mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-14 17:06:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

7852 fix analysis results misidentified in logic as data artifacts

Browse Source
This commit is contained in:
William Schaefer 2021-09-03 16:57:31 -04:00
parent 7434c3fea0
commit 18f7f21c0f
1 changed files with 2 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java
View File

@ -63,17 +63,6 @@ public class CorrelationAttributeUtil {
ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID()
)); ));
private static final Set<Integer> FILE_ARTIFACT_TYPE_IDS = new HashSet<>(Arrays.asList(
ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID(),
ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID(),
ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),
ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID(),
ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID(),
ARTIFACT_TYPE.TSK_OBJECT_DETECTED.getTypeID(),
ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID(),
ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
));
/** /**
* Gets a string that is expected to be the same string that is stored in * Gets a string that is expected to be the same string that is stored in
* the correlation_types table in the central repository as the display name * the correlation_types table in the central repository as the display name
@ -94,8 +83,7 @@ public class CorrelationAttributeUtil {
//The account fields in these types are expected to be saved in a TSK_ACCOUNT artifact, which will be processed //The account fields in these types are expected to be saved in a TSK_ACCOUNT artifact, which will be processed
if (artifactTypeID == ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() if (artifactTypeID == ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
|| artifactTypeID == ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() || artifactTypeID == ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
|| artifactTypeID == ARTIFACT_TYPE.TSK_CONTACT.getTypeID() || artifactTypeID == ARTIFACT_TYPE.TSK_CONTACT.getTypeID()) {
|| FILE_ARTIFACT_TYPE_IDS.contains(artifactTypeID)) {
return new ArrayList<>(); return new ArrayList<>();
} }
return CorrelationAttributeUtil.makeCorrAttrsForSearch(artifact); return CorrelationAttributeUtil.makeCorrAttrsForSearch(artifact);
@ -178,8 +166,7 @@ public class CorrelationAttributeUtil {
return CorrelationAttributeUtil.makeCorrAttrsForSearch(sourceArtifact); return CorrelationAttributeUtil.makeCorrAttrsForSearch(sourceArtifact);
} }
} }
Content content = Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(analysisResult.getObjectID()); correlationAttrs.addAll(CorrelationAttributeUtil.makeCorrAttrsForSearch(analysisResult.getParent()));
correlationAttrs.addAll(CorrelationAttributeUtil.makeCorrAttrsForSearch(content));
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Failed to get information regarding correlation attributes from AnalysisResult", ex); logger.log(Level.SEVERE, "Failed to get information regarding correlation attributes from AnalysisResult", ex);
} catch (NoCurrentCaseException ex) { } catch (NoCurrentCaseException ex) {
@ -203,9 +190,6 @@ public class CorrelationAttributeUtil {
&& !domainsToSkip.contains(domainAttr.getValueString())) { && !domainsToSkip.contains(domainAttr.getValueString())) {
makeCorrAttrFromArtifactAttr(correlationAttrs, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID, attributes); makeCorrAttrFromArtifactAttr(correlationAttrs, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID, attributes);
} }
} else if (FILE_ARTIFACT_TYPE_IDS.contains(artifactTypeID) && artifact.getParent() instanceof AbstractFile) {
//if it is one of the types in this set we instead want to correlate on the parent file
correlationAttrs.addAll(makeCorrAttrsForSearch((AbstractFile) artifact.getParent()));
} else if (artifactTypeID == ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) { } else if (artifactTypeID == ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()) {
// prefetch all the information as we will be calling makeCorrAttrFromArtifactAttr() multiple times // prefetch all the information as we will be calling makeCorrAttrFromArtifactAttr() multiple times
Content sourceContent = Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(artifact.getObjectID()); Content sourceContent = Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(artifact.getObjectID());