances table name. * * @param type Correlation Type * diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java index 6610fcbd86..c6f8b96275 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/CaseEventListener.java @@ -482,10 +482,11 @@ public final class CaseEventListener implements PropertyChangeListener { for (BlackboardArtifactTag bbTag : artifactTags) { //start with assumption that none of the other tags applied to this Correlation Attribute will prevent it's status from being changed boolean hasTagWithConflictingKnownStatus = false; - // if the status of the tag has been changed to TskData.FileKnown.UNKNOWN + // if the status of the tag has been changed to TskData.TagType.UNKNOWN or TskData.TagType.SUSPICIOUS // we need to check the status of all other tags on this correlation attribute before changing // the status of the correlation attribute in the central repository - if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) { + if (tagName.getTagType() == TskData.TagType.UNKNOWN + || tagName.getTagType() == TskData.TagType.SUSPICIOUS) { Content content = bbTag.getContent(); // If the content which this Blackboard Artifact Tag is linked to is an AbstractFile with KNOWN status then // it's status in the central reporsitory should not be changed to UNKNOWN @@ -503,7 +504,7 @@ public final class CaseEventListener implements PropertyChangeListener { continue; } //if any other tags on this artifact are Notable in status then this artifact can not have its status changed - if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) { + if (TskData.TagType.BAD == t.getName().getTagType()) { //a tag with a conflicting status has been found, the status of this correlation attribute can not be modified hasTagWithConflictingKnownStatus = true; break; @@ -522,10 +523,11 @@ public final class CaseEventListener implements PropertyChangeListener { for (ContentTag contentTag : fileTags) { //start with assumption that none of the other tags applied to this ContentTag will prevent it's status from being changed boolean hasTagWithConflictingKnownStatus = false; - // if the status of the tag has been changed to TskData.FileKnown.UNKNOWN + // if the status of the tag has been changed to TskData.TagType.UNKNOWN or TskData.TagType.SUSPICIOUS // we need to check the status of all other tags on this file before changing // the status of the file in the central repository - if (tagName.getKnownStatus() == TskData.FileKnown.UNKNOWN) { + if (tagName.getTagType() == TskData.TagType.UNKNOWN + || tagName.getTagType() == TskData.TagType.SUSPICIOUS) { Content content = contentTag.getContent(); TagsManager tagsManager = Case.getCurrentCaseThrows().getServices().getTagsManager(); List tags = tagsManager.getContentTagsByContent(content); @@ -536,7 +538,7 @@ public final class CaseEventListener implements PropertyChangeListener { continue; } //if any other tags on this file are Notable in status then this file can not have its status changed - if (TskData.FileKnown.BAD == t.getName().getKnownStatus()) { + if (TskData.TagType.BAD == t.getName().getTagType()) { //a tag with a conflicting status has been found, the status of this file can not be modified hasTagWithConflictingKnownStatus = true; break; @@ -556,7 +558,7 @@ public final class CaseEventListener implements PropertyChangeListener { } } } catch (TskCoreException ex) { - LOGGER.log(Level.SEVERE, "Cannot update known status in central repository for tag: " + modifiedTagName, ex); //NON-NLS + LOGGER.log(Level.SEVERE, "Cannot update tag type in central repository for tag: " + modifiedTagName, ex); //NON-NLS } catch (CentralRepoException ex) { LOGGER.log(Level.SEVERE, "Cannot get central repository for tag: " + modifiedTagName, ex); //NON-NLS } catch (NoCurrentCaseException ex) { diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java index e556c39e7d..f1a707531a 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java @@ -175,7 +175,8 @@ public class AnalysisResultsViewModel { "AnalysisResultsViewModel_displayAttributes_score=Score", "AnalysisResultsViewModel_displayAttributes_type=Type", "AnalysisResultsViewModel_displayAttributes_configuration=Configuration", - "AnalysisResultsViewModel_displayAttributes_conclusion=Conclusion" + "AnalysisResultsViewModel_displayAttributes_conclusion=Conclusion", + "AnalysisResultsViewModel_displayAttributes_justification=Justification" }) private ResultDisplayAttributes getDisplayAttributes(AnalysisResult analysisResult) { // The type of BlackboardArtifact.Type of the analysis result. @@ -195,7 +196,9 @@ public class AnalysisResultsViewModel { Pair.of(Bundle.AnalysisResultsViewModel_displayAttributes_configuration(), normalizeAttr(analysisResult.getConfiguration())), Pair.of(Bundle.AnalysisResultsViewModel_displayAttributes_conclusion(), - normalizeAttr(analysisResult.getConclusion())) + normalizeAttr(analysisResult.getConclusion())), + Pair.of(Bundle.AnalysisResultsViewModel_displayAttributes_justification(), + normalizeAttr(analysisResult.getJustification())) ); // The