diff --git a/Report/src/org/sleuthkit/autopsy/report/ReportModuleException.java b/Report/src/org/sleuthkit/autopsy/report/ReportModuleException.java new file mode 100644 index 0000000000..93d61f990b --- /dev/null +++ b/Report/src/org/sleuthkit/autopsy/report/ReportModuleException.java @@ -0,0 +1,33 @@ + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.report; + +//exception thrown by a reporting module when report generation failed +class ReportModuleException extends Exception { + + public ReportModuleException(String msg) { + super(msg); + } + + public ReportModuleException(String msg, Exception ex) { + super(msg, ex); + } +} diff --git a/Report/src/org/sleuthkit/autopsy/report/report.java b/Report/src/org/sleuthkit/autopsy/report/report.java index 1c95b969d0..16f6578383 100644 --- a/Report/src/org/sleuthkit/autopsy/report/report.java +++ b/Report/src/org/sleuthkit/autopsy/report/report.java @@ -1,12 +1,29 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; import java.sql.ResultSet; import java.util.ArrayList; import java.util.HashMap; +import java.util.Map; import java.util.logging.Level; import java.util.logging.Logger; import org.sleuthkit.autopsy.casemodule.Case; @@ -18,278 +35,242 @@ import org.sleuthkit.datamodel.SleuthkitCase; * * @author Alex */ -public class report implements reportInterface { - -private void report(){ +public class report { -} -@Override -public HashMap> getGenInfo() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(1); - for (BlackboardArtifact artifact : bbart) - { - ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); - } + private void report() { } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} -@Override -public HashMap> getWebHistory() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(4); - for (BlackboardArtifact artifact : bbart) - { + public HashMap> getGenInfo() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO); + for (BlackboardArtifact artifact : bbart) { ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); + reportMap.put(artifact, attributes); } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} -@Override -public HashMap> getWebCookie() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(3); - for (BlackboardArtifact artifact : bbart) - { - ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); - } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} -@Override -public HashMap> getWebBookmark() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(2); - for (BlackboardArtifact artifact : bbart) - { - ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); - } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } -@Override -public HashMap> getWebDownload() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(5); - for (BlackboardArtifact artifact : bbart) - { - ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); - } + return reportMap; } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} -@Override -public HashMap> getRecentObject() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(6); - for (BlackboardArtifact artifact : bbart) - { + public HashMap> getWebHistory() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY); + for (BlackboardArtifact artifact : bbart) { ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); + reportMap.put(artifact, attributes); } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } -@Override -public HashMap> getKeywordHit() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(9); - for (BlackboardArtifact artifact : bbart) - { - ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); - } + return reportMap; } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} -@Override -public HashMap> getHashHit() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(10); - for (BlackboardArtifact artifact : bbart) - { - ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); - } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} -@Override -public HashMap> getInstalledProg() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(8); - for (BlackboardArtifact artifact : bbart) - { - ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); - } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} -@Override -public HashMap> getDevices() { - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ArrayList bbart = tempDb.getBlackboardArtifacts(11); - for (BlackboardArtifact artifact : bbart) - { + public HashMap> getWebCookie() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE); + for (BlackboardArtifact artifact : bbart) { ArrayList attributes = artifact.getAttributes(); - reportMap.put(artifact, attributes); + reportMap.put(artifact, attributes); } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - return reportMap; -} + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } -@Override -public String getGroupedKeywordHit() { - StringBuilder table = new StringBuilder(); - HashMap> reportMap = new HashMap>(); - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase tempDb = currentCase.getSleuthkitCase(); - try - { - ResultSet uniqueresults = tempDb.runQuery("SELECT DISTINCT value_text from blackboard_attributes where attribute_type_id = '10' order by value_text ASC"); - while(uniqueresults.next()) - { - table.append("").append(uniqueresults.getString("value_text")).append(""); - table.append(""); - ArrayList artlist = new ArrayList(); - ResultSet tempresults = tempDb.runQuery("select DISTINCT artifact_id from blackboard_attributes where attribute_type_id = '10' and value_text = '" + uniqueresults.getString("value_text") +"'"); - while(tempresults.next()) - { - artlist.add(tempDb.getBlackboardArtifact(tempresults.getLong("artifact_id"))); + return reportMap; + } + + public HashMap> getWebBookmark() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); } - for(BlackboardArtifact art : artlist) - { - String filename = tempDb.getFsContentById(art.getObjectID()).getName(); - String preview = ""; - String set = ""; - table.append(""); - ArrayList tempatts = art.getAttributes(); - for(BlackboardAttribute att : tempatts) - { - if(att.getAttributeTypeID() == 12) - { - preview = ""; + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + return reportMap; + } + + public HashMap> getWebDownload() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); + } + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + return reportMap; + } + + public HashMap> getRecentObject() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); + } + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + return reportMap; + } + + public HashMap> getKeywordHit() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); + } + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + return reportMap; + } + + public HashMap> getHashHit() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); + } + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + return reportMap; + } + + public HashMap> getInstalledProg() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); + } + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + return reportMap; + } + + public HashMap> getDevices() { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ArrayList bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); + } + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + return reportMap; + } + + public String getGroupedKeywordHit() { + StringBuilder table = new StringBuilder(); + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + ResultSet uniqueresults = tempDb.runQuery("SELECT DISTINCT value_text from blackboard_attributes where attribute_type_id = '10' order by value_text ASC"); + while (uniqueresults.next()) { + table.append("").append(uniqueresults.getString("value_text")).append(""); + table.append("
").append("File Name").append("PreviewKeyword List
").append(filename).append("" + att.getValueString() + "
"); + ArrayList artlist = new ArrayList(); + ResultSet tempresults = tempDb.runQuery("select DISTINCT artifact_id from blackboard_attributes where attribute_type_id = '10' and value_text = '" + uniqueresults.getString("value_text") + "'"); + while (tempresults.next()) { + artlist.add(tempDb.getBlackboardArtifact(tempresults.getLong("artifact_id"))); + } + for (BlackboardArtifact art : artlist) { + String filename = tempDb.getFsContentById(art.getObjectID()).getName(); + String preview = ""; + String set = ""; + table.append(""); + ArrayList tempatts = art.getAttributes(); + for (BlackboardAttribute att : tempatts) { + if (att.getAttributeTypeID() == 12) { + preview = ""; + } + if (att.getAttributeTypeID() == 13) { + set = ""; + } } - if(att.getAttributeTypeID() == 13) - { - set = ""; + table.append(preview).append(set).append(""); + } + + + table.append("
").append("File Name").append("PreviewKeyword List
").append(filename).append("" + att.getValueString() + "" + att.getValueString() + "" + att.getValueString() + "


"); + } + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + + String result = table.toString(); + return result; + } + + public HashMap> getAllTypes(ReportConfiguration config) { + HashMap> reportMap = new HashMap>(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try { + for (Map.Entry entry : config.config.entrySet()) { + if (entry.getValue()) { + ArrayList bbart = tempDb.getBlackboardArtifacts(entry.getKey()); + for (BlackboardArtifact artifact : bbart) { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); } } - table.append(preview).append(set).append(""); } - - - table.append("

