mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7623 from sleuthkit/develop

Browse Source 
merge develop into new_table_load 5/10/22
This commit is contained in:
Ann Priestman 2022-05-10 08:32:19 -07:00 committed by GitHub
commit 0c3164fd8e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
17 changed files with 383 additions and 162 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Core/build.xml
View File

@ -134,10 +134,10 @@
<property environment="env"/> <property environment="env"/>
<copy file="${env.TSK_HOME}/bindings/java/dist/sleuthkit-${TSK_VERSION}.jar" <copy file="${env.TSK_HOME}/bindings/java/dist/sleuthkit-${TSK_VERSION}.jar"
tofile="${ext.dir}/sleuthkit-${TSK_VERSION}.jar"/> tofile="${ext.dir}/sleuthkit-${TSK_VERSION}.jar"/>
<copy file="${env.TSK_HOME}/bindings/java/lib/sqlite-jdbc-3.25.2.jar" <copy file="${env.TSK_HOME}/bindings/java/lib/sqlite-jdbc-3.36.0.3.jar"
tofile="${ext.dir}/sqlite-jdbc-3.25.2.jar"/> tofile="${ext.dir}/sqlite-jdbc-3.36.0.3.jar"/>
<copy file="${env.TSK_HOME}/bindings/java/lib/postgresql-42.2.18.jar" <copy file="${env.TSK_HOME}/bindings/java/lib/postgresql-42.3.5.jar"
tofile="${ext.dir}/postgresql-42.2.18.jar"/> tofile="${ext.dir}/postgresql-42.3.5.jar"/>
<copy file="${env.TSK_HOME}/bindings/java/lib/c3p0-0.9.5.5.jar" <copy file="${env.TSK_HOME}/bindings/java/lib/c3p0-0.9.5.5.jar"
tofile="${ext.dir}/c3p0-0.9.5.5.jar"/> tofile="${ext.dir}/c3p0-0.9.5.5.jar"/>
<copy file="${env.TSK_HOME}/bindings/java/lib/mchange-commons-java-0.2.20.jar" <copy file="${env.TSK_HOME}/bindings/java/lib/mchange-commons-java-0.2.20.jar"

4
Core/nbproject/project.properties
View File

@ -60,7 +60,7 @@ file.reference.netty-transport-native-epoll-4.1.73.Final.jar=release/modules/ext
file.reference.netty-transport-native-unix-common-4.1.73.Final.jar=release/modules/ext/netty-transport-native-unix-common-4.1.73.Final.jar file.reference.netty-transport-native-unix-common-4.1.73.Final.jar=release/modules/ext/netty-transport-native-unix-common-4.1.73.Final.jar
file.reference.okhttp-2.7.5.jar=release/modules/ext/okhttp-2.7.5.jar file.reference.okhttp-2.7.5.jar=release/modules/ext/okhttp-2.7.5.jar
file.reference.okio-1.6.0.jar=release/modules/ext/okio-1.6.0.jar file.reference.okio-1.6.0.jar=release/modules/ext/okio-1.6.0.jar
file.reference.postgresql-42.2.18.jar=release/modules/ext/postgresql-42.2.18.jar file.reference.postgresql-42.3.5.jar=release/modules/ext/postgresql-42.3.5.jar
file.reference.Rejistry-1.1-SNAPSHOT.jar=release/modules/ext/Rejistry-1.1-SNAPSHOT.jar file.reference.Rejistry-1.1-SNAPSHOT.jar=release/modules/ext/Rejistry-1.1-SNAPSHOT.jar
file.reference.sevenzipjbinding-AllPlatforms.jar=release/modules/ext/sevenzipjbinding-AllPlatforms.jar file.reference.sevenzipjbinding-AllPlatforms.jar=release/modules/ext/sevenzipjbinding-AllPlatforms.jar
file.reference.sevenzipjbinding.jar=release/modules/ext/sevenzipjbinding.jar file.reference.sevenzipjbinding.jar=release/modules/ext/sevenzipjbinding.jar
@ -69,7 +69,7 @@ file.reference.sleuthkit-caseuco-4.11.1.jar=release/modules/ext/sleuthkit-caseuc
file.reference.snakeyaml-1.30.jar=release/modules/ext/snakeyaml-1.30.jar file.reference.snakeyaml-1.30.jar=release/modules/ext/snakeyaml-1.30.jar
file.reference.SparseBitSet-1.1.jar=release/modules/ext/SparseBitSet-1.1.jar file.reference.SparseBitSet-1.1.jar=release/modules/ext/SparseBitSet-1.1.jar
file.reference.spotbugs-annotations-4.6.0.jar=release/modules/ext/spotbugs-annotations-4.6.0.jar file.reference.spotbugs-annotations-4.6.0.jar=release/modules/ext/spotbugs-annotations-4.6.0.jar
file.reference.sqlite-jdbc-3.25.2.jar=release/modules/ext/sqlite-jdbc-3.25.2.jar file.reference.sqlite-jdbc-3.36.0.3.jar=release/modules/ext/sqlite-jdbc-3.36.0.3.jar
file.reference.xmpcore-6.1.11.jar=release/modules/ext/xmpcore-6.1.11.jar file.reference.xmpcore-6.1.11.jar=release/modules/ext/xmpcore-6.1.11.jar
file.reference.YaraJNIWrapper.jar=release/modules/ext/YaraJNIWrapper.jar file.reference.YaraJNIWrapper.jar=release/modules/ext/YaraJNIWrapper.jar
file.reference.zookeeper-3.8.0.jar=release/modules/ext/zookeeper-3.8.0.jar file.reference.zookeeper-3.8.0.jar=release/modules/ext/zookeeper-3.8.0.jar

