mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
Did additional new ingest framework effort
This commit is contained in:
parent
7ad2b5b5ae
commit
17a9ab103f
@ -49,9 +49,10 @@ import org.sleuthkit.datamodel.TskCoreException;
|
|||||||
* IngestModuleAdapter abstract class could have been used as a base class to
|
* IngestModuleAdapter abstract class could have been used as a base class to
|
||||||
* obtain default implementations of many of the DataSourceIngestModule methods.
|
* obtain default implementations of many of the DataSourceIngestModule methods.
|
||||||
*/
|
*/
|
||||||
// RJCTODO: Add service provider annotation (commend out)
|
// RJCTODO: Add factory with service provider annotation (commend out)
|
||||||
// RJCTODO: Remove inheritance from IngestModuleAdapter and provide better documentation,
|
// RJCTODO: Remove inheritance from IngestModuleAdapter to show full implementation
|
||||||
// and more extensive demonstration of how to use various ingest services.
|
// and provide better documentation, and more extensive demonstration of how to
|
||||||
|
// use various ingest services.
|
||||||
class SampleDataSourceIngestModule extends IngestModuleAdapter implements DataSourceIngestModule {
|
class SampleDataSourceIngestModule extends IngestModuleAdapter implements DataSourceIngestModule {
|
||||||
|
|
||||||
private static final Logger logger = Logger.getLogger(SampleDataSourceIngestModule.class);
|
private static final Logger logger = Logger.getLogger(SampleDataSourceIngestModule.class);
|
||||||
|
@ -54,9 +54,10 @@ import org.sleuthkit.datamodel.TskData;
|
|||||||
* org.sleuthkit.autopsy.examples package. Either change the package or the
|
* org.sleuthkit.autopsy.examples package. Either change the package or the
|
||||||
* loading code to make this module actually run.
|
* loading code to make this module actually run.
|
||||||
*/
|
*/
|
||||||
// RJCTODO: Add service provider annotation (commend out)
|
// RJCTODO: Add factory with service provider annotation (commend out)
|
||||||
// RJCTODO: Remove inheritance from IngestModuleAdapter and provide better documentation,
|
// RJCTODO: Remove inheritance from IngestModuleAdapter to show full implementation
|
||||||
// and more extensive demonstration of how to use various ingest services.
|
// and provide better documentation, and more extensive demonstration of how to
|
||||||
|
// use various ingest services.
|
||||||
class SampleFileIngestModule extends IngestModuleAdapter implements FileIngestModule {
|
class SampleFileIngestModule extends IngestModuleAdapter implements FileIngestModule {
|
||||||
|
|
||||||
private int attrId = -1;
|
private int attrId = -1;
|
||||||
@ -117,7 +118,7 @@ class SampleFileIngestModule extends IngestModuleAdapter implements FileIngestMo
|
|||||||
|
|
||||||
if (attrId != -1) {
|
if (attrId != -1) {
|
||||||
// Make an attribute using the ID for the private type that we previously created.
|
// Make an attribute using the ID for the private type that we previously created.
|
||||||
BlackboardAttribute attr = new BlackboardAttribute(attrId, "SampleFileIngestModule", count); // RJCTODO: Set up with module name as example
|
BlackboardAttribute attr = new BlackboardAttribute(attrId, "SampleFileIngestModule", count); // RJCTODO: Set up factory with static module name function as example
|
||||||
|
|
||||||
/* add it to the general info artifact. In real modules, you would likely have
|
/* add it to the general info artifact. In real modules, you would likely have
|
||||||
* more complex data types and be making more specific artifacts.
|
* more complex data types and be making more specific artifacts.
|
||||||
|
@ -39,7 +39,7 @@ public final class IngestJobContext {
|
|||||||
|
|
||||||
public void addFilesToPipeline(List<AbstractFile> files) {
|
public void addFilesToPipeline(List<AbstractFile> files) {
|
||||||
for (AbstractFile file : files) {
|
for (AbstractFile file : files) {
|
||||||
IngestManager.getDefault().scheduleFile(ingestJob.getId(), file); // RJCTODO: Should this API be just AbstractFile?
|
IngestManager.getDefault().scheduleFile(ingestJob.getId(), file);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -200,7 +200,7 @@ public final class IngestJobLauncher {
|
|||||||
if (!modulesSetting.isEmpty()) {
|
if (!modulesSetting.isEmpty()) {
|
||||||
String[] settingNames = modulesSetting.split(", ");
|
String[] settingNames = modulesSetting.split(", ");
|
||||||
for (String name : settingNames) {
|
for (String name : settingNames) {
|
||||||
// Map some old core module names to the current core module names. // RJCTODO: Do we have the right names?
|
// Map some old core module names to the current core module names.
|
||||||
switch (name) {
|
switch (name) {
|
||||||
case "Thunderbird Parser":
|
case "Thunderbird Parser":
|
||||||
case "MBox Parser":
|
case "MBox Parser":
|
||||||
@ -210,7 +210,7 @@ public final class IngestJobLauncher {
|
|||||||
moduleNames.add("Extension Mismatch Detector");
|
moduleNames.add("Extension Mismatch Detector");
|
||||||
break;
|
break;
|
||||||
case "EWF Verify":
|
case "EWF Verify":
|
||||||
moduleNames.add("EWF Verifier");
|
moduleNames.add("E01 Verifier");
|
||||||
break;
|
break;
|
||||||
default:
|
default:
|
||||||
moduleNames.add(name);
|
moduleNames.add(name);
|
||||||
|
@ -35,9 +35,6 @@ import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
|
|||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
import org.sleuthkit.datamodel.Content;
|
import org.sleuthkit.datamodel.Content;
|
||||||
|
|
||||||
// RJCTODO: Fix comment
|
|
||||||
// RJCTODO: It woulod be really nice to move such a powerful class behind a
|
|
||||||
// facade. This is a good argument for IngestServices as the facade.
|
|
||||||
/**
|
/**
|
||||||
* IngestManager sets up and manages ingest modules runs them in a background
|
* IngestManager sets up and manages ingest modules runs them in a background
|
||||||
* thread notifies modules when work is complete or should be interrupted
|
* thread notifies modules when work is complete or should be interrupted
|
||||||
@ -63,7 +60,6 @@ public class IngestManager {
|
|||||||
"IngestManager.moduleProperties.text");
|
"IngestManager.moduleProperties.text");
|
||||||
private volatile IngestUI ingestMessageBox;
|
private volatile IngestUI ingestMessageBox;
|
||||||
|
|
||||||
// RJCTODO: Redo eventing for 3.1
|
|
||||||
/**
|
/**
|
||||||
* Possible events about ingest modules Event listeners can get the event
|
* Possible events about ingest modules Event listeners can get the event
|
||||||
* name by using String returned by toString() method on the specific event.
|
* name by using String returned by toString() method on the specific event.
|
||||||
@ -276,10 +272,13 @@ public class IngestManager {
|
|||||||
void scheduleFile(long ingestJobId, AbstractFile file) {
|
void scheduleFile(long ingestJobId, AbstractFile file) {
|
||||||
IngestJob job = this.ingestJobs.get(ingestJobId);
|
IngestJob job = this.ingestJobs.get(ingestJobId);
|
||||||
if (job == null) {
|
if (job == null) {
|
||||||
// RJCTODO: Handle severe error
|
logger.log(Level.SEVERE, "Unable to map ingest job id (id = {0}) to an ingest job, failed to schedule file (id = {1})", new Object[]{ingestJobId, file.getId()});
|
||||||
|
MessageNotifyUtil.Notify.show(NbBundle.getMessage(IngestManager.class, "IngestManager.moduleErr"),
|
||||||
|
"Unable to associate " + file.getName() + " with ingest job, file will not be processed by ingest nodules",
|
||||||
|
MessageNotifyUtil.MessageType.ERROR);
|
||||||
}
|
}
|
||||||
|
|
||||||
scheduler.getFileScheduler().scheduleIngestOfDerivedFile(job, file);
|
scheduler.getFileScheduler().scheduleFile(job, file);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -328,7 +327,6 @@ public class IngestManager {
|
|||||||
taskSchedulingWorker.cancel(true);
|
taskSchedulingWorker.cancel(true);
|
||||||
while (!taskSchedulingWorker.isDone()) {
|
while (!taskSchedulingWorker.isDone()) {
|
||||||
// Wait.
|
// Wait.
|
||||||
// RJCTODO: Add sleep?
|
|
||||||
}
|
}
|
||||||
taskSchedulingWorker = null;
|
taskSchedulingWorker = null;
|
||||||
}
|
}
|
||||||
@ -437,9 +435,18 @@ public class IngestManager {
|
|||||||
|
|
||||||
List<IngestModuleError> errors = ingestJob.startUpIngestPipelines();
|
List<IngestModuleError> errors = ingestJob.startUpIngestPipelines();
|
||||||
if (!errors.isEmpty()) {
|
if (!errors.isEmpty()) {
|
||||||
// RJCTODO: Log all errors, not just the first one. Provide a list of all of the modules that failed.
|
StringBuilder failedModules = new StringBuilder();
|
||||||
|
for (int i = 0; i < errors.size(); ++i) {
|
||||||
|
IngestModuleError error = errors.get(i);
|
||||||
|
String moduleName = error.getModuleDisplayName();
|
||||||
|
logger.log(Level.SEVERE, "The " + moduleName + " module failed to start up", error.getModuleError());
|
||||||
|
failedModules.append(moduleName);
|
||||||
|
if ((errors.size() > 1) && (i != (errors.size() - 1))) {
|
||||||
|
failedModules.append(",");
|
||||||
|
}
|
||||||
|
}
|
||||||
MessageNotifyUtil.Message.error(
|
MessageNotifyUtil.Message.error(
|
||||||
"Failed to load " + errors.get(0).getModuleDisplayName() + " ingest module.\n\n"
|
"Failed to start the following ingest modules: " + failedModules.toString() + " .\n\n"
|
||||||
+ "No ingest modules will be run. Please disable the module "
|
+ "No ingest modules will be run. Please disable the module "
|
||||||
+ "or fix the error and restart ingest by right clicking on "
|
+ "or fix the error and restart ingest by right clicking on "
|
||||||
+ "the data source and selecting Run Ingest Modules.\n\n"
|
+ "the data source and selecting Run Ingest Modules.\n\n"
|
||||||
@ -472,7 +479,7 @@ public class IngestManager {
|
|||||||
// IngestManager.stopAll() will dispose of all tasks.
|
// IngestManager.stopAll() will dispose of all tasks.
|
||||||
} catch (Exception ex) {
|
} catch (Exception ex) {
|
||||||
logger.log(Level.SEVERE, "Error while scheduling ingest jobs", ex);
|
logger.log(Level.SEVERE, "Error while scheduling ingest jobs", ex);
|
||||||
// RJCTODO: On EDT, report error, cannot dump all tasks since multiple data source tasks can be submitted. Would get partial results either way.