"); + } catch (Exception e) { + Logger.getLogger(report.class.getName()).log(Level.INFO, "Exception occurred", e); } - } - catch (Exception e) - { - Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - - String result = table.toString(); - return result; -} + return reportMap; + } } \ No newline at end of file diff --git a/Report/src/org/sleuthkit/autopsy/report/reportAction.java b/Report/src/org/sleuthkit/autopsy/report/reportAction.java index dbdd86f698..afde5e4c52 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportAction.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportAction.java @@ -1,6 +1,22 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; @@ -12,22 +28,22 @@ import java.awt.event.ActionListener; import java.beans.PropertyChangeEvent; import java.beans.PropertyChangeListener; import java.io.File; +import java.util.logging.Level; +import java.util.logging.Logger; +import javax.swing.ImageIcon; import javax.swing.JButton; import javax.swing.JDialog; import javax.swing.JFrame; -import org.openide.awt.ActionRegistration; +import org.openide.awt.ActionID; import org.openide.awt.ActionReference; import org.openide.awt.ActionReferences; -import org.openide.awt.ActionID; +import org.openide.awt.ActionRegistration; import org.openide.util.HelpCtx; import org.openide.util.NbBundle.Messages; import org.openide.util.actions.CallableSystemAction; import org.openide.util.actions.Presenter; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Log; -import java.util.logging.Level; -import java.util.logging.Logger; -import javax.swing.ImageIcon; @ActionID(category = "Tools", id = "org.sleuthkit.autopsy.report.reportAction") @@ -36,53 +52,50 @@ id = "org.sleuthkit.autopsy.report.reportAction") @ActionReference(path = "Menu/Tools", position = 80) }) @Messages("CTL_reportAction=Run Report") -public final class reportAction extends CallableSystemAction implements Presenter.Toolbar{ - +public final class reportAction extends CallableSystemAction implements Presenter.Toolbar { + private JButton toolbarButton = new JButton(); private static final String ACTION_NAME = "Generate Report"; - Logger logger = Logger.getLogger(reportAction.class.getName()); - + static final Logger logger = Logger.getLogger(reportAction.class.getName()); + public reportAction() { setEnabled(false); Case.addPropertyChangeListener(new PropertyChangeListener() { @Override public void propertyChange(PropertyChangeEvent evt) { - if(evt.getPropertyName().equals(Case.CASE_CURRENT_CASE)){ + if (evt.getPropertyName().equals(Case.CASE_CURRENT_CASE)) { setEnabled(evt.getNewValue() != null); } } - }); //attempt to create a report folder if a case is active - Case.addPropertyChangeListener(new PropertyChangeListener () { + Case.addPropertyChangeListener(new PropertyChangeListener() { - @Override - public void propertyChange(PropertyChangeEvent evt) { - String changed = evt.getPropertyName(); + @Override + public void propertyChange(PropertyChangeEvent evt) { + String changed = evt.getPropertyName(); - //case has been changed - if (changed.equals(Case.CASE_CURRENT_CASE)) { - Case newCase = (Case)evt.getNewValue(); + //case has been changed + if (changed.equals(Case.CASE_CURRENT_CASE)) { + Case newCase = (Case) evt.getNewValue(); - if (newCase != null) { - boolean exists = (new File(newCase.getCaseDirectory() + "\\Reports")).exists(); - if (exists) { - // report directory exists -- don't need to do anything - - } else { - // report directory does not exist -- create it - boolean reportCreate = (new File(newCase.getCaseDirectory() + "\\Reports")).mkdirs(); - if(!reportCreate){ - logger.log(Level.WARNING, "Could not create Reports directory for case. It does not exist."); + if (newCase != null) { + boolean exists = (new File(newCase.getCaseDirectory() + "\\Reports")).exists(); + if (exists) { + // report directory exists -- don't need to do anything + } else { + // report directory does not exist -- create it + boolean reportCreate = (new File(newCase.getCaseDirectory() + "\\Reports")).mkdirs(); + if (!reportCreate) { + logger.log(Level.WARNING, "Could not create Reports directory for case. It does not exist."); + } } } - } + } } - } + }); -}); - // set action of the toolbar button toolbarButton.addActionListener(new ActionListener() { @@ -93,24 +106,25 @@ public final class reportAction extends CallableSystemAction implements Presente }); } - + @Override public void actionPerformed(ActionEvent e) { try { - + // create the popUp window for it final JFrame frame = new JFrame(ACTION_NAME); final JDialog popUpWindow = new JDialog(frame, ACTION_NAME, true); // to make the popUp Window to be modal // initialize panel with loaded settings - final reportFilter panel = new reportFilter(); - panel.setjButton2ActionListener(new ActionListener() { - @Override - public void actionPerformed(ActionEvent e) { - popUpWindow.dispose(); - } - }); - + final reportFilter panel = new reportFilter(); + panel.setjButton2ActionListener(new ActionListener() { + + @Override + public void actionPerformed(ActionEvent e) { + popUpWindow.dispose(); + } + }); + // add the panel to the popup window popUpWindow.add(panel); popUpWindow.pack(); @@ -125,16 +139,15 @@ public final class reportAction extends CallableSystemAction implements Presente // display the window popUpWindow.setVisible(true); // add the command to close the window to the button on the Case Properties form / panel - - + + } catch (Exception ex) { Log.get(reportFilterAction.class).log(Level.WARNING, "Error displaying " + ACTION_NAME + " window.", ex); } } - + @Override public void performAction() { - } @Override @@ -146,11 +159,11 @@ public final class reportAction extends CallableSystemAction implements Presente public HelpCtx getHelpCtx() { return HelpCtx.DEFAULT_HELP; } - + /** * Returns the toolbar component of this action * - * @return component the toolbar button + * @return component the toolbar button */ @Override public Component getToolbarPresenter() { @@ -163,10 +176,10 @@ public final class reportAction extends CallableSystemAction implements Presente /** * Set this action to be enabled/disabled * - * @param value whether to enable this action or not + * @param value whether to enable this action or not */ @Override - public void setEnabled(boolean value){ + public void setEnabled(boolean value) { super.setEnabled(value); toolbarButton.setEnabled(value); } diff --git a/Report/src/org/sleuthkit/autopsy/report/reportFilter.form b/Report/src/org/sleuthkit/autopsy/report/reportFilter.form index 7b3e65968b..6f51b2114a 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportFilter.form +++ b/Report/src/org/sleuthkit/autopsy/report/reportFilter.form @@ -1,4 +1,4 @@ - +
@@ -39,29 +39,24 @@ - - - - - - - - - - - - - - - - - + + + + + + + + + + + + diff --git a/Report/src/org/sleuthkit/autopsy/report/reportFilterAction.java b/Report/src/org/sleuthkit/autopsy/report/reportFilterAction.java index 304b204f91..f6346a4ee2 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportFilterAction.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportFilterAction.java @@ -16,7 +16,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.sleuthkit.autopsy.report; import java.awt.Container; @@ -31,6 +30,7 @@ import org.sleuthkit.autopsy.coreutils.Log; /** * The reportFilterAction opens the reportFilterPanel in a dialog, and saves the * settings of the panel if the Apply button is clicked. + * * @author pmartel */ class reportFilterAction { @@ -44,10 +44,10 @@ class reportFilterAction { try { // create the popUp window for it - Container cpane; + Container cpane; final JFrame frame = new JFrame(ACTION_NAME); final JDialog popUpWindow = new JDialog(frame, ACTION_NAME, true); // to make the popUp Window to be modal - cpane = frame.getContentPane(); + cpane = frame.getContentPane(); // initialize panel with loaded settings final reportFilter panel = new reportFilter(); @@ -64,8 +64,8 @@ class reportFilterAction { // display the window popUpWindow.setVisible(true); - - + + } catch (Exception ex) { Log.get(reportFilterAction.class).log(Level.WARNING, "Error displaying " + ACTION_NAME + " window.", ex); } @@ -76,9 +76,8 @@ class reportFilterAction { return ACTION_NAME; } - // @Override + // @Override public HelpCtx getHelpCtx() { return HelpCtx.DEFAULT_HELP; } } - diff --git a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java index b9d086c5eb..f1fc88bf56 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java @@ -1,6 +1,22 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; @@ -30,383 +46,369 @@ import org.sleuthkit.datamodel.TskData; * @author Alex */ public class reportHTML { - + //Declare our publically accessible formatted report, this will change everytime they run a report public static StringBuilder formatted_Report = new StringBuilder(); public static StringBuilder unformatted_header = new StringBuilder(); public static StringBuilder formatted_header = new StringBuilder(); public static String htmlPath = ""; -public reportHTML (HashMap> report, reportFilter rr){ - - //This is literally a terrible way to count up all the types of artifacts, and doesn't include any added ones. - //Unlike the XML report, which is dynamic, this is formatted and needs to be redone later instead of being hardcoded. - //Also, clearing variables to generate new report. - formatted_Report.setLength(0); - unformatted_header.setLength(0); - formatted_header.setLength(0); - - int countGen = 0; - int countWebBookmark = 0; - int countWebCookie = 0; - int countWebHistory = 0; - int countWebDownload = 0; - int countRecentObjects = 0; - int countTrackPoint = 0; - int countInstalled = 0; - int countKeyword = 0; - int countHash = 0; - int countDevice = 0; - for (Entry> entry : report.entrySet()) { - if(entry.getKey().getArtifactTypeID() == 1){ - countGen++; - } - if(entry.getKey().getArtifactTypeID() == 2){ - countWebBookmark++; - } - if(entry.getKey().getArtifactTypeID() == 3){ - countWebCookie++; - } - if(entry.getKey().getArtifactTypeID() == 4){ + public reportHTML(HashMap> report, reportFilter rr) { - countWebHistory++; - } - if(entry.getKey().getArtifactTypeID() == 5){ - countWebDownload++; - } - if(entry.getKey().getArtifactTypeID() == 6){ - countRecentObjects++; - } - if(entry.getKey().getArtifactTypeID() == 7){ - countTrackPoint++; - } - if(entry.getKey().getArtifactTypeID() == 8){ - countInstalled++; - } - if(entry.getKey().getArtifactTypeID() == 9){ - countKeyword++; - } - if(entry.getKey().getArtifactTypeID() == 10){ - countHash++; - } - if(entry.getKey().getArtifactTypeID() == 11){ - countDevice++; - } - } - - try{ - String ingestwarning = "

Warning, this report was run before ingest services completed!

"; - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase skCase = currentCase.getSleuthkitCase(); - String caseName = currentCase.getName(); - Integer imagecount = currentCase.getImageIDs().length; - Integer totalfiles = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG); - Integer totaldirs = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR); - int reportsize = report.size(); - Integer filesystemcount = currentCase.getRootObjectsCount(); - DateFormat datetimeFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss"); - DateFormat dateFormat = new SimpleDateFormat("MM-dd-yyyy"); - Date date = new Date(); - String datetime = datetimeFormat.format(date); - String datenotime = dateFormat.format(date); - String CSS = ""; - //Add additional header information - String header = "Autopsy Report for Case: " + caseName + ""; - formatted_header.append(header); - formatted_header.append(CSS); - - //do for unformatted + + "h3 {font-size: 16px;color: #0077aa; margin: 40px 0 10px 0;} " + + "p {margin: 0 0 20px 0;} table {width: 100%; padding: 0; margin: 0; border-collapse: collapse; border-bottom: 1px solid #e5e5e5;} " + + "table thead th {display: table-cell; text-align: left; padding: 8px 16px; background: #e5e5e5; color: #777;font-size: 11px;text-shadow: #e9f9fd 0 1px 0; border-top: 1px solid #dedede; border-bottom: 2px solid #dedede;} " + + "table tr th:nth-child(1) {text-align: center; width: 60px;} " + + "table td {display: table-cell; padding: 8px 16px; font: 13px/20px Arial, Helvetica, sans-serif;} " + + "table tr:nth-child(even) td {background: #f3f3f3;} " + + "table tr td:nth-child(1) {text-align: left; width: 60px; background: #f3f3f3;} " + + "table tr:nth-child(even) td:nth-child(1) {background: #eaeaea;}" + + ""; + //Add additional header information + String header = "Autopsy Report for Case: " + caseName + ""; + formatted_header.append(header); + formatted_header.append(CSS); + + //do for unformatted String simpleCSS = ""; - unformatted_header.append(header); - unformatted_header.append(simpleCSS); + + ""; + unformatted_header.append(header); + unformatted_header.append(simpleCSS); //formatted_Report.append(""); formatted_Report.append("
"); // Add summary information now - + formatted_Report.append("

Report for Case: ").append(caseName).append("

"); - if(IngestManager.getDefault().isIngestRunning()) - { + if (IngestManager.getDefault().isIngestRunning()) { formatted_Report.append(ingestwarning); } - formatted_Report.append("

Case Summary

HTML Report Generated by Autopsy 3 on ").append(datetime).append("

"); - formatted_header.append(formatted_Report); - // unformatted_header.append(formatted_Report); - htmlPath = currentCase.getCaseDirectory()+"/Reports/" + caseName + "-" + datenotime + ".html"; - Writer out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(htmlPath), "UTF-8")); - out.write(formatted_header.toString()); - - out.flush(); - out.close(); - - } - catch(Exception e) - { - Logger.getLogger(reportHTML.class.getName()).log(Level.WARNING, "Exception occurred", e); - } - } + formatted_Report.append(""); + formatted_header.append(formatted_Report); + // unformatted_header.append(formatted_Report); + htmlPath = currentCase.getCaseDirectory() + "/Reports/" + caseName + "-" + datenotime + ".html"; + Writer out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(htmlPath), "UTF-8")); + out.write(formatted_header.toString()); - + out.flush(); + out.close(); + + } catch (Exception e) { + + Logger.getLogger(reportHTML.class.getName()).log(Level.WARNING, "Exception occurred", e); + } + } } \ No newline at end of file diff --git a/Report/src/org/sleuthkit/autopsy/report/reportPanel.form b/Report/src/org/sleuthkit/autopsy/report/reportPanel.form index 25b5456d3b..813c576b43 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportPanel.form +++ b/Report/src/org/sleuthkit/autopsy/report/reportPanel.form @@ -1,4 +1,4 @@ - + diff --git a/Report/src/org/sleuthkit/autopsy/report/reportPanel.java b/Report/src/org/sleuthkit/autopsy/report/reportPanel.java index ff67e76400..337c9012ff 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportPanel.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportPanel.java @@ -1,20 +1,27 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. - */ - -/* - * reportPanel.java + /* * - * Created on Feb 21, 2012, 12:13:14 PM + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; + import java.awt.event.ActionListener; -import java.io.BufferedWriter; -import java.io.FileOutputStream; -import java.io.IOException; -import java.io.OutputStreamWriter; -import java.io.Writer; +import java.io.*; import java.text.DateFormat; import java.text.SimpleDateFormat; import java.util.Date; @@ -30,16 +37,17 @@ import org.jdom.output.XMLOutputter; */ public class reportPanel extends javax.swing.JPanel { - /** Creates new form reportPanel */ - public reportPanel(String report) { + /** + * Creates new form reportPanel + */ + public reportPanel() { initComponents(); - setReportWindow(report); } - /** This method is called from within the constructor to - * initialize the form. - * WARNING: Do NOT modify this code. The content of this method is - * always regenerated by the Form Editor. + /** + * This method is called from within the constructor to initialize the form. + * WARNING: Do NOT modify this code. The content of this method is always + * regenerated by the Form Editor. */ @SuppressWarnings("unchecked") // //GEN-BEGIN:initComponents @@ -94,86 +102,64 @@ public class reportPanel extends javax.swing.JPanel { }// //GEN-END:initComponents private void saveReportActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_saveReportActionPerformed - + saveReportAction(); }//GEN-LAST:event_saveReportActionPerformed - /** + /** * Sets the listener for the OK button * - * @param e The action listener + * @param e The action listener */ - public void setjButton1ActionListener(ActionListener e){ - jButton1.addActionListener(e); + public void setjButton1ActionListener(ActionListener e) { + jButton1.addActionListener(e); } - public void getLink(HyperlinkEvent evt){ - try{ - - String str = evt.getDescription(); - // jEditorPane1.scrollToReference(str.substring(1)); - } - catch(Exception e){ - String whater = ""; - } - } - public void setjEditorPane1EventListener(HyperlinkListener evt){ - // jEditorPane1.addHyperlinkListener(evt); - } - - private void setReportWindow(String report) - { - // jEditorPane1.setText(report); - // jEditorPane1.setCaretPosition(0); - } - - public void setFinishedReportText(){ + + public void setFinishedReportText() { DateFormat dateFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss"); Date date = new Date(); String reportText = "Report was sucessfully generated at " + dateFormat.format(date) + "."; jLabel1.setText(reportText); } - - - private void saveReportAction(){ - + + private void saveReportAction() { + int option = jFileChooser1.showSaveDialog(this); - if(option == JFileChooser.APPROVE_OPTION){ - if(jFileChooser1.getSelectedFile()!=null){ - String path = jFileChooser1.getSelectedFile().toString(); - exportReport(path); + if (option == JFileChooser.APPROVE_OPTION) { + if (jFileChooser1.getSelectedFile() != null) { + String path = jFileChooser1.getSelectedFile().toString(); + exportReport(path); + } } - } - } - - private void exportReport(String path){ - - String htmlpath = reportUtils.changeExtension(path, ".html"); - String xmlpath = reportUtils.changeExtension(path, ".xml"); - String xlspath = reportUtils.changeExtension(path, ".xlsx"); - try { - Writer out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(htmlpath), "UTF-8")); - - // FileOutputStream out = new FileOutputStream(htmlpath); - out.write(reportHTML.formatted_header.toString()); - out.flush(); - out.close(); - - //xls report - FileOutputStream fos = new FileOutputStream(xlspath); - reportXLS.wb.write(fos); - fos.close(); - - FileOutputStream xmlout = new FileOutputStream(xmlpath); - XMLOutputter serializer = new XMLOutputter(); - serializer.output(reportXML.xmldoc, xmlout); - xmlout.flush(); - xmlout.close(); - JOptionPane.showMessageDialog(this, "Report has been successfully saved!"); - } - catch (IOException e) { - System.err.println(e); - } } + private void exportReport(String path) { + + String htmlpath = reportUtils.changeExtension(path, ".html"); + String xmlpath = reportUtils.changeExtension(path, ".xml"); + String xlspath = reportUtils.changeExtension(path, ".xlsx"); + try { + Writer out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(htmlpath), "UTF-8")); + + // FileOutputStream out = new FileOutputStream(htmlpath); + out.write(reportHTML.formatted_header.toString()); + out.flush(); + out.close(); + + //xls report + FileOutputStream fos = new FileOutputStream(xlspath); + reportXLS.wb.write(fos); + fos.close(); + + FileOutputStream xmlout = new