BlackboardAttributes sorted by type display name. diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/Bundle.properties-MERGED index ae4d0b3b6b..fc4ba9ee8c 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/Bundle.properties-MERGED @@ -8,5 +8,6 @@ AnalysisResultsContentViewer_title=Analysis Results AnalysisResultsContentViewer_tooltip=Viewer for Analysis Results related to the selected node. AnalysisResultsViewModel_displayAttributes_conclusion=Conclusion AnalysisResultsViewModel_displayAttributes_configuration=Configuration +AnalysisResultsViewModel_displayAttributes_justification=Justification AnalysisResultsViewModel_displayAttributes_score=Score AnalysisResultsViewModel_displayAttributes_type=Type diff --git a/Core/src/org/sleuthkit/autopsy/report/infrastructure/ReportVisualPanel2.java b/Core/src/org/sleuthkit/autopsy/report/infrastructure/ReportVisualPanel2.java index 9a43174ae7..ddbfef840c 100644 --- a/Core/src/org/sleuthkit/autopsy/report/infrastructure/ReportVisualPanel2.java +++ b/Core/src/org/sleuthkit/autopsy/report/infrastructure/ReportVisualPanel2.java @@ -158,7 +158,7 @@ final class ReportVisualPanel2 extends JPanel { } for (TagName tagName : tagNamesInUse) { - String notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tagName.getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; tagStates.put(tagName.getDisplayName() + notableString, Boolean.FALSE); } tags.addAll(tagStates.keySet()); diff --git a/Core/src/org/sleuthkit/autopsy/report/infrastructure/TableReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/infrastructure/TableReportGenerator.java index 8a591d693e..96c2f58da0 100644 --- a/Core/src/org/sleuthkit/autopsy/report/infrastructure/TableReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/infrastructure/TableReportGenerator.java @@ -94,7 +94,7 @@ class TableReportGenerator { String notableString = ""; for (TagName tagName : tagNamesInUse) { - notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + notableString = tagName.getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; tagNames.add(tagName.getDisplayName() + notableString); } tagNamesFilter = new HashSet<>(tagNames); @@ -369,7 +369,7 @@ class TableReportGenerator { } // skip tags that we are not reporting on - String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tag.getName().getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) { continue; } @@ -461,7 +461,7 @@ class TableReportGenerator { return; } - String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tag.getName().getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) { continue; } @@ -1193,7 +1193,7 @@ class TableReportGenerator { try { List contentTags = Case.getCurrentCaseThrows().getServices().getTagsManager().getContentTagsByContent(content); for (ContentTag ct : contentTags) { - String notableString = ct.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = ct.getName().getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; allTags.add(ct.getName().getDisplayName() + notableString); } } catch (TskCoreException | NoCurrentCaseException ex) { @@ -1239,7 +1239,7 @@ class TableReportGenerator { List tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact); HashSet uniqueTagNames = new HashSet<>(); for (BlackboardArtifactTag tag : tags) { - String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tag.getName().getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; uniqueTagNames.add(tag.getName().getDisplayName() + notableString); } if (failsTagFilter(uniqueTagNames, tagNamesFilter)) { diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java b/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java index 0d9ca80cb9..0f640885a4 100644 --- a/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java +++ b/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java @@ -954,7 +954,7 @@ public class HTMLReport implements TableReportModule { } for (int i = 0; i < contentTags.size(); i++) { ContentTag tag = contentTags.get(i); - String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tag.getName().getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; linkToThumbnail.append(tag.getName().getDisplayName()).append(notableString); if (i != contentTags.size() - 1) { linkToThumbnail.append(", "); diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java b/Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java index 1b022d069f..860739f91b 100644 --- a/Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java +++ b/Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java @@ -344,7 +344,7 @@ public class PortableCaseReportModule implements ReportModule { progressPanel.updateStatusLabel(Bundle.PortableCaseReportModule_generateReport_copyingTags()); try { for (TagName tagName : tagNames) { - TagName newTagName = portableSkCase.getTaggingManager().addOrUpdateTagName(tagName.getDisplayName(), tagName.getDescription(), tagName.getColor(), tagName.getKnownStatus()); + TagName newTagName = portableSkCase.getTaggingManager().addOrUpdateTagName(tagName.getDisplayName(), tagName.getDescription(), tagName.getColor(), tagName.getTagType()); oldTagNameToNewTagName.put(tagName, newTagName); } } catch (TskCoreException ex) { diff --git a/Core/src/org/sleuthkit/autopsy/tags/TagUtils.java b/Core/src/org/sleuthkit/autopsy/tags/TagUtils.java index de93bed26e..aca445ea84 100755 --- a/Core/src/org/sleuthkit/autopsy/tags/TagUtils.java +++ b/Core/src/org/sleuthkit/autopsy/tags/TagUtils.java @@ -64,7 +64,7 @@ public final class TagUtils { logger.log(Level.SEVERE, String.format("Failed to get TagSet for TagName '%s' (ID=%d)", tagName.getDisplayName(), tagName.getId())); } - if (tagName.getKnownStatus() == TskData.FileKnown.BAD) { + if (tagName.getTagType() == TskData.TagType.BAD) { displayName += " (Notable)"; } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryService.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryService.java index 897b50ae2b..ff17afbdf2 100755 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryService.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryService.java @@ -65,11 +65,11 @@ public class ImageGalleryService implements AutopsyService { static { // NOTE: The colors here are what will be shown in the border - PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT0, "", TagName.HTML_COLOR.GREEN, TskData.FileKnown.UNKNOWN)); - PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT1, "", TagName.HTML_COLOR.RED, TskData.FileKnown.BAD)); - PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT2, "", TagName.HTML_COLOR.YELLOW, TskData.FileKnown.BAD)); - PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT3, "", TagName.HTML_COLOR.FUCHSIA, TskData.FileKnown.BAD)); - PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT4, "", TagName.HTML_COLOR.BLUE, TskData.FileKnown.UNKNOWN)); + PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT0, "", TagName.HTML_COLOR.GREEN, TskData.TagType.SUSPICIOUS)); + PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT1, "", TagName.HTML_COLOR.RED, TskData.TagType.BAD)); + PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT2, "", TagName.HTML_COLOR.YELLOW, TskData.TagType.BAD)); + PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT3, "", TagName.HTML_COLOR.FUCHSIA, TskData.TagType.BAD)); + PROJECT_VIC_US_CATEGORIES.add(new TagNameDefinition(PV_US_CAT4, "", TagName.HTML_COLOR.BLUE, TskData.TagType.SUSPICIOUS)); } @Override @@ -149,7 +149,7 @@ public class ImageGalleryService implements AutopsyService { private void addProjetVicTagSet(Case currentCase) throws TskCoreException { List tagNames = new ArrayList<>(); for (TagNameDefinition def : PROJECT_VIC_US_CATEGORIES) { - tagNames.add(currentCase.getSleuthkitCase().getTaggingManager().addOrUpdateTagName(def.getDisplayName(), def.getDescription(), def.getColor(), def.getKnownStatus())); + tagNames.add(currentCase.getSleuthkitCase().getTaggingManager().addOrUpdateTagName(def.getDisplayName(), def.getDescription(), def.getColor(), def.getTagType())); } currentCase.getServices().getTagsManager().addTagSet(PROJECT_VIC_TAG_SET_NAME, tagNames); } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/AddTagAction.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/AddTagAction.java index e6af400473..c75d6e5272 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/AddTagAction.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/AddTagAction.java @@ -68,7 +68,7 @@ public class AddTagAction extends Action { this.selectedFileIDs = selectedFileIDs; this.tagName = tagName; setGraphic(controller.getTagsManager().getGraphic(tagName)); - String notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tagName.getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; setText(tagName.getDisplayName() + notableString); setEventHandler(actionEvent -> addTagWithComment("")); } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/DeleteTagAction.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/DeleteTagAction.java index efe279bba3..c0ec387082 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/DeleteTagAction.