mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-15 09:17:42 +00:00
Changed the logic per Brian's comments
This commit is contained in:
parent
c14b8d55fc
commit
05da0c83b5
@ -2,7 +2,6 @@ cannotBuildXmlParser=Unable to build XML parser:
|
|||||||
cannotLoadSEUQA=Unable to load Search Engine URL Query Analyzer settings file, SEUQAMappings.xml:
|
cannotLoadSEUQA=Unable to load Search Engine URL Query Analyzer settings file, SEUQAMappings.xml:
|
||||||
cannotParseXml=Unable to parse XML file:
|
cannotParseXml=Unable to parse XML file:
|
||||||
ChromeCacheExtractor.moduleName=ChromeCacheExtractor
|
ChromeCacheExtractor.moduleName=ChromeCacheExtractor
|
||||||
# {0} - OS name
|
|
||||||
DataSourceUsageAnalyzer.customVolume.label=OS Drive ({0})
|
DataSourceUsageAnalyzer.customVolume.label=OS Drive ({0})
|
||||||
DataSourceUsageAnalyzer.parentModuleName=Recent Activity
|
DataSourceUsageAnalyzer.parentModuleName=Recent Activity
|
||||||
Extract.indexError.message=Failed to index artifact for keyword search.
|
Extract.indexError.message=Failed to index artifact for keyword search.
|
||||||
@ -48,8 +47,14 @@ ExtractSafari_Error_Getting_History=An error occurred while processing Safari hi
|
|||||||
ExtractSafari_Error_Parsing_Bookmark=An error occured while processing Safari Bookmark files
|
ExtractSafari_Error_Parsing_Bookmark=An error occured while processing Safari Bookmark files
|
||||||
ExtractSafari_Error_Parsing_Cookies=An error occured while processing Safari Cookies files
|
ExtractSafari_Error_Parsing_Cookies=An error occured while processing Safari Cookies files
|
||||||
ExtractSafari_Module_Name=Safari
|
ExtractSafari_Module_Name=Safari
|
||||||
|
ExtractZone_process_errMsg=A error occured processing ':Zone.Indentifier' files.
|
||||||
|
ExtractZone_process_errMsg_find=A failure occured while searching for :Zone.Indentifier files.
|
||||||
|
ExtractZone_progress_Msg=Extracting :Zone.Identifer files
|
||||||
|
INTENET_ZONE=Internet Zone
|
||||||
|
LOCAL_INTRANET_ZONE=Local Intranet Zone
|
||||||
|
LOCAL_MACHINE_ZONE=Local Machine Zone
|
||||||
OpenIDE-Module-Display-Category=Ingest Module
|
OpenIDE-Module-Display-Category=Ingest Module
|
||||||
OpenIDE-Module-Long-Description=Recent Activity ingest module.\n\n\The module extracts useful information about the recent user activity on the disk image being ingested, such as:\n\n- Recently open documents,\n- Web acitivity (sites visited, stored cookies, bookmarked sites, search engine queries, file downloads),\n- Recently attached devices,\n- Installed programs.\n\n\The module currently supports Windows only disk images.\n\The plugin is also fully functional when deployed on Windows version of Autopsy.
|
OpenIDE-Module-Long-Description=Recent Activity ingest module.\n\nThe module extracts useful information about the recent user activity on the disk image being ingested, such as:\n\n- Recently open documents,\n- Web acitivity (sites visited, stored cookies, bookmarked sites, search engine queries, file downloads),\n- Recently attached devices,\n- Installed programs.\n\nThe module currently supports Windows only disk images.\nThe plugin is also fully functional when deployed on Windows version of Autopsy.
|
||||||
OpenIDE-Module-Name=RecentActivity
|
OpenIDE-Module-Name=RecentActivity
|
||||||
OpenIDE-Module-Short-Description=Recent Activity finder ingest module
|
OpenIDE-Module-Short-Description=Recent Activity finder ingest module
|
||||||
Chrome.moduleName=Chrome
|
Chrome.moduleName=Chrome
|
||||||
@ -173,12 +178,13 @@ RecentDocumentsByLnk.parentModuleName.noSpace=RecentActivity
|
|||||||
RecentDocumentsByLnk.parentModuleName=Recent Activity
|
RecentDocumentsByLnk.parentModuleName=Recent Activity
|
||||||
RegRipperFullNotFound=Full version RegRipper executable not found.
|
RegRipperFullNotFound=Full version RegRipper executable not found.
|
||||||
RegRipperNotFound=Autopsy RegRipper executable not found.
|
RegRipperNotFound=Autopsy RegRipper executable not found.
|
||||||
# {0} - file name
|
RESTRICTED_ZONE=Restricted Sites Zone
|
||||||
SearchEngineURLQueryAnalyzer.init.exception.msg=Unable to find {0}.
|
SearchEngineURLQueryAnalyzer.init.exception.msg=Unable to find {0}.
|
||||||
SearchEngineURLQueryAnalyzer.moduleName.text=Search Engine
|
SearchEngineURLQueryAnalyzer.moduleName.text=Search Engine
|
||||||
SearchEngineURLQueryAnalyzer.engineName.none=NONE
|
SearchEngineURLQueryAnalyzer.engineName.none=NONE
|
||||||
SearchEngineURLQueryAnalyzer.domainSubStr.none=NONE
|
SearchEngineURLQueryAnalyzer.domainSubStr.none=NONE
|
||||||
SearchEngineURLQueryAnalyzer.toString=Name: {0}\nDomain Substring: {1}\n\count: {2}\nSplit Tokens: \n{3}
|
SearchEngineURLQueryAnalyzer.toString=Name: {0}\nDomain Substring: {1}\ncount: {2}\nSplit Tokens: \n{3}
|
||||||
SearchEngineURLQueryAnalyzer.parentModuleName.noSpace=RecentActivity
|
SearchEngineURLQueryAnalyzer.parentModuleName.noSpace=RecentActivity
|
||||||
SearchEngineURLQueryAnalyzer.parentModuleName=Recent Activity
|
SearchEngineURLQueryAnalyzer.parentModuleName=Recent Activity
|
||||||
|
TRUSTED_ZONE=Trusted Sites Zone
|
||||||
UsbDeviceIdMapper.parseAndLookup.text=Product: {0}
|
UsbDeviceIdMapper.parseAndLookup.text=Product: {0}
|
||||||
|
@ -73,6 +73,18 @@ final class ExtractZoneIdentifier extends Extract {
|
|||||||
if (zoneFiles == null || zoneFiles.isEmpty()) {
|
if (zoneFiles == null || zoneFiles.isEmpty()) {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ArrayList<Long> knownPathIDs = null;
|
||||||
|
try {
|
||||||
|
knownPathIDs = getPathIDsForType(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD);
|
||||||
|
} catch (TskCoreException ex) {
|
||||||
|
addErrorMessage(Bundle.ExtractZone_process_errMsg());
|
||||||
|
LOG.log(Level.SEVERE, "Failed to build PathIDs List for TSK_WEB_DOWNLOAD", ex);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (knownPathIDs == null) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
Collection<BlackboardArtifact> sourceArtifacts = new ArrayList<>();
|
Collection<BlackboardArtifact> sourceArtifacts = new ArrayList<>();
|
||||||
Collection<BlackboardArtifact> downloadArtifacts = new ArrayList<>();
|
Collection<BlackboardArtifact> downloadArtifacts = new ArrayList<>();
|
||||||
@ -129,21 +141,22 @@ final class ExtractZoneIdentifier extends Extract {
|
|||||||
}
|
}
|
||||||
|
|
||||||
AbstractFile downloadFile = getDownloadFile(dataSource, zoneFile);
|
AbstractFile downloadFile = getDownloadFile(dataSource, zoneFile);
|
||||||
|
ArrayList<Long> knownPathIDs = getPathIDsForType(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD);
|
||||||
|
|
||||||
if (downloadFile != null) {
|
if (downloadFile != null) {
|
||||||
if (getArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DOWNLOAD_SOURCE, zoneFile) == null) {
|
if (!knownPathIDs.contains(downloadFile.getDataSourceObjectId())) {
|
||||||
BlackboardArtifact sourcebba = createDownloadSourceArtifact(downloadFile, zoneInfo);
|
|
||||||
if (sourcebba != null) {
|
|
||||||
sourceArtifacts.add(sourcebba);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (getArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD, downloadFile) == null) {
|
|
||||||
BlackboardArtifact downloadbba = createDownloadArtifact(zoneFile, zoneInfo);
|
BlackboardArtifact downloadbba = createDownloadArtifact(zoneFile, zoneInfo);
|
||||||
if (downloadbba != null) {
|
if (downloadbba != null) {
|
||||||
downloadArtifacts.add(downloadbba);
|
downloadArtifacts.add(downloadbba);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (downloadFile.getArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE.TSK_DOWNLOAD_SOURCE) == 0) {
|
||||||
|
BlackboardArtifact sourcebba = createDownloadSourceArtifact(downloadFile, zoneInfo);
|
||||||
|
if (sourcebba != null) {
|
||||||
|
sourceArtifacts.add(sourcebba);
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -245,23 +258,27 @@ final class ExtractZoneIdentifier extends Extract {
|
|||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Determine if an artifact of the given type exists for the AbstractFile.
|
* Creates a list of PathIDs for the given Artifact type.
|
||||||
*
|
*
|
||||||
* @param type BlackboardArtifact type
|
* @param type BlackboardArtifact.ARTIFACT_TYPE
|
||||||
* @param file AbstraceFile
|
|
||||||
*
|
*
|
||||||
* @return Returns the existing BlackboardArtifact or null if none exists
|
* @return A list of PathIDs
|
||||||
*
|
*
|
||||||
* @throws TskCoreException
|
* @throws TskCoreException
|
||||||
*/
|
*/
|
||||||
private BlackboardArtifact getArtifact(BlackboardArtifact.ARTIFACT_TYPE type, AbstractFile file) throws TskCoreException {
|
private ArrayList<Long> getPathIDsForType(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
|
||||||
|
ArrayList<Long> idList = new ArrayList();
|
||||||
for (BlackboardArtifact artifact : currentCase.getSleuthkitCase().getBlackboardArtifacts(type)) {
|
for (BlackboardArtifact artifact : currentCase.getSleuthkitCase().getBlackboardArtifacts(type)) {
|
||||||
if (artifact.getDataSource().getId() == file.getDataSourceObjectId()) {
|
BlackboardAttribute pathIDAttribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
|
||||||
return artifact;
|
|
||||||
|
if (pathIDAttribute != null) {
|
||||||
|
long contentID = pathIDAttribute.getValueLong();
|
||||||
|
if (contentID != -1) {
|
||||||
|
idList.add(contentID);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
return idList;
|
||||||
return null;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Messages({
|
@Messages({
|
||||||
|
Loading…
x
Reference in New Issue
Block a user