8
Core/nbproject/project.xml
View File

@ -595,8 +595,8 @@
<binary-origin>release/modules/ext/okio-1.6.0.jar</binary-origin> <binary-origin>release/modules/ext/okio-1.6.0.jar</binary-origin>
</class-path-extension> </class-path-extension>
<class-path-extension> <class-path-extension>
<runtime-relative-path>ext/postgresql-42.2.18.jar</runtime-relative-path> <runtime-relative-path>ext/postgresql-42.3.5.jar</runtime-relative-path>
<binary-origin>release/modules/ext/postgresql-42.2.18.jar</binary-origin> <binary-origin>release/modules/ext/postgresql-42.3.5.jar</binary-origin>
</class-path-extension> </class-path-extension>
<class-path-extension> <class-path-extension>
<runtime-relative-path>ext/Rejistry-1.1-SNAPSHOT.jar</runtime-relative-path> <runtime-relative-path>ext/Rejistry-1.1-SNAPSHOT.jar</runtime-relative-path>
@ -631,8 +631,8 @@
<binary-origin>release/modules/ext/spotbugs-annotations-4.6.0.jar</binary-origin> <binary-origin>release/modules/ext/spotbugs-annotations-4.6.0.jar</binary-origin>
</class-path-extension> </class-path-extension>
<class-path-extension> <class-path-extension>
<runtime-relative-path>ext/sqlite-jdbc-3.25.2.jar</runtime-relative-path> <runtime-relative-path>ext/sqlite-jdbc-3.36.0.3.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sqlite-jdbc-3.25.2.jar</binary-origin> <binary-origin>release/modules/ext/sqlite-jdbc-3.36.0.3.jar</binary-origin>
</class-path-extension> </class-path-extension>
<class-path-extension> <class-path-extension>
<runtime-relative-path>ext/xmpcore-6.1.11.jar</runtime-relative-path> <runtime-relative-path>ext/xmpcore-6.1.11.jar</runtime-relative-path>

3
Core/src/org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties
View File

@ -84,3 +84,6 @@ FilesSetDefsPanel.ruleLabel.text=Rule Details
FilesSetDefsPanel.pathLabel.text=Path Substring: FilesSetDefsPanel.pathLabel.text=Path Substring:
FilesSetDefsPanel.mimeTypeLabel.text=MIME Type: FilesSetDefsPanel.mimeTypeLabel.text=MIME Type:
FilesSetDefsPanel.fileSizeLabel.text=File Size: FilesSetDefsPanel.fileSizeLabel.text=File Size:
FilesSetRulePanel.ruleTypeLabel.text=Rule Type:
FilesSetRulePanel.inclusiveRuleTypeRadio.text=Include - files matching this rule will be included in results
FilesSetRulePanel.exclusiveRuleTypeRadio.text=Exclude - files matching this rule will be excluded from results

4
Core/src/org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties-MERGED
View File

@ -1,3 +1,4 @@
FileSet_fileIsMemberOf_noInclusiveRules_ruleName=Not Excluded
FilesIdentifierIngestJobSettingsPanel.getError=Error getting interesting files sets from settings file. FilesIdentifierIngestJobSettingsPanel.getError=Error getting interesting files sets from settings file.
FilesIdentifierIngestJobSettingsPanel.updateError=Error updating interesting files sets settings file. FilesIdentifierIngestJobSettingsPanel.updateError=Error updating interesting files sets settings file.
FilesIdentifierIngestModule.getFilesError=Error getting interesting files sets from file. FilesIdentifierIngestModule.getFilesError=Error getting interesting files sets from file.
@ -179,6 +180,9 @@ FilesSetDefsPanel.ruleLabel.text=Rule Details
FilesSetDefsPanel.pathLabel.text=Path Substring: FilesSetDefsPanel.pathLabel.text=Path Substring:
FilesSetDefsPanel.mimeTypeLabel.text=MIME Type: FilesSetDefsPanel.mimeTypeLabel.text=MIME Type:
FilesSetDefsPanel.fileSizeLabel.text=File Size: FilesSetDefsPanel.fileSizeLabel.text=File Size:
FilesSetRulePanel.ruleTypeLabel.text=Rule Type:
FilesSetRulePanel.inclusiveRuleTypeRadio.text=Include - files matching this rule will be included in results
FilesSetRulePanel.exclusiveRuleTypeRadio.text=Exclude - files matching this rule will be excluded from results
# {0} - filesSetName # {0} - filesSetName
StandardInterestingFileSetsLoader.customSuffixed={0} (Custom) StandardInterestingFileSetsLoader.customSuffixed={0} (Custom)
StandardInterestingFilesSetsLoader_cannotLoadStandard=Unable to properly read standard interesting files sets. StandardInterestingFilesSetsLoader_cannotLoadStandard=Unable to properly read standard interesting files sets.

3
Core/src/org/sleuthkit/autopsy/modules/interestingitems/Bundle_ja.properties
View File

@ -158,3 +158,6 @@ StandardInterestingFileSetsLoader.customSuffixed={0}\uff08\u30ab\u30b9\u30bf\u30
StandardInterestingFilesSetsLoader_cannotLoadStandard=\u6a19\u6e96\u306e\u8208\u5473\u6df1\u3044\u30d5\u30a1\u30a4\u30eb\u30bb\u30c3\u30c8\u3092\u6b63\u3057\u304f\u8aad\u307f\u53d6\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u305b\u3093\u3002 StandardInterestingFilesSetsLoader_cannotLoadStandard=\u6a19\u6e96\u306e\u8208\u5473\u6df1\u3044\u30d5\u30a1\u30a4\u30eb\u30bb\u30c3\u30c8\u3092\u6b63\u3057\u304f\u8aad\u307f\u53d6\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u305b\u3093\u3002
StandardInterestingFilesSetsLoader_cannotLoadUserConfigured=\u30e6\u30fc\u30b6\u30fc\u304c\u8a2d\u5b9a\u3057\u305f\u8208\u5473\u6df1\u3044\u30d5\u30a1\u30a4\u30eb\u30bb\u30c3\u30c8\u3092\u6b63\u3057\u304f\u8aad\u307f\u53d6\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u305b\u3093\u3002 StandardInterestingFilesSetsLoader_cannotLoadUserConfigured=\u30e6\u30fc\u30b6\u30fc\u304c\u8a2d\u5b9a\u3057\u305f\u8208\u5473\u6df1\u3044\u30d5\u30a1\u30a4\u30eb\u30bb\u30c3\u30c8\u3092\u6b63\u3057\u304f\u8aad\u307f\u53d6\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u305b\u3093\u3002
StandardInterestingFilesSetsLoader_cannotUpdateInterestingFilesSets=\u8208\u5473\u6df1\u3044\u30d5\u30a1\u30a4\u30eb\u30bb\u30c3\u30c8\u306e\u66f4\u65b0\u8a2d\u5b9a\u3092\u8a2d\u5b9a\u30d5\u30a9\u30eb\u30c0\u30fc\u306b\u66f8\u8fbc\u3081\u307e\u305b\u3093\u3002 StandardInterestingFilesSetsLoader_cannotUpdateInterestingFilesSets=\u8208\u5473\u6df1\u3044\u30d5\u30a1\u30a4\u30eb\u30bb\u30c3\u30c8\u306e\u66f4\u65b0\u8a2d\u5b9a\u3092\u8a2d\u5b9a\u30d5\u30a9\u30eb\u30c0\u30fc\u306b\u66f8\u8fbc\u3081\u307e\u305b\u3093\u3002
FilesSetRulePanel.ruleTypeLabel.text=\u30bf\u30a4\u30d7:
FilesSetRulePanel.inclusiveRuleTypeRadio.text=\u30d5\u30a1\u30a4\u30eb
FilesSetRulePanel.exclusiveRuleTypeRadio.text=\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30fc

80
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java
View File

@ -20,12 +20,15 @@ package org.sleuthkit.autopsy.modules.interestingitems;
import java.io.Serializable; import java.io.Serializable;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap; import java.util.HashMap;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Map.Entry;
import java.util.UUID; import java.util.UUID;
import java.util.regex.Pattern; import java.util.regex.Pattern;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.openide.util.NbBundle.Messages;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData; import org.sleuthkit.datamodel.TskData;
@ -48,7 +51,10 @@ public final class FilesSet implements Serializable {
private final boolean standardSet; private final boolean standardSet;
private final int versionNumber; private final int versionNumber;
private final Map<String, Rule> rules = new HashMap<>(); private final Map<String, Rule> rules;
private final Map<String, Rule> inclusiveRules;
private final Map<String, Rule> exclusiveRules;
/** /**
* Constructs an interesting files set. * Constructs an interesting files set.
@ -100,11 +106,22 @@ public final class FilesSet implements Serializable {
this.description = (description != null ? description : ""); this.description = (description != null ? description : "");
this.ignoreKnownFiles = ignoreKnownFiles; this.ignoreKnownFiles = ignoreKnownFiles;
this.ignoreUnallocatedSpace = ignoreUnallocatedSpace; this.ignoreUnallocatedSpace = ignoreUnallocatedSpace;
if (rules != null) { this.rules = rules == null ? Collections.emptyMap() : new HashMap<>(rules);
this.rules.putAll(rules);
Map<String, Rule> inclusiveRules = new HashMap<>();
Map<String, Rule> exclusiveRules = new HashMap<>();
for (Entry<String, Rule> ruleEntry : rules.entrySet()) {
if (ruleEntry.getValue().isExclusive()) {
exclusiveRules.put(ruleEntry.getKey(), ruleEntry.getValue());
} else {
inclusiveRules.put(ruleEntry.getKey(), ruleEntry.getValue());
} }
} }
this.inclusiveRules = inclusiveRules;
this.exclusiveRules = exclusiveRules;
}
/** /**
* @return Whether or not the FilesSet is considered a standard interesting * @return Whether or not the FilesSet is considered a standard interesting
* set file. * set file.
@ -171,6 +188,7 @@ public final class FilesSet implements Serializable {
return new HashMap<>(this.rules); return new HashMap<>(this.rules);
} }
/** /**
* Determines whether a file is a member of this interesting files set. * Determines whether a file is a member of this interesting files set.
* *
@ -179,6 +197,9 @@ public final class FilesSet implements Serializable {
* @return The name of the first set membership rule satisfied by the file, * @return The name of the first set membership rule satisfied by the file,
* will be null if the file does not belong to the set. * will be null if the file does not belong to the set.
*/ */
@Messages({
"FileSet_fileIsMemberOf_noInclusiveRules_ruleName=Not Excluded"
})
public String fileIsMemberOf(AbstractFile file) { public String fileIsMemberOf(AbstractFile file) {
if ((this.ignoreKnownFiles) && (file.getKnown() == TskData.FileKnown.KNOWN)) { if ((this.ignoreKnownFiles) && (file.getKnown() == TskData.FileKnown.KNOWN)) {
return null; return null;
@ -191,12 +212,35 @@ public final class FilesSet implements Serializable {
return null; return null;
} }
for (Rule rule : rules.values()) {
if (rule.isSatisfied(file)) { String ruleName;
return rule.getName(); if (inclusiveRules.isEmpty()) {
} // in the event there are no rules, return null for no match
} if (exclusiveRules.isEmpty()) {
return null; return null;
// in the event there are exclusion rules, rely on those
} else {
ruleName = Bundle.FileSet_fileIsMemberOf_noInclusiveRules_ruleName();
}
} else {
// if there are inclusive rules, at least one should be matched
ruleName = null;
for (Rule rule : inclusiveRules.values()) {
if (rule.isSatisfied(file)) {
ruleName = rule.getName();
break;
}
}
}
for (Rule rule : exclusiveRules.values()) {
if (rule.isSatisfied(file)) {
return null;
}
}
return ruleName;
} }
@Override @Override
@ -215,6 +259,7 @@ public final class FilesSet implements Serializable {
private static final long serialVersionUID = 1L; private static final long serialVersionUID = 1L;
private final String uuid; private final String uuid;
private final String ruleName; private final String ruleName;
private final Boolean exclusive;
private final FileNameCondition fileNameCondition; private final FileNameCondition fileNameCondition;
private final MetaTypeCondition metaTypeCondition; private final MetaTypeCondition metaTypeCondition;
private final ParentPathCondition pathCondition; private final ParentPathCondition pathCondition;
@ -234,8 +279,14 @@ public final class FilesSet implements Serializable {
* @param fileSizeCondition A file size condition, may be null. * @param fileSizeCondition A file size condition, may be null.
* @param dateCondition A file date created or modified condition, * @param dateCondition A file date created or modified condition,
* may be null * may be null
* @param exclusive Whether or not the rule excludes items
* matching the rule otherwise including them.
*/ */
public Rule(String ruleName, FileNameCondition fileNameCondition, MetaTypeCondition metaTypeCondition, ParentPathCondition pathCondition, MimeTypeCondition mimeTypeCondition, FileSizeCondition fileSizeCondition, DateCondition dateCondition) { public Rule(String ruleName, FileNameCondition fileNameCondition, MetaTypeCondition metaTypeCondition,
ParentPathCondition pathCondition, MimeTypeCondition mimeTypeCondition,
FileSizeCondition fileSizeCondition, DateCondition dateCondition,
Boolean exclusive) {
// since ruleName is optional, ruleUUID can be used to uniquely identify a rule. // since ruleName is optional, ruleUUID can be used to uniquely identify a rule.
this.uuid = UUID.randomUUID().toString(); this.uuid = UUID.randomUUID().toString();
if (metaTypeCondition == null) { if (metaTypeCondition == null) {
@ -274,6 +325,8 @@ public final class FilesSet implements Serializable {
if (this.dateCondition != null) { if (this.dateCondition != null) {
this.conditions.add(this.dateCondition); this.conditions.add(this.dateCondition);
} }
this.exclusive = exclusive;
} }
/** /**
@ -316,6 +369,15 @@ public final class FilesSet implements Serializable {
return this.dateCondition; return this.dateCondition;
} }
/**
* @return True if this rule should exclude certain files matching
* criteria, otherwise including files matching criteria if
* false.
*/
public boolean isExclusive() {
return exclusive != null && exclusive == true;
}
/** /**
* Determines whether or not a file satisfies the rule. * Determines whether or not a file satisfies the rule.
* *

6
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetDefsPanel.java
View File

@ -516,7 +516,11 @@ public final class FilesSetDefsPanel extends IngestModuleGlobalSettingsPanel imp
if (selectedRule != null) { if (selectedRule != null) {
rules.remove(selectedRule.getUuid()); rules.remove(selectedRule.getUuid());
} }
FilesSet.Rule newRule = new FilesSet.Rule(panel.getRuleName(), panel.getFileNameCondition(), panel.getMetaTypeCondition(), panel.getPathCondition(), panel.getMimeTypeCondition(), panel.getFileSizeCondition(), panel.getDateCondition()); FilesSet.Rule newRule = new FilesSet.Rule(panel.getRuleName(),
panel.getFileNameCondition(), panel.getMetaTypeCondition(),
panel.getPathCondition(), panel.getMimeTypeCondition(),
panel.getFileSizeCondition(), panel.getDateCondition(),
panel.isExclusive());
rules.put(newRule.getUuid(), newRule); rules.put(newRule.getUuid(), newRule);
// Add the new/edited files set definition, replacing any previous // Add the new/edited files set definition, replacing any previous

93
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetRulePanel.form
View File

@ -6,6 +6,8 @@
</Component> </Component>
<Component class="javax.swing.ButtonGroup" name="typeButtonGroup"> <Component class="javax.swing.ButtonGroup" name="typeButtonGroup">
</Component> </Component>
<Component class="javax.swing.ButtonGroup" name="ruleTypeButtonGroup">
</Component>
</NonVisualComponents> </NonVisualComponents>
<AuxValues> <AuxValues>
<AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/> <AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/>
@ -22,10 +24,34 @@
<Layout> <Layout>
<DimensionLayout dim="0"> <DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0"> <Group type="102" alignment="1" attributes="0">
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="1" attributes="0">
<Group type="102" alignment="0" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<EmptySpace min="-2" pref="8" max="-2" attributes="0"/> <EmptySpace min="-2" pref="8" max="-2" attributes="0"/>
<Component id="jLabel5" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Component id="ruleTypeLabel" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="119" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="exclusiveRuleTypeRadio" min="-2" max="-2" attributes="0"/>
<Component id="inclusiveRuleTypeRadio" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
</Group>
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
<Group type="102" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0">
<Component id="jSeparator1" max="32767" attributes="0"/>
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="1" attributes="0"> <Group type="102" alignment="1" attributes="0">
<Component id="ruleNameLabel" min="-2" max="-2" attributes="0"/> <Component id="ruleNameLabel" min="-2" max="-2" attributes="0"/>
@ -45,10 +71,10 @@
<EmptySpace max="32767" attributes="0"/> <EmptySpace max="32767" attributes="0"/>
<Component id="pathSeparatorInfoLabel" min="-2" max="-2" attributes="0"/> <Component id="pathSeparatorInfoLabel" min="-2" max="-2" attributes="0"/>
</Group> </Group>
<Group type="102" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Component id="ruleNameTextField" max="32767" attributes="0"/> <Component id="ruleNameTextField" max="32767" attributes="0"/>
<Group type="102" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Component id="daysIncludedTextField" min="-2" pref="69" max="-2" attributes="0"/> <Component id="daysIncludedTextField" min="-2" pref="69" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/> <EmptySpace max="-2" attributes="0"/>
<Component id="daysIncludedLabel" min="-2" max="-2" attributes="0"/> <Component id="daysIncludedLabel" min="-2" max="-2" attributes="0"/>
@ -66,7 +92,6 @@
</Group> </Group>
</Group> </Group>
</Group> </Group>
<Component id="jLabel5" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Component id="nameCheck" alignment="1" min="-2" pref="95" max="-2" attributes="0"/> <Component id="nameCheck" alignment="1" min="-2" pref="95" max="-2" attributes="0"/>
@ -74,20 +99,19 @@
</Group> </Group>
<EmptySpace min="-2" pref="16" max="-2" attributes="0"/> <EmptySpace min="-2" pref="16" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0"> <Component id="nameTextField" max="32767" attributes="0"/>
<Group type="102" alignment="0" attributes="0">
<Component id="filesRadioButton" min="-2" max="-2" attributes="0"/> <Component id="filesRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/> <EmptySpace max="-2" attributes="0"/>
<Component id="dirsRadioButton" min="-2" max="-2" attributes="0"/> <Component id="dirsRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/> <EmptySpace max="-2" attributes="0"/>
<Component id="allRadioButton" min="-2" max="-2" attributes="0"/> <Component id="allRadioButton" min="-2" max="-2" attributes="0"/>
</Group> </Group>
<Component id="nameTextField" max="32767" attributes="0"/>
</Group> </Group>
</Group> </Group>
</Group> </Group>
</Group> </Group>
<Group type="102" attributes="0"> <Group type="102" alignment="0" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Component id="pathCheck" alignment="0" min="-2" max="-2" attributes="0"/> <Component id="pathCheck" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="mimeCheck" min="-2" max="-2" attributes="0"/> <Component id="mimeCheck" min="-2" max="-2" attributes="0"/>
@ -97,7 +121,9 @@
<EmptySpace min="0" pref="0" max="32767" attributes="0"/> <EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group> </Group>
</Group> </Group>
<EmptySpace min="-2" max="-2" attributes="0"/> </Group>
</Group>
<EmptySpace max="-2" attributes="0"/>
</Group> </Group>
</Group> </Group>
</DimensionLayout> </DimensionLayout>
@ -105,7 +131,16 @@
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Component id="jLabel5" min="-2" max="-2" attributes="0"/> <Component id="jLabel5" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="3" max="-2" attributes="0"/> <EmptySpace min="-2" pref="8" max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0">
<Component id="ruleTypeLabel" min="-2" max="-2" attributes="0"/>
<Component id="inclusiveRuleTypeRadio" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace max="-2" attributes="0"/>
<Component id="exclusiveRuleTypeRadio" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="jSeparator1" min="-2" pref="9" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0"> <Group type="103" groupAlignment="1" attributes="0">
<Group type="102" alignment="1" attributes="0"> <Group type="102" alignment="1" attributes="0">
<Component id="jLabel1" min="-2" max="-2" attributes="0"/> <Component id="jLabel1" min="-2" max="-2" attributes="0"/>
@ -161,7 +196,7 @@
<Component id="ruleNameTextField" alignment="3" min="-2" max="-2" attributes="0"/> <Component id="ruleNameTextField" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="ruleNameLabel" alignment="3" max="32767" attributes="0"/> <Component id="ruleNameLabel" alignment="3" max="32767" attributes="0"/>
</Group> </Group>
<EmptySpace max="-2" attributes="0"/> <EmptySpace min="-2" pref="12" max="-2" attributes="0"/>
</Group> </Group>
</Group> </Group>
</DimensionLayout> </DimensionLayout>
@ -421,5 +456,39 @@
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="dateCheckActionPerformed"/> <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="dateCheckActionPerformed"/>
</Events> </Events>
</Component> </Component>
<Component class="javax.swing.JLabel" name="ruleTypeLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties" key="FilesSetRulePanel.ruleTypeLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
</Component>
<Component class="javax.swing.JRadioButton" name="inclusiveRuleTypeRadio">
<Properties>
<Property name="buttonGroup" type="javax.swing.ButtonGroup" editor="org.netbeans.modules.form.RADComponent$ButtonGroupPropertyEditor">
<ComponentRef name="ruleTypeButtonGroup"/>
</Property>
<Property name="selected" type="boolean" value="true"/>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties" key="FilesSetRulePanel.inclusiveRuleTypeRadio.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JRadioButton" name="exclusiveRuleTypeRadio">
<Properties>
<Property name="buttonGroup" type="javax.swing.ButtonGroup" editor="org.netbeans.modules.form.RADComponent$ButtonGroupPropertyEditor">
<ComponentRef name="ruleTypeButtonGroup"/>
</Property>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties" key="FilesSetRulePanel.exclusiveRuleTypeRadio.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JSeparator" name="jSeparator1">
</Component>
</SubComponents> </SubComponents>
</Form> </Form>