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/DeleteTagAction.java @@ -66,7 +66,7 @@ public class DeleteTagAction extends Action { this.tagName = tagName; this.contentTag = contentTag; setGraphic(controller.getTagsManager().getGraphic(tagName)); - String notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; + String notableString = tagName.getTagType() == TskData.TagType.BAD ? TagsManager.getNotableTagLabel() : ""; setText(tagName.getDisplayName() + notableString); setEventHandler(actionEvent -> deleteTag()); } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java index 7f1449c609..bc91d9b9a8 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java @@ -320,6 +320,8 @@ class Chromium extends Extract { jProfile = jElement.get("profile").getAsJsonObject(); //NON-NLS jInfoCache = jProfile.get("info_cache").getAsJsonObject(); } else { + userProfiles.put(browserLocation, "Default"); + browserLocations.put(browserLocation, browser); continue; } } catch (JsonIOException | JsonSyntaxException | IllegalStateException ex) { @@ -854,60 +856,62 @@ class Chromium extends Extract { Set bookmarkKeys = jRoot.keySet(); for (String bookmarkKey : bookmarkKeys) { JsonObject jBookmark = jRoot.get(bookmarkKey).getAsJsonObject(); //NON-NLS - JsonArray jBookmarkArray = jBookmark.getAsJsonArray("children"); //NON-NLS - for (JsonElement result : jBookmarkArray) { - JsonObject address = result.getAsJsonObject(); - if (address == null) { - continue; - } - JsonElement urlEl = address.get("url"); //NON-NLS - String url; - if (urlEl != null) { - url = urlEl.getAsString(); - } else { - url = ""; - } - String name; - JsonElement nameEl = address.get("name"); //NON-NLS - if (nameEl != null) { - name = nameEl.getAsString(); - } else { - name = ""; - } - Long date; - JsonElement dateEl = address.get("date_added"); //NON-NLS - if (dateEl != null) { - date = dateEl.getAsLong(); - } else { - date = Long.valueOf(0); - } - String domain = NetworkUtils.extractDomain(url); - Collection bbattributes = new ArrayList<>(); - //TODO Revisit usage of deprecated constructor as per TSK-583 - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL, - RecentActivityExtracterModuleFactory.getModuleName(), url)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TITLE, - RecentActivityExtracterModuleFactory.getModuleName(), name)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, - RecentActivityExtracterModuleFactory.getModuleName(), (date / 1000000) - Long.valueOf("11644473600"))); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, - RecentActivityExtracterModuleFactory.getModuleName(), browserName)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DOMAIN, - RecentActivityExtracterModuleFactory.getModuleName(), domain)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_USER_NAME, - RecentActivityExtracterModuleFactory.getModuleName(), userName)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, - RecentActivityExtracterModuleFactory.getModuleName(), bookmarkKey)); + if (jBookmark.has("children")) { + JsonArray jBookmarkArray = jBookmark.getAsJsonArray("children"); //NON-NLS + for (JsonElement result : jBookmarkArray) { + JsonObject address = result.getAsJsonObject(); + if (address == null) { + continue; + } + JsonElement urlEl = address.get("url"); //NON-NLS + String url; + if (urlEl != null) { + url = urlEl.getAsString(); + } else { + url = ""; + } + String name; + JsonElement nameEl = address.get("name"); //NON-NLS + if (nameEl != null) { + name = nameEl.getAsString(); + } else { + name = ""; + } + Long date; + JsonElement dateEl = address.get("date_added"); //NON-NLS + if (dateEl != null) { + date = dateEl.getAsLong(); + } else { + date = Long.valueOf(0); + } + String domain = NetworkUtils.extractDomain(url); + Collection bbattributes = new ArrayList<>(); + //TODO Revisit usage of deprecated constructor as per TSK-583 + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL, + RecentActivityExtracterModuleFactory.getModuleName(), url)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TITLE, + RecentActivityExtracterModuleFactory.getModuleName(), name)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, + RecentActivityExtracterModuleFactory.getModuleName(), (date / 1000000) - Long.valueOf("11644473600"))); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, + RecentActivityExtracterModuleFactory.getModuleName(), browserName)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DOMAIN, + RecentActivityExtracterModuleFactory.getModuleName(), domain)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_USER_NAME, + RecentActivityExtracterModuleFactory.getModuleName(), userName)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, + RecentActivityExtracterModuleFactory.getModuleName(), bookmarkKey)); - try { - bbartifacts.add(createArtifactWithAttributes(BlackboardArtifact.Type.TSK_WEB_BOOKMARK, bookmarkFile, bbattributes)); - } catch (TskCoreException ex) { - logger.log(Level.SEVERE, String.format("Failed to create bookmark artifact for file (%d)", bookmarkFile.getId()), ex); - } + try { + bbartifacts.add(createArtifactWithAttributes(BlackboardArtifact.Type.TSK_WEB_BOOKMARK, bookmarkFile, bbattributes)); + } catch (TskCoreException ex) { + logger.log(Level.SEVERE, String.format("Failed to create bookmark artifact for file (%d)", bookmarkFile.getId()), ex); + } + } } - } + } if (!context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts);