From 19026b732f845622015160a650085aec22287b48 Mon Sep 17 00:00:00 2001 From: raman-bt Date: Wed, 24 Jul 2013 14:15:03 -0400 Subject: [PATCH 1/5] i. Ensure that artifacts in use are automatically included in the reports. ii. Fixed the TimeStamp_Start and TimeStamp_End attributes to be seconds since epoch --- .../datamodel/ArtifactStringContent.java | 4 +- .../datamodel/BlackboardArtifactNode.java | 4 +- .../report/ArtifactSelectionDialog.java | 22 ++++++-- .../autopsy/report/ReportGenerator.java | 56 ++++++++++++++++++- .../sleuthkit/autopsy/report/ReportHTML.java | 2 +- .../autopsy/report/ReportVisualPanel2.java | 25 +++++++-- 6 files changed, 101 insertions(+), 12 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java index 908fa037cb..b313043322 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java @@ -71,7 +71,9 @@ public class ArtifactStringContent implements StringContent { buffer.append(""); buffer.append(""); if (attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) { + || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() + || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() + || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID() ) { long epoch = attr.getValueLong(); String time = "0000-00-00 00:00:00"; if (epoch != 0) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 9a16de582a..280ca2c6eb 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -177,7 +177,9 @@ public class BlackboardArtifactNode extends DisplayableItemNode { break; case LONG: if (attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() - || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) { + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) { map.put(attribute.getAttributeTypeDisplayName(), ContentUtils.getStringTime(attribute.getValueLong(), associated)); } else { map.put(attribute.getAttributeTypeDisplayName(), attribute.getValueLong()); diff --git a/Core/src/org/sleuthkit/autopsy/report/ArtifactSelectionDialog.java b/Core/src/org/sleuthkit/autopsy/report/ArtifactSelectionDialog.java index 2c3f0f9576..24ed36f302 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ArtifactSelectionDialog.java +++ b/Core/src/org/sleuthkit/autopsy/report/ArtifactSelectionDialog.java @@ -27,15 +27,18 @@ import java.util.ArrayList; import java.util.EnumMap; import java.util.List; import java.util.Map; +import java.util.logging.Level; import javax.swing.JCheckBox; import javax.swing.JLabel; import javax.swing.JList; import javax.swing.ListCellRenderer; import javax.swing.ListModel; import javax.swing.event.ListDataListener; +import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; +import org.sleuthkit.datamodel.TskCoreException; public class ArtifactSelectionDialog extends javax.swing.JDialog { private static final Logger logger = Logger.getLogger(ArtifactSelectionDialog.class.getName()); @@ -60,10 +63,21 @@ public class ArtifactSelectionDialog extends javax.swing.JDialog { * Populate the list of artifacts with all important artifacts. */ private void populateList() { - artifacts = getImportantArtifactTypes(); - artifactStates = new EnumMap(BlackboardArtifact.ARTIFACT_TYPE.class); - for (BlackboardArtifact.ARTIFACT_TYPE type : artifacts) { - artifactStates.put(type, Boolean.TRUE); + try { + ArrayList doNotReport = new ArrayList(); + doNotReport.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO); + + artifacts = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifactTypesInUse(); + + artifacts.removeAll(doNotReport); + + artifactStates = new EnumMap(BlackboardArtifact.ARTIFACT_TYPE.class); + for (BlackboardArtifact.ARTIFACT_TYPE type : artifacts) { + artifactStates.put(type, Boolean.TRUE); + } + } catch (TskCoreException ex) { + Logger.getLogger(ArtifactSelectionDialog.class.getName()).log(Level.SEVERE, "Error getting list of artifacts in use: " + ex.getLocalizedMessage()); + return; } } diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java index 542bf4e2e6..e7fbb0ec0b 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java @@ -694,6 +694,16 @@ public class ReportGenerator { return new ArrayList(Arrays.asList(new String[] {"Comment", "File Name", "Source File"})); case 18: // TSK_TAG_ARTIFACT return new ArrayList(Arrays.asList(new String[] {"Comment", "File Name", "Source File"})); + + case 23: // TSK_CONTACT + return new ArrayList(Arrays.asList(new String[] {"Person Name", "Phone Number", "Phone Number (Home)", "Phone Number (Office)", "Phone Number (Mobile)", "Email", "Source File" })); + case 24: // TSK_MESSAGE + return new ArrayList(Arrays.asList(new String[] {"Message Type", "Direction", "Date/Time", "From Phone Number", "From Email", "To Phone Number", "To Email", "Subject", "Text", "Source File" })); + case 25: // TSK_CALLLOG + return new ArrayList(Arrays.asList(new String[] {"Person Name", "Phone Number", "Date/Time", "Direction", "Source File" })); + case 26: // TSK_CALENDAR_ENTRY + return new ArrayList(Arrays.asList(new String[] {"Calendar Entry Type", "Description", "Start Date/Time", "End Date/Time", "Location", "Source File" })); + } return null; } @@ -715,7 +725,10 @@ public class ReportGenerator { for (BlackboardAttribute tempatt : attList) { String value = ""; Integer type = tempatt.getAttributeTypeID(); - if (type.equals(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID()) || type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID())) { + if (type.equals(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID()) || + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) || + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID()) || + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID())) { if (module.length > 0) { value = module[0].dateToString(tempatt.getValueLong()); } else { @@ -843,6 +856,47 @@ public class ReportGenerator { tagArtifact.add(""); } return tagArtifact; + case 23: // TSK_CONTACT + List contact = new ArrayList(); + contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME_PERSON.getTypeID())); + contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER.getTypeID())); + contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME.getTypeID())); + contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE.getTypeID())); + contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE.getTypeID())); + contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_EMAIL.getTypeID())); + contact.add(getFileUniquePath(entry.getKey().getObjectID())); + return contact; + case 24: // TSK_MESSAGE + List message = new ArrayList(); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_EMAIL_FROM.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_EMAIL_TO.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_SUBJECT.getTypeID())); + message.add(attributes.get(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID())); + message.add(getFileUniquePath(entry.getKey().getObjectID())); + return message; + case 25: // TSK_CALLLOG + List call_log = new ArrayList(); + call_log.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME_PERSON.getTypeID())); + call_log.