|
MessageNotifyUtil.Message.error("An error occurred while starting ingest. Results may only be partial");
|
||||||
} finally {
|
} finally {
|
||||||
if (!isCancelled()) {
|
if (!isCancelled()) {
|
||||||
startAll();
|
startAll();
|
||||||
@ -603,7 +610,7 @@ public class IngestManager {
|
|||||||
IngestScheduler.FileScheduler.FileTask task = fileScheduler.next();
|
IngestScheduler.FileScheduler.FileTask task = fileScheduler.next();
|
||||||
AbstractFile file = task.getFile();
|
AbstractFile file = task.getFile();
|
||||||
progress.progress(file.getName(), processedFiles);
|
progress.progress(file.getName(), processedFiles);
|
||||||
IngestJob.FileIngestPipeline pipeline = task.getParent().getFileIngestPipelineForThread(this.id);
|
IngestJob.FileIngestPipeline pipeline = task.getJob().getFileIngestPipelineForThread(this.id);
|
||||||
pipeline.process(file);
|
pipeline.process(file);
|
||||||
|
|
||||||
// Update the progress bar.
|
// Update the progress bar.
|
||||||
@ -625,7 +632,6 @@ public class IngestManager {
|
|||||||
|
|
||||||
@Override
|
@Override
|
||||||
protected void done() {
|
protected void done() {
|
||||||
// RJCTODO: Why was GC done here in the old code?
|
|
||||||
try {
|
try {
|
||||||
super.get();
|
super.get();
|
||||||
} catch (CancellationException | InterruptedException e) {
|
} catch (CancellationException | InterruptedException e) {
|
||||||
|
@ -210,7 +210,7 @@ import org.sleuthkit.datamodel.Content;
|
|||||||
|
|
||||||
private void registerListeners() {
|
private void registerListeners() {
|
||||||
//handle case change
|
//handle case change
|
||||||
Case.addPropertyChangeListener(new PropertyChangeListener() { // RJCTODO: Why is this here?
|
Case.addPropertyChangeListener(new PropertyChangeListener() {
|
||||||
@Override
|
@Override
|
||||||
public void propertyChange(PropertyChangeEvent evt) {
|
public void propertyChange(PropertyChangeEvent evt) {
|
||||||
if (evt.getPropertyName().equals(Case.Events.CURRENT_CASE.toString())) {
|
if (evt.getPropertyName().equals(Case.Events.CURRENT_CASE.toString())) {
|
||||||
|
@ -46,7 +46,7 @@ final class IngestModuleLoader {
|
|||||||
|
|
||||||
synchronized List<IngestModuleFactory> getIngestModuleFactories() {
|
synchronized List<IngestModuleFactory> getIngestModuleFactories() {
|
||||||
moduleFactories.clear();
|
moduleFactories.clear();
|
||||||
// RJCTODO: Need a name uniqueness test/solution?
|
// RJCTODO: Need a name uniqueness test/solution, here or in the launcher.
|
||||||
Collection<? extends IngestModuleFactory> factories = Lookup.getDefault().lookupAll(IngestModuleFactory.class);
|
Collection<? extends IngestModuleFactory> factories = Lookup.getDefault().lookupAll(IngestModuleFactory.class);
|
||||||
for (IngestModuleFactory factory : factories) {
|
for (IngestModuleFactory factory : factories) {
|
||||||
logger.log(Level.INFO, "Found ingest module factory: name = {0}, version = {1}", new Object[]{factory.getModuleDisplayName(), factory.getModuleVersionNumber()});
|
logger.log(Level.INFO, "Found ingest module factory: name = {0}, version = {1}", new Object[]{factory.getModuleDisplayName(), factory.getModuleVersionNumber()});
|
||||||
|
@ -162,11 +162,11 @@ final class IngestScheduler {
|
|||||||
try {
|
try {
|
||||||
children = root.getChildren();
|
children = root.getChildren();
|
||||||
if (children.isEmpty()) {
|
if (children.isEmpty()) {
|
||||||
//add the root itself, could be unalloc file, child of volume or image // RJCTODO: Get explanation, improve comment
|
//add the root itself, could be unalloc file, child of volume or image
|
||||||
firstLevelFiles.add(root);
|
firstLevelFiles.add(root);
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
//root for fs root dir, schedule children dirs/files // RJCTODO: Get explanation, improve comment
|
//root for fs root dir, schedule children dirs/files
|
||||||
for (Content child : children) {
|
for (Content child : children) {
|
||||||
if (child instanceof AbstractFile) {
|
if (child instanceof AbstractFile) {
|
||||||
firstLevelFiles.add((AbstractFile) child);
|
firstLevelFiles.add((AbstractFile) child);
|
||||||
@ -206,7 +206,7 @@ final class IngestScheduler {
|
|||||||
* @param originalContext original content schedule context that was used
|
* @param originalContext original content schedule context that was used
|
||||||
* to schedule the parent origin content, with the modules, settings, etc.
|
* to schedule the parent origin content, with the modules, settings, etc.