74
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetRulePanel.java
View File

@ -120,6 +120,7 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
populatePathConditionComponents(rule); populatePathConditionComponents(rule);
populateDateConditionComponents(rule); populateDateConditionComponents(rule);
populateSizeConditionComponents(rule); populateSizeConditionComponents(rule);
populateInclusiveExclusive(rule);
this.setButtons(okButton, cancelButton); this.setButtons(okButton, cancelButton);
updateNameTextFieldPrompt(); updateNameTextFieldPrompt();
@ -273,6 +274,11 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
} }
} }
private void populateInclusiveExclusive(FilesSet.Rule rule) {
this.inclusiveRuleTypeRadio.setSelected(!rule.isExclusive());
this.exclusiveRuleTypeRadio.setSelected(rule.isExclusive());
}
/** /**
* Populates the UI components that display the name condition for a rule. * Populates the UI components that display the name condition for a rule.
* *
@ -461,6 +467,14 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
return this.ruleNameTextField.getText(); return this.ruleNameTextField.getText();
} }
/**
* @return Whether or not this rule should exclude or include files based on
* the rule.
*/
boolean isExclusive() {
return this.exclusiveRuleTypeRadio.isSelected();
}
/** /**
* Gets the name condition for the rule that was created or edited. Should * Gets the name condition for the rule that was created or edited. Should
* only be called if isValidDefintion() returns true. * only be called if isValidDefintion() returns true.
@ -664,6 +678,7 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
nameButtonGroup = new javax.swing.ButtonGroup(); nameButtonGroup = new javax.swing.ButtonGroup();
typeButtonGroup = new javax.swing.ButtonGroup(); typeButtonGroup = new javax.swing.ButtonGroup();
ruleTypeButtonGroup = new javax.swing.ButtonGroup();
ruleNameLabel = new javax.swing.JLabel(); ruleNameLabel = new javax.swing.JLabel();
ruleNameTextField = new javax.swing.JTextField(); ruleNameTextField = new javax.swing.JTextField();
jLabel1 = new javax.swing.JLabel(); jLabel1 = new javax.swing.JLabel();
@ -689,6 +704,10 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
daysIncludedTextField = new javax.swing.JTextField(); daysIncludedTextField = new javax.swing.JTextField();
daysIncludedLabel = new javax.swing.JLabel(); daysIncludedLabel = new javax.swing.JLabel();
dateCheck = new javax.swing.JCheckBox(); dateCheck = new javax.swing.JCheckBox();
javax.swing.JLabel ruleTypeLabel = new javax.swing.JLabel();
inclusiveRuleTypeRadio = new javax.swing.JRadioButton();
exclusiveRuleTypeRadio = new javax.swing.JRadioButton();
jSeparator1 = new javax.swing.JSeparator();
org.openide.awt.Mnemonics.setLocalizedText(ruleNameLabel, org.openide.util.NbBundle.getMessage(FilesSetRulePanel.class, "FilesSetRulePanel.ruleNameLabel.text")); // NOI18N org.openide.awt.Mnemonics.setLocalizedText(ruleNameLabel, org.openide.util.NbBundle.getMessage(FilesSetRulePanel.class, "FilesSetRulePanel.ruleNameLabel.text")); // NOI18N
@ -810,14 +829,41 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
} }
}); });
org.openide.awt.Mnemonics.setLocalizedText(ruleTypeLabel, org.openide.util.NbBundle.getMessage(FilesSetRulePanel.class, "FilesSetRulePanel.ruleTypeLabel.text")); // NOI18N
ruleTypeButtonGroup.add(inclusiveRuleTypeRadio);
inclusiveRuleTypeRadio.setSelected(true);
org.openide.awt.Mnemonics.setLocalizedText(inclusiveRuleTypeRadio, org.openide.util.NbBundle.getMessage(FilesSetRulePanel.class, "FilesSetRulePanel.inclusiveRuleTypeRadio.text")); // NOI18N
ruleTypeButtonGroup.add(exclusiveRuleTypeRadio);
org.openide.awt.Mnemonics.setLocalizedText(exclusiveRuleTypeRadio, org.openide.util.NbBundle.getMessage(FilesSetRulePanel.class, "FilesSetRulePanel.exclusiveRuleTypeRadio.text")); // NOI18N
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
this.setLayout(layout); this.setLayout(layout);
layout.setHorizontalGroup( layout.setHorizontalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup() .addGroup(javax.swing.GroupLayout.Alignment.TRAILING, layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup() .addGroup(layout.createSequentialGroup()
.addGap(8, 8, 8) .addGap(8, 8, 8)
.addComponent(jLabel5))
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addComponent(ruleTypeLabel))
.addGroup(layout.createSequentialGroup()
.addGap(119, 119, 119)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(exclusiveRuleTypeRadio)
.addComponent(inclusiveRuleTypeRadio))))
.addGap(0, 0, Short.MAX_VALUE))
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addComponent(jSeparator1)
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
.addGap(2, 2, 2)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(javax.swing.GroupLayout.Alignment.TRAILING, layout.createSequentialGroup() .addGroup(javax.swing.GroupLayout.Alignment.TRAILING, layout.createSequentialGroup()
.addComponent(ruleNameLabel) .addComponent(ruleNameLabel)
