mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 18:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Readdition of merged files.

Browse Source
This commit is contained in:
Alex Ebadirad 2012-05-02 15:01:29 -07:00
parent bce66978c4
commit 15136d3a61
12 changed files with 1324 additions and 1306 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
Report/src/org/sleuthkit/autopsy/report/ReportModuleException.java Normal file
View File

@ -0,0 +1,33 @@
/*
*
* Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.report;
//exception thrown by a reporting module when report generation failed
class ReportModuleException extends Exception {
public ReportModuleException(String msg) {
super(msg);
}
public ReportModuleException(String msg, Exception ex) {
super(msg, ex);
}
}

205
Report/src/org/sleuthkit/autopsy/report/report.java
View File

@ -1,12 +1,29 @@
/* /*
* To change this template, choose Tools | Templates *
* and open the template in the editor. * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
import java.sql.ResultSet; import java.sql.ResultSet;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map;
import java.util.logging.Level; import java.util.logging.Level;
import java.util.logging.Logger; import java.util.logging.Logger;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
@ -18,261 +35,207 @@ import org.sleuthkit.datamodel.SleuthkitCase;
* *
* @author Alex * @author Alex
*/ */
public class report implements reportInterface { public class report {
private void report() { private void report() {
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getGenInfo() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getGenInfo() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(1); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebHistory() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebHistory() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(4); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebCookie() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebCookie() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(3); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebBookmark() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebBookmark() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(2); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebDownload() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getWebDownload() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(5); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getRecentObject() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getRecentObject() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(6); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getKeywordHit() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getKeywordHit() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(9); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getHashHit() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getHashHit() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(10); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getInstalledProg() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getInstalledProg() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(8); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getDevices() { public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getDevices() {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{ ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED);
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(11); for (BlackboardArtifact artifact : bbart) {
for (BlackboardArtifact artifact : bbart)
{
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes(); ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes); reportMap.put(artifact, attributes);
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
return reportMap; return reportMap;
} }
@Override
public String getGroupedKeywordHit() { public String getGroupedKeywordHit() {
StringBuilder table = new StringBuilder(); StringBuilder table = new StringBuilder();
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>(); HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try try {
{
ResultSet uniqueresults = tempDb.runQuery("SELECT DISTINCT value_text from blackboard_attributes where attribute_type_id = '10' order by value_text ASC"); ResultSet uniqueresults = tempDb.runQuery("SELECT DISTINCT value_text from blackboard_attributes where attribute_type_id = '10' order by value_text ASC");
while(uniqueresults.next()) while (uniqueresults.next()) {
{
table.append("<strong>").append(uniqueresults.getString("value_text")).append("</strong>"); table.append("<strong>").append(uniqueresults.getString("value_text")).append("</strong>");
table.append("<table><thead><tr><th>").append("File Name").append("</th><th>Preview</th><th>Keyword List</th></tr><tbody>"); table.append("<table><thead><tr><th>").append("File Name").append("</th><th>Preview</th><th>Keyword List</th></tr><tbody>");
ArrayList<BlackboardArtifact> artlist = new ArrayList<BlackboardArtifact>(); ArrayList<BlackboardArtifact> artlist = new ArrayList<BlackboardArtifact>();
ResultSet tempresults = tempDb.runQuery("select DISTINCT artifact_id from blackboard_attributes where attribute_type_id = '10' and value_text = '" + uniqueresults.getString("value_text") + "'"); ResultSet tempresults = tempDb.runQuery("select DISTINCT artifact_id from blackboard_attributes where attribute_type_id = '10' and value_text = '" + uniqueresults.getString("value_text") + "'");
while(tempresults.next()) while (tempresults.next()) {
{
artlist.add(tempDb.getBlackboardArtifact(tempresults.getLong("artifact_id"))); artlist.add(tempDb.getBlackboardArtifact(tempresults.getLong("artifact_id")));
} }
for(BlackboardArtifact art : artlist) for (BlackboardArtifact art : artlist) {
{
String filename = tempDb.getFsContentById(art.getObjectID()).getName(); String filename = tempDb.getFsContentById(art.getObjectID()).getName();
String preview = ""; String preview = "";
String set = ""; String set = "";
table.append("<tr><td>").append(filename).append("</td>"); table.append("<tr><td>").append(filename).append("</td>");
ArrayList<BlackboardAttribute> tempatts = art.getAttributes(); ArrayList<BlackboardAttribute> tempatts = art.getAttributes();
for(BlackboardAttribute att : tempatts) for (BlackboardAttribute att : tempatts) {
{ if (att.getAttributeTypeID() == 12) {
if(att.getAttributeTypeID() == 12)
{
preview = "<td>" + att.getValueString() + "</td>"; preview = "<td>" + att.getValueString() + "</td>";
} }
if(att.getAttributeTypeID() == 13) if (att.getAttributeTypeID() == 13) {
{
set = "<td>" + att.getValueString() + "</td>"; set = "<td>" + att.getValueString() + "</td>";
} }
} }
@ -282,9 +245,7 @@ public String getGroupedKeywordHit() {
table.append("</tbody></table><br /><br />"); table.append("</tbody></table><br /><br />");
} }
} } catch (Exception e) {
catch (Exception e)
{
Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(report.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
@ -292,4 +253,24 @@ public String getGroupedKeywordHit() {
return result; return result;
} }
public HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> getAllTypes(ReportConfiguration config) {
HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> reportMap = new HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>>();
Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase();
try {
for (Map.Entry<BlackboardArtifact.ARTIFACT_TYPE, Boolean> entry : config.config.entrySet()) {
if (entry.getValue()) {
ArrayList<BlackboardArtifact> bbart = tempDb.getBlackboardArtifacts(entry.getKey());
for (BlackboardArtifact artifact : bbart) {
ArrayList<BlackboardAttribute> attributes = artifact.getAttributes();
reportMap.put(artifact, attributes);
}
}
}
} catch (Exception e) {
Logger.getLogger(report.class.getName()).log(Level.INFO, "Exception occurred", e);
}
return reportMap;
}
} }