|
||||||
*/
|
*/
|
||||||
synchronized void scheduleIngestOfDerivedFile(IngestJob ingestJob, AbstractFile file) {
|
synchronized void scheduleFile(IngestJob ingestJob, AbstractFile file) {
|
||||||
FileTask fileTask = new FileTask(file, ingestJob);
|
FileTask fileTask = new FileTask(file, ingestJob);
|
||||||
if (shouldEnqueueTask(fileTask)) {
|
if (shouldEnqueueTask(fileTask)) {
|
||||||
fileTasks.addFirst(fileTask);
|
fileTasks.addFirst(fileTask);
|
||||||
@ -328,7 +328,7 @@ final class IngestScheduler {
|
|||||||
for (Content c : children) {
|
for (Content c : children) {
|
||||||
if (c instanceof AbstractFile) {
|
if (c instanceof AbstractFile) {
|
||||||
AbstractFile childFile = (AbstractFile) c;
|
AbstractFile childFile = (AbstractFile) c;
|
||||||
FileTask childTask = new FileTask(childFile, parentTask.getParent());
|
FileTask childTask = new FileTask(childFile, parentTask.getJob());
|
||||||
|
|
||||||
if (childFile.hasChildren()) {
|
if (childFile.hasChildren()) {
|
||||||
this.directoryTasks.add(childTask);
|
this.directoryTasks.add(childTask);
|
||||||
@ -363,13 +363,13 @@ final class IngestScheduler {
|
|||||||
final Set<Content> contentSet = new HashSet<>();
|
final Set<Content> contentSet = new HashSet<>();
|
||||||
|
|
||||||
for (FileTask task : rootDirectoryTasks) {
|
for (FileTask task : rootDirectoryTasks) {
|
||||||
contentSet.add(task.getParent().getDataSource());
|
contentSet.add(task.getJob().getDataSource());
|
||||||
}
|
}
|
||||||
for (FileTask task : directoryTasks) {
|
for (FileTask task : directoryTasks) {
|
||||||
contentSet.add(task.getParent().getDataSource());
|
contentSet.add(task.getJob().getDataSource());
|
||||||
}
|
}
|
||||||
for (FileTask task : fileTasks) {
|
for (FileTask task : fileTasks) {
|
||||||
contentSet.add(task.getParent().getDataSource());
|
contentSet.add(task.getJob().getDataSource());
|
||||||
}
|
}
|
||||||
|
|
||||||
return new ArrayList<>(contentSet);
|
return new ArrayList<>(contentSet);
|
||||||
@ -392,7 +392,7 @@ final class IngestScheduler {
|
|||||||
final AbstractFile aFile = processTask.file;
|
final AbstractFile aFile = processTask.file;
|
||||||
|
|
||||||
//if it's unalloc file, skip if so scheduled
|
//if it's unalloc file, skip if so scheduled
|
||||||
if (processTask.getParent().shouldProcessUnallocatedSpace() == false
|
if (processTask.getJob().shouldProcessUnallocatedSpace() == false
|
||||||
&& aFile.getType().equals(TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS //unalloc files
|
&& aFile.getType().equals(TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS //unalloc files
|
||||||
)) {
|
)) {
|
||||||
return false;
|
return false;
|
||||||
@ -459,7 +459,7 @@ final class IngestScheduler {
|
|||||||
this.task = task;
|
this.task = task;
|
||||||
}
|
}
|
||||||
|
|
||||||
public IngestJob getParent() { // RJCTODO: Provide wrappers to get rid of train-style calls
|
public IngestJob getJob() {
|
||||||
return task;
|
return task;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -499,8 +499,8 @@ final class IngestScheduler {
|
|||||||
if (this.file != other.file && (this.file == null || !this.file.equals(other.file))) {
|
if (this.file != other.file && (this.file == null || !this.file.equals(other.file))) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
IngestJob thisTask = this.getParent();
|
IngestJob thisTask = this.getJob();
|
||||||
IngestJob otherTask = other.getParent();
|
IngestJob otherTask = other.getJob();
|
||||||
|
|
||||||
if (thisTask != otherTask
|
if (thisTask != otherTask
|
||||||
&& (thisTask == null || !thisTask.equals(otherTask))) {
|
&& (thisTask == null || !thisTask.equals(otherTask))) {
|
||||||
|
@ -18,9 +18,11 @@
|
|||||||
*/
|
*/
|
||||||
package org.sleuthkit.autopsy.ingest;
|
package org.sleuthkit.autopsy.ingest;
|
||||||
|
|
||||||
|
import java.util.Map;
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
import org.sleuthkit.autopsy.casemodule.Case;
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
|
import org.sleuthkit.autopsy.coreutils.ModuleSettings;
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
import org.sleuthkit.datamodel.SleuthkitCase;
|
import org.sleuthkit.datamodel.SleuthkitCase;
|
||||||
|
|
||||||
@ -123,20 +125,6 @@ public final class IngestServices {
|
|||||||
IngestManager.fireModuleContentEvent(moduleContentEvent);
|
IngestManager.fireModuleContentEvent(moduleContentEvent);
|
||||||
}
|
}
|
||||||
|
|
||||||
// RJCTODO: This can stay in the context since it is context (pipeline) specific
|
|
||||||
/**
|
|
||||||
* Schedule a new file for ingest with the same settings as the file being
|
|
||||||
* analyzed. This is used, for example, when opening an archive file. File
|
|
||||||
* needs to have already been added to the database.
|
|
||||||
*
|
|
||||||
* @param file file to be scheduled
|
|
||||||
* @param pipelineContext the ingest context for the file ingest pipeline
|
|
||||||
*/
|
|
||||||
public void scheduleFile(long dataSourceTaskId, AbstractFile file) {
|
|
||||||
logger.log(Level.INFO, "Scheduling file: {0}", file.getName());
|
|
||||||
manager.scheduleFile(dataSourceTaskId, file);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Get free disk space of a drive where ingest data are written to That
|
* Get free disk space of a drive where ingest data are written to That
|
||||||
* drive is being monitored by IngestMonitor thread when ingest is running.
|
* drive is being monitored by IngestMonitor thread when ingest is running.