@ -850,35 +896,41 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
.addComponent(extensionRadioButton) .addComponent(extensionRadioButton)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(nameRegexCheckbox)))) .addComponent(nameRegexCheckbox))))
.addComponent(jLabel5)
.addGroup(layout.createSequentialGroup() .addGroup(layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(nameCheck, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.PREFERRED_SIZE, 95, javax.swing.GroupLayout.PREFERRED_SIZE) .addComponent(nameCheck, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.PREFERRED_SIZE, 95, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(jLabel1)) .addComponent(jLabel1))
.addGap(16, 16, 16) .addGap(16, 16, 16)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(nameTextField)
.addGroup(layout.createSequentialGroup() .addGroup(layout.createSequentialGroup()
.addComponent(filesRadioButton) .addComponent(filesRadioButton)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(dirsRadioButton) .addComponent(dirsRadioButton)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(allRadioButton)) .addComponent(allRadioButton))))))
.addComponent(nameTextField))))) .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(pathCheck) .addComponent(pathCheck)
.addComponent(mimeCheck) .addComponent(mimeCheck)
.addComponent(fileSizeCheck) .addComponent(fileSizeCheck)
.addComponent(dateCheck)) .addComponent(dateCheck))
.addGap(0, 0, Short.MAX_VALUE))) .addGap(0, 0, Short.MAX_VALUE)))))
.addContainerGap()) .addContainerGap())
); );
layout.setVerticalGroup( layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup() .addGroup(layout.createSequentialGroup()
.addComponent(jLabel5) .addComponent(jLabel5)
.addGap(3, 3, 3) .addGap(8, 8, 8)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addComponent(ruleTypeLabel)
.addComponent(inclusiveRuleTypeRadio))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(exclusiveRuleTypeRadio)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(jSeparator1, javax.swing.GroupLayout.PREFERRED_SIZE, 9, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addGroup(layout.createSequentialGroup() .addGroup(layout.createSequentialGroup()
.addComponent(jLabel1) .addComponent(jLabel1)
@ -923,7 +975,7 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(ruleNameTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE) .addComponent(ruleNameTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(ruleNameLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) .addComponent(ruleNameLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addContainerGap()) .addGap(12, 12, 12))
); );
}// </editor-fold>//GEN-END:initComponents }// </editor-fold>//GEN-END:initComponents
@ -1023,14 +1075,17 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
private javax.swing.JTextField daysIncludedTextField; private javax.swing.JTextField daysIncludedTextField;
private javax.swing.JRadioButton dirsRadioButton; private javax.swing.JRadioButton dirsRadioButton;
private javax.swing.JComboBox<String> equalitySymbolComboBox; private javax.swing.JComboBox<String> equalitySymbolComboBox;
private javax.swing.JRadioButton exclusiveRuleTypeRadio;
private javax.swing.JRadioButton extensionRadioButton; private javax.swing.JRadioButton extensionRadioButton;
private javax.swing.JCheckBox fileSizeCheck; private javax.swing.JCheckBox fileSizeCheck;
private javax.swing.JComboBox<String> fileSizeComboBox; private javax.swing.JComboBox<String> fileSizeComboBox;
private javax.swing.JSpinner fileSizeSpinner; private javax.swing.JSpinner fileSizeSpinner;
private javax.swing.JRadioButton filesRadioButton; private javax.swing.JRadioButton filesRadioButton;
private javax.swing.JRadioButton fullNameRadioButton; private javax.swing.JRadioButton fullNameRadioButton;
private javax.swing.JRadioButton inclusiveRuleTypeRadio;
private javax.swing.JLabel jLabel1; private javax.swing.JLabel jLabel1;
private javax.swing.JLabel jLabel5; private javax.swing.JLabel jLabel5;
private javax.swing.JSeparator jSeparator1;
private javax.swing.JCheckBox mimeCheck; private javax.swing.JCheckBox mimeCheck;
private javax.swing.JComboBox<String> mimeTypeComboBox; private javax.swing.JComboBox<String> mimeTypeComboBox;
private javax.swing.ButtonGroup nameButtonGroup; private javax.swing.ButtonGroup nameButtonGroup;
@ -1043,6 +1098,7 @@ final class FilesSetRulePanel extends javax.swing.JPanel {
private javax.swing.JTextField pathTextField; private javax.swing.JTextField pathTextField;
private javax.swing.JLabel ruleNameLabel; private javax.swing.JLabel ruleNameLabel;
private javax.swing.JTextField ruleNameTextField; private javax.swing.JTextField ruleNameTextField;
private javax.swing.ButtonGroup ruleTypeButtonGroup;
private javax.swing.ButtonGroup typeButtonGroup; private javax.swing.ButtonGroup typeButtonGroup;
// End of variables declaration//GEN-END:variables // End of variables declaration//GEN-END:variables
} }