FileOutputStream(xmlpath); + XMLOutputter serializer = new XMLOutputter(); + serializer.output(reportXML.xmldoc, xmlout); + xmlout.flush(); + xmlout.close(); + JOptionPane.showMessageDialog(this, "Report has been successfully saved!"); + } catch (IOException e) { + System.err.println(e); + } + } // Variables declaration - do not modify//GEN-BEGIN:variables private javax.swing.JButton jButton1; private javax.swing.JFileChooser jFileChooser1; @@ -181,6 +167,4 @@ private void saveReportActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FI private javax.swing.JOptionPane jOptionPane1; private javax.swing.JButton saveReport; // End of variables declaration//GEN-END:variables - - } diff --git a/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java b/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java index 8496b1541b..72077c11df 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java @@ -1,6 +1,22 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; @@ -8,18 +24,11 @@ import java.awt.Dimension; import java.awt.Toolkit; import java.awt.event.ActionEvent; import java.awt.event.ActionListener; -import java.net.URL; -import java.util.ArrayList; -import java.util.HashMap; import java.util.logging.Level; import javax.swing.JDialog; import javax.swing.JFrame; import javax.swing.SwingUtilities; -import javax.swing.event.HyperlinkEvent; -import javax.swing.event.HyperlinkListener; import org.sleuthkit.autopsy.coreutils.Log; -import org.sleuthkit.datamodel.BlackboardArtifact; -import org.sleuthkit.datamodel.BlackboardAttribute; /** * @@ -32,15 +41,14 @@ public class reportPanelAction { } - public void reportGenerate(ArrayList reportlist, final reportFilter rr){ + public void reportGenerate(ReportConfiguration reportconfig, final reportFilter rr){ try { //Clear any old reports in the string viewReport.setLength(0); // Generate the reports and create the hashmap - final HashMap> Results = new HashMap>(); - report bbreport = new report(); + final ReportGen report = new ReportGen(); //see what reports we need to run and run them //Set progress bar to move while doing this SwingUtilities.invokeLater(new Runnable() { @@ -48,21 +56,11 @@ public class reportPanelAction { public void run() { rr.progBarStartText(); }}); - if(reportlist.contains(1)){Results.putAll(bbreport.getGenInfo());} - if(reportlist.contains(2)){Results.putAll(bbreport.getWebBookmark());} - if(reportlist.contains(3)){Results.putAll(bbreport.getWebCookie());} - if(reportlist.contains(4)){Results.putAll(bbreport.getWebHistory());} - if(reportlist.contains(5)){Results.putAll(bbreport.getWebDownload());} - if(reportlist.contains(6)){Results.putAll(bbreport.getRecentObject());} - // if(reportlist.contains(7)){Results.putAll(bbreport.getGenInfo());} - if(reportlist.contains(8)){Results.putAll(bbreport.getInstalledProg());} - if(reportlist.contains(9)){Results.putAll(bbreport.getKeywordHit());} - if(reportlist.contains(10)){Results.putAll(bbreport.getHashHit());} - if(reportlist.contains(11)){Results.putAll(bbreport.getDevices());} + report.populateReport(reportconfig); SwingUtilities.invokeLater(new Runnable() { @Override public void run() { - rr.progBarCount(2*Results.size()); + rr.progBarCount(2*report.Results.size()); }}); //Turn our results into the appropriate xml/html reports //TODO: add a way for users to select what they will run when @@ -71,7 +69,7 @@ public class reportPanelAction { @Override public void run() { - reportXML xmlReport = new reportXML(Results, rr); + reportXML xmlReport = new reportXML(report.Results, rr); } }); Thread htmlthread = new Thread(new Runnable() @@ -79,7 +77,7 @@ public class reportPanelAction { @Override public void run() { - reportHTML htmlReport = new reportHTML(Results,rr); + reportHTML htmlReport = new reportHTML(report.Results,rr); BrowserControl.openUrl(reportHTML.htmlPath); } }); @@ -88,7 +86,7 @@ public class reportPanelAction { @Override public void run() { - reportXLS xlsReport = new reportXLS(Results,rr); + reportXLS xlsReport = new reportXLS(report.Results,rr); // } }); @@ -110,7 +108,7 @@ public class reportPanelAction { htmlthread.join(); //Set the temporary label to let the user know its done and is waiting on the report rr.progBarText(); - final reportPanel panel = new reportPanel(viewReport.toString()); + final reportPanel panel = new reportPanel(); panel.setjButton1ActionListener(new ActionListener() { @@ -120,19 +118,6 @@ public class reportPanelAction { popUpWindow.dispose(); } }); - panel.setjEditorPane1EventListener(new HyperlinkListener(){ - @Override - public void hyperlinkUpdate(HyperlinkEvent hev) { - try { - if (hev.getEventType() == HyperlinkEvent.EventType.ACTIVATED) - - panel.getLink(hev); - } - catch (Exception e) { - // Exceptions thrown............... - } - } - }); // add the panel to the popup window popUpWindow.add(panel); diff --git a/Report/src/org/sleuthkit/autopsy/report/reportUtils.java b/Report/src/org/sleuthkit/autopsy/report/reportUtils.java index eb2ce020a1..c07f277da8 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportUtils.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportUtils.java @@ -1,6 +1,22 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; @@ -9,34 +25,32 @@ package org.sleuthkit.autopsy.report; * @author Alex */ public class reportUtils { - -static String changeExtension(String originalName, String newExtension) { - int lastDot = originalName.lastIndexOf("."); - if (lastDot != -1) { - return originalName.substring(0, lastDot) + newExtension; - } else { - return originalName + newExtension; - } -} -public static String insertPeriodically( - String text, String insert, int period) -{ - StringBuilder builder = new StringBuilder( - text.length() + insert.length() * (text.length()/period)+1); - - int index = 0; - String prefix = ""; - while (index < text.length()) - { - // Don't put the insert in the very first iteration. - // This is easier than appending it *after* each substring - builder.append(prefix); - prefix = insert; - builder.append(text.substring(index, - Math.min(index + period, text.length()))); - index += period; + static String changeExtension(String originalName, String newExtension) { + int lastDot = originalName.lastIndexOf("."); + if (lastDot != -1) { + return originalName.substring(0, lastDot) + newExtension; + } else { + return originalName + newExtension; + } + } + + public static String insertPeriodically( + String text, String insert, int period) { + StringBuilder builder = new StringBuilder( + text.length() + insert.length() * (text.length() / period) + 1); + + int index = 0; + String prefix = ""; + while (index < text.length()) { + // Don't put the insert in the very first iteration. + // This is easier than appending it *after* each substring + builder.append(prefix); + prefix = insert; + builder.append(text.substring(index, + Math.min(index + period, text.length()))); + index += period; + } + return builder.toString(); } - return builder.toString(); -} } \ No newline at end of file diff --git a/Report/src/org/sleuthkit/autopsy/report/reportXLS.java b/Report/src/org/sleuthkit/autopsy/report/reportXLS.java index 3d9f785a55..bff3e66243 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportXLS.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportXLS.java @@ -1,11 +1,26 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; import java.io.FileOutputStream; - import java.io.IOException; import java.text.DateFormat; import java.text.SimpleDateFormat; @@ -14,362 +29,343 @@ import java.util.Date; import java.util.HashMap; import java.util.Map.Entry; import java.util.TreeMap; -import org.apache.poi.ss.usermodel.Cell; -import org.apache.poi.ss.usermodel.CellStyle; -import org.apache.poi.ss.usermodel.Font; -import org.apache.poi.ss.usermodel.Row; -import org.apache.poi.ss.usermodel.Sheet; -import org.apache.poi.ss.usermodel.Workbook; +import org.apache.poi.ss.usermodel.*; import org.apache.poi.xssf.usermodel.XSSFWorkbook; import org.sleuthkit.autopsy.casemodule.Case; -import org.sleuthkit.datamodel.BlackboardArtifact; -import org.sleuthkit.datamodel.BlackboardAttribute; -import org.sleuthkit.datamodel.FsContent; -import org.sleuthkit.datamodel.SleuthkitCase; -import org.sleuthkit.datamodel.TskData; +import org.sleuthkit.datamodel.