|
||||||
@ -147,5 +135,42 @@ public final class IngestServices {
|
|||||||
return manager.getFreeDiskSpace();
|
return manager.getFreeDiskSpace();
|
||||||
}
|
}
|
||||||
|
|
||||||
// RJCTODO: Add properties methods back into IngestServices
|
/**
|
||||||
|
* Gets a specific name/value configuration setting for a module
|
||||||
|
* @param moduleName moduleName identifier unique to that module
|
||||||
|
* @param settingName setting name to retrieve
|
||||||
|
* @return setting value for the module / setting name, or null if not found
|
||||||
|
*/
|
||||||
|
public String getConfigSetting(String moduleName, String settingName) {
|
||||||
|
return ModuleSettings.getConfigSetting(moduleName, settingName);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets a specific name/value configuration setting for a module
|
||||||
|
* @param moduleName moduleName identifier unique to that module
|
||||||
|
* @param settingName setting name to set
|
||||||
|
* @param settingVal setting value to set
|
||||||
|
*/
|
||||||
|
public void setConfigSetting(String moduleName, String settingName, String settingVal) {
|
||||||
|
ModuleSettings.setConfigSetting(moduleName, settingName, settingVal);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Gets all name/value configuration settings for a module
|
||||||
|
* @param moduleName moduleName identifier unique to that module
|
||||||
|
* @return settings for the module / setting name
|
||||||
|
*/
|
||||||
|
public Map<String,String> getConfigSettings(String moduleName) {
|
||||||
|
return ModuleSettings.getConfigSettings(moduleName);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets all name/value configuration setting for a module. Names not in the list will have settings preserved.
|
||||||
|
* @param moduleName moduleName identifier unique to that module
|
||||||
|
* @param settings settings to set and replace old settings, keeping settings not specified in the map.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
public void setConfigSettings(String moduleName, Map<String,String>settings) {
|
||||||
|
ModuleSettings.setConfigSettings(moduleName, settings);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@ -21,7 +21,6 @@ package org.sleuthkit.autopsy.ingest;
|
|||||||
|
|
||||||
import org.sleuthkit.datamodel.Content;
|
import org.sleuthkit.datamodel.Content;
|
||||||
|
|
||||||
// RJCTODO: This is not needed, KISS
|
|
||||||
/**
|
/**
|
||||||
* UI support for ingest
|
* UI support for ingest
|
||||||
*/
|
*/
|
||||||
|
@ -23,7 +23,6 @@ import org.sleuthkit.autopsy.coreutils.Logger;
|
|||||||
import org.openide.modules.ModuleInstall;
|
import org.openide.modules.ModuleInstall;
|
||||||
import org.openide.windows.WindowManager;
|
import org.openide.windows.WindowManager;
|
||||||
|
|
||||||
// RJCTODO: Does this really need to be public
|
|
||||||
/**
|
/**
|
||||||
* Initializes ingest manager when the module is loaded
|
* Initializes ingest manager when the module is loaded
|
||||||
*/
|
*/
|
||||||
|
@ -21,7 +21,6 @@ package org.sleuthkit.autopsy.ingest;
|
|||||||
import javax.swing.event.ChangeEvent;
|
import javax.swing.event.ChangeEvent;
|
||||||
import org.sleuthkit.datamodel.Content;
|
import org.sleuthkit.datamodel.Content;
|
||||||
|
|
||||||
// RJCTODO: Rename
|
|
||||||
/**
|
/**
|
||||||
* Event data that are fired off by ingest modules when they changed or added new content.
|
* Event data that are fired off by ingest modules when they changed or added new content.
|
||||||
*/
|
*/
|
||||||
|
@ -38,7 +38,6 @@ import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
|
|||||||
*
|
*
|
||||||
* By design, only a single type of artifacts can be contained in a single data event.
|
* By design, only a single type of artifacts can be contained in a single data event.
|
||||||
*/
|
*/
|
||||||
// RJCTODO: Rename
|
|
||||||
public class ModuleDataEvent extends ChangeEvent {
|
public class ModuleDataEvent extends ChangeEvent {
|
||||||
|
|
||||||
private String moduleName;
|
private String moduleName;
|
||||||
|
@ -43,7 +43,7 @@ public class FileTypeIdIngestModule extends IngestModuleAdapter implements FileI
|
|||||||
|
|
||||||
private static final Logger logger = Logger.getLogger(FileTypeIdIngestModule.class.getName());
|
private static final Logger logger = Logger.getLogger(FileTypeIdIngestModule.class.getName());
|
||||||
private static final long MIN_FILE_SIZE = 512;
|
private static final long MIN_FILE_SIZE = 512;
|
||||||
private final FileTypeIdentifierModuleSettings settings;
|
private final FileTypeIdModuleSettings settings;
|
||||||
private long matchTime = 0;
|
private long matchTime = 0;
|
||||||
private int messageId = 0; // RJCTODO: If this is not made a thread safe static, duplicate message ids will be used
|
private int messageId = 0; // RJCTODO: If this is not made a thread safe static, duplicate message ids will be used
|
||||||
private long numFiles = 0;
|
private long numFiles = 0;
|
||||||
@ -52,7 +52,7 @@ public class FileTypeIdIngestModule extends IngestModuleAdapter implements FileI
|
|||||||
// actually have a list of detectors which are called in order until a match is found.
|
// actually have a list of detectors which are called in order until a match is found.