37
Report/src/org/sleuthkit/autopsy/report/reportAction.java
View File

@ -1,6 +1,22 @@
/* /*
* To change this template, choose Tools | Templates *
* and open the template in the editor. * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
@ -12,22 +28,22 @@ import java.awt.event.ActionListener;
import java.beans.PropertyChangeEvent; import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener; import java.beans.PropertyChangeListener;
import java.io.File; import java.io.File;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.swing.ImageIcon;
import javax.swing.JButton; import javax.swing.JButton;
import javax.swing.JDialog; import javax.swing.JDialog;
import javax.swing.JFrame; import javax.swing.JFrame;
import org.openide.awt.ActionRegistration; import org.openide.awt.ActionID;
import org.openide.awt.ActionReference; import org.openide.awt.ActionReference;
import org.openide.awt.ActionReferences; import org.openide.awt.ActionReferences;
import org.openide.awt.ActionID; import org.openide.awt.ActionRegistration;
import org.openide.util.HelpCtx; import org.openide.util.HelpCtx;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.openide.util.actions.CallableSystemAction; import org.openide.util.actions.CallableSystemAction;
import org.openide.util.actions.Presenter; import org.openide.util.actions.Presenter;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Log; import org.sleuthkit.autopsy.coreutils.Log;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.swing.ImageIcon;
@ActionID(category = "Tools", @ActionID(category = "Tools",
id = "org.sleuthkit.autopsy.report.reportAction") id = "org.sleuthkit.autopsy.report.reportAction")
@ -40,7 +56,7 @@ public final class reportAction extends CallableSystemAction implements Presente
private JButton toolbarButton = new JButton(); private JButton toolbarButton = new JButton();
private static final String ACTION_NAME = "Generate Report"; private static final String ACTION_NAME = "Generate Report";
Logger logger = Logger.getLogger(reportAction.class.getName()); static final Logger logger = Logger.getLogger(reportAction.class.getName());
public reportAction() { public reportAction() {
setEnabled(false); setEnabled(false);
@ -52,7 +68,6 @@ public final class reportAction extends CallableSystemAction implements Presente
setEnabled(evt.getNewValue() != null); setEnabled(evt.getNewValue() != null);
} }
} }
}); });
//attempt to create a report folder if a case is active //attempt to create a report folder if a case is active
Case.addPropertyChangeListener(new PropertyChangeListener() { Case.addPropertyChangeListener(new PropertyChangeListener() {
@ -69,7 +84,6 @@ public final class reportAction extends CallableSystemAction implements Presente
boolean exists = (new File(newCase.getCaseDirectory() + "\\Reports")).exists(); boolean exists = (new File(newCase.getCaseDirectory() + "\\Reports")).exists();
if (exists) { if (exists) {
// report directory exists -- don't need to do anything // report directory exists -- don't need to do anything
} else { } else {
// report directory does not exist -- create it // report directory does not exist -- create it
boolean reportCreate = (new File(newCase.getCaseDirectory() + "\\Reports")).mkdirs(); boolean reportCreate = (new File(newCase.getCaseDirectory() + "\\Reports")).mkdirs();
@ -80,7 +94,6 @@ public final class reportAction extends CallableSystemAction implements Presente
} }
} }
} }
}); });
// set action of the toolbar button // set action of the toolbar button
@ -105,6 +118,7 @@ public final class reportAction extends CallableSystemAction implements Presente
// initialize panel with loaded settings // initialize panel with loaded settings
final reportFilter panel = new reportFilter(); final reportFilter panel = new reportFilter();
panel.setjButton2ActionListener(new ActionListener() { panel.setjButton2ActionListener(new ActionListener() {
@Override @Override
public void actionPerformed(ActionEvent e) { public void actionPerformed(ActionEvent e) {
popUpWindow.dispose(); popUpWindow.dispose();
@ -134,7 +148,6 @@ public final class reportAction extends CallableSystemAction implements Presente
@Override @Override
public void performAction() { public void performAction() {
} }
@Override @Override

17
Report/src/org/sleuthkit/autopsy/report/reportFilter.form
View File

@ -1,4 +1,4 @@
<?xml version="1.1" encoding="UTF-8" ?> <?xml version="1.0" encoding="UTF-8" ?>
<Form version="1.5" maxVersion="1.7" type="org.netbeans.modules.form.forminfo.JPanelFormInfo"> <Form version="1.5" maxVersion="1.7" type="org.netbeans.modules.form.forminfo.JPanelFormInfo">
<NonVisualComponents> <NonVisualComponents>
@ -40,7 +40,11 @@
<EmptySpace max="-2" attributes="0"/> <EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0"> <Component id="jButton1" min="-2" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
<Component id="cancelButton" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="156" max="-2" attributes="0"/>
</Group>
<Component id="jCheckBox3" alignment="0" min="-2" max="-2" attributes="0"/> <Component id="jCheckBox3" alignment="0" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
@ -53,15 +57,6 @@
<Component id="jCheckBox4" alignment="0" min="-2" max="-2" attributes="0"/> <Component id="jCheckBox4" alignment="0" min="-2" max="-2" attributes="0"/>
</Group> </Group>
</Group> </Group>
</Group>
<EmptySpace min="-2" pref="69" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Component id="jButton1" min="-2" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
<Component id="cancelButton" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="156" max="-2" attributes="0"/>
</Group>
<Component id="progBar" alignment="0" min="-2" pref="231" max="-2" attributes="0"/> <Component id="progBar" alignment="0" min="-2" pref="231" max="-2" attributes="0"/>
</Group> </Group>
<EmptySpace max="-2" attributes="0"/> <EmptySpace max="-2" attributes="0"/>

3
Report/src/org/sleuthkit/autopsy/report/reportFilterAction.java
View File

@ -16,7 +16,6 @@
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
import java.awt.Container; import java.awt.Container;
@ -31,6 +30,7 @@ import org.sleuthkit.autopsy.coreutils.Log;
/** /**
* The reportFilterAction opens the reportFilterPanel in a dialog, and saves the * The reportFilterAction opens the reportFilterPanel in a dialog, and saves the
* settings of the panel if the Apply button is clicked. * settings of the panel if the Apply button is clicked.
*
* @author pmartel * @author pmartel
*/ */
class reportFilterAction { class reportFilterAction {
@ -81,4 +81,3 @@ class reportFilterAction {
return HelpCtx.DEFAULT_HELP; return HelpCtx.DEFAULT_HELP;
} }
} }