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER.getTypeID())); + call_log.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); + call_log.add(attributes.get(ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID())); + call_log.add(getFileUniquePath(entry.getKey().getObjectID())); + return call_log; + case 26: // TSK_CALENDAR_ENTRY + List calEntry = new ArrayList(); + calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE.getTypeID())); + calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DESCRIPTION.getTypeID())); + calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID())); + calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID())); + calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID())); + calEntry.add(getFileUniquePath(entry.getKey().getObjectID())); + return calEntry; + } return null; } diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java index d3d16d109c..7c2af55280 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java @@ -158,7 +158,7 @@ public class ReportHTML implements TableReportModule { // Like , header, title, any content divs try { StringBuilder page = new StringBuilder(); - page.append("\n\n\t").append(title).append("\n\t\n\n\n"); + page.append("\n\n\t\n\t").append(title).append("\n\t\n\n\n"); page.append("
").append(title).append("
\n
\n"); out.write(page.toString()); currentDataType = title; diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportVisualPanel2.java b/Core/src/org/sleuthkit/autopsy/report/ReportVisualPanel2.java index ff9e6c8a7e..6ad93ec9c7 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportVisualPanel2.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportVisualPanel2.java @@ -27,6 +27,7 @@ import java.util.LinkedHashMap; import java.util.List; import java.util.Map; import java.util.Map.Entry; +import java.util.logging.Level; import javax.swing.JCheckBox; import javax.swing.JFrame; import javax.swing.JLabel; @@ -35,9 +36,13 @@ import javax.swing.JPanel; import javax.swing.ListCellRenderer; import javax.swing.ListModel; import javax.swing.event.ListDataListener; +import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.datamodel.ExtractedContentChildren; import org.sleuthkit.autopsy.datamodel.Tags; +import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; +import org.sleuthkit.datamodel.TskCoreException; public final class ReportVisualPanel2 extends JPanel { private static final Logger logger = Logger.getLogger(ReportVisualPanel2.class.getName()); @@ -97,10 +102,22 @@ public final class ReportVisualPanel2 extends JPanel { // Initialize the list of Artifacts private void initArtifactTypes() { - artifacts = ArtifactSelectionDialog.getImportantArtifactTypes(); - artifactStates = new EnumMap(ARTIFACT_TYPE.class); - for (ARTIFACT_TYPE type : artifacts) { - artifactStates.put(type, Boolean.TRUE); + + try { + ArrayList doNotReport = new ArrayList(); + doNotReport.add(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO); + + artifacts = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifactTypesInUse(); + + artifacts.removeAll(doNotReport); + + artifactStates = new EnumMap(ARTIFACT_TYPE.class); + for (ARTIFACT_TYPE type : artifacts) { + artifactStates.put(type, Boolean.TRUE); + } + } catch (TskCoreException ex) { + Logger.getLogger(ReportVisualPanel2.class.getName()).log(Level.SEVERE, "Error getting list of artifacts in use: " + ex.getLocalizedMessage()); + return; } } From ae3b343c1b071fb6bab8a3ef91cd14d1e75d41fa Mon Sep 17 00:00:00 2001 From: raman-bt Date: Wed, 24 Jul 2013 18:53:40 -0400 Subject: [PATCH 2/5] Added icons for new artifacts to show up in the results tree view and the HTML report. --- .../autopsy/datamodel/ArtifactTypeNode.java | 8 ++++++ .../datamodel/BlackboardArtifactNode.java | 8 ++++++ .../org/sleuthkit/autopsy/images/calendar.png | Bin 0 -> 3473 bytes .../org/sleuthkit/autopsy/images/calllog.png | Bin 0 -> 691 bytes .../org/sleuthkit/autopsy/images/contact.png | Bin 0 -> 738 bytes .../org/sleuthkit/autopsy/images/message.png | Bin 0 -> 829 bytes .../sleuthkit/autopsy/report/ReportHTML.java | 26 ++++++++++++++++++ .../autopsy/report/images/calendar.png | Bin 0 -> 3473 bytes .../autopsy/report/images/calllog.png | Bin 0 -> 691 bytes .../autopsy/report/images/contact.png | Bin 0 -> 738 bytes .../autopsy/report/images/message.png | Bin 0 -> 829 bytes 11 files changed, 42 insertions(+) create mode 100644 Core/src/org/sleuthkit/autopsy/images/calendar.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/calllog.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/contact.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/message.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/calendar.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/calllog.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/contact.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/message.png diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java index 456f9f3bf6..b6c06ee5d9 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java @@ -104,6 +104,14 @@ public class ArtifactTypeNode extends DisplayableItemNode { return "searchquery.png"; case TSK_METADATA_EXIF: return "camera-icon-16.png"; + case TSK_CONTACT: + return "contact.png"; + case TSK_MESSAGE: + return "message.png"; + case TSK_CALLLOG: + return "calllog.png"; + case TSK_CALENDAR_ENTRY: + return "calendar.png"; } return "artifact-icon.png"; } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 280ca2c6eb..14bfd45f35 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -287,6 +287,14 @@ public class BlackboardArtifactNode extends DisplayableItemNode { return "green-tag-icon-16.png"; case TSK_METADATA_EXIF: return "camera-icon-16.png"; + case TSK_CONTACT: + return "contact.png"; + case TSK_MESSAGE: + return "message.png"; + case TSK_CALLLOG: + return "calllog.png"; + case TSK_CALENDAR_ENTRY: + return "calendar.png"; } return "artifact-icon.png"; } diff --git a/Core/src/org/sleuthkit/autopsy/images/calendar.png b/Core/src/org/sleuthkit/autopsy/images/calendar.png new file mode 100644 index 0000000000000000000000000000000000000000..4c0f910f069985b8e2b09fba05da6a5e02c41339 GIT binary patch literal 3473 zcmV;C4Q}#@P)004&%004{+008|`004nN004b?008NW002DY000@xb3BE2000U( zX+uL$P-t&-Z*ypGa3D!TLm+T+Z)Rz1WdHz3$DNjUR8-d%htIutdZEoQ0#b(FyTAa_ zdy`&8VVD_UC<6{NG_fI~0ue<-nj%P0#DLLIBvwSR5EN9f2P6n6F&ITuEN@2Ei>|D^ z_ww@lRz|vC zuzLs)$;-`!o*{AqUjza0dRV*yaMRE;fKCVhpQKsoe1Yhg01=zBIT!&C1$=TK@rP|Ibo3vKKm@PqnO#LJhq6%Ij6Hz*<$V$@wQAMN5qJ)hzm2h zoGcOF60t^#FqJFfH{#e-4l@G)6iI9sa9D{VHW4w29}?su;^hF~NC{tY+*d5%WDCTX za!E_i;d2ub1#}&jF5T4HnnCyEWTkKf0>c0%E1Ah>(_PY1)0w;+02c53Su*0<(nUqK zG_|(0G&D0Z{i;y^b@OjZ+}lNZ8Th$p5Uu}MTtq^NHl*T1?CO*}7&0ztZsv2j*bmJyf3G7=Z`5B*PvzoDiKdLpOAxi2$L0#SX*@cY z_n(^h55xYX#km%V()bZjV~l{*bt*u9?FT3d5g^g~#a;iSZ@&02Abxq_DwB(I|L-^b zXThc7C4-yrInE_0gw7K3GZ**7&k~>k0Z0NWkO#^@9q0fwx1%qj zZ=)yBuQ3=54Wo^*!gyjLF-e%Um=erBOdIALW)L%unZshS@>qSW9o8Sq#0s#5*edK% z>{;v(b^`kbN5rY%%y90wC>#%$kE_5P!JWYk;U;klcqzOl-UjcFXXA75rT9jCH~u<) z0>40zCTJ7v2qAyk54cquI@7b&LHdZ`+zlTss6bJ7%PQ)z$cROu4wBhpu-r)01) zS~6}jY?