|
||||||
private FileTypeDetectionInterface detector = new TikaFileTypeDetector();
|
private FileTypeDetectionInterface detector = new TikaFileTypeDetector();
|
||||||
|
|
||||||
FileTypeIdIngestModule(FileTypeIdentifierModuleSettings settings) {
|
FileTypeIdIngestModule(FileTypeIdModuleSettings settings) {
|
||||||
this.settings = settings;
|
this.settings = settings;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -82,7 +82,7 @@ public class FileTypeIdIngestModule extends IngestModuleAdapter implements FileI
|
|||||||
if (!fileId.type.isEmpty()) {
|
if (!fileId.type.isEmpty()) {
|
||||||
// add artifact
|
// add artifact
|
||||||
BlackboardArtifact bart = abstractFile.getGenInfoArtifact();
|
BlackboardArtifact bart = abstractFile.getGenInfoArtifact();
|
||||||
BlackboardAttribute batt = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID(), FileTypeIdentifierModuleFactory.getModuleName(), fileId.type);
|
BlackboardAttribute batt = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileId.type);
|
||||||
bart.addAttribute(batt);
|
bart.addAttribute(batt);
|
||||||
|
|
||||||
// we don't fire the event because we just updated TSK_GEN_INFO, which isn't displayed in the tree and is vague.
|
// we don't fire the event because we just updated TSK_GEN_INFO, which isn't displayed in the tree and is vague.
|
||||||
@ -101,7 +101,7 @@ public class FileTypeIdIngestModule extends IngestModuleAdapter implements FileI
|
|||||||
public void shutDown(boolean ingestJobCancelled) {
|
public void shutDown(boolean ingestJobCancelled) {
|
||||||
StringBuilder detailsSb = new StringBuilder();
|
StringBuilder detailsSb = new StringBuilder();
|
||||||
detailsSb.append("<table border='0' cellpadding='4' width='280'>");
|
detailsSb.append("<table border='0' cellpadding='4' width='280'>");
|
||||||
detailsSb.append("<tr><td>").append(FileTypeIdentifierModuleFactory.getModuleName()).append("</td></tr>");
|
detailsSb.append("<tr><td>").append(FileTypeIdModuleFactory.getModuleName()).append("</td></tr>");
|
||||||
detailsSb.append("<tr><td>")
|
detailsSb.append("<tr><td>")
|
||||||
.append(NbBundle.getMessage(this.getClass(), "FileTypeIdIngestModule.complete.totalProcTime"))
|
.append(NbBundle.getMessage(this.getClass(), "FileTypeIdIngestModule.complete.totalProcTime"))
|
||||||
.append("</td><td>").append(matchTime).append("</td></tr>\n");
|
.append("</td><td>").append(matchTime).append("</td></tr>\n");
|
||||||
@ -109,7 +109,7 @@ public class FileTypeIdIngestModule extends IngestModuleAdapter implements FileI
|
|||||||
.append(NbBundle.getMessage(this.getClass(), "FileTypeIdIngestModule.complete.totalFiles"))
|
.append(NbBundle.getMessage(this.getClass(), "FileTypeIdIngestModule.complete.totalFiles"))
|
||||||
.append("</td><td>").append(numFiles).append("</td></tr>\n");
|
.append("</td><td>").append(numFiles).append("</td></tr>\n");
|
||||||
detailsSb.append("</table>");
|
detailsSb.append("</table>");
|
||||||
IngestServices.getDefault().postMessage(IngestMessage.createMessage(++messageId, IngestMessage.MessageType.INFO, FileTypeIdentifierModuleFactory.getModuleName(),
|
IngestServices.getDefault().postMessage(IngestMessage.createMessage(++messageId, IngestMessage.MessageType.INFO, FileTypeIdModuleFactory.getModuleName(),
|
||||||
NbBundle.getMessage(this.getClass(),
|
NbBundle.getMessage(this.getClass(),
|
||||||
"FileTypeIdIngestModule.complete.srvMsg.text"),
|
"FileTypeIdIngestModule.complete.srvMsg.text"),
|
||||||
detailsSb.toString()));
|
detailsSb.toString()));
|
||||||
|
@ -32,7 +32,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleSettingsPanel;
|
|||||||
* files.
|
* files.
|
||||||
*/
|
*/
|
||||||
@ServiceProvider(service = IngestModuleFactory.class)
|
@ServiceProvider(service = IngestModuleFactory.class)
|
||||||
public class FileTypeIdentifierModuleFactory extends IngestModuleFactoryAdapter {
|
public class FileTypeIdModuleFactory extends IngestModuleFactoryAdapter {
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public String getModuleDisplayName() {
|
public String getModuleDisplayName() {
|
||||||
@ -57,7 +57,7 @@ public class FileTypeIdentifierModuleFactory extends IngestModuleFactoryAdapter
|
|||||||
|
|
||||||
@Override
|
@Override
|
||||||
public IngestModuleSettings getDefaultModuleSettings() {
|
public IngestModuleSettings getDefaultModuleSettings() {
|
||||||
return new FileTypeIdentifierModuleSettings();
|
return new FileTypeIdModuleSettings();
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
@ -67,11 +67,11 @@ public class FileTypeIdentifierModuleFactory extends IngestModuleFactoryAdapter
|
|||||||
|
|
||||||
@Override
|
@Override
|
||||||
public IngestModuleSettingsPanel getModuleSettingsPanel(IngestModuleSettings settings) {
|
public IngestModuleSettingsPanel getModuleSettingsPanel(IngestModuleSettings settings) {
|
||||||
assert settings instanceof FileTypeIdentifierModuleSettings;
|
assert settings instanceof FileTypeIdModuleSettings;
|
||||||