96
Report/src/org/sleuthkit/autopsy/report/reportHTML.java
View File

@ -1,6 +1,22 @@
/* /*
* To change this template, choose Tools | Templates *
* and open the template in the editor. * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
@ -36,6 +52,7 @@ public class reportHTML {
public static StringBuilder unformatted_header = new StringBuilder(); public static StringBuilder unformatted_header = new StringBuilder();
public static StringBuilder formatted_header = new StringBuilder(); public static StringBuilder formatted_header = new StringBuilder();
public static String htmlPath = ""; public static String htmlPath = "";
public reportHTML(HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> report, reportFilter rr) { public reportHTML(HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> report, reportFilter rr) {
//This is literally a terrible way to count up all the types of artifacts, and doesn't include any added ones. //This is literally a terrible way to count up all the types of artifacts, and doesn't include any added ones.
@ -57,39 +74,39 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
int countHash = 0; int countHash = 0;
int countDevice = 0; int countDevice = 0;
for (Entry<BlackboardArtifact, ArrayList<BlackboardAttribute>> entry : report.entrySet()) { for (Entry<BlackboardArtifact, ArrayList<BlackboardAttribute>> entry : report.entrySet()) {
if(entry.getKey().getArtifactTypeID() == 1){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
countGen++; countGen++;
} }
if(entry.getKey().getArtifactTypeID() == 2){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) {
countWebBookmark++; countWebBookmark++;
} }
if(entry.getKey().getArtifactTypeID() == 3){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) {
countWebCookie++; countWebCookie++;
} }
if(entry.getKey().getArtifactTypeID() == 4){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) {
countWebHistory++; countWebHistory++;
} }
if(entry.getKey().getArtifactTypeID() == 5){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) {
countWebDownload++; countWebDownload++;
} }
if(entry.getKey().getArtifactTypeID() == 6){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) {
countRecentObjects++; countRecentObjects++;
} }
if(entry.getKey().getArtifactTypeID() == 7){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) {
countTrackPoint++; countTrackPoint++;
} }
if(entry.getKey().getArtifactTypeID() == 8){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) {
countInstalled++; countInstalled++;
} }
if(entry.getKey().getArtifactTypeID() == 9){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
countKeyword++; countKeyword++;
} }
if(entry.getKey().getArtifactTypeID() == 10){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
countHash++; countHash++;
} }
if(entry.getKey().getArtifactTypeID() == 11){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
countDevice++; countDevice++;
} }
} }
@ -147,8 +164,7 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
// Add summary information now // Add summary information now
formatted_Report.append("<h1>Report for Case: ").append(caseName).append("</h1>"); formatted_Report.append("<h1>Report for Case: ").append(caseName).append("</h1>");
if(IngestManager.getDefault().isIngestRunning()) if (IngestManager.getDefault().isIngestRunning()) {
{
formatted_Report.append(ingestwarning); formatted_Report.append(ingestwarning);
} }
formatted_Report.append("<h2>Case Summary</h2><p>HTML Report Generated by <strong>Autopsy 3</strong> on ").append(datetime).append("<ul>"); formatted_Report.append("<h2>Case Summary</h2><p>HTML Report Generated by <strong>Autopsy 3</strong> on ").append(datetime).append("<ul>");
@ -208,12 +224,10 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
} }
int cc = 0; int cc = 0;
if(alt > 0) if (alt > 0) {
{
altRow = " class=\"alt\""; altRow = " class=\"alt\"";
alt = 0; alt = 0;
} } else {
else{
altRow = ""; altRow = "";
alt++; alt++;
} }
@ -228,29 +242,23 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
TreeMap<Integer, String> attributes = new TreeMap<Integer, String>(); TreeMap<Integer, String> attributes = new TreeMap<Integer, String>();
// Get all the attributes, line them up to be added. Place empty string placeholders for each attribute type // Get all the attributes, line them up to be added. Place empty string placeholders for each attribute type
int n; int n;
for(n=1;n<=35;n++) for (n = 1; n <= 35; n++) {
{
attributes.put(n, ""); attributes.put(n, "");
} }
for (BlackboardAttribute tempatt : entry.getValue()) for (BlackboardAttribute tempatt : entry.getValue()) {
{
if (reportFilter.cancel == true) { if (reportFilter.cancel == true) {
break; break;
} }
String value = ""; String value = "";
int type = tempatt.getAttributeTypeID(); int type = tempatt.getAttributeTypeID();
if (tempatt.getValueString() == null || "null".equals(tempatt.getValueString())) { if (tempatt.getValueString() == null || "null".equals(tempatt.getValueString())) {
} else if (type == 2 || type == 33) {
}
else if(type == 2 || type == 33 ){
value = new java.text.SimpleDateFormat("MM/dd/yyyy HH:mm:ss").format(new java.util.Date((tempatt.getValueLong()))); value = new java.text.SimpleDateFormat("MM/dd/yyyy HH:mm:ss").format(new java.util.Date((tempatt.getValueLong())));
if (value == null || "".equals(value)) { if (value == null || "".equals(value)) {
value = tempatt.getValueString(); value = tempatt.getValueString();
} }
} } else {
else
{
value = tempatt.getValueString(); value = tempatt.getValueString();
} }
value = reportUtils.insertPeriodically(value, "<br>", 30); value = reportUtils.insertPeriodically(value, "<br>", 30);
@ -259,19 +267,19 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
} }
if(entry.getKey().getArtifactTypeID() == 1){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
artifact.append("</tr>"); artifact.append("</tr>");
nodeGen.append(artifact); nodeGen.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 2){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) {
artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(1)).append("</td>"); artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(1)).append("</td>");
artifact.append("<td>").append(attributes.get(3)).append("</td>"); artifact.append("<td>").append(attributes.get(3)).append("</td>");
artifact.append("<td>").append(attributes.get(4)).append("</td>"); artifact.append("<td>").append(attributes.get(4)).append("</td>");
artifact.append("</tr>"); artifact.append("</tr>");
nodeWebBookmark.append(artifact); nodeWebBookmark.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 3){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) {
artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(1)).append("</td>"); artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(1)).append("</td>");
artifact.append("<td>").append(attributes.get(2)).append("</td>"); artifact.append("<td>").append(attributes.get(2)).append("</td>");
artifact.append("<td>").append(attributes.get(3)).append("</td>"); artifact.append("<td>").append(attributes.get(3)).append("</td>");
@ -280,7 +288,7 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
artifact.append("</tr>"); artifact.append("</tr>");
nodeWebCookie.append(artifact); nodeWebCookie.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 4){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) {
artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(1)).append("</td>"); artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(1)).append("</td>");
artifact.append("<td>").append(attributes.get(33)).append("</td>"); artifact.append("<td>").append(attributes.get(33)).append("</td>");
artifact.append("<td>").append(attributes.get(32)).append("</td>"); artifact.append("<td>").append(attributes.get(32)).append("</td>");
@ -289,7 +297,7 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
artifact.append("</tr>"); artifact.append("</tr>");
nodeWebHistory.append(artifact); nodeWebHistory.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 5){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) {
artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(8)).append("</td>"); artifact.append("<tr").append(altRow).append("><td>").append(attributes.get(8)).append("</td>");
artifact.append("<td>").append(attributes.get(1)).append("</td>"); artifact.append("<td>").append(attributes.get(1)).append("</td>");
artifact.append("<td>").append(attributes.get(33)).append("</td>"); artifact.append("<td>").append(attributes.get(33)).append("</td>");
@ -297,7 +305,7 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
artifact.append("</tr>"); artifact.append("</tr>");
nodeWebDownload.append(artifact); nodeWebDownload.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 6){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) {
//artifact.append("<tr><td>").append(objId.toString()); //artifact.append("<tr><td>").append(objId.toString());
artifact.append("<tr").append(altRow).append("><td><strong>").append(attributes.get(3)).append("</strong></td>"); artifact.append("<tr").append(altRow).append("><td><strong>").append(attributes.get(3)).append("</strong></td>");
artifact.append("<td>").append(attributes.get(8)).append("</td>"); artifact.append("<td>").append(attributes.get(8)).append("</td>");
@ -305,27 +313,25 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
artifact.append("</tr>"); artifact.append("</tr>");
nodeRecentObjects.append(artifact); nodeRecentObjects.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 7){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) {
artifact.append("<tr").append(altRow).append("><td>").append(objId.toString()); artifact.append("<tr").append(altRow).append("><td>").append(objId.toString());
artifact.append("</td><td><strong>").append(file.getName().toString()).append("</strong></td>"); artifact.append("</td><td><strong>").append(file.getName().toString()).append("</strong></td>");
artifact.append("<td>").append(filesize.toString()).append("</td>"); artifact.append("<td>").append(filesize.toString()).append("</td>");
artifact.append("</tr>"); artifact.append("</tr>");
nodeTrackPoint.append(artifact); nodeTrackPoint.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 8){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) {
artifact.append("<tr").append(altRow).append("><td><strong>").append(attributes.get(4)).append("</strong></td>"); artifact.append("<tr").append(altRow).append("><td><strong>").append(attributes.get(4)).append("</strong></td>");
artifact.append("<td>").append(attributes.get(2)).append("</td>"); artifact.append("<td>").append(attributes.get(2)).append("</td>");
artifact.append("</tr>"); artifact.append("</tr>");
nodeInstalled.append(artifact); nodeInstalled.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 9){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
// artifact.append("<table><thead><tr><th>Artifact ID</th><th>Name</th><th>Size</th>"); // artifact.append("<table><thead><tr><th>Artifact ID</th><th>Name</th><th>Size</th>");
// artifact.append("</tr></table>"); // artifact.append("</tr></table>");
// nodeKeyword.append(artifact); // nodeKeyword.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 10){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
// artifact.append("<tr><td>").append(objId.toString()); // artifact.append("<tr><td>").append(objId.toString());
artifact.append("<tr").append(altRow).append("><td><strong>").append(file.getName().toString()).append("</strong></td>"); artifact.append("<tr").append(altRow).append("><td><strong>").append(file.getName().toString()).append("</strong></td>");
artifact.append("<td>").append(filesize.toString()).append("</td>"); artifact.append("<td>").append(filesize.toString()).append("</td>");
@ -334,7 +340,7 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
artifact.append("</tr>"); artifact.append("</tr>");
nodeHash.append(artifact); nodeHash.append(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 11){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
artifact.append("<tr").append(altRow).append("><td><strong>").append(attributes.get(18)).append("</strong></td>"); artifact.append("<tr").append(altRow).append("><td><strong>").append(attributes.get(18)).append("</strong></td>");
artifact.append("<td>").append(attributes.get(20)).append("</td>"); artifact.append("<td>").append(attributes.get(20)).append("</td>");
artifact.append("<td>").append(attributes.get(2)).append("</td>"); artifact.append("<td>").append(attributes.get(2)).append("</td>");
@ -400,13 +406,9 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
out.flush(); out.flush();
out.close(); out.close();
} } catch (Exception e) {
catch(Exception e)
{
Logger.getLogger(reportHTML.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(reportHTML.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
} }
} }