%U?gEALn#wiFzo#H}aQ8rT=DHkadR18&{>P1bW7E`~Y4p3)hWn`DhhRJ5j z*2tcg9i<^OEt(fCg;q*CP8+7ZTcWhYX$fb^_9d-LhL+6BEtPYWVlfKTBusSTASKKb%HuWJzl+By+?gkLq)?+BTu761 zjmyXF)a;mc^>(B7bo*HQ1NNg1st!zt28YLv>W*y3CdWx9U8f|cqfXDAO`Q48?auQq zHZJR2&bcD49Ip>EY~kKEPV6Wm+eXFV)D)_R=tM0@&p?(!V*Qu1PXHG9o^ zTY0bZ?)4%01p8F`JoeS|<@=<@RE7GY07EYX@lwd>4oW|Yi!o+Su@M`;WuSK z8LKk71XR(_RKHM1xJ5XYX`fk>`6eqY>qNG6HZQwBM=xi4&Sb88?zd}EYguc1@>KIS z<&CX#T35dwS|7K*XM_5Nf(;WJJvJWRMA($P>8E^?{IdL4o5MGE7bq2MEEwP7v8AO@ zqL5!WvekBL-8R%V?zVyL=G&{be=K4bT`e{#t|)$A!YaA?jp;X)-+bB;zhj`(vULAW z%ue3U;av{94wp%n<(7@__S@Z2PA@Mif3+uO&y|X06?J#oSi8M;ejj_^(0<4Lt#wLu#dYrva1Y$6_o(k^&}yhSh&h;f@JVA>W8b%o zZ=0JGnu?n~9O4}sJsfnnx7n(>`H13?(iXTy*fM=I`sj`CT)*pTHEgYKqqP+u1IL8N zo_-(u{qS+0<2@%BCt82d{Gqm;(q7a7b>wu+b|!X?c13m#p7cK1({0<`{-e>4hfb-U zsyQuty7Ua;Ou?B?XLHZaol8GAb3Wnxcu!2v{R_`T4=x`(GvqLI{-*2AOSimk zUAw*F_TX^n@STz9kDQ z$NC=!KfXWC8h`dn#xL(D3Z9UkR7|Q&Hcy#Notk!^zVUSB(}`#4&lYA1f0h2V_PNgU zAAWQEt$#LRcH#y9#i!p(Udq2b^lI6wp1FXzN3T;~FU%Lck$-deE#qz9yYP3D3t8{6 z?<+s(e(3(_^YOu_)K8!O1p}D#{JO;G(*OVf32;bRa{vGi!~g&e!~vBn4jTXf0>Vi| zK~y+TrISl+OkotqfA=xdnW3FdJA+1r2q~f}(P$(h(v^i3D=QHZgte6*VL>86B4MQq zRvIgdCI~i&pheN7)l4fM?QJ`c&g0I^eSFT`=~5!%NKuhmK#0Xnv0Sh#|KYVP@^V~A%Hqs zIK??GsPODJ&3*#l$tpEo8Bkk0%wlZjF}KIIRNclovU3@nJo+0npr*lDA%W z`JDbq&$e!AuFsg2A@%GDYGRy%>(Vrx=KZBBgiVv)zTNn~*8r&ZH#{;D^g25F5xZ2B zKEpUKU(ozvnDKKLsR$d93uo~RgM2PaOFT{{lR>XkDuhBIYO;qzCXq-apsrLXG8>Jd zkB_tB!F@Jeze>J)8@}g}mBe^*6|*xlm<#jsw70iYwrvb4&69w*pzAX2VyS~)19u6H zec{)RUOKzC%YfrdClZYQtb#R-J|ieyU0vv!7Tlgnr7)z-I>3syHfp&Xm9^{eBT>;p zmc?R`<*iAo;bqLvFQ5$#4XK@dyM(rQV;p}myXNug>l{C_4))j+v^xU>YX5;l6v{Qx ziGdlk;mbUgXh;bgq5~0BQ4;fIhn&QDN)M`-9J-D6?(G{jmG{`&-^Z6v>0p>0qWfrb zjFPlja_UP73qGy@)-BXzGI;Yc=Z+n0NcrT66LfCwAtrrBW6P+D@;u?#*L0~v!Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0!T?jK~y+TjgoCh zQ&AYl|9880cXtjqbbg5Z;Dkjb=7)k&R75l=C>PWh2lh6~K#EcdBFLZyWe~LwjrvrO z4#om2h_a|82}*QEnvNu#m=5!8tG(QLx7)dQw{5*F{BiF&-2XYx|D5|g4183s#&04;6A1%ExNOnSH)hvdz_xZXL8`KW-)$Lq2; z*u3@#qKPn4LJV`!2{?D$1E;6qKGX-db5Rb8#d$Jj(DmvI+BzcW9r`Zoxhgcd%b?S7 zs5EXs>;8xGVj-cgbJ%@u7z+svHm#=MyJVI1TosykcHvuO3L{h9NW@9a{$M#eatwSriSzes74>%x+l*+on=v>VRuqEt3x%AyT`M+RgXrqmt|)ng z)Vvr7`jxLN|Lnw5x6BB~$5CmppmpyvtT36;`_YTLua82*s9~*Y!ogkb^4_AYeA;8d zOni)7QGUQ_RM2ZHK&x5A_&Mxbe-k#Vv$%moyVs6^$wx5gbf8GOD2jqw#gJnuqi zli~jxNc04}@H};Z004R= z004l4008;_004mL004C`008P>0026e000+nl3&F}00009a7bBm000ie000ie0hKEb z8vpmMS&!K5|2FzE<9M(Dw6wC7`riDkNAgR=ISIC zo@5YjYePVm>L$Z-UD&RNDs8)6yzOxfhJQu2_VOJ;& z-IWmHUJYsp&^lVr_Rtl?40!flEaq$w|l_hLGdklIa#LV++dE8$9?w<>p zpVp6dtwV%170k`eLT}v-<-icVY~)P~?>2PoiAAthGW{O7ETQNqnCe+VGLUN$hzzIF zr_rq`h-~HHNHTI|3n4|ug;YOUf-0(x$LzvfIE5(XXiWlvw~LGTnq9?u(SSom;edj& z?LuegMFN}O94ZKTC0zHWkd?aqxLOJ9aw3ty!NEi58yG-^LGe%!QIfp)xrxlTH6fEE zOicfc{5nb%5!on#4GTvic=LQ7%dcO;Q&g0y4vzPB;q&ipf1fRu{XYDvRPktR5Ght6 z;1f8GgO4BH<7j#mhet+Xm?liB3X*taZxTaY?Np<39%{2-kgx%tK;hI4pE!wEnOQ76 zxDQVa(9wlKVw-Cx%Mq~nUNH^Gyygb{Nwh4BSuOnd@(I)D$6;G06y5}n{igxjw$a(s zi(8qeh()7NRkcQ7QnIe=yl2V|N8qyKVlPZUW+}piQkl)Pj0##}F=(979sZqxKSo6z UmG`m)AOHXW07*qoM6N<$f;clpl>h($ literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/images/message.png b/Core/src/org/sleuthkit/autopsy/images/message.png new file mode 100644 index 0000000000000000000000000000000000000000..6223516e3e122204aef38296213d0a4d2b382a36 GIT binary patch literal 829 zcmV-D1H$}?P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0@6uDK~y+Tb(7C) zR96(oKkvTxW-^mFGfeyyQxmkMDvB|J#pq5KUDUJ`#6>Bt6bjvyLKp3(+jb)&{uxFh zZd`~Wx+xmN_`3U^6oj``#s-tu9dBU4Oo`7zWaZe zcoUa@wbt2(Ne}P8;O6rluikTf?GBW=B7OUUjqHk0p_GL+CH=B!}T__NK8v+vk< zU>C}3zTsZ{u_Pq4BT39GmI8~&QY;7HOSxWbv6@)2SG0PXq0ue;I<=CQq3%9@OYNi0 zSgr^yC}O2>N{T>;3T2yi>c~>OTJ>2JSGz*&%X;cLIf3ISO?6PAEKQ$CHnkd)OR`^F ziTHjz zjKmlw39jj@I5K_nAzz+2gmNo&zN*aQm!Q7c$hU9?Y|icR7_FBGq7+~HsD&UDN5eRy z8^oMEzF#i%g-USgy9r8-Tj;XIppeifgHw`vql`<}8~icX)F}my$NeQ+7g3N>FO|!+e!P=UFA1_~JX6G=U=!lcj zoikq?&q?PN{${QfFi@%F1{$eKMl*^Nj*JY@U#Y$?fl#KXC<@kLew#OvL?QEwujz%- zA$bqW9Uo5@*}J2{r)GZs`x-a+Ht^xu2HGoaI)2E=@OJ(ImnmJUg7nZp00000NkvXX Hu0mjf^w*CM literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java index 7c2af55280..81bf63649f 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java @@ -561,6 +561,32 @@ public class ReportHTML implements TableReportModule { FileUtil.copy(in, output); in.close(); output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/contact.png"); + output = new FileOutputStream(new File(path + File.separator + "Contacts.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/message.png"); + output = new FileOutputStream(new File(path + File.separator + "Messages.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/calllog.png"); + output = new FileOutputStream(new File(path + File.separator + "Call Logs.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/calendar.png"); + output = new FileOutputStream(new File(path + File.separator + "Calendar Entries.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + } catch (IOException ex) { logger.log(Level.SEVERE, "Failed to extract images for HTML report.", ex); } finally { diff --git a/Core/src/org/sleuthkit/autopsy/report/images/calendar.png b/Core/src/org/sleuthkit/autopsy/report/images/calendar.png new file mode 100644 index 0000000000000000000000000000000000000000..4c0f910f069985b8e2b09fba05da6a5e02c41339 GIT binary patch literal 3473 zcmV;C4Q}#@P)004&%004{+008|`004nN004b?008NW002DY000@xb3BE2000U( zX+uL$P-t&-Z*ypGa3D!TLm+T+Z)Rz1WdHz3$DNjUR8-d%htIutdZEoQ0#b(FyTAa_ zdy`&8VVD_UC<6{NG_fI~0ue<-nj%P0#DLLIBvwSR5EN9f2P6n6F&ITuEN@2Ei>|D^ z_ww@lRz|vC zuzLs)$;-`!o*{AqUjza0dRV*yaMRE;fKCVhpQKsoe1Yhg01=zBIT!&C1$=TK@rP|Ibo3vKKm@PqnO#LJhq6%Ij6Hz*<$V$@wQAMN5qJ)hzm2h zoGcOF60t^#FqJFfH{#e-4l@G)6iI9sa9D{VHW4w29}?su;^hF~NC{tY+*d5%WDCTX za!E_i;d2ub1#}&jF5T4HnnCyEWTkKf0>c0%E1Ah>(_PY1)0w;+02c53Su*0<(nUqK zG_|(0G&D0Z{i;y^b@OjZ+}lNZ8Th$p5Uu}MTtq^NHl*T1?CO*}7&0ztZsv2j*bmJyf3G7=Z`5B*PvzoDiKdLpOAxi2$L0#SX*@cY z_n(^h55xYX#km%V()bZjV~l{*bt*u9?FT3d5g^g~#a;iSZ@&02Abxq_DwB(I|L-^b zXThc7C4-yrInE_0gw7K3GZ**7&k~>k0Z0NWkO#^@9q0fwx1%qj zZ=)yBuQ3=54Wo^*!gyjLF-e%Um=erBOdIALW)L%unZshS@>qSW9o8Sq#0s#5*edK% z>{;v(b^`kbN5rY%%y90wC>#%$kE_5P!JWYk;U;klcqzOl-UjcFXXA75rT9jCH~u<) z0>40zCTJ7v2qAyk54cquI@7b&LHdZ`+zlTss6bJ7%PQ)z$cROu4wBhpu-r)01) zS~6}jY?%U?gEALn#wiFzo#H}aQ8rT=DHkadR18&{>P1bW7E`~Y4p3)hWn`DhhRJ5j z*2tcg9i<^OEt(fCg;q*CP8+7ZTcWhYX$fb^_9d-LhL+6BEtPYWVlfKTBusSTASKKb%HuWJzl+By+?gkLq)?+BTu761 zjmyXF)a;mc^>(B7bo*HQ1NNg1st!zt28YLv>W*y3CdWx9U8f|cqfXDAO`Q48?auQq zHZJR2&bcD49Ip>EY~kKEPV6Wm+eXFV)D)_R=tM0@&p?(!V*Qu1PXHG9o^ zTY0bZ?)4%01p8F`JoeS|<@=<@RE7GY07EYX@lwd>4oW|Yi!o+Su@M`;WuSK z8LKk71XR(_RKHM1xJ5XYX`fk>`6eqY>qNG6HZQwBM=xi4&Sb88?zd}EYguc1@>KIS z<&CX#T35dwS|7K*XM_5Nf(;WJJvJWRMA($P>8E^?{IdL4o5MGE7bq2MEEwP7v8AO@ zqL5!WvekBL-8R%V?zVyL=G&{be=K4bT`e{#t|)$A!YaA?jp;X)-+bB;zhj`(vULAW z%ue3U;av{94wp%n<(7@__S@Z2PA@Mif3+uO&y|X06?J#oSi8M;ejj_^(0<4Lt#wLu#dYrva1Y$6_o(k^&}yhSh&h;f@JVA>W8b%o zZ=0JGnu?n~9O4}sJsfnnx7n(>`H13?(iXTy*fM=I`sj`CT)*pTHEgYKqqP+u1IL8N zo_-(u{qS+0<2@%BCt82d{Gqm;(q7a7b>wu+b|!X?c13m#p7cK1({0<`{-e>4hfb-U zsyQuty7Ua;Ou?B?XLHZaol8GAb3Wnxcu!2v{R_`T4=x`(GvqLI{-*2AOSimk zUAw*F_TX^n@STz9kDQ z$NC=!KfXWC8h`dn#xL(D3Z9UkR7|Q&Hcy#Notk!