if (!(settings instanceof FileTypeIdentifierModuleSettings)) {
|
if (!(settings instanceof FileTypeIdModuleSettings)) {
|
||||||
throw new IllegalArgumentException("Expected settings argument to be instanceof FileTypeIdentifierModuleSettings");
|
throw new IllegalArgumentException("Expected settings argument to be instanceof FileTypeIdModuleSettings");
|
||||||
}
|
}
|
||||||
return new FileTypeIdentifierModuleSettingsPanel((FileTypeIdentifierModuleSettings) settings);
|
return new FileTypeIdModuleSettingsPanel((FileTypeIdModuleSettings) settings);
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
@ -81,10 +81,10 @@ public class FileTypeIdentifierModuleFactory extends IngestModuleFactoryAdapter
|
|||||||
|
|
||||||
@Override
|
@Override
|
||||||
public FileIngestModule createFileIngestModule(IngestModuleSettings settings) {
|
public FileIngestModule createFileIngestModule(IngestModuleSettings settings) {
|
||||||
assert settings instanceof FileTypeIdentifierModuleSettings;
|
assert settings instanceof FileTypeIdModuleSettings;
|
||||||
if (!(settings instanceof FileTypeIdentifierModuleSettings)) {
|
if (!(settings instanceof FileTypeIdModuleSettings)) {
|
||||||
throw new IllegalArgumentException("Expected settings argument to be instanceof FileTypeIdentifierModuleSettings");
|
throw new IllegalArgumentException("Expected settings argument to be instanceof FileTypeIdModuleSettings");
|
||||||
}
|
}
|
||||||
return new FileTypeIdIngestModule((FileTypeIdentifierModuleSettings) settings);
|
return new FileTypeIdIngestModule((FileTypeIdModuleSettings) settings);
|
||||||
}
|
}
|
||||||
}
|
}
|
@ -23,14 +23,14 @@ import org.sleuthkit.autopsy.ingest.IngestModuleSettings;
|
|||||||
/**
|
/**
|
||||||
* Ingest job options for the file type identifier ingest module instances.
|
* Ingest job options for the file type identifier ingest module instances.
|
||||||
*/
|
*/
|
||||||
public class FileTypeIdentifierModuleSettings implements IngestModuleSettings {
|
public class FileTypeIdModuleSettings implements IngestModuleSettings {
|
||||||
|
|
||||||
private boolean skipKnownFiles = true;
|
private boolean skipKnownFiles = true;
|
||||||
|
|
||||||
FileTypeIdentifierModuleSettings() {
|
FileTypeIdModuleSettings() {
|
||||||
}
|
}
|
||||||
|
|
||||||
FileTypeIdentifierModuleSettings(boolean skipKnownFiles) {
|
FileTypeIdModuleSettings(boolean skipKnownFiles) {
|
||||||
this.skipKnownFiles = skipKnownFiles;
|
this.skipKnownFiles = skipKnownFiles;
|
||||||
}
|
}
|
||||||
|
|
@ -25,11 +25,11 @@ import org.sleuthkit.autopsy.ingest.IngestModuleSettingsPanel;
|
|||||||
* UI component used to set ingest job options for file type identifier ingest
|
* UI component used to set ingest job options for file type identifier ingest
|
||||||
* modules.
|
* modules.
|
||||||
*/
|
*/
|
||||||
final class FileTypeIdentifierModuleSettingsPanel extends IngestModuleSettingsPanel {
|
final class FileTypeIdModuleSettingsPanel extends IngestModuleSettingsPanel {
|
||||||
|
|
||||||
private final FileTypeIdentifierModuleSettings settings;
|
private final FileTypeIdModuleSettings settings;
|
||||||
|
|
||||||
public FileTypeIdentifierModuleSettingsPanel(FileTypeIdentifierModuleSettings settings) {
|
public FileTypeIdModuleSettingsPanel(FileTypeIdModuleSettings settings) {
|
||||||
this.settings = settings;
|
this.settings = settings;
|
||||||
initComponents();
|
initComponents();
|
||||||
customizeComponents();
|
customizeComponents();
|
||||||
@ -56,8 +56,8 @@ final class FileTypeIdentifierModuleSettingsPanel extends IngestModuleSettingsPa
|
|||||||
skipKnownCheckBox = new javax.swing.JCheckBox();
|
skipKnownCheckBox = new javax.swing.JCheckBox();
|
||||||
|
|
||||||
skipKnownCheckBox.setSelected(true);
|
skipKnownCheckBox.setSelected(true);
|
||||||
skipKnownCheckBox.setText(org.openide.util.NbBundle.getMessage(FileTypeIdSimpleConfigPanel.class, "FileTypeIdSimpleConfigPanel.skipKnownCheckBox.text")); // NOI18N
|
skipKnownCheckBox.setText(org.openide.util.NbBundle.getMessage(FileTypeIdModuleSettingsPanel.class, "FileTypeIdSimpleConfigPanel.skipKnownCheckBox.text")); // NOI18N
|
||||||
skipKnownCheckBox.setToolTipText(org.openide.util.NbBundle.getMessage(FileTypeIdSimpleConfigPanel.class, "FileTypeIdSimpleConfigPanel.skipKnownCheckBox.toolTipText")); // NOI18N
|
skipKnownCheckBox.setToolTipText(org.openide.util.NbBundle.getMessage(FileTypeIdModuleSettingsPanel.class, "FileTypeIdSimpleConfigPanel.skipKnownCheckBox.toolTipText")); // NOI18N
|
||||||
skipKnownCheckBox.addActionListener(new java.awt.event.ActionListener() {
|
skipKnownCheckBox.addActionListener(new java.awt.event.ActionListener() {
|
||||||
public void actionPerformed(java.awt.event.ActionEvent evt) {
|
public void actionPerformed(java.awt.event.ActionEvent evt) {
|
||||||
skipKnownCheckBoxActionPerformed(evt);
|
skipKnownCheckBoxActionPerformed(evt);
|
@ -44,7 +44,6 @@ import org.sleuthkit.autopsy.ingest.IngestModuleAdapter;
|
|||||||
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
