diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java index 56ed85bf12..192632eecf 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java @@ -280,6 +280,8 @@ public class FileManager implements Closeable { //added.add(localFileAdded); //send new content event //for now reusing ingest events, in future this will be replaced by datamodel / observer sending out events + // @@@ Is this the right place for this? A directory tree refresh will be triggered, so this may be creating a race condition + // since the transaction is not yet committed. IngestServices.getDefault().fireModuleContentEvent(new ModuleContentEvent(localFileAdded)); } } diff --git a/Core/src/org/sleuthkit/autopsy/core/layer.xml b/Core/src/org/sleuthkit/autopsy/core/layer.xml index f43b8285d6..54bec76816 100644 --- a/Core/src/org/sleuthkit/autopsy/core/layer.xml +++ b/Core/src/org/sleuthkit/autopsy/core/layer.xml @@ -310,6 +310,11 @@ + + + + + - + @@ -181,14 +197,6 @@ - - - - - - - - diff --git a/docs/doxygen/modReport.dox b/docs/doxygen/modReport.dox index 8913ccfdbe..d3cfaf10cb 100644 --- a/docs/doxygen/modReport.dox +++ b/docs/doxygen/modReport.dox @@ -1,24 +1,36 @@ /*! \page mod_report_page Developing Report Modules \section report_summary Summary -Report modules allow you to create different report types. Autopsy comes with moules to generate HTML and a body file for timeline creation. You can made additional modules to create custom output formats. +Report modules allow you to create different report types. Autopsy comes with modules to generate HTML and Excel artifact reports, a tab delimited File report, and a body file for timeline creation. You can made additional modules to create custom output formats. -There are two types of reporting modules that differ in how the data is organized. +There are three types of reporting modules that differ in how the data is organized. - General report modules are free form and you are allowed to organize the output however you want. - Table report modules organize the data into tables. If your output is in table format, this type of module will be easier to make the module because Autopsy does a lot of the organizing work for you. +- File report modules are also table based, but they specifically deal with reporting on the Files in the case, not artifacts. -Each reporting submodule implements either the org.sleuthkit.autopsy.report.TableReportModule interface or the org.sleuthkit.autopsy.report.GeneralReportModule interface, and registers itself in layer.xml +Each reporting submodule implements one of the org.sleuthkit.autopsy.report.TableReportModule interface, the org.sleuthkit.autopsy.report.GeneralReportModule interface, or the org.sleuthkit.autopsy.report.FileReportModule interface and registers itself in layer.xml -Implementing either of those interfaces will require the reporting module to implement a number of abstract methods. And depending on the type of report module, different methods will be invoked by the application. +Implementing any of those interfaces will require the reporting module to implement a number of abstract methods. And depending on the type of report module, different methods will be invoked by the application. Table report modules require their sub-classes to override methods to start and end tables, and add rows to those tables. These methods are provided data, generated from a default configuration panel, for the module to report on. Because of this, when creating a table report module one only needs to focus on how to display the data, not how to find it. +File report modules are similar to table report modules, but only require their sub-classes to start and end a single table, and add rows to that table. The methods are given an AbstractFile and a list of FileReportDataTypes, which specify what information about the file should be added to the report. The data can be extracted from the file by calling the FileReportDataTypes getValue method with the file as it's argument. + On the other hand, general report modules have a single method to generate the report. This method gives the module freedom to find and process any data it so chooses. General modules also have the ability to provide a configuration panel, allowing the user to choose from various displayed settings. The report module may then use the user's selection to generate a more specific report. -General modules are also given the responsibility of updating their report's progress bar and processing label in the UI. A progress panel is given to every general report module. It contains basic API to start, stop, and add to the progress bar, as well as update the processing label. The module is also expeted to check the progress bar's status occasionally to see if the user has manually canceled the report. +General modules are also given the responsibility of updating their report's progress bar and processing label in the UI. A progress panel is given to every general report module. It contains basic API to start, stop, and add to the progress bar, as well as update the processing label. The module is also expected to check the progress bar's status occasionally to see if the user has manually canceled the report. \section report_create_module Creating a Report Module -To create a table report module, start off by creating a class and implementing either the TableReportModule interface or the GeneralReportModule interface. +To create a table report module, start off by creating a class and implementing one of the TableReportModule interface, the FileReportModule interface, or the GeneralReportModule interface. + +\section report_create_module_all All Report Modules +All report modules will need to override the following methods: +- org.sleuthkit.autopsy.report.ReportModule::getName() +- org.sleuthkit.autopsy.report.ReportModule::getDescription() +- org.sleuthkit.autopsy.report.ReportModule::getExtension() +- org.sleuthkit.autopsy.report.ReportModule::getFilePath() + +These will be called by Autopsy to set up the configuration panels and other information. \subsection report_create_module_table Table Report Modules If you implement TableReportModule, you should override the methods: @@ -35,7 +47,17 @@ If you implement TableReportModule, you should override the methods: - org.sleuthkit.autopsy.report.TableReportModule::addRow(List row) - org.sleuthkit.autopsy.report.TableReportModule::dateToString(long date) -When generating table module reports, Autopsy will iterate through a list of user selected data, and call methods such as addRow(List row) for every "row" of data it finds, or startTable(List titles) for every new category it finds. Developers are guarenteed that every start of a data type, set, or table will be followed by an approptiate end. The focus for a table report module should be to take the given information and display it in a user friendly format. See org.sleuthkit.autopsy.report.ReportExcel for an example. +When generating table module reports, Autopsy will iterate through a list of user selected data, and call methods such as addRow(List row) for every "row" of data it finds, or startTable(List titles) for every new category it finds. Developers are guaranteed that every start of a data type, set, or table will be followed by an appropriate end. The focus for a table report module should be to take the given information and display it in a user friendly format. See org.sleuthkit.autopsy.report.ReportExcel for an example. + +\subsection report_create_module_file File Report Modules +If you implement FileReportModule, the overriden methods will be: +- org.sleuthkit.autopsy.report.FileReportModule::startReport(String path) +- org.sleuthkit.autopsy.report.FileReportModule::endReport() +- org.sleuthkit.autopsy.report.FileReportModule::startTable(List headers) +- org.sleuthkit.autopsy.report.FileReportModule::endTable() +- org.sleuthkit.autopsy.report.FileReportModule::addRow(AbstractFile toAdd, List columns) + +As when generating table module reports, Autopsy will iterate through a list of user selected data (which are represented by FileReportDataTypes), and call addRow(AbstractFile toAdd, List columns) for every abstract file in the case. Developers are guaranteed that the order of method calls will be startReport(), startTable(List headers), addRow(AbstractFile toAdd, List columns), AbstractFile toAdd, List columns),..., endTable(), endReport(). \subsection report_create_module_general General Report Modules If you implement GeneralReportModule, the overriden methods will be: diff --git a/nbproject/project.properties b/nbproject/project.properties index e70fffba4b..6446b47619 100644 --- a/nbproject/project.properties +++ b/nbproject/project.properties @@ -4,7 +4,7 @@ app.title=Autopsy ### lowercase version of above app.name=autopsy ### if left unset, version will default to today's date -app.version=3.0.7 +app.version=3.0.8 ### Build type isn't used at this point, but it may be useful ### Must be one of: DEVELOPMENT, RELEASE build.type=RELEASE