*; /** * * @author Alex */ public class reportXLS { - public static Workbook wb = new XSSFWorkbook(); - public reportXLS(HashMap> report, reportFilter rr){ - //Empty the workbook first - Workbook wbtemp = new XSSFWorkbook(); - - int countGen = 0; - int countBookmark = 0; - int countCookie = 0; - int countHistory = 0; - int countDownload = 0; - int countRecentObjects = 0; - int countTrackPoint = 0; - int countInstalled = 0; - int countKeyword = 0; - int countHash = 0; - int countDevice = 0; - for (Entry> entry : report.entrySet()) { - if(entry.getKey().getArtifactTypeID() == 1){ - countGen++; - } - if(entry.getKey().getArtifactTypeID() == 2){ - countBookmark++; - } - if(entry.getKey().getArtifactTypeID() == 3){ - countCookie++; - } - if(entry.getKey().getArtifactTypeID() == 4){ + public static Workbook wb = new XSSFWorkbook(); - countHistory++; + public reportXLS(HashMap> report, reportFilter rr) { + //Empty the workbook first + Workbook wbtemp = new XSSFWorkbook(); + + int countGen = 0; + int countBookmark = 0; + int countCookie = 0; + int countHistory = 0; + int countDownload = 0; + int countRecentObjects = 0; + int countTrackPoint = 0; + int countInstalled = 0; + int countKeyword = 0; + int countHash = 0; + int countDevice = 0; + for (Entry> entry : report.entrySet()) { + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) { + countGen++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) { + countBookmark++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) { + + countCookie++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) { + + countHistory++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) { + countDownload++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) { + countRecentObjects++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) { + countTrackPoint++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) { + countInstalled++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) { + countKeyword++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) { + countHash++; + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) { + countDevice++; + } + } + + try { + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase skCase = currentCase.getSleuthkitCase(); + String caseName = currentCase.getName(); + Integer imagecount = currentCase.getImageIDs().length; + Integer filesystemcount = currentCase.getRootObjectsCount(); + Integer totalfiles = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG); + Integer totaldirs = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR); + DateFormat datetimeFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss"); + DateFormat dateFormat = new SimpleDateFormat("MM-dd-yyyy-HH-mm-ss"); + Date date = new Date(); + String datetime = datetimeFormat.format(date); + String datenotime = dateFormat.format(date); + + //The first summary report page + Sheet sheetSummary = wbtemp.createSheet("Summary"); + //Generate a sheet per artifact type + // Sheet sheetGen = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getDisplayName()); + Sheet sheetHash = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()); + Sheet sheetDevice = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getDisplayName()); + Sheet sheetInstalled = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getDisplayName()); + Sheet sheetKeyword = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()); + // Sheet sheetTrackpoint = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getDisplayName()); + Sheet sheetRecent = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getDisplayName()); + Sheet sheetCookie = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getDisplayName()); + Sheet sheetBookmark = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getDisplayName()); + Sheet sheetDownload = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getDisplayName()); + Sheet sheetHistory = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getDisplayName()); + + //Bold/underline cell style for the top header rows + CellStyle style = wbtemp.createCellStyle(); + style.setBorderBottom((short) 2); + Font font = wbtemp.createFont(); + font.setFontHeightInPoints((short) 16); + font.setFontName("Courier New"); + font.setBoldweight((short) 2); + style.setFont(font); + //create the rows in the worksheet for our records + //Create first row and header + // sheetGen.createRow(0); + // sheetGen.getRow(0).createCell(0).setCellValue("Name"); + // sheetGen.getRow(0).createCell(1).setCellValue("Value"); + // sheetGen.getRow(0).createCell(2).setCellValue("Date/Time"); + + sheetSummary.createRow(0).setRowStyle(style); + sheetSummary.getRow(0).createCell(0).setCellValue("Summary Information"); + sheetSummary.getRow(0).createCell(1).setCellValue(caseName); + //add some basic information + sheetSummary.createRow(1); + sheetSummary.getRow(1).createCell(0).setCellValue("# of Images"); + sheetSummary.getRow(1).createCell(1).setCellValue(imagecount); + sheetSummary.createRow(2); + sheetSummary.getRow(2).createCell(0).setCellValue("Filesystems found"); + sheetSummary.getRow(2).createCell(1).setCellValue(imagecount); + sheetSummary.createRow(3); + sheetSummary.getRow(3).createCell(0).setCellValue("# of Files"); + sheetSummary.getRow(3).createCell(1).setCellValue(totalfiles); + sheetSummary.createRow(4); + sheetSummary.getRow(4).createCell(0).setCellValue("# of Directories"); + sheetSummary.getRow(4).createCell(1).setCellValue(totaldirs); + sheetSummary.createRow(5); + sheetSummary.getRow(5).createCell(0).setCellValue("Date/Time"); + sheetSummary.getRow(5).createCell(1).setCellValue(datetime); + + + + sheetHash.createRow(0).setRowStyle(style); + sheetHash.getRow(0).createCell(0).setCellValue("Name"); + sheetHash.getRow(0).createCell(1).setCellValue("Size"); + sheetHash.getRow(0).createCell(2).setCellValue("Hashset Name"); + + sheetDevice.createRow(0).setRowStyle(style); + sheetDevice.getRow(0).createCell(0).setCellValue("Name"); + sheetDevice.getRow(0).createCell(1).setCellValue("Serial #"); + sheetDevice.getRow(0).createCell(2).setCellValue("Time"); + + sheetInstalled.createRow(0).setRowStyle(style); + sheetInstalled.getRow(0).createCell(0).setCellValue("Program Name"); + sheetInstalled.getRow(0).createCell(1).setCellValue("Install Date/Time"); + + sheetKeyword.createRow(0).setRowStyle(style); + sheetKeyword.getRow(0).createCell(0).setCellValue("Keyword"); + sheetKeyword.getRow(0).createCell(1).setCellValue("File Name"); + sheetKeyword.getRow(0).createCell(2).setCellValue("Preview"); + sheetKeyword.getRow(0).createCell(3).setCellValue("Keyword LIst"); + + sheetRecent.createRow(0).setRowStyle(style); + sheetRecent.getRow(0).createCell(0).setCellValue("Name"); + sheetRecent.getRow(0).createCell(1).setCellValue("Path"); + sheetRecent.getRow(0).createCell(2).setCellValue("Related Shortcut"); + + sheetCookie.createRow(0).setRowStyle(style); + sheetCookie.getRow(0).createCell(0).setCellValue("URL"); + sheetCookie.getRow(0).createCell(1).setCellValue("Date"); + sheetCookie.getRow(0).createCell(2).setCellValue("Name"); + sheetCookie.getRow(0).createCell(3).setCellValue("Value"); + sheetCookie.getRow(0).createCell(4).setCellValue("Program"); + + sheetBookmark.createRow(0).setRowStyle(style); + sheetBookmark.getRow(0).createCell(0).setCellValue("URL"); + sheetBookmark.getRow(0).createCell(1).setCellValue("Title"); + sheetBookmark.getRow(0).createCell(2).setCellValue("Program"); + + sheetDownload.createRow(0).setRowStyle(style); + sheetDownload.getRow(0).createCell(0).setCellValue("File"); + sheetDownload.getRow(0).createCell(1).setCellValue("Source"); + sheetDownload.getRow(0).createCell(2).setCellValue("Time"); + sheetDownload.getRow(0).createCell(3).setCellValue("Program"); + + sheetHistory.createRow(0).setRowStyle(style); + sheetHistory.getRow(0).createCell(0).setCellValue("URL"); + sheetHistory.getRow(0).createCell(1).setCellValue("Date"); + sheetHistory.getRow(0).createCell(2).setCellValue("Referrer"); + sheetHistory.getRow(0).createCell(3).setCellValue("Title"); + sheetHistory.getRow(0).createCell(4).setCellValue("Program"); + + for (int i = 0; i < wbtemp.getNumberOfSheets(); i++) { + Sheet tempsheet = wbtemp.getSheetAt(i); + tempsheet.setAutobreaks(true); + + for (Row temprow : tempsheet) { + for (Cell cell : temprow) { + cell.setCellStyle(style); + tempsheet.autoSizeColumn(cell.getColumnIndex()); } - if(entry.getKey().getArtifactTypeID() == 5){ - countDownload++; + } + } + + int countedGen = 0; + int countedBookmark = 0; + int countedCookie = 0; + int countedHistory = 0; + int countedDownload = 0; + int countedRecentObjects = 0; + int countedTrackPoint = 0; + int countedInstalled = 0; + int countedKeyword = 0; + int countedHash = 0; + int countedDevice = 0; + + //start populating the sheets in the workbook + for (Entry> entry : report.entrySet()) { + if (reportFilter.cancel == true) { + break; + } + int cc = 0; + Long objId = entry.getKey().getObjectID(); + FsContent file = skCase.getFsContentById(objId); + Long filesize = file.getSize(); + TreeMap attributes = new TreeMap(); + // Get all the attributes, line them up to be added. Place empty string placeholders for each attribute type + int n; + for (n = 1; n <= 36; n++) { + attributes.put(n, ""); + + } + for (BlackboardAttribute tempatt : entry.getValue()) { + if (reportFilter.cancel == true) { + break; } - if(entry.getKey().getArtifactTypeID() == 6){ - countRecentObjects++; + String value = ""; + int type = tempatt.getAttributeTypeID(); + if (tempatt.getValueString() == null || "null".equals(tempatt.getValueString())) { + } else if (type == 2 || type == 33) { + value = new java.text.SimpleDateFormat("MM/dd/yyyy HH:mm:ss").format(new java.util.Date((tempatt.getValueLong()) * 1000)); + } else { + value = tempatt.getValueString(); } - if(entry.getKey().getArtifactTypeID() == 7){ - countTrackPoint++; - } - if(entry.getKey().getArtifactTypeID() == 8){ - countInstalled++; - } - if(entry.getKey().getArtifactTypeID() == 9){ - countKeyword++; - } - if(entry.getKey().getArtifactTypeID() == 10){ - countHash++; - } - if(entry.getKey().getArtifactTypeID() == 11){ - countDevice++; - } + + attributes.put(type, value); + cc++; + } + + + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) { + countedGen++; + // Row temp = sheetGen.getRow(countedGen); + + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) { + countedBookmark++; + Row temp = sheetBookmark.createRow(countedBookmark); + temp.createCell(0).setCellValue(attributes.get(1)); + temp.createCell(1).setCellValue(attributes.get(3)); + temp.createCell(2).setCellValue(attributes.get(4)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) { + countedCookie++; + Row temp = sheetCookie.createRow(countedCookie); + temp.createCell(0).setCellValue(attributes.get(1)); + temp.createCell(1).setCellValue(attributes.get(2)); + temp.createCell(2).setCellValue(attributes.get(3)); + temp.createCell(3).setCellValue(attributes.get(6)); + temp.createCell(4).setCellValue(attributes.get(4)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) { + countedHistory++; + Row temp = sheetHistory.createRow(countedHistory); + temp.createCell(0).setCellValue(attributes.get(1)); + temp.createCell(1).setCellValue(attributes.get(33)); + temp.createCell(2).setCellValue(attributes.get(32)); + temp.createCell(3).setCellValue(attributes.get(3)); + temp.createCell(4).setCellValue(attributes.get(4)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) { + countedDownload++; + Row temp = sheetDownload.createRow(countedDownload); + temp.createCell(0).setCellValue(attributes.get(8)); + temp.createCell(1).setCellValue(attributes.get(1)); + temp.createCell(2).setCellValue(attributes.get(33)); + temp.createCell(3).setCellValue(attributes.get(4)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) { + countedRecentObjects++; + Row temp = sheetRecent.createRow(countedRecentObjects); + temp.createCell(0).setCellValue(attributes.get(3)); + temp.createCell(1).setCellValue(attributes.get(8)); + temp.createCell(2).setCellValue(file.getName()); + temp.createCell(3).setCellValue(attributes.get(4)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) { + // sheetTrackpoint.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) { + countedInstalled++; + Row temp = sheetInstalled.createRow(countedInstalled); + temp.createCell(0).setCellValue(attributes.get(4)); + temp.createCell(1).setCellValue(attributes.get(2)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) { + countedKeyword++; + Row temp = sheetKeyword.createRow(countedKeyword); + temp.createCell(0).setCellValue(attributes.get(10)); + temp.createCell(1).setCellValue(attributes.get(3)); + temp.createCell(2).setCellValue(attributes.get(12)); + temp.createCell(3).setCellValue(attributes.get(13)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) { + countedHash++; + Row temp = sheetHash.createRow(countedHash); + temp.createCell(0).setCellValue(file.getName().toString()); + temp.createCell(1).setCellValue(filesize.toString()); + temp.createCell(2).setCellValue(attributes.get(30)); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) { + countedDevice++; + Row temp = sheetDevice.createRow(countedDevice); + temp.createCell(0).setCellValue(attributes.get(18)); + temp.createCell(1).setCellValue(attributes.get(20)); + temp.createCell(2).setCellValue(attributes.get(2)); + } + + + cc++; + rr.progBarSet(cc); + } + + + //write out the report to the reports folder + try { + FileOutputStream fos = new FileOutputStream(currentCase.getCaseDirectory() + "/Reports/" + caseName + "-" + datenotime + ".xlsx"); + wbtemp.write(fos); + fos.close(); + wb = wbtemp; + } catch (IOException e) { + System.err.println(e); + } + + } catch (Exception E) { + String test = E.toString(); + } + } - - try{ - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase skCase = currentCase.getSleuthkitCase(); - String caseName = currentCase.getName(); - Integer imagecount = currentCase.getImageIDs().length; - Integer filesystemcount = currentCase.getRootObjectsCount(); - Integer totalfiles = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG); - Integer totaldirs = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR); - DateFormat datetimeFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss"); - DateFormat dateFormat = new SimpleDateFormat("MM-dd-yyyy-HH-mm-ss"); - Date date = new Date(); - String datetime = datetimeFormat.format(date); - String datenotime = dateFormat.format(date); - - //The first summary report page - Sheet sheetSummary = wbtemp.createSheet("Summary"); - //Generate a sheet per artifact type - // Sheet sheetGen = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getDisplayName()); - Sheet sheetHash = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()); - Sheet sheetDevice = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getDisplayName()); - Sheet sheetInstalled = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getDisplayName()); - Sheet sheetKeyword = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()); - // Sheet sheetTrackpoint = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getDisplayName()); - Sheet sheetRecent = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getDisplayName()); - Sheet sheetCookie = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getDisplayName()); - Sheet sheetBookmark = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getDisplayName()); - Sheet sheetDownload = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getDisplayName()); - Sheet sheetHistory = wbtemp.createSheet(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getDisplayName()); - - //Bold/underline cell style for the top header rows - CellStyle style = wbtemp.createCellStyle(); - style.setBorderBottom((short) 2); - Font font = wbtemp.createFont(); - font.setFontHeightInPoints((short)16); - font.setFontName("Courier New"); - font.setBoldweight((short)2); - style.setFont(font); - //create the rows in the worksheet for our records - //Create first row and header - // sheetGen.createRow(0); - // sheetGen.getRow(0).createCell(0).setCellValue("Name"); - // sheetGen.getRow(0).createCell(1).setCellValue("Value"); - // sheetGen.getRow(0).createCell(2).setCellValue("Date/Time"); - - sheetSummary.createRow(0).setRowStyle(style); - sheetSummary.getRow(0).createCell(0).setCellValue("Summary Information"); - sheetSummary.getRow(0).createCell(1).setCellValue(caseName); - //add some basic information - sheetSummary.createRow(1); - sheetSummary.getRow(1).createCell(0).setCellValue("# of Images"); - sheetSummary.getRow(1).createCell(1).setCellValue(imagecount); - sheetSummary.createRow(2); - sheetSummary.getRow(2).createCell(0).setCellValue("Filesystems found"); - sheetSummary.getRow(2).createCell(1).setCellValue(imagecount); - sheetSummary.createRow(3); - sheetSummary.getRow(3).createCell(0).setCellValue("# of Files"); - sheetSummary.getRow(3).createCell(1).setCellValue(totalfiles); - sheetSummary.createRow(4); - sheetSummary.getRow(4).createCell(0).setCellValue("# of Directories"); - sheetSummary.getRow(4).createCell(1).setCellValue(totaldirs); - sheetSummary.createRow(5); - sheetSummary.getRow(5).createCell(0).setCellValue("Date/Time"); - sheetSummary.getRow(5).createCell(1).setCellValue(datetime); - - - - sheetHash.createRow(0).setRowStyle(style); - sheetHash.getRow(0).createCell(0).setCellValue("Name"); - sheetHash.getRow(0).createCell(1).setCellValue("Size"); - sheetHash.getRow(0).createCell(2).setCellValue("Hashset Name"); - - sheetDevice.createRow(0).setRowStyle(style); - sheetDevice.getRow(0).createCell(0).setCellValue("Name"); - sheetDevice.getRow(0).createCell(1).setCellValue("Serial #"); - sheetDevice.getRow(0).createCell(2).setCellValue("Time"); - - sheetInstalled.createRow(0).setRowStyle(style); - sheetInstalled.getRow(0).createCell(0).setCellValue("Program Name"); - sheetInstalled.getRow(0).createCell(1).setCellValue("Install Date/Time"); - - sheetKeyword.createRow(0).setRowStyle(style); - sheetKeyword.getRow(0).createCell(0).setCellValue("Keyword"); - sheetKeyword.getRow(0).createCell(1).setCellValue("File Name"); - sheetKeyword.getRow(0).createCell(2).setCellValue("Preview"); - sheetKeyword.getRow(0).createCell(3).setCellValue("Keyword LIst"); - - sheetRecent.createRow(0).setRowStyle(style); - sheetRecent.getRow(0).createCell(0).setCellValue("Name"); - sheetRecent.getRow(0).createCell(1).setCellValue("Path"); - sheetRecent.getRow(0).createCell(2).setCellValue("Related