4
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetsManager.java
View File

@ -52,7 +52,7 @@ public final class FilesSetsManager extends Observable {
{ {
put(Bundle.FilesSetsManager_allFilesAndDirectories(), put(Bundle.FilesSetsManager_allFilesAndDirectories(),
new Rule(Bundle.FilesSetsManager_allFilesAndDirectories(), null, new Rule(Bundle.FilesSetsManager_allFilesAndDirectories(), null,
new MetaTypeCondition(MetaTypeCondition.Type.ALL), null, null, null, null)); new MetaTypeCondition(MetaTypeCondition.Type.ALL), null, null, null, null, null));
} }
}); });
private static final FilesSet FILES_DIRS_UNALLOC_INGEST_FILTER = new FilesSet( private static final FilesSet FILES_DIRS_UNALLOC_INGEST_FILTER = new FilesSet(
@ -61,7 +61,7 @@ public final class FilesSetsManager extends Observable {
{ {
put(Bundle.FilesSetsManager_allFilesDirectoriesAndUnallocated(), put(Bundle.FilesSetsManager_allFilesDirectoriesAndUnallocated(),
new Rule(Bundle.FilesSetsManager_allFilesDirectoriesAndUnallocated(), null, new Rule(Bundle.FilesSetsManager_allFilesDirectoriesAndUnallocated(), null,
new MetaTypeCondition(MetaTypeCondition.Type.ALL), null, null, null, null)); new MetaTypeCondition(MetaTypeCondition.Type.ALL), null, null, null, null, null));
} }
}); });

22
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemsFilesSetSettings.java
View File

@ -81,6 +81,7 @@ class InterestingItemsFilesSetSettings implements Serializable {
private static final String FS_COMPARATOR_ATTR = "comparatorSymbol"; private static final String FS_COMPARATOR_ATTR = "comparatorSymbol";
private static final String FS_SIZE_ATTR = "sizeValue"; private static final String FS_SIZE_ATTR = "sizeValue";
private static final String FS_UNITS_ATTR = "sizeUnits"; private static final String FS_UNITS_ATTR = "sizeUnits";
private static final String EXCLUSIVE_ATTR = "isExclusive";
private static final String TYPE_FILTER_VALUE_FILES = "file"; //NON-NLS private static final String TYPE_FILTER_VALUE_FILES = "file"; //NON-NLS
private static final String XML_ENCODING = "UTF-8"; //NON-NLS private static final String XML_ENCODING = "UTF-8"; //NON-NLS
private static final Logger logger = Logger.getLogger(InterestingItemsFilesSetSettings.class.getName()); private static final Logger logger = Logger.getLogger(InterestingItemsFilesSetSettings.class.getName());
@ -268,13 +269,14 @@ class InterestingItemsFilesSetSettings implements Serializable {
MimeTypeCondition mimeCondition = readMimeCondition(elem); MimeTypeCondition mimeCondition = readMimeCondition(elem);
FileSizeCondition sizeCondition = readSizeCondition(elem); FileSizeCondition sizeCondition = readSizeCondition(elem);
DateCondition dateCondition = readDateCondition(elem); //if meta type condition or all four types of conditions the user can create are all null then don't make the rule DateCondition dateCondition = readDateCondition(elem); //if meta type condition or all four types of conditions the user can create are all null then don't make the rule
Boolean isExclusive = readExclusive(elem);
if (metaCondition == null || (nameCondition == null && pathCondition == null && mimeCondition == null && sizeCondition == null && dateCondition == null)) { if (metaCondition == null || (nameCondition == null && pathCondition == null && mimeCondition == null && sizeCondition == null && dateCondition == null)) {
logger.log(Level.WARNING, "Error Reading Rule, " + ruleName + " was either missing a meta condition or contained only a meta condition. No rule was imported."); // NON-NLS logger.log(Level.WARNING, "Error Reading Rule, " + ruleName + " was either missing a meta condition or contained only a meta condition. No rule was imported."); // NON-NLS
throw new FilesSetsManager.FilesSetsManagerException( throw new FilesSetsManager.FilesSetsManagerException(
Bundle.InterestingItemsFilesSetSettings_readRule_missingNecessary(ruleName)); Bundle.InterestingItemsFilesSetSettings_readRule_missingNecessary(ruleName));
} }
return new FilesSet.Rule(ruleName, nameCondition, metaCondition, pathCondition, mimeCondition, sizeCondition, dateCondition); return new FilesSet.Rule(ruleName, nameCondition, metaCondition, pathCondition, mimeCondition, sizeCondition, dateCondition, isExclusive);
} }
/** /**
@ -338,6 +340,22 @@ class InterestingItemsFilesSetSettings implements Serializable {
return nameCondition; return nameCondition;
} }
/**
* Construct a MIME type condition for a FilesSet membership rule from data
* in an XML element.
*
* @param ruleElement The XML element.
*
* @return The mime TYPE condition, or null if none existed
*/
private static Boolean readExclusive(Element elem) {
Boolean isExclusive = null;
if (!elem.getAttribute(EXCLUSIVE_ATTR).isEmpty()) {
isExclusive = Boolean.parseBoolean(elem.getAttribute(EXCLUSIVE_ATTR));
}
return isExclusive;
}
/** /**
* Construct a MIME type condition for a FilesSet membership rule from data * Construct a MIME type condition for a FilesSet membership rule from data
* in an XML element. * in an XML element.
@ -725,6 +743,8 @@ class InterestingItemsFilesSetSettings implements Serializable {
ruleElement.setAttribute(DAYS_INCLUDED_ATTR, Integer.toString(dateCondition.getDaysIncluded())); ruleElement.setAttribute(DAYS_INCLUDED_ATTR, Integer.toString(dateCondition.getDaysIncluded()));
} }
ruleElement.setAttribute(EXCLUSIVE_ATTR, Boolean.toString(rule.isExclusive()));
setElement.appendChild(ruleElement); setElement.appendChild(ruleElement);
} }
rootElement.appendChild(setElement); rootElement.appendChild(setElement);