^zVUSB(}`#4&lYA1f0h2V_PNgU zAAWQEt$#LRcH#y9#i!p(Udq2b^lI6wp1FXzN3T;~FU%Lck$-deE#qz9yYP3D3t8{6 z?<+s(e(3(_^YOu_)K8!O1p}D#{JO;G(*OVf32;bRa{vGi!~g&e!~vBn4jTXf0>Vi| zK~y+TrISl+OkotqfA=xdnW3FdJA+1r2q~f}(P$(h(v^i3D=QHZgte6*VL>86B4MQq zRvIgdCI~i&pheN7)l4fM?QJ`c&g0I^eSFT`=~5!%NKuhmK#0Xnv0Sh#|KYVP@^V~A%Hqs zIK??GsPODJ&3*#l$tpEo8Bkk0%wlZjF}KIIRNclovU3@nJo+0npr*lDA%W z`JDbq&$e!AuFsg2A@%GDYGRy%>(Vrx=KZBBgiVv)zTNn~*8r&ZH#{;D^g25F5xZ2B zKEpUKU(ozvnDKKLsR$d93uo~RgM2PaOFT{{lR>XkDuhBIYO;qzCXq-apsrLXG8>Jd zkB_tB!F@Jeze>J)8@}g}mBe^*6|*xlm<#jsw70iYwrvb4&69w*pzAX2VyS~)19u6H zec{)RUOKzC%YfrdClZYQtb#R-J|ieyU0vv!7Tlgnr7)z-I>3syHfp&Xm9^{eBT>;p zmc?R`<*iAo;bqLvFQ5$#4XK@dyM(rQV;p}myXNug>l{C_4))j+v^xU>YX5;l6v{Qx ziGdlk;mbUgXh;bgq5~0BQ4;fIhn&QDN)M`-9J-D6?(G{jmG{`&-^Z6v>0p>0qWfrb zjFPlja_UP73qGy@)-BXzGI;Yc=Z+n0NcrT66LfCwAtrrBW6P+D@;u?#*L0~v!Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0!T?jK~y+TjgoCh zQ&AYl|9880cXtjqbbg5Z;Dkjb=7)k&R75l=C>PWh2lh6~K#EcdBFLZyWe~LwjrvrO z4#om2h_a|82}*QEnvNu#m=5!8tG(QLx7)dQw{5*F{BiF&-2XYx|D5|g4183s#&04;6A1%ExNOnSH)hvdz_xZXL8`KW-)$Lq2; z*u3@#qKPn4LJV`!2{?D$1E;6qKGX-db5Rb8#d$Jj(DmvI+BzcW9r`Zoxhgcd%b?S7 zs5EXs>;8xGVj-cgbJ%@u7z+svHm#=MyJVI1TosykcHvuO3L{h9NW@9a{$M#eatwSriSzes74>%x+l*+on=v>VRuqEt3x%AyT`M+RgXrqmt|)ng z)Vvr7`jxLN|Lnw5x6BB~$5CmppmpyvtT36;`_YTLua82*s9~*Y!ogkb^4_AYeA;8d zOni)7QGUQ_RM2ZHK&x5A_&Mxbe-k#Vv$%moyVs6^$wx5gbf8GOD2jqw#gJnuqi zli~jxNc04}@H};Z004R= z004l4008;_004mL004C`008P>0026e000+nl3&F}00009a7bBm000ie000ie0hKEb z8vpmMS&!K5|2FzE<9M(Dw6wC7`riDkNAgR=ISIC zo@5YjYePVm>L$Z-UD&RNDs8)6yzOxfhJQu2_VOJ;& z-IWmHUJYsp&^lVr_Rtl?40!flEaq$w|l_hLGdklIa#LV++dE8$9?w<>p zpVp6dtwV%170k`eLT}v-<-icVY~)P~?>2PoiAAthGW{O7ETQNqnCe+VGLUN$hzzIF zr_rq`h-~HHNHTI|3n4|ug;YOUf-0(x$LzvfIE5(XXiWlvw~LGTnq9?u(SSom;edj& z?LuegMFN}O94ZKTC0zHWkd?aqxLOJ9aw3ty!NEi58yG-^LGe%!QIfp)xrxlTH6fEE zOicfc{5nb%5!on#4GTvic=LQ7%dcO;Q&g0y4vzPB;q&ipf1fRu{XYDvRPktR5Ght6 z;1f8GgO4BH<7j#mhet+Xm?liB3X*taZxTaY?Np<39%{2-kgx%tK;hI4pE!wEnOQ76 zxDQVa(9wlKVw-Cx%Mq~nUNH^Gyygb{Nwh4BSuOnd@(I)D$6;G06y5}n{igxjw$a(s zi(8qeh()7NRkcQ7QnIe=yl2V|N8qyKVlPZUW+}piQkl)Pj0##}F=(979sZqxKSo6z UmG`m)AOHXW07*qoM6N<$f;clpl>h($ literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/images/message.png b/Core/src/org/sleuthkit/autopsy/report/images/message.png new file mode 100644 index 0000000000000000000000000000000000000000..6223516e3e122204aef38296213d0a4d2b382a36 GIT binary patch literal 829 zcmV-D1H$}?P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0@6uDK~y+Tb(7C) zR96(oKkvTxW-^mFGfeyyQxmkMDvB|J#pq5KUDUJ`#6>Bt6bjvyLKp3(+jb)&{uxFh zZd`~Wx+xmN_`3U^6oj``#s-tu9dBU4Oo`7zWaZe zcoUa@wbt2(Ne}P8;O6rluikTf?GBW=B7OUUjqHk0p_GL+CH=B!}T__NK8v+vk< zU>C}3zTsZ{u_Pq4BT39GmI8~&QY;7HOSxWbv6@)2SG0PXq0ue;I<=CQq3%9@OYNi0 zSgr^yC}O2>N{T>;3T2yi>c~>OTJ>2JSGz*&%X;cLIf3ISO?6PAEKQ$CHnkd)OR`^F ziTHjz zjKmlw39jj@I5K_nAzz+2gmNo&zN*aQm!Q7c$hU9?Y|icR7_FBGq7+~HsD&UDN5eRy z8^oMEzF#i%g-USgy9r8-Tj;XIppeifgHw`vql`<}8~icX)F}my$NeQ+7g3N>FO|!+e!P=UFA1_~JX6G=U=!lcj zoikq?&q?PN{${QfFi@%F1{$eKMl*^Nj*JY@U#Y$?fl#KXC<@kLew#OvL?QEwujz%- zA$bqW9Uo5@*}J2{r)GZs`x-a+Ht^xu2HGoaI)2E=@OJ(ImnmJUg7nZp00000NkvXX Hu0mjf^w*CM literal 0 HcmV?d00001 From 992d71eda3e557a72c13268c22795d850d6ab34b Mon Sep 17 00:00:00 2001 From: raman-bt Date: Fri, 26 Jul 2013 13:39:51 -0400 Subject: [PATCH 3/5] Ensure all DATETIME_* attributes are treated as integers. --- .../sleuthkit/autopsy/datamodel/ArtifactStringContent.java | 4 ++++ .../autopsy/datamodel/BlackboardArtifactNode.java | 6 +++++- Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java | 7 ++++++- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java index 0ed599127c..aa0973b345 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java @@ -82,6 +82,10 @@ public class ArtifactStringContent implements StringContent { buffer.append(""); if (attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() + || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID() + || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID() + || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID() + || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID() || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID() ) { long epoch = attr.getValueLong(); diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 14bfd45f35..8ecb85fb2f 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -178,8 +178,12 @@ public class BlackboardArtifactNode extends DisplayableItemNode { case LONG: if (attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID() + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID() + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID() + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID() || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() - || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) { + || attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID() ) { map.put(attribute.getAttributeTypeDisplayName(), ContentUtils.getStringTime(attribute.getValueLong(), associated)); } else { map.put(attribute.getAttributeTypeDisplayName(), attribute.getValueLong()); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java index 2c6a893bf3..5965746e94 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java @@ -719,8 +719,13 @@ public class ReportGenerator { Integer type = tempatt.getAttributeTypeID(); if (type.equals(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID()) || type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) || + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID()) || + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID()) || + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID()) || + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID()) || type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID()) || - type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID())) { + type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) + ) { if (module.length > 0) { value = module[0].dateToString(tempatt.getValueLong()); } else { From 7cac583530b6f5932f680b75f416ca345e45e33d Mon Sep 17 00:00:00 2001 From: raman-bt Date: Fri, 26 Jul 2013 16:29:25 -0400 Subject: [PATCH 4/5] Replace hard coded numbers in switch/case statements with corresponding enum values. --- .../autopsy/report/ReportGenerator.java | 73 ++++++++++--------- .../sleuthkit/autopsy/report/ReportHTML.java | 5 +- 2 files changed, 42 insertions(+), 36 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java index 5965746e94..1865c88d0a 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java @@ -636,56 +636,58 @@ public class ReportGenerator { private List getArtifactTableColumnHeaders(int artifactTypeId) { ArrayList columnHeaders; - switch (artifactTypeId) { - case 2: // TSK_WEB_BOOKMARK + BlackboardArtifact.ARTIFACT_TYPE type = BlackboardArtifact.ARTIFACT_TYPE.fromID(artifactTypeId); + + switch (type) { + case TSK_WEB_BOOKMARK: columnHeaders = new ArrayList(Arrays.asList(new String[] {"URL", "Title", "Date Accessed", "Program", "Source File"})); break; - case 3: // TSK_WEB_COOKIE + case TSK_WEB_COOKIE: columnHeaders = new ArrayList(Arrays.asList(new String[] {"URL", "Date/Time", "Name", "Value", "Program", "Source