Shortcut"); - - sheetCookie.createRow(0).setRowStyle(style); - sheetCookie.getRow(0).createCell(0).setCellValue("URL"); - sheetCookie.getRow(0).createCell(1).setCellValue("Date"); - sheetCookie.getRow(0).createCell(2).setCellValue("Name"); - sheetCookie.getRow(0).createCell(3).setCellValue("Value"); - sheetCookie.getRow(0).createCell(4).setCellValue("Program"); - - sheetBookmark.createRow(0).setRowStyle(style); - sheetBookmark.getRow(0).createCell(0).setCellValue("URL"); - sheetBookmark.getRow(0).createCell(1).setCellValue("Title"); - sheetBookmark.getRow(0).createCell(2).setCellValue("Program"); - - sheetDownload.createRow(0).setRowStyle(style); - sheetDownload.getRow(0).createCell(0).setCellValue("File"); - sheetDownload.getRow(0).createCell(1).setCellValue("Source"); - sheetDownload.getRow(0).createCell(2).setCellValue("Time"); - sheetDownload.getRow(0).createCell(3).setCellValue("Program"); - - sheetHistory.createRow(0).setRowStyle(style); - sheetHistory.getRow(0).createCell(0).setCellValue("URL"); - sheetHistory.getRow(0).createCell(1).setCellValue("Date"); - sheetHistory.getRow(0).createCell(2).setCellValue("Referrer"); - sheetHistory.getRow(0).createCell(3).setCellValue("Title"); - sheetHistory.getRow(0).createCell(4).setCellValue("Program"); - - for(int i = 0;i < wbtemp.getNumberOfSheets();i++){ - Sheet tempsheet = wbtemp.getSheetAt(i); - tempsheet.setAutobreaks(true); - - for (Row temprow : tempsheet){ - for (Cell cell : temprow) { - cell.setCellStyle(style); - tempsheet.autoSizeColumn(cell.getColumnIndex()); - } - } - } - - int countedGen = 0; - int countedBookmark = 0; - int countedCookie = 0; - int countedHistory = 0; - int countedDownload = 0; - int countedRecentObjects = 0; - int countedTrackPoint = 0; - int countedInstalled = 0; - int countedKeyword = 0; - int countedHash = 0; - int countedDevice = 0; - - //start populating the sheets in the workbook - for (Entry> entry : report.entrySet()) { - if(reportFilter.cancel == true){ - break; - } - int cc = 0; - Long objId = entry.getKey().getObjectID(); - FsContent file = skCase.getFsContentById(objId); - Long filesize = file.getSize(); - TreeMap attributes = new TreeMap(); - // Get all the attributes, line them up to be added. Place empty string placeholders for each attribute type - int n; - for(n=1;n<=36;n++) - { - attributes.put(n, ""); - - } - for (BlackboardAttribute tempatt : entry.getValue()) - { - if(reportFilter.cancel == true){ - break; - } - String value = ""; - int type = tempatt.getAttributeTypeID(); - if(tempatt.getValueString() == null || "null".equals(tempatt.getValueString())){ - - } - else if(type == 2){ - value = new java.text.SimpleDateFormat("MM/dd/yyyy HH:mm:ss").format(new java.util.Date ((tempatt.getValueLong())*1000)); - } - else - { - value = tempatt.getValueString(); - } - - attributes.put(type, value); - cc++; - } - - - if(entry.getKey().getArtifactTypeID() == 1){ - countedGen++; - // Row temp = sheetGen.getRow(countedGen); - - } - if(entry.getKey().getArtifactTypeID() == 2){ - countedBookmark++; - Row temp = sheetBookmark.createRow(countedBookmark); - temp.createCell(0).setCellValue(attributes.get(1)); - temp.createCell(1).setCellValue(attributes.get(3)); - temp.createCell(2).setCellValue(attributes.get(4)); - } - if(entry.getKey().getArtifactTypeID() == 3){ - countedCookie++; - Row temp = sheetCookie.createRow(countedCookie); - temp.createCell(0).setCellValue(attributes.get(1)); - temp.createCell(1).setCellValue(attributes.get(2)); - temp.createCell(2).setCellValue(attributes.get(3)); - temp.createCell(3).setCellValue(attributes.get(6)); - temp.createCell(4).setCellValue(attributes.get(4)); - } - if(entry.getKey().getArtifactTypeID() == 4){ - countedHistory++; - Row temp = sheetHistory.createRow(countedHistory); - temp.createCell(0).setCellValue(attributes.get(1)); - temp.createCell(1).setCellValue(attributes.get(33)); - temp.createCell(2).setCellValue(attributes.get(32)); - temp.createCell(3).setCellValue(attributes.get(3)); - temp.createCell(4).setCellValue(attributes.get(4)); - } - if(entry.getKey().getArtifactTypeID() == 5){ - countedDownload++; - Row temp = sheetDownload.createRow(countedDownload); - temp.createCell(0).setCellValue(attributes.get(8)); - temp.createCell(1).setCellValue(attributes.get(1)); - temp.createCell(2).setCellValue(attributes.get(33)); - temp.createCell(3).setCellValue(attributes.get(4)); - } - if(entry.getKey().getArtifactTypeID() == 6){ - countedRecentObjects++; - Row temp = sheetRecent.createRow(countedRecentObjects); - temp.createCell(0).setCellValue(attributes.get(3)); - temp.createCell(1).setCellValue(attributes.get(8)); - temp.createCell(2).setCellValue(file.getName()); - temp.createCell(3).setCellValue(attributes.get(4)); - } - if(entry.getKey().getArtifactTypeID() == 7){ - // sheetTrackpoint.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 8){ - countedInstalled++; - Row temp = sheetInstalled.createRow(countedInstalled); - temp.createCell(0).setCellValue(attributes.get(4)); - temp.createCell(1).setCellValue(attributes.get(2)); - } - if(entry.getKey().getArtifactTypeID() == 9){ - countedKeyword++; - Row temp = sheetKeyword.createRow(countedKeyword); - temp.createCell(0).setCellValue(attributes.get(10)); - temp.createCell(1).setCellValue(attributes.get(3)); - temp.createCell(2).setCellValue(attributes.get(12)); - temp.createCell(3).setCellValue(attributes.get(13)); - } - if(entry.getKey().getArtifactTypeID() == 10){ - countedHash++; - Row temp = sheetHash.createRow(countedHash); - temp.createCell(0).setCellValue(file.getName().toString()); - temp.createCell(1).setCellValue(filesize.toString()); - temp.createCell(2).setCellValue(attributes.get(30)); - } - if(entry.getKey().getArtifactTypeID() == 11){ - countedDevice++; - Row temp = sheetDevice.createRow(countedDevice); - temp.createCell(0).setCellValue(attributes.get(18)); - temp.createCell(1).setCellValue(attributes.get(20)); - temp.createCell(2).setCellValue(attributes.get(2)); - } - - - cc++; - rr.progBarSet(cc); - } - - - //write out the report to the reports folder - try { - FileOutputStream fos = new FileOutputStream(currentCase.getCaseDirectory()+"/Reports/" + caseName + "-" + datenotime + ".xlsx"); - wbtemp.write(fos); - fos.close(); - wb = wbtemp; - } - catch (IOException e) { - System.err.println(e); - } - - } - - catch(Exception E) - { - String test = E.toString(); - } - - } - - } diff --git a/Report/src/org/sleuthkit/autopsy/report/reportXML.java b/Report/src/org/sleuthkit/autopsy/report/reportXML.java index c8d9d0335a..eb03ff140f 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportXML.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportXML.java @@ -1,8 +1,25 @@ -/* - * To change this template, choose Tools | Templates - * and open the template in the editor. + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.report; + import java.io.FileOutputStream; import java.io.IOException; import java.text.DateFormat; @@ -31,128 +48,129 @@ import org.sleuthkit.datamodel.File; import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskData; + public class reportXML { + public static Document xmldoc = new Document(); - public reportXML (HashMap> report, reportFilter rr){ - try{ - Case currentCase = Case.getCurrentCase(); // get the most updated case - SleuthkitCase skCase = currentCase.getSleuthkitCase(); - String caseName = currentCase.getName(); - Integer imagecount = currentCase.getImageIDs().length; - Integer filesystemcount = currentCase.getRootObjectsCount(); - Integer totalfiles = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG); - Integer totaldirs = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR); - Element root = new Element("Case"); - xmldoc = new Document(root); - DateFormat datetimeFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss"); - DateFormat dateFormat = new SimpleDateFormat("MM-dd-yyyy-HH-mm-ss"); - Date date = new Date(); - String datetime = datetimeFormat.format(date); - String datenotime = dateFormat.format(date); - Comment comment = new Comment("XML Report Generated by Autopsy 3 on " + datetime); - root.addContent(comment); - //Create summary node involving how many of each type - Element summary = new Element("Summary"); - if(IngestManager.getDefault().isIngestRunning()) - { - summary.addContent(new Element("Warning").setText("Report was run before ingest services completed!")); + + public reportXML(HashMap> report, reportFilter rr) { + try { + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase skCase = currentCase.getSleuthkitCase(); + String caseName = currentCase.getName(); + Integer imagecount = currentCase.getImageIDs().length; + Integer filesystemcount = currentCase.getRootObjectsCount(); + Integer totalfiles = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG); + Integer