2
Report/src/org/sleuthkit/autopsy/report/reportPanel.form
View File

@ -1,4 +1,4 @@
<?xml version="1.1" encoding="UTF-8" ?> <?xml version="1.0" encoding="UTF-8" ?>
<Form version="1.5" maxVersion="1.7" type="org.netbeans.modules.form.forminfo.JPanelFormInfo"> <Form version="1.5" maxVersion="1.7" type="org.netbeans.modules.form.forminfo.JPanelFormInfo">
<NonVisualComponents> <NonVisualComponents>

72
Report/src/org/sleuthkit/autopsy/report/reportPanel.java
View File

@ -1,20 +1,27 @@
/* /*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
/*
* reportPanel.java
* *
* Created on Feb 21, 2012, 12:13:14 PM * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
import java.awt.event.ActionListener; import java.awt.event.ActionListener;
import java.io.BufferedWriter; import java.io.*;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.OutputStreamWriter;
import java.io.Writer;
import java.text.DateFormat; import java.text.DateFormat;
import java.text.SimpleDateFormat; import java.text.SimpleDateFormat;
import java.util.Date; import java.util.Date;
@ -30,16 +37,17 @@ import org.jdom.output.XMLOutputter;
*/ */
public class reportPanel extends javax.swing.JPanel { public class reportPanel extends javax.swing.JPanel {
/** Creates new form reportPanel */ /**
public reportPanel(String report) { * Creates new form reportPanel
*/
public reportPanel() {
initComponents(); initComponents();
setReportWindow(report);
} }
/** This method is called from within the constructor to /**
* initialize the form. * This method is called from within the constructor to initialize the form.
* WARNING: Do NOT modify this code. The content of this method is * WARNING: Do NOT modify this code. The content of this method is always
* always regenerated by the Form Editor. * regenerated by the Form Editor.
*/ */
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
@ -105,25 +113,6 @@ private void saveReportActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FI
public void setjButton1ActionListener(ActionListener e) { public void setjButton1ActionListener(ActionListener e) {
jButton1.addActionListener(e); jButton1.addActionListener(e);
} }
public void getLink(HyperlinkEvent evt){
try{
String str = evt.getDescription();
// jEditorPane1.scrollToReference(str.substring(1));
}
catch(Exception e){
String whater = "";
}
}
public void setjEditorPane1EventListener(HyperlinkListener evt){
// jEditorPane1.addHyperlinkListener(evt);
}
private void setReportWindow(String report)
{
// jEditorPane1.setText(report);
// jEditorPane1.setCaretPosition(0);
}
public void setFinishedReportText() { public void setFinishedReportText() {
DateFormat dateFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss"); DateFormat dateFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");
@ -132,7 +121,6 @@ private void saveReportActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FI
jLabel1.setText(reportText); jLabel1.setText(reportText);
} }
private void saveReportAction() { private void saveReportAction() {
int option = jFileChooser1.showSaveDialog(this); int option = jFileChooser1.showSaveDialog(this);
@ -168,12 +156,10 @@ private void saveReportActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FI
xmlout.flush(); xmlout.flush();
xmlout.close(); xmlout.close();
JOptionPane.showMessageDialog(this, "Report has been successfully saved!"); JOptionPane.showMessageDialog(this, "Report has been successfully saved!");
} } catch (IOException e) {
catch (IOException e) {
System.err.println(e); System.err.println(e);
} }
} }
// Variables declaration - do not modify//GEN-BEGIN:variables // Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JButton jButton1; private javax.swing.JButton jButton1;
private javax.swing.JFileChooser jFileChooser1; private javax.swing.JFileChooser jFileChooser1;
@ -181,6 +167,4 @@ private void saveReportActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FI
private javax.swing.JOptionPane jOptionPane1; private javax.swing.JOptionPane jOptionPane1;
private javax.swing.JButton saveReport; private javax.swing.JButton saveReport;
// End of variables declaration//GEN-END:variables // End of variables declaration//GEN-END:variables
} }

67
Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java
View File

@ -1,6 +1,22 @@
/* /*
* To change this template, choose Tools | Templates *
* and open the template in the editor. * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
@ -8,18 +24,11 @@ import java.awt.Dimension;
import java.awt.Toolkit; import java.awt.Toolkit;
import java.awt.event.ActionEvent; import java.awt.event.ActionEvent;
import java.awt.event.ActionListener; import java.awt.event.ActionListener;
import java.net.URL;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.logging.Level; import java.util.logging.Level;
import javax.swing.JDialog; import javax.swing.JDialog;
import javax.swing.JFrame; import javax.swing.JFrame;
import javax.swing.SwingUtilities; import javax.swing.SwingUtilities;
import javax.swing.event.HyperlinkEvent;
import javax.swing.event.HyperlinkListener;
import org.sleuthkit.autopsy.coreutils.Log; import org.sleuthkit.autopsy.coreutils.Log;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
/** /**
* *
@ -32,15 +41,14 @@ public class reportPanelAction {
} }
public void reportGenerate(ArrayList<Integer> reportlist, final reportFilter rr){ public void reportGenerate(ReportConfiguration reportconfig, final reportFilter rr){
try { try {
//Clear any old reports in the string //Clear any old reports in the string
viewReport.setLength(0); viewReport.setLength(0);
// Generate the reports and create the hashmap // Generate the reports and create the hashmap
final HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> Results = new HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>>(); final ReportGen report = new ReportGen();
report bbreport = new report();
//see what reports we need to run and run them //see what reports we need to run and run them
//Set progress bar to move while doing this //Set progress bar to move while doing this
SwingUtilities.invokeLater(new Runnable() { SwingUtilities.invokeLater(new Runnable() {
@ -48,21 +56,11 @@ public class reportPanelAction {
public void run() { public void run() {
rr.progBarStartText(); rr.progBarStartText();
}}); }});
if(reportlist.contains(1)){Results.putAll(bbreport.getGenInfo());} report.populateReport(reportconfig);
if(reportlist.contains(2)){Results.putAll(bbreport.getWebBookmark());}
if(reportlist.contains(3)){Results.putAll(bbreport.getWebCookie());}
if(reportlist.contains(4)){Results.putAll(bbreport.getWebHistory());}
if(reportlist.contains(5)){Results.putAll(bbreport.getWebDownload());}
if(reportlist.contains(6)){Results.putAll(bbreport.getRecentObject());}
// if(reportlist.contains(7)){Results.putAll(bbreport.getGenInfo());}
if(reportlist.contains(8)){Results.putAll(bbreport.getInstalledProg());}
if(reportlist.contains(9)){Results.putAll(bbreport.getKeywordHit());}
if(reportlist.contains(10)){Results.putAll(bbreport.getHashHit());}
if(reportlist.contains(11)){Results.putAll(bbreport.getDevices());}
SwingUtilities.invokeLater(new Runnable() { SwingUtilities.invokeLater(new Runnable() {
@Override @Override
public void run() { public void run() {
rr.progBarCount(2*Results.size()); rr.progBarCount(2*report.Results.size());
}}); }});
//Turn our results into the appropriate xml/html reports //Turn our results into the appropriate xml/html reports
//TODO: add a way for users to select what they will run when //TODO: add a way for users to select what they will run when
@ -71,7 +69,7 @@ public class reportPanelAction {
@Override @Override
public void run() public void run()
{ {
reportXML xmlReport = new reportXML(Results, rr); reportXML xmlReport = new reportXML(report.Results, rr);
} }
}); });
Thread htmlthread = new Thread(new Runnable() Thread htmlthread = new Thread(new Runnable()
@ -79,7 +77,7 @@ public class reportPanelAction {
@Override @Override
public void run() public void run()
{ {
reportHTML htmlReport = new reportHTML(Results,rr); reportHTML htmlReport = new reportHTML(report.Results,rr);
BrowserControl.openUrl(reportHTML.htmlPath); BrowserControl.openUrl(reportHTML.htmlPath);
} }
}); });
@ -88,7 +86,7 @@ public class reportPanelAction {
@Override @Override
public void run() public void run()
{ {
reportXLS xlsReport = new reportXLS(Results,rr); reportXLS xlsReport = new reportXLS(report.Results,rr);
// //
} }
}); });
@ -110,7 +108,7 @@ public class reportPanelAction {
htmlthread.join(); htmlthread.join();
//Set the temporary label to let the user know its done and is waiting on the report //Set the temporary label to let the user know its done and is waiting on the report
rr.progBarText(); rr.progBarText();
final reportPanel panel = new reportPanel(viewReport.toString()); final reportPanel panel = new reportPanel();
panel.setjButton1ActionListener(new ActionListener() { panel.setjButton1ActionListener(new ActionListener() {
@ -120,19 +118,6 @@ public class reportPanelAction {
popUpWindow.dispose(); popUpWindow.dispose();
} }
}); });
panel.setjEditorPane1EventListener(new HyperlinkListener(){
@Override
public void hyperlinkUpdate(HyperlinkEvent hev) {
try {
if (hev.getEventType() == HyperlinkEvent.EventType.ACTIVATED)
panel.getLink(hev);
}
catch (Exception e) {
// Exceptions thrown...............
}
}
});
// add the panel to the popup window // add the panel to the popup window
popUpWindow.add(panel); popUpWindow.add(panel);