22
Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java
View File

@ -90,7 +90,7 @@ public class IngestFileFiltersTest extends NbTestCase {
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH); IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rule = new HashMap<>(); HashMap<String, Rule> rule = new HashMap<>();
rule.put("Rule", new Rule("testFileType", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); rule.put("Rule", new Rule("testFileType", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null, null));
//Filter for dir1 and no unallocated space //Filter for dir1 and no unallocated space
FilesSet dirFilter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule); FilesSet dirFilter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule);
@ -131,7 +131,7 @@ public class IngestFileFiltersTest extends NbTestCase {
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH); IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>(); HashMap<String, Rule> rules = new HashMap<>();
rules.put("Rule", new Rule("testExtAndDirWithOneRule", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); rules.put("Rule", new Rule("testExtAndDirWithOneRule", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null, null));
//Build the filter that ignore unallocated space and with one rule //Build the filter that ignore unallocated space and with one rule
FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules); FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules);
@ -167,8 +167,8 @@ public class IngestFileFiltersTest extends NbTestCase {
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH); IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>(); HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
rules.put("rule2", new Rule("FindDir1Directory", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); rules.put("rule2", new Rule("FindDir1Directory", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null, null));
//Build the filter that ingnore unallocated space and with 2 rules //Build the filter that ingnore unallocated space and with 2 rules
FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all files in dir1 and all files with jpg extention.", false, true, rules); FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all files in dir1 and all files with jpg extention.", false, true, rules);
@ -211,7 +211,7 @@ public class IngestFileFiltersTest extends NbTestCase {
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH); IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>(); HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule", new Rule("FindFileWithFullName", new FullNameCondition("file.docx"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule", new Rule("FindFileWithFullName", new FullNameCondition("file.docx"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
//Build the filter to find file: file.docx //Build the filter to find file: file.docx
FilesSet fullNameFilter = new FilesSet("Filter", "Filter to find file.docx.", false, true, rules); FilesSet fullNameFilter = new FilesSet("Filter", "Filter to find file.docx.", false, true, rules);
@ -246,8 +246,8 @@ public class IngestFileFiltersTest extends NbTestCase {
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH); IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>(); HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
//Build the filter to find files with .jpg and .gif extension and unallocated space //Build the filter to find files with .jpg and .gif extension and unallocated space
FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, false, rules); FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, false, rules);
@ -294,8 +294,8 @@ public class IngestFileFiltersTest extends NbTestCase {
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH); IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>(); HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
//Build the filter to find files with .jpg and .gif extension //Build the filter to find files with .jpg and .gif extension
FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, true, rules); FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, true, rules);
@ -330,9 +330,9 @@ public class IngestFileFiltersTest extends NbTestCase {
//Build the filter to find jpg files //Build the filter to find jpg files
HashMap<String, Rule> rules = new HashMap<>(); HashMap<String, Rule> rules = new HashMap<>();
//Extension condition for jpg files //Extension condition for jpg files
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
//Extension condition for zip files, because we want test jpg extension filter for extracted files from a zip file //Extension condition for zip files, because we want test jpg extension filter for extracted files from a zip file
rules.put("rule2", new Rule("ZipExtention", new ExtensionCondition("zip"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); rules.put("rule2", new Rule("ZipExtention", new ExtensionCondition("zip"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null, null));
FilesSet embeddedFilter = new FilesSet("Filter", "Filter to files with .jpg extension.", false, false, rules); FilesSet embeddedFilter = new FilesSet("Filter", "Filter to files with .jpg extension.", false, false, rules);
ArrayList<IngestModuleTemplate> templates = new ArrayList<>(); ArrayList<IngestModuleTemplate> templates = new ArrayList<>();

2
ImageGallery/nbproject/project.properties
View File

@ -1,4 +1,4 @@
file.reference.sqlite-jdbc-3.25.2.jar=release/modules/ext/sqlite-jdbc-3.25.2.jar file.reference.sqlite-jdbc-3.36.0.3.jar=release/modules/ext/sqlite-jdbc-3.36.0.3.jar
javac.source=1.8 javac.source=1.8
javac.compilerargs=-Xlint -Xlint:-serial javac.compilerargs=-Xlint -Xlint:-serial
license.file=LICENSE-2.0.txt license.file=LICENSE-2.0.txt

4
ImageGallery/nbproject/project.xml
View File

@ -142,8 +142,8 @@
</module-dependencies> </module-dependencies>
<public-packages/> <public-packages/>
<class-path-extension> <class-path-extension>
<runtime-relative-path>ext/sqlite-jdbc-3.25.2.jar</runtime-relative-path> <runtime-relative-path>ext/sqlite-jdbc-3.36.0.3.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sqlite-jdbc-3.25.2.jar</binary-origin> <binary-origin>release/modules/ext/sqlite-jdbc-3.36.0.3.jar</binary-origin>
</class-path-extension> </class-path-extension>
</data> </data>
</configuration> </configuration>

2
RecentActivity/nbproject/project.properties
View File

@ -1,5 +1,5 @@
file.reference.Rejistry-1.1-SNAPSHOT.jar=release/modules/ext/Rejistry-1.1-SNAPSHOT.jar file.reference.Rejistry-1.1-SNAPSHOT.jar=release/modules/ext/Rejistry-1.1-SNAPSHOT.jar
file.reference.sqlite-jdbc-3.25.2.jar=release/modules/ext/sqlite-jdbc-3.25.2.jar file.reference.sqlite-jdbc-3.36.0.3.jar=release/modules/ext/sqlite-jdbc-3.36.0.3.jar
javac.source=1.8 javac.source=1.8
javac.compilerargs=-Xlint -Xlint:-serial javac.compilerargs=-Xlint -Xlint:-serial
license.file=../LICENSE-2.0.txt license.file=../LICENSE-2.0.txt

4
RecentActivity/nbproject/project.xml
View File

@ -88,8 +88,8 @@
<binary-origin>release/modules/ext/Rejistry-1.1-SNAPSHOT.jar</binary-origin> <binary-origin>release/modules/ext/Rejistry-1.1-SNAPSHOT.jar</binary-origin>
</class-path-extension> </class-path-extension>
<class-path-extension> <class-path-extension>
<runtime-relative-path>ext/sqlite-jdbc-3.25.2.jar</runtime-relative-path> <runtime-relative-path>ext/sqlite-jdbc-3.36.0.3.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sqlite-jdbc-3.25.2.jar</binary-origin> <binary-origin>release/modules/ext/sqlite-jdbc-3.36.0.3.jar</binary-origin>
</class-path-extension> </class-path-extension>
</data> </data>
</configuration> </configuration>