totaldirs = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR); + Element root = new Element("Case"); + xmldoc = new Document(root); + DateFormat datetimeFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss"); + DateFormat dateFormat = new SimpleDateFormat("MM-dd-yyyy-HH-mm-ss"); + Date date = new Date(); + String datetime = datetimeFormat.format(date); + String datenotime = dateFormat.format(date); + Comment comment = new Comment("XML Report Generated by Autopsy 3 on " + datetime); + root.addContent(comment); + //Create summary node involving how many of each type + Element summary = new Element("Summary"); + if (IngestManager.getDefault().isIngestRunning()) { + summary.addContent(new Element("Warning").setText("Report was run before ingest services completed!")); } - summary.addContent(new Element("Name").setText(caseName)); - summary.addContent(new Element("Total-Images").setText(imagecount.toString())); - summary.addContent(new Element("Total-FileSystems").setText(filesystemcount.toString())); - summary.addContent(new Element("Total-Files").setText(totalfiles.toString())); - summary.addContent(new Element("Total-Directories").setText(totaldirs.toString())); - root.addContent(summary); - //generate the nodes for each of the types so we can use them later - Element nodeGen = new Element("General-Information"); - Element nodeWebBookmark = new Element("Web-Bookmarks"); - Element nodeWebCookie = new Element("Web-Cookies"); - Element nodeWebHistory = new Element("Web-History"); - Element nodeWebDownload = new Element("Web-Downloads"); - Element nodeRecentObjects = new Element("Recent-Documents"); - Element nodeTrackPoint = new Element("Track-Points"); - Element nodeInstalled = new Element("Installed-Programfiles"); - Element nodeKeyword = new Element("Keyword-Search-Hits"); - Element nodeHash = new Element("Hashset-Hits"); - Element nodeDevice = new Element("Attached-Devices"); - //remove bytes - Pattern INVALID_XML_CHARS = Pattern.compile("[^\\u0009\\u000A\\u000D\\u0020-\\uD7FF\\uE000-\\uFFFD\uD800\uDC00-\uDBFF\uDFFF]"); - for (Entry> entry : report.entrySet()) { - if(reportFilter.cancel == true){ - break; - } - int cc = 0; - Element artifact = new Element("Artifact"); - Long objId = entry.getKey().getObjectID(); - Content cont = skCase.getContentById(objId); - Long filesize = cont.getSize(); - artifact.setAttribute("ID", objId.toString()); - artifact.setAttribute("Name", cont.accept(new NameVisitor())); - artifact.setAttribute("Size", filesize.toString()); - - // Get all the attributes for this guy - for (BlackboardAttribute tempatt : entry.getValue()) - { - if(reportFilter.cancel == true){ - break; - } - Element attribute = new Element("Attribute").setAttribute("Type",tempatt.getAttributeTypeDisplayName()); - String tempvalue = tempatt.getValueString(); - //INVALID_XML_CHARS.matcher(tempvalue).replaceAll(""); - Element value = new Element("Value").setText(tempvalue); - attribute.addContent(value); - Element context = new Element("Context").setText(StringEscapeUtils.escapeXml(tempatt.getContext())); - attribute.addContent(context); - artifact.addContent(attribute); - cc++; - } - - if(entry.getKey().getArtifactTypeID() == 1){ - //while (entry.getValue().iterator().hasNext()) - // { - // } - nodeGen.addContent(artifact); + summary.addContent(new Element("Name").setText(caseName)); + summary.addContent(new Element("Total-Images").setText(imagecount.toString())); + summary.addContent(new Element("Total-FileSystems").setText(filesystemcount.toString())); + summary.addContent(new Element("Total-Files").setText(totalfiles.toString())); + summary.addContent(new Element("Total-Directories").setText(totaldirs.toString())); + root.addContent(summary); + //generate the nodes for each of the types so we can use them later + Element nodeGen = new Element("General-Information"); + Element nodeWebBookmark = new Element("Web-Bookmarks"); + Element nodeWebCookie = new Element("Web-Cookies"); + Element nodeWebHistory = new Element("Web-History"); + Element nodeWebDownload = new Element("Web-Downloads"); + Element nodeRecentObjects = new Element("Recent-Documents"); + Element nodeTrackPoint = new Element("Track-Points"); + Element nodeInstalled = new Element("Installed-Programfiles"); + Element nodeKeyword = new Element("Keyword-Search-Hits"); + Element nodeHash = new Element("Hashset-Hits"); + Element nodeDevice = new Element("Attached-Devices"); + //remove bytes + Pattern INVALID_XML_CHARS = Pattern.compile("[^\\u0009\\u000A\\u000D\\u0020-\\uD7FF\\uE000-\\uFFFD\uD800\uDC00-\uDBFF\uDFFF]"); + for (Entry> entry : report.entrySet()) { + if (reportFilter.cancel == true) { + break; + } + int cc = 0; + Element artifact = new Element("Artifact"); + Long objId = entry.getKey().getObjectID(); + Content cont = skCase.getContentById(objId); + Long filesize = cont.getSize(); + artifact.setAttribute("ID", objId.toString()); + artifact.setAttribute("Name", cont.accept(new NameVisitor())); + artifact.setAttribute("Size", filesize.toString()); + + // Get all the attributes for this guy + for (BlackboardAttribute tempatt : entry.getValue()) { + if (reportFilter.cancel == true) { + break; + } + Element attribute = new Element("Attribute").setAttribute("Type", tempatt.getAttributeTypeDisplayName()); + String tempvalue = tempatt.getValueString(); + //INVALID_XML_CHARS.matcher(tempvalue).replaceAll(""); + Element value = new Element("Value").setText(tempvalue); + attribute.addContent(value); + Element context = new Element("Context").setText(StringEscapeUtils.escapeXml(tempatt.getContext())); + attribute.addContent(context); + artifact.addContent(attribute); + cc++; + } + + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) { + //while (entry.getValue().iterator().hasNext()) + // { + // } + nodeGen.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) { + + + nodeWebBookmark.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) { + + nodeWebCookie.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) { + + nodeWebHistory.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) { + nodeWebDownload.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) { + nodeRecentObjects.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) { + nodeTrackPoint.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) { + nodeInstalled.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) { + nodeKeyword.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) { + nodeHash.addContent(artifact); + } + if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) { + nodeDevice.addContent(artifact); + } + cc++; + rr.progBarSet(cc); + //end of master loop } - if(entry.getKey().getArtifactTypeID() == 2){ - - - nodeWebBookmark.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 3){ - - nodeWebCookie.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 4){ - - nodeWebHistory.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 5){ - nodeWebDownload.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 6){ - nodeRecentObjects.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 7){ - nodeTrackPoint.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 8){ - nodeInstalled.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 9){ - nodeKeyword.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 10){ - nodeHash.addContent(artifact); - } - if(entry.getKey().getArtifactTypeID() == 11){ - nodeDevice.addContent(artifact); - } - cc++; - rr.progBarSet(cc); - //end of master loop - } - - //add them in the order we want them to the document + + //add them in the order we want them to the document root.addContent(nodeGen); root.addContent(nodeWebBookmark); root.addContent(nodeWebCookie); @@ -162,26 +180,24 @@ public class reportXML { root.addContent(nodeTrackPoint); root.addContent(nodeInstalled); root.addContent(nodeKeyword); - root.addContent(nodeHash); + root.addContent(nodeHash); root.addContent(nodeDevice); - - try { - FileOutputStream out = new FileOutputStream(currentCase.getCaseDirectory()+"/Reports/" + caseName + "-" + datenotime + ".xml"); - XMLOutputter serializer = new XMLOutputter(); - serializer.output(xmldoc, out); - out.flush(); - out.close(); - } - catch (IOException e) { - System.err.println(e); - } - } - catch (Exception e){ - Logger.getLogger(reportXML.class.getName()).log(Level.WARNING, "Exception occurred", e); + try { + FileOutputStream out = new FileOutputStream(currentCase.getCaseDirectory() + "/Reports/" + caseName + "-" + datenotime + ".xml"); + XMLOutputter serializer = new XMLOutputter(); + serializer.output(xmldoc, out); + out.flush(); + out.close(); + } catch (IOException e) { + System.err.println(e); + } + + } catch (Exception e) { + Logger.getLogger(reportXML.class.getName()).log(Level.WARNING, "Exception occurred", e); + } } - } - + private class NameVisitor extends ContentVisitor.Default { @Override