26
Report/src/org/sleuthkit/autopsy/report/reportUtils.java
View File

@ -1,6 +1,22 @@
/* /*
* To change this template, choose Tools | Templates *
* and open the template in the editor. * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
@ -20,15 +36,13 @@ static String changeExtension(String originalName, String newExtension) {
} }
public static String insertPeriodically( public static String insertPeriodically(
String text, String insert, int period) String text, String insert, int period) {
{
StringBuilder builder = new StringBuilder( StringBuilder builder = new StringBuilder(
text.length() + insert.length() * (text.length() / period) + 1); text.length() + insert.length() * (text.length() / period) + 1);
int index = 0; int index = 0;
String prefix = ""; String prefix = "";
while (index < text.length()) while (index < text.length()) {
{
// Don't put the insert in the very first iteration. // Don't put the insert in the very first iteration.
// This is easier than appending it *after* each substring // This is easier than appending it *after* each substring
builder.append(prefix); builder.append(prefix);

104
Report/src/org/sleuthkit/autopsy/report/reportXLS.java
View File

@ -1,11 +1,26 @@
/* /*
* To change this template, choose Tools | Templates *
* and open the template in the editor. * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
import java.io.FileOutputStream; import java.io.FileOutputStream;
import java.io.IOException; import java.io.IOException;
import java.text.DateFormat; import java.text.DateFormat;
import java.text.SimpleDateFormat; import java.text.SimpleDateFormat;
@ -14,26 +29,19 @@ import java.util.Date;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map.Entry; import java.util.Map.Entry;
import java.util.TreeMap; import java.util.TreeMap;
import org.apache.poi.ss.usermodel.Cell; import org.apache.poi.ss.usermodel.*;
import org.apache.poi.ss.usermodel.CellStyle;
import org.apache.poi.ss.usermodel.Font;
import org.apache.poi.ss.usermodel.Row;
import org.apache.poi.ss.usermodel.Sheet;
import org.apache.poi.ss.usermodel.Workbook;
import org.apache.poi.xssf.usermodel.XSSFWorkbook; import org.apache.poi.xssf.usermodel.XSSFWorkbook;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.*;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.FsContent;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskData;
/** /**
* *
* @author Alex * @author Alex
*/ */
public class reportXLS { public class reportXLS {
public static Workbook wb = new XSSFWorkbook(); public static Workbook wb = new XSSFWorkbook();
public reportXLS(HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> report, reportFilter rr) { public reportXLS(HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> report, reportFilter rr) {
//Empty the workbook first //Empty the workbook first
Workbook wbtemp = new XSSFWorkbook(); Workbook wbtemp = new XSSFWorkbook();
@ -50,39 +58,39 @@ public class reportXLS {
int countHash = 0; int countHash = 0;
int countDevice = 0; int countDevice = 0;
for (Entry<BlackboardArtifact, ArrayList<BlackboardAttribute>> entry : report.entrySet()) { for (Entry<BlackboardArtifact, ArrayList<BlackboardAttribute>> entry : report.entrySet()) {
if(entry.getKey().getArtifactTypeID() == 1){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
countGen++; countGen++;
} }
if(entry.getKey().getArtifactTypeID() == 2){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) {
countBookmark++; countBookmark++;
} }
if(entry.getKey().getArtifactTypeID() == 3){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) {
countCookie++; countCookie++;
} }
if(entry.getKey().getArtifactTypeID() == 4){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) {
countHistory++; countHistory++;
} }
if(entry.getKey().getArtifactTypeID() == 5){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) {
countDownload++; countDownload++;
} }
if(entry.getKey().getArtifactTypeID() == 6){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) {
countRecentObjects++; countRecentObjects++;
} }
if(entry.getKey().getArtifactTypeID() == 7){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) {
countTrackPoint++; countTrackPoint++;
} }
if(entry.getKey().getArtifactTypeID() == 8){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) {
countInstalled++; countInstalled++;
} }
if(entry.getKey().getArtifactTypeID() == 9){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
countKeyword++; countKeyword++;
} }
if(entry.getKey().getArtifactTypeID() == 10){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
countHash++; countHash++;
} }
if(entry.getKey().getArtifactTypeID() == 11){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
countDevice++; countDevice++;
} }
} }
@ -239,26 +247,20 @@ public class reportXLS {
TreeMap<Integer, String> attributes = new TreeMap<Integer, String>(); TreeMap<Integer, String> attributes = new TreeMap<Integer, String>();
// Get all the attributes, line them up to be added. Place empty string placeholders for each attribute type // Get all the attributes, line them up to be added. Place empty string placeholders for each attribute type
int n; int n;
for(n=1;n<=36;n++) for (n = 1; n <= 36; n++) {
{
attributes.put(n, ""); attributes.put(n, "");
} }
for (BlackboardAttribute tempatt : entry.getValue()) for (BlackboardAttribute tempatt : entry.getValue()) {
{
if (reportFilter.cancel == true) { if (reportFilter.cancel == true) {
break; break;
} }
String value = ""; String value = "";
int type = tempatt.getAttributeTypeID(); int type = tempatt.getAttributeTypeID();
if (tempatt.getValueString() == null || "null".equals(tempatt.getValueString())) { if (tempatt.getValueString() == null || "null".equals(tempatt.getValueString())) {
} else if (type == 2 || type == 33) {
}
else if(type == 2){
value = new java.text.SimpleDateFormat("MM/dd/yyyy HH:mm:ss").format(new java.util.Date((tempatt.getValueLong()) * 1000)); value = new java.text.SimpleDateFormat("MM/dd/yyyy HH:mm:ss").format(new java.util.Date((tempatt.getValueLong()) * 1000));