File"})); break; - case 4: // TSK_WEB_HISTORY + case TSK_WEB_HISTORY: columnHeaders = new ArrayList(Arrays.asList(new String[] {"URL", "Date Accessed", "Referrer", "Name", "Program", "Source File"})); break; - case 5: // TSK_WEB_DOWNLOAD + case TSK_WEB_DOWNLOAD: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Destination", "Source URL", "Date Accessed", "Program", "Source File"})); break; - case 6: // TSK_RECENT_OBJECT + case TSK_RECENT_OBJECT: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Path", "Source File"})); break; - case 8: // TSK_INSTALLED_PROG + case TSK_INSTALLED_PROG: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Program Name", "Install Date/Time", "Source File"})); break; - case 9: // TSK_KEYWORD_HIT + case TSK_KEYWORD_HIT: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Preview", "Source File"})); break; - case 10: // TSK_HASHSET_HIT + case TSK_HASHSET_HIT: columnHeaders = new ArrayList(Arrays.asList(new String[] {"File", "Size"})); break; - case 11: // TSK_DEVICE_ATTACHED + case TSK_DEVICE_ATTACHED: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Name", "Device ID", "Date/Time", "Source File"})); break; - case 15: // TSK_WEB_SEARCH_QUERY + case TSK_WEB_SEARCH_QUERY: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Text", "Domain", "Date Accessed", "Program Name", "Source File"})); break; - case 16: // TSK_METADATA_EXIF + case TSK_METADATA_EXIF: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Date Taken", "Device Manufacturer", "Device Model", "Latitude", "Longitude", "Source File"})); break; - case 17: // TSK_TAG_FILE + case TSK_TAG_FILE: columnHeaders = new ArrayList(Arrays.asList(new String[] {"File", "Tag", "Comment"})); break; - case 18: // TSK_TAG_ARTIFACT + case TSK_TAG_ARTIFACT: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Result Type", "Tag", "Comment", "Source File"})); break; - case 23: // TSK_CONTACT + case TSK_CONTACT: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Person Name", "Phone Number", "Phone Number (Home)", "Phone Number (Office)", "Phone Number (Mobile)", "Email", "Source File" })); break; - case 24: // TSK_MESSAGE + case TSK_MESSAGE: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Message Type", "Direction", "Date/Time", "From Phone Number", "From Email", "To Phone Number", "To Email", "Subject", "Text", "Source File" })); break; - case 25: // TSK_CALLLOG + case TSK_CALLLOG: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Person Name", "Phone Number", "Date/Time", "Direction", "Source File" })); break; - case 26: // TSK_CALENDAR_ENTRY + case TSK_CALENDAR_ENTRY: columnHeaders = new ArrayList(Arrays.asList(new String[] {"Calendar Entry Type", "Description", "Start Date/Time", "End Date/Time", "Location", "Source File" })); break; default: @@ -773,8 +775,11 @@ public class ReportGenerator { */ private List getArtifactRow(Entry> entry, TableReportModule module) throws TskCoreException { Map attributes = getMappedAttributes(entry.getValue(), module); - switch (entry.getKey().getArtifactTypeID()) { - case 2: // TSK_WEB_BOOKMARK + + BlackboardArtifact.ARTIFACT_TYPE type = BlackboardArtifact.ARTIFACT_TYPE.fromID(entry.getKey().getArtifactTypeID()); + + switch (type) { + case TSK_WEB_BOOKMARK: List bookmark = new ArrayList<>(); bookmark.add(attributes.get(ATTRIBUTE_TYPE.TSK_URL.getTypeID())); bookmark.add(attributes.get(ATTRIBUTE_TYPE.TSK_TITLE.getTypeID())); @@ -782,7 +787,7 @@ public class ReportGenerator { bookmark.add(attributes.get(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID())); bookmark.add(getFileUniquePath(entry.getKey().getObjectID())); return bookmark; - case 3: // TSK_WEB_COOKIE + case TSK_WEB_COOKIE: List cookie = new ArrayList<>(); cookie.add(attributes.get(ATTRIBUTE_TYPE.TSK_URL.getTypeID())); cookie.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); @@ -791,7 +796,7 @@ public class ReportGenerator { cookie.add(attributes.get(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID())); cookie.add(getFileUniquePath(entry.getKey().getObjectID())); return cookie; - case 4: // TSK_WEB_HISTORY + case TSK_WEB_HISTORY: List history = new ArrayList<>(); history.add(attributes.get(ATTRIBUTE_TYPE.TSK_URL.getTypeID())); history.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID())); @@ -800,7 +805,7 @@ public class ReportGenerator { history.add(attributes.get(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID())); history.add(getFileUniquePath(entry.getKey().getObjectID())); return history; - case 5: // TSK_WEB_DOWNLOAD + case TSK_WEB_DOWNLOAD: List download = new ArrayList<>(); download.add(attributes.get(ATTRIBUTE_TYPE.TSK_PATH.getTypeID())); download.add(attributes.get(ATTRIBUTE_TYPE.TSK_URL.getTypeID())); @@ -808,25 +813,25 @@ public class ReportGenerator { download.add(attributes.get(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID())); download.add(getFileUniquePath(entry.getKey().getObjectID())); return download; - case 6: // TSK_RECENT_OBJECT + case TSK_RECENT_OBJECT: List recent = new ArrayList<>(); recent.add(attributes.get(ATTRIBUTE_TYPE.TSK_PATH.getTypeID())); recent.add(getFileUniquePath(entry.getKey().getObjectID())); return recent; - case 8: // TSK_INSTALLED_PROG + case TSK_INSTALLED_PROG: List installed = new ArrayList<>(); installed.add(attributes.get(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID())); installed.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); installed.add(getFileUniquePath(entry.getKey().getObjectID())); return installed; - case 11: // TSK_DEVICE_ATTACHED + case TSK_DEVICE_ATTACHED: List devices = new ArrayList<>(); devices.add(attributes.get(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL.getTypeID())); devices.add(attributes.get(ATTRIBUTE_TYPE.TSK_DEVICE_ID.getTypeID())); devices.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); devices.add(getFileUniquePath(entry.getKey().getObjectID())); return devices; - case 15: // TSK_WEB_SEARCH_QUERY + case TSK_WEB_SEARCH_QUERY: List search = new ArrayList<>(); search.add(attributes.get(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID())); search.add(attributes.get(ATTRIBUTE_TYPE.TSK_DOMAIN.getTypeID())); @@ -834,7 +839,7 @@ public class ReportGenerator { search.add(attributes.get(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID())); search.add(getFileUniquePath(entry.getKey().getObjectID())); return search; - case 16: // TSK_METADATA_EXIF + case TSK_METADATA_EXIF: List exif = new ArrayList<>(); exif.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); exif.add(attributes.get(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE.getTypeID())); @@ -843,7 +848,7 @@ public class ReportGenerator { exif.