||||||
import org.sleuthkit.datamodel.HashInfo;
|
import org.sleuthkit.datamodel.HashInfo;
|
||||||
|
|
||||||
// RJCTODO: Create stories for a) peristing context-sensitive module settings and b) adapt core modules to use module settings (more important)
|
|
||||||
public class HashDbIngestModule extends IngestModuleAdapter implements FileIngestModule {
|
public class HashDbIngestModule extends IngestModuleAdapter implements FileIngestModule {
|
||||||
private static final Logger logger = Logger.getLogger(HashDbIngestModule.class.getName());
|
private static final Logger logger = Logger.getLogger(HashDbIngestModule.class.getName());
|
||||||
private static final int MAX_COMMENT_SIZE = 500;
|
private static final int MAX_COMMENT_SIZE = 500;
|
||||||
|
@ -86,7 +86,7 @@ public class HashLookupModuleFactory extends IngestModuleFactoryAdapter {
|
|||||||
if (moduleSettingsPanel == null) {
|
if (moduleSettingsPanel == null) {
|
||||||
moduleSettingsPanel = new HashLookupModuleSettingsPanel();
|
moduleSettingsPanel = new HashLookupModuleSettingsPanel();
|
||||||
}
|
}
|
||||||
moduleSettingsPanel.load(); // RJCTODO: Fix this
|
moduleSettingsPanel.load(); // RJCTODO: Fix this, use passed in settings
|
||||||
return moduleSettingsPanel;
|
return moduleSettingsPanel;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -29,7 +29,6 @@ import org.sleuthkit.autopsy.coreutils.Logger;
|
|||||||
// Note: This is a first step towards a keyword lists manager; it consists of
|
// Note: This is a first step towards a keyword lists manager; it consists of
|
||||||
// the portion of the keyword list management code that resided in the keyword
|
// the portion of the keyword list management code that resided in the keyword
|
||||||
// search file ingest module.
|
// search file ingest module.
|
||||||
// RJCTODO: How to keyword lists get initialized
|
|
||||||
final class KeywordListsManager {
|
final class KeywordListsManager {
|
||||||
|
|
||||||
private static KeywordListsManager instance = null;
|
private static KeywordListsManager instance = null;
|
||||||
|
@ -74,9 +74,6 @@ import org.sleuthkit.datamodel.TskData.FileKnown;
|
|||||||
* ingest update interval) Runs a periodic keyword / regular expression search
|
* ingest update interval) Runs a periodic keyword / regular expression search
|
||||||
* on currently configured lists for ingest and writes results to blackboard
|
* on currently configured lists for ingest and writes results to blackboard
|
||||||
* Reports interesting events to Inbox and to viewers
|
* Reports interesting events to Inbox and to viewers
|
||||||
*
|
|
||||||
* Registered as a module in layer.xml RJCTODO: Track this down, does not seem
|
|
||||||
* to be true
|
|
||||||
*/
|
*/
|
||||||
public final class KeywordSearchIngestModule extends IngestModuleAdapter implements FileIngestModule {
|
public final class KeywordSearchIngestModule extends IngestModuleAdapter implements FileIngestModule {
|
||||||
|
|
||||||
|
@ -303,7 +303,7 @@ class KeywordSearchListsManagementPanel extends javax.swing.JPanel implements Op
|
|||||||
@Override
|
@Override
|
||||||
public void store() {
|
public void store() {
|
||||||
// Implemented by parent panel
|
// Implemented by parent panel
|
||||||
// RJCTODO: The parent panel calls save on the XML doc thing
|
// RJCTODO: The parent panel calls save on the XML doc thing, does this still work?
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
|
@ -102,7 +102,7 @@ class KeywordSearchListsXML extends KeywordSearchListsAbstract {
|
|||||||
listEl.setAttribute(LIST_MOD_ATTR, modified);
|
listEl.setAttribute(LIST_MOD_ATTR, modified);
|
||||||
|
|
||||||
// only write the 'useForIngest' and 'ingestMessages' attributes
|
// only write the 'useForIngest' and 'ingestMessages' attributes
|
||||||
// if we're not exporting the list // RJCTODO: What? These should be ingest options...
|
// if we're not exporting the list.
|
||||||
if (!isExport) {
|
if (!isExport) {
|
||||||
listEl.setAttribute(LIST_USE_FOR_INGEST, useForIngest);
|
listEl.setAttribute(LIST_USE_FOR_INGEST, useForIngest);
|
||||||
listEl.setAttribute(LIST_INGEST_MSGS, ingestMessages);
|
listEl.setAttribute(LIST_INGEST_MSGS, ingestMessages);
|
||||||
|
@ -78,7 +78,7 @@ class ScalpelCarverIngestModule extends IngestModuleAdapter implements FileInges
|
|||||||
if (!carver.isInitialized()) {
|
if (!carver.isInitialized()) {
|
||||||
String message = "Error initializing scalpel carver.";
|
String message = "Error initializing scalpel carver.";
|
||||||
logger.log(Level.SEVERE, message);
|
logger.log(Level.SEVERE, message);
|
||||||
throw new IngestModuleException(message); // RJCTODO: Needs additional internationalization
|
throw new IngestModuleException(message);
|
||||||
}
|
}
|
||||||
|
|
||||||
// make sure module output directory exists; create it if it doesn't
|
// make sure module output directory exists; create it if it doesn't
|
||||||
|
Loading…
x
Reference in New Issue
Block a user