} } else {
else
{
value = tempatt.getValueString(); value = tempatt.getValueString();
} }
@ -267,19 +269,19 @@ public class reportXLS {
} }
if(entry.getKey().getArtifactTypeID() == 1){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
countedGen++; countedGen++;
// Row temp = sheetGen.getRow(countedGen); // Row temp = sheetGen.getRow(countedGen);
} }
if(entry.getKey().getArtifactTypeID() == 2){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) {
countedBookmark++; countedBookmark++;
Row temp = sheetBookmark.createRow(countedBookmark); Row temp = sheetBookmark.createRow(countedBookmark);
temp.createCell(0).setCellValue(attributes.get(1)); temp.createCell(0).setCellValue(attributes.get(1));
temp.createCell(1).setCellValue(attributes.get(3)); temp.createCell(1).setCellValue(attributes.get(3));
temp.createCell(2).setCellValue(attributes.get(4)); temp.createCell(2).setCellValue(attributes.get(4));
} }
if(entry.getKey().getArtifactTypeID() == 3){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) {
countedCookie++; countedCookie++;
Row temp = sheetCookie.createRow(countedCookie); Row temp = sheetCookie.createRow(countedCookie);
temp.createCell(0).setCellValue(attributes.get(1)); temp.createCell(0).setCellValue(attributes.get(1));
@ -288,7 +290,7 @@ public class reportXLS {
temp.createCell(3).setCellValue(attributes.get(6)); temp.createCell(3).setCellValue(attributes.get(6));
temp.createCell(4).setCellValue(attributes.get(4)); temp.createCell(4).setCellValue(attributes.get(4));
} }
if(entry.getKey().getArtifactTypeID() == 4){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) {
countedHistory++; countedHistory++;
Row temp = sheetHistory.createRow(countedHistory); Row temp = sheetHistory.createRow(countedHistory);
temp.createCell(0).setCellValue(attributes.get(1)); temp.createCell(0).setCellValue(attributes.get(1));
@ -297,7 +299,7 @@ public class reportXLS {
temp.createCell(3).setCellValue(attributes.get(3)); temp.createCell(3).setCellValue(attributes.get(3));
temp.createCell(4).setCellValue(attributes.get(4)); temp.createCell(4).setCellValue(attributes.get(4));
} }
if(entry.getKey().getArtifactTypeID() == 5){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) {
countedDownload++; countedDownload++;
Row temp = sheetDownload.createRow(countedDownload); Row temp = sheetDownload.createRow(countedDownload);
temp.createCell(0).setCellValue(attributes.get(8)); temp.createCell(0).setCellValue(attributes.get(8));
@ -305,7 +307,7 @@ public class reportXLS {
temp.createCell(2).setCellValue(attributes.get(33)); temp.createCell(2).setCellValue(attributes.get(33));
temp.createCell(3).setCellValue(attributes.get(4)); temp.createCell(3).setCellValue(attributes.get(4));
} }
if(entry.getKey().getArtifactTypeID() == 6){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) {
countedRecentObjects++; countedRecentObjects++;
Row temp = sheetRecent.createRow(countedRecentObjects); Row temp = sheetRecent.createRow(countedRecentObjects);
temp.createCell(0).setCellValue(attributes.get(3)); temp.createCell(0).setCellValue(attributes.get(3));
@ -313,16 +315,16 @@ public class reportXLS {
temp.createCell(2).setCellValue(file.getName()); temp.createCell(2).setCellValue(file.getName());
temp.createCell(3).setCellValue(attributes.get(4)); temp.createCell(3).setCellValue(attributes.get(4));
} }
if(entry.getKey().getArtifactTypeID() == 7){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) {
// sheetTrackpoint.addContent(artifact); // sheetTrackpoint.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 8){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) {
countedInstalled++; countedInstalled++;
Row temp = sheetInstalled.createRow(countedInstalled); Row temp = sheetInstalled.createRow(countedInstalled);
temp.createCell(0).setCellValue(attributes.get(4)); temp.createCell(0).setCellValue(attributes.get(4));
temp.createCell(1).setCellValue(attributes.get(2)); temp.createCell(1).setCellValue(attributes.get(2));
} }
if(entry.getKey().getArtifactTypeID() == 9){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
countedKeyword++; countedKeyword++;
Row temp = sheetKeyword.createRow(countedKeyword); Row temp = sheetKeyword.createRow(countedKeyword);
temp.createCell(0).setCellValue(attributes.get(10)); temp.createCell(0).setCellValue(attributes.get(10));
@ -330,14 +332,14 @@ public class reportXLS {
temp.createCell(2).setCellValue(attributes.get(12)); temp.createCell(2).setCellValue(attributes.get(12));
temp.createCell(3).setCellValue(attributes.get(13)); temp.createCell(3).setCellValue(attributes.get(13));
} }
if(entry.getKey().getArtifactTypeID() == 10){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
countedHash++; countedHash++;
Row temp = sheetHash.createRow(countedHash); Row temp = sheetHash.createRow(countedHash);
temp.createCell(0).setCellValue(file.getName().toString()); temp.createCell(0).setCellValue(file.getName().toString());
temp.createCell(1).setCellValue(filesize.toString()); temp.createCell(1).setCellValue(filesize.toString());
temp.createCell(2).setCellValue(attributes.get(30)); temp.createCell(2).setCellValue(attributes.get(30));
} }
if(entry.getKey().getArtifactTypeID() == 11){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
countedDevice++; countedDevice++;
Row temp = sheetDevice.createRow(countedDevice); Row temp = sheetDevice.createRow(countedDevice);
temp.createCell(0).setCellValue(attributes.get(18)); temp.createCell(0).setCellValue(attributes.get(18));
@ -357,19 +359,13 @@ public class reportXLS {
wbtemp.write(fos); wbtemp.write(fos);
fos.close(); fos.close();
wb = wbtemp; wb = wbtemp;
} } catch (IOException e) {
catch (IOException e) {
System.err.println(e); System.err.println(e);
} }
} } catch (Exception E) {
catch(Exception E)
{
String test = E.toString(); String test = E.toString();
} }
} }
} }