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID())); exif.add(getFileUniquePath(entry.getKey().getObjectID())); return exif; - case 17: // TSK_TAG_FILE + case TSK_TAG_FILE: List taggedFileRow = new ArrayList<>(); AbstractFile taggedFile = getAbstractFile(entry.getKey().getObjectID()); if (taggedFile != null) { @@ -854,7 +859,7 @@ public class ReportGenerator { taggedFileRow.add(attributes.get(ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID())); taggedFileRow.add(attributes.get(ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID())); return taggedFileRow; - case 18: // TSK_TAG_ARTIFACT + case TSK_TAG_ARTIFACT: List taggedArtifactRow = new ArrayList<>(); String taggedArtifactType = ""; for (BlackboardAttribute attr : entry.getValue()) { @@ -876,7 +881,7 @@ public class ReportGenerator { taggedArtifactRow.add(""); } return taggedArtifactRow; - case 23: // TSK_CONTACT + case TSK_CONTACT: List contact = new ArrayList(); contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME_PERSON.getTypeID())); contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER.getTypeID())); @@ -886,7 +891,7 @@ public class ReportGenerator { contact.add(attributes.get(ATTRIBUTE_TYPE.TSK_EMAIL.getTypeID())); contact.add(getFileUniquePath(entry.getKey().getObjectID())); return contact; - case 24: // TSK_MESSAGE + case TSK_MESSAGE: List message = new ArrayList(); message.add(attributes.get(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE.getTypeID())); message.add(attributes.get(ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID())); @@ -899,7 +904,7 @@ public class ReportGenerator { message.add(attributes.get(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID())); message.add(getFileUniquePath(entry.getKey().getObjectID())); return message; - case 25: // TSK_CALLLOG + case TSK_CALLLOG: List call_log = new ArrayList(); call_log.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME_PERSON.getTypeID())); call_log.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER.getTypeID())); @@ -907,7 +912,7 @@ public class ReportGenerator { call_log.add(attributes.get(ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID())); call_log.add(getFileUniquePath(entry.getKey().getObjectID())); return call_log; - case 26: // TSK_CALENDAR_ENTRY + case TSK_CALENDAR_ENTRY: List calEntry = new ArrayList(); calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE.getTypeID())); calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DESCRIPTION.getTypeID())); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java index fbbc689ffc..e8aff7e50b 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java @@ -380,8 +380,9 @@ public class ReportHTML implements TableReportModule { */ private void addRowDataForSourceArtifact(List row, BlackboardArtifact sourceArtifact) { int artifactTypeID = sourceArtifact.getArtifactTypeID(); - switch (artifactTypeID) { - case 17: + BlackboardArtifact.ARTIFACT_TYPE type = BlackboardArtifact.ARTIFACT_TYPE.fromID(artifactTypeID); + switch (type) { + case TSK_TAG_FILE: addRowDataForFileTagArtifact(row, sourceArtifact); break; default: From f22fcc5aab5dd76374f79a62ab30e65a032f795a Mon Sep 17 00:00:00 2001 From: raman-bt Date: Wed, 7 Aug 2013 08:49:45 -0400 Subject: [PATCH 5/5] Handle new artifacts/attributes for Autopsy/MPF integration. --- .../autopsy/datamodel/ArtifactTypeNode.java | 12 +++ .../datamodel/BlackboardArtifactNode.java | 13 +++ .../sleuthkit/autopsy/images/Bluetooth.png | Bin 0 -> 744 bytes .../autopsy/images/gps-lastlocation.png | Bin 0 -> 509 bytes .../sleuthkit/autopsy/images/gps-search.png | Bin 0 -> 958 bytes .../autopsy/images/gps-trackpoint.png | Bin 0 -> 661 bytes .../org/sleuthkit/autopsy/images/gpsfav.png | Bin 0 -> 643 bytes .../autopsy/images/speeddialentry.png | Bin 0 -> 724 bytes .../autopsy/report/ReportGenerator.java | 90 ++++++++++++++++++ .../sleuthkit/autopsy/report/ReportHTML.java | 37 +++++++ .../autopsy/report/images/account-icon-16.png | Bin 0 -> 832 bytes .../autopsy/report/images/bluetooth.png | Bin 0 -> 744 bytes .../report/images/gps-lastlocation.png | Bin 0 -> 509 bytes .../autopsy/report/images/gps-search.png | Bin 0 -> 958 bytes .../autopsy/report/images/gps_trackpoint.png | Bin 0 -> 661 bytes .../autopsy/report/images/gpsfav.png | Bin 0 -> 643 bytes .../autopsy/report/images/speeddialentry.png | Bin 0 -> 724 bytes .../netbeans/core/startup/Bundle.properties | 4 +- .../core/windows/view/ui/Bundle.properties | 6 +- 19 files changed, 157 insertions(+), 5 deletions(-) create mode 100644 Core/src/org/sleuthkit/autopsy/images/Bluetooth.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/gps-lastlocation.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/gps-search.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/gps-trackpoint.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/gpsfav.png create mode 100644 Core/src/org/sleuthkit/autopsy/images/speeddialentry.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/account-icon-16.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/bluetooth.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/gps-lastlocation.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/gps-search.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/gps_trackpoint.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/gpsfav.png create mode 100644 Core/src/org/sleuthkit/autopsy/report/images/speeddialentry.png diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java index b6c06ee5d9..c5d347ae6e 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java @@ -112,6 +112,18 @@ public class ArtifactTypeNode extends DisplayableItemNode { return "calllog.png"; case TSK_CALENDAR_ENTRY: return "calendar.png"; + case TSK_SPEED_DIAL_ENTRY: + return "speeddialentry.png"; + case TSK_BLUETOOTH_PAIRING: + return "bluetooth.png"; + case TSK_GPS_BOOKMARK: + return "gpsfav.png"; + case TSK_GPS_LAST_KNOWN_LOCATION: + return "gps-lastlocation.png"; + case TSK_GPS_SEARCH: + return "gps-search.png"; + case TSK_SERVICE_ACCOUNT: + return "account-icon-16.png"; } return "artifact-icon.png"; } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 8ecb85fb2f..5879d6f341 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -299,6 +299,19 @@ public class BlackboardArtifactNode extends DisplayableItemNode { return "calllog.png"; case TSK_CALENDAR_ENTRY: return "calendar.png"; + case TSK_SPEED_DIAL_ENTRY: + return "speeddialentry.png"; + case TSK_BLUETOOTH_PAIRING: + return "bluetooth.png"; + case TSK_GPS_BOOKMARK: + return "gpsfav.png"; + case TSK_GPS_LAST_KNOWN_LOCATION: + return "gps-lastlocation.png"; + case TSK_GPS_SEARCH: + return "gps-search.png"; + case TSK_SERVICE_ACCOUNT: + return "account-icon-16.png"; + } return "artifact-icon.png"; } diff --git a/Core/src/org/sleuthkit/autopsy/images/Bluetooth.png b/Core/src/org/sleuthkit/autopsy/images/Bluetooth.png new file mode 100644 index 0000000000000000000000000000000000000000..a54acb00a1d674f02e6689f2ab3a7f7e873cf3ce GIT binary patch literal 744 zcmVP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0)0tDK~y+TbyGcP z6j2cV-tHMayhDg*JTEGdL*cA|ntk$6h(ZgW4o``-A?+q2BT+%j+Gee-?u=8Vult3_Q@YcT@j!!6B;!Dy)u zrNVX}dw^T7zhds?PoNO;#LzXvpCACl(HU!>|KG@BVX}hxi9-bFL}F%F5gf?FguP4p z4GGqXVEW6D&4#uHEZsQ>zwUb*vUCE$T0I5g7CnZWN>f{ZhDxSSyFui z{Q3-YbfQhh>M{ze1A)J?cT3G)1oPn*lj2*%FC)qZ63eIo)W1HT3e zK>A)r*TFWLkdagVvYHHz!Zsu3dNm#-1s|9aba7JBB7k=xsgI<6cM2Fe4IH}wESv>C zt-!ckCV?__;Hp2HfwJ)L%!JtnJm%D|K7-ja40HGlP(A`Ym}WJ%kFVsHO9w#7ltA6e zLKA#{H2=a}dj}LN{!E_Ea`Sk0W0ko-S&at~55d*vf#o)6VhhTN@HGEt;y|4~7ft7+rYyqPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0g_2XK~y+Tg_F%o z0znwYpUtw}jr>9h!y@rmx6XCTb9L$1%`V;g6N1j69fBx`ZW4W53JJPM-a^EvKnzq$ zG+cBEG2C_9*@i9MRe!L|zR$e#?7K7bazq0?G@DI`qR67bjIhz5(P$w1^vt5+m<*gw zCz7cYi-uz|pls*vLB3=b4T0{#e?E>6NPV6o?ei0+48~+|=JAjhKZvrkK~%NF)c$n+ zg3@Z?Tau71Yn4f5sJC%8)1NMb+-4YVJ5bl&^XXTNJlw!^#yuDYO7$H`B;oY}lRS{l zRAC#pqZL158P*sErTtylw7cV)pbrOG`}Esg62j67%do~U2<{z%TU>zH)+!JP92`&_ zn*#iEETa!>GYtyi8IqX>xz?s0Gg+pZ>2!WisB04`vxy=^H?VvfMWOo1)IVfdMx|0= z5n$O&L{-4qMsaa@h4r;nK@cEm_o7y->5F|n zAA-RkLZOh}GZf1TC{&I_w!rf|VzDSwdjWm``nMlv*a#q000000NkvXXu0mjf_f6Rn literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/images/gps-search.png b/Core/src/org/sleuthkit/autopsy/images/gps-search.png new file mode 100644 index 0000000000000000000000000000000000000000..26c97d488809de8088c6896490014015a5beb5f0 GIT binary patch literal 958 zcmV;v13~Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn z4jTXf02y>eSaefwW^{L9a%BK_cXuvnZfkR6VQ^(GZ*pgw?mQX*00SOLL_t(IPmPj2 zY#VhL#(#I`^T*kD{z_syA2@E@q){NKkjrHR_aj$^xLpY8Mc?tJ_mXJF)+{vUdNdf)eXrM_ncf3@zA zRHwyntw zGjIdy-8R1B(0bS=>MvkKvpBv>Qvhc39?!2_6m}JPM9G9tFbo0|N2cHEpebPz5tW_a zP0lR5!I`yn7FUWC7jrzjw92D{6#wiz7+J@FXpknR#8KulVEH(KsHW9pIe!5y<>5&K zqH35aJ&P1`Nl(b!+x!opFE@yV3;{7nr*a%vRqp+{%l!N)f`NhG&tSDun5Is}v!wH|f#W(Pvpb}7574z38#5c2yKTae2(l!JEV~Khkc2E6azuo>T4E|+ z;?o=N^TRhkkWWBW&%>LyO#U{1;K(Z^qt?A6%Z zZxSy|vi{t8a;XAARHjjXOh}IKOu5X`^u`$Q*u2kPcc1)>!j1QCbLZwS)LKt?_u4z0 zI~!xGc|fyLr)f6n=pNl zrzKclK22^VN46lMw09{N7DrZO*Kx6Gj3h~4r|ci&8x5Q()m^FxJ+tdo5Nv| zPRyce*9byBx-@|?86N|DhSJ#~`FD(7V~gseE_!>C zWMzR3?d2o$NJlg1_B=lM@NH_{30`~kb&B(|$KPZ5BAJfWA!+CkI(|IX5ny!a+G5|s gAr$3kEdNvRFVrnyOyAjydjJ3c07*qoM6N<$f_xFYNB{r; literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/images/gps-trackpoint.png b/Core/src/org/sleuthkit/autopsy/images/gps-trackpoint.png new file mode 100644 index 0000000000000000000000000000000000000000..78f1f97dcc3026b5cbe20a356df6eb7ea56d97ff GIT binary patch literal 661 zcmV;G0&4wPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf02y>eSaefwW^{L9 za%BKPWN%_+AW3auXJt}lVPtu6$z?nM00IR`L_t(IPmPmJYZFlvhMzmhOoK`lt5P?9 z5UC5HA_Wn_trel*#;Uj}f@0mc7eVkx*p(J>Q57jwH?9OX)e0?C5TT*9>Y~=#*qCI} zNoMZ#Oy&xSO^Of9aPFD+y!YIXQ6}d5eaz3tU^FPjrWhj{2es=Gs{0Dc1V4dTaBLH3SRhKUbP$t|xC1Uo2{U5e!lcV69MaixIAL7q&H^I&=m z+^tCsv4QN9sYx6u$~DD8ex3Pzss1ed@>wb>7T1#8w?ZTunO&=-MrzaXPMfNDg${k$ zey(ecC(CI?HLB8g=rpWOB{g#F%2bw2^l~q%>nP67ciP6NsrkjXnZlmW$q$3a2*+crw8~df1 zriL4F_77rwIo?V|;>$L>k+ue^t5@FJ(0)9QEXwP&nT>2};ARK# vdIs&NHEj(_WuIK_FrPb4kzZ^051N2KzYqffdU?>O00000NkvXXu0mjf+oC0# literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/images/gpsfav.png b/Core/src/org/sleuthkit/autopsy/images/gpsfav.png new file mode 100644 index 0000000000000000000000000000000000000000..721dba3d50d257656fffe7fd2b738a6aa7bf277c GIT binary patch literal 643 zcmV-}0(||6P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0vJg|K~y+Tm6Oj; z(_kEjpN*}stw;jfVjBDv@CVTV#-N8?lw>C^UQLKsj~+ew4;bTtD;JD21iV0qF+q$s z=8`GFjlo=`fM~7IRU{0^e$=jOre!helYG0g z^K5d$9{n2*L1Ax~&sveE&(n;ICmDa4F}uau;vaAbetgf9Ror~adq^owj4t{K-(RP4 zxMwFCaR|1*ePMO0iNvzXo3(wCg;uuqJ9zXYZ6_LW2;MF(v8Id6BsJ3cW_CTtXkY(G z^lH#fG~y7vN^G#XlBZlb#NBlU??I7Bn@nGCmz`*&E-06Z^z}#>AMRkx-C|IlO7cUvDS`K|B&MGIH6F8?(S|P zw;wYhXbGx6m?iT05Cj32%T+T}1&Kt$7#kZiG)=2c9hg_Ms#2-g9Vf`LY(%3`V`yl| dZv792@e}l(Ea-jz89M*~002ovPDHLkV1kaz8e{+f literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/images/speeddialentry.png b/Core/src/org/sleuthkit/autopsy/images/speeddialentry.png new file mode 100644 index 0000000000000000000000000000000000000000..498c9e4bd2b398a2a5388b0a6f1565e32104c576 GIT binary patch literal 724 zcmV;_0xSKAP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0%=J^K~y+Tb&}0% z6Hye!f0N84k(y{yTKb8gSdCRQ&_!$A6j2wtkh<)~zo6*K(xvFig@1v#DJ}#T7SSpc z{3wcTA&R1Q(N?jwwV2PDWM(p%dA^jPO=)`I4sYH)_uO-5E)rs|xG~ZuM7m#;ru&5W zJSZk^AKArG{KGCJq6*71SI|%hsR2GMY|uCS-p_7hOJJb?3}ZL1gXdyfVR}z3l02rO z>mIR0knwSYLmdZc?{4MJy$8(Af2oyi3%q)Ap9{n1A*(|`P>H_8ENiGi_%Nl=67J!2 zsuMcmJbme$OM(vvRB^A?&~Cg4~US1WvdYa;9nIHq4!CxBgqat6=L60vPgcE(7a z$m11qXw?iek9As_Dk#E`B63V0+X7BmhO|~GqPZr~1M3K9ors&`;|qhXW|gkEq}S|M zCD%ut1DPoOLzJ^Ja){6@VXMf(tbzSk(A!-lJn=E3UcqQ70fBm>Cpj11qodeNN#=+94jx$rH$Tk@;wSNUj!vCE0g*PnkBMn@eUPE;x7RJvPL6xnK%7*M!7 znPqNK?v0Py{f-z)A+8O|eQuCz5IZj-8scnH*>SgbApQep2|_7&C)ExB0000(Arrays.asList(new String[] {"Calendar Entry Type", "Description", "Start Date/Time", "End Date/Time", "Location", "Source File" })); break; + case TSK_SPEED_DIAL_ENTRY: + columnHeaders = new ArrayList(Arrays.asList(new String[] {"Dial String", "Person Name", "Phone Number", "Source File" })); + break; + case TSK_BLUETOOTH_PAIRING: + columnHeaders = new ArrayList(Arrays.asList(new String[] {"Device Name", "Device Address", "Date/Time", "Source File" })); + break; + case TSK_GPS_TRACKPOINT: + columnHeaders = new ArrayList(Arrays.asList(new String[] {"Latitude", "Longitude", "Altitude", "Name", "Location Address", "Date/Time", "Source File" })); + break; + case TSK_GPS_BOOKMARK: + columnHeaders = new ArrayList(Arrays.asList(new String[] {"Latitude", "Longitude", "Altitude", "Name", "Location Address", "Date/Time", "Source File" })); + break; + case TSK_GPS_LAST_KNOWN_LOCATION: + columnHeaders = new ArrayList(Arrays.asList(new String[] {"Latitude", "Longitude", "Altitude", "Name", "Location Address", "Date/Time", "Source File" })); + break; + case TSK_GPS_SEARCH: + columnHeaders = new ArrayList(Arrays.asList(new String[] {"Latitude", "Longitude", "Altitude", "Name", "Location Address", "Date/Time", "Source File" })); + break; + case TSK_SERVICE_ACCOUNT: + columnHeaders = new ArrayList(Arrays.asList(new String[] {"Category", "User ID", "Password", "Person Name", "App Name", "URL", "App Path", "Mailbox Name", "ReplyTo Address", "Mail Server", "Source File" })); + break; default: return null; } @@ -921,6 +942,75 @@ public class ReportGenerator { calEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID())); calEntry.add(getFileUniquePath(entry.getKey().getObjectID())); return calEntry; + case TSK_SPEED_DIAL_ENTRY: + List speedDialEntry = new ArrayList(); + speedDialEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DIAL_STRING.getTypeID())); + speedDialEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME_PERSON.getTypeID())); + speedDialEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER.getTypeID())); + speedDialEntry.add(getFileUniquePath(entry.getKey().getObjectID())); + return speedDialEntry; + case TSK_BLUETOOTH_PAIRING: + List bluetoothEntry = new ArrayList(); + bluetoothEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DEVICE_NAME.getTypeID())); + bluetoothEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DEVICE_ID.getTypeID())); + bluetoothEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); + bluetoothEntry.add(getFileUniquePath(entry.getKey().getObjectID())); + return bluetoothEntry; + case TSK_GPS_TRACKPOINT: + List gpsTrackpoint = new ArrayList(); + gpsTrackpoint.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID())); + gpsTrackpoint.