58
Report/src/org/sleuthkit/autopsy/report/reportXML.java
View File

@ -1,8 +1,25 @@
/* /*
* To change this template, choose Tools | Templates *
* and open the template in the editor. * Autopsy Forensic Browser
*
* Copyright 2012 42six Solutions.
* Contact: aebadirad <at> 42six <dot> com
* Project Contact/Architect: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.report; package org.sleuthkit.autopsy.report;
import java.io.FileOutputStream; import java.io.FileOutputStream;
import java.io.IOException; import java.io.IOException;
import java.text.DateFormat; import java.text.DateFormat;
@ -31,8 +48,11 @@ import org.sleuthkit.datamodel.File;
import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskData; import org.sleuthkit.datamodel.TskData;
public class reportXML { public class reportXML {
public static Document xmldoc = new Document(); public static Document xmldoc = new Document();
public reportXML(HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> report, reportFilter rr) { public reportXML(HashMap<BlackboardArtifact, ArrayList<BlackboardAttribute>> report, reportFilter rr) {
try { try {
Case currentCase = Case.getCurrentCase(); // get the most updated case Case currentCase = Case.getCurrentCase(); // get the most updated case
@ -53,8 +73,7 @@ public class reportXML {
root.addContent(comment); root.addContent(comment);
//Create summary node involving how many of each type //Create summary node involving how many of each type
Element summary = new Element("Summary"); Element summary = new Element("Summary");
if(IngestManager.getDefault().isIngestRunning()) if (IngestManager.getDefault().isIngestRunning()) {
{
summary.addContent(new Element("Warning").setText("Report was run before ingest services completed!")); summary.addContent(new Element("Warning").setText("Report was run before ingest services completed!"));
} }
summary.addContent(new Element("Name").setText(caseName)); summary.addContent(new Element("Name").setText(caseName));
@ -91,8 +110,7 @@ public class reportXML {
artifact.setAttribute("Size", filesize.toString()); artifact.setAttribute("Size", filesize.toString());
// Get all the attributes for this guy // Get all the attributes for this guy
for (BlackboardAttribute tempatt : entry.getValue()) for (BlackboardAttribute tempatt : entry.getValue()) {
{
if (reportFilter.cancel == true) { if (reportFilter.cancel == true) {
break; break;
} }
@ -107,44 +125,44 @@ public class reportXML {
cc++; cc++;
} }
if(entry.getKey().getArtifactTypeID() == 1){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
//while (entry.getValue().iterator().hasNext()) //while (entry.getValue().iterator().hasNext())
// { // {
// } // }
nodeGen.addContent(artifact); nodeGen.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 2){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()) {
nodeWebBookmark.addContent(artifact); nodeWebBookmark.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 3){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()) {
nodeWebCookie.addContent(artifact); nodeWebCookie.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 4){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()) {
nodeWebHistory.addContent(artifact); nodeWebHistory.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 5){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) {
nodeWebDownload.addContent(artifact); nodeWebDownload.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 6){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()) {
nodeRecentObjects.addContent(artifact); nodeRecentObjects.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 7){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_TRACKPOINT.getTypeID()) {
nodeTrackPoint.addContent(artifact); nodeTrackPoint.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 8){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()) {
nodeInstalled.addContent(artifact); nodeInstalled.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 9){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
nodeKeyword.addContent(artifact); nodeKeyword.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 10){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
nodeHash.addContent(artifact); nodeHash.addContent(artifact);
} }
if(entry.getKey().getArtifactTypeID() == 11){ if (entry.getKey().getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
nodeDevice.addContent(artifact); nodeDevice.addContent(artifact);
} }
cc++; cc++;
@ -171,13 +189,11 @@ public class reportXML {
serializer.output(xmldoc, out); serializer.output(xmldoc, out);
out.flush(); out.flush();
out.close(); out.close();
} } catch (IOException e) {
catch (IOException e) {
System.err.println(e); System.err.println(e);
} }
} } catch (Exception e) {
catch (Exception e){
Logger.getLogger(reportXML.class.getName()).log(Level.WARNING, "Exception occurred", e); Logger.getLogger(reportXML.class.getName()).log(Level.WARNING, "Exception occurred", e);
} }
} }