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID())); + gpsTrackpoint.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE.getTypeID())); + gpsTrackpoint.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME.getTypeID())); + gpsTrackpoint.add(attributes.get(ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID())); + gpsTrackpoint.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); + gpsTrackpoint.add(getFileUniquePath(entry.getKey().getObjectID())); + return gpsTrackpoint; + case TSK_GPS_BOOKMARK: + List gpsBookmarkEntry = new ArrayList(); + gpsBookmarkEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID())); + gpsBookmarkEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID())); + gpsBookmarkEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE.getTypeID())); + gpsBookmarkEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME.getTypeID())); + gpsBookmarkEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID())); + gpsBookmarkEntry.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); + gpsBookmarkEntry.add(getFileUniquePath(entry.getKey().getObjectID())); + return gpsBookmarkEntry; + case TSK_GPS_LAST_KNOWN_LOCATION: + List gpsLastLocation = new ArrayList(); + gpsLastLocation.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID())); + gpsLastLocation.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID())); + gpsLastLocation.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE.getTypeID())); + gpsLastLocation.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME.getTypeID())); + gpsLastLocation.add(attributes.get(ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID())); + gpsLastLocation.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); + gpsLastLocation.add(getFileUniquePath(entry.getKey().getObjectID())); + return gpsLastLocation; + case TSK_GPS_SEARCH: + List gpsSearch = new ArrayList(); + gpsSearch.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID())); + gpsSearch.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID())); + gpsSearch.add(attributes.get(ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE.getTypeID())); + gpsSearch.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME.getTypeID())); + gpsSearch.add(attributes.get(ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID())); + gpsSearch.add(attributes.get(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID())); + gpsSearch.add(getFileUniquePath(entry.getKey().getObjectID())); + return gpsSearch; + case TSK_SERVICE_ACCOUNT: + List appAccount = new ArrayList(); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_CATEGORY.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_USER_ID.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_PASSWORD.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_NAME.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_URL.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_PATH.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_MAILBOX_NAME.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO.getTypeID())); + appAccount.add(attributes.get(ATTRIBUTE_TYPE.TSK_SERVER_NAME.getTypeID())); + appAccount.add(getFileUniquePath(entry.getKey().getObjectID())); + return appAccount; + } return null; diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java index 3c660cade9..a02c47a757 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java @@ -734,6 +734,43 @@ public class ReportHTML implements TableReportModule { in.close(); output.close(); + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/speeddialentry.png"); + output = new FileOutputStream(new File(path + File.separator + "Speed Dial Entries.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/bluetooth.png"); + output = new FileOutputStream(new File(path + File.separator + "BlueTooth.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/gpsfav.png"); + output = new FileOutputStream(new File(path + File.separator + "GPS Bookmarks.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/gps-lastlocation.png"); + output = new FileOutputStream(new File(path + File.separator + "GPS Last Location.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/gps-search.png"); + output = new FileOutputStream(new File(path + File.separator + "GPS Search.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/account-icon-16.png"); + output = new FileOutputStream(new File(path + File.separator + "Accounts.png")); + FileUtil.copy(in, output); + in.close(); + output.close(); + + } catch (IOException ex) { logger.log(Level.SEVERE, "Failed to extract images for HTML report.", ex); diff --git a/Core/src/org/sleuthkit/autopsy/report/images/account-icon-16.png b/Core/src/org/sleuthkit/autopsy/report/images/account-icon-16.png new file mode 100644 index 0000000000000000000000000000000000000000..73d9cfeabbe96c505e6921c5f0d68d3db0f42b09 GIT binary patch literal 832 zcmV-G1Hb%k7RCwBaQ%y(|VHkeCnc3ZT)!k*) zbT?fnwJcEXQ5BSdRTO+WTaDg@Ftqv{$n=ieYX%fW?Jp_L>`ZfHBNCNSHRZ?n z@Br*ZHAsj83eOZE$Lj?j(Qxh5aqJUw4m)EUBuVX&H8V8gfC3hTTf@7d`*^+(KP0=+ zNobmrZcu=DT%qzbh+-Utl~*X34d>h$D6PuJ1K%UmeOEwsBf7+76aAKUe!iGx7|Y3t zJp*@R>P&I%)yl1v-w20z$O!@0n;Xz2voMoX5Joi^DHme8xy>dG&S zL`%^?f6@=CNL6Hb+*xqDJqFO;^hpmmB2xg>db_3dTi)e1Z%u7Iq=ba24^Pn7+Xr8} z4=z_atQHd(&UDC7-2=9)w6rxfEp0X@_k_ciVn=3X2FlCJ!J4d?nVZG*^c1|FY2zXqa|02c`q18ifx*WZFK9CiB-97G#W1l9 ztcjffmtwPFF&Km^Jqvtz9r^kB#&jDSo5;yMiKXRbILr*h{+ksC*#(+gK!kL3+|iC% zZLnCZU>JsiY=Grh*zGRe8%UxEafgRRmB^c-E|?V&tfu@0Vgw-;5MtW~dpNXauq(1` zocYi?VzDg+k0 literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/images/bluetooth.png b/Core/src/org/sleuthkit/autopsy/report/images/bluetooth.png new file mode 100644 index 0000000000000000000000000000000000000000..a54acb00a1d674f02e6689f2ab3a7f7e873cf3ce GIT binary patch literal 744 zcmVP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0)0tDK~y+TbyGcP z6j2cV-tHMayhDg*JTEGdL*cA|ntk$6h(ZgW4o``-A?+q2BT+%j+Gee-?u=8Vult3_Q@YcT@j!!6B;!Dy)u zrNVX}dw^T7zhds?PoNO;#LzXvpCACl(HU!>|KG@BVX}hxi9-bFL}F%F5gf?FguP4p z4GGqXVEW6D&4#uHEZsQ>zwUb*vUCE$T0I5g7CnZWN>f{ZhDxSSyFui z{Q3-YbfQhh>M{ze1A)J?cT3G)1oPn*lj2*%FC)qZ63eIo)W1HT3e zK>A)r*TFWLkdagVvYHHz!Zsu3dNm#-1s|9aba7JBB7k=xsgI<6cM2Fe4IH}wESv>C zt-!ckCV?__;Hp2HfwJ)L%!JtnJm%D|K7-ja40HGlP(A`Ym}WJ%kFVsHO9w#7ltA6e zLKA#{H2=a}dj}LN{!E_Ea`Sk0W0ko-S&at~55d*vf#o)6VhhTN@HGEt;y|4~7ft7+rYyqPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0g_2XK~y+Tg_F%o z0znwYpUtw}jr>9h!y@rmx6XCTb9L$1%`V;g6N1j69fBx`ZW4W53JJPM-a^EvKnzq$ zG+cBEG2C_9*@i9MRe!L|zR$e#?7K7bazq0?G@DI`qR67bjIhz5(P$w1^vt5+m<*gw zCz7cYi-uz|pls*vLB3=b4T0{#e?E>6NPV6o?ei0+48~+|=JAjhKZvrkK~%NF)c$n+ zg3@Z?Tau71Yn4f5sJC%8)1NMb+-4YVJ5bl&^XXTNJlw!^#yuDYO7$H`B;oY}lRS{l zRAC#pqZL158P*sErTtylw7cV)pbrOG`}Esg62j67%do~U2<{z%TU>zH)+!JP92`&_ zn*#iEETa!>GYtyi8IqX>xz?s0Gg+pZ>2!WisB04`vxy=^H?VvfMWOo1)IVfdMx|0= z5n$O&L{-4qMsaa@h4r;nK@cEm_o7y->5F|n zAA-RkLZOh}GZf1TC{&I_w!rf|VzDSwdjWm``nMlv*a#q000000NkvXXu0mjf_f6Rn literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/images/gps-search.png b/Core/src/org/sleuthkit/autopsy/report/images/gps-search.png new file mode 100644 index 0000000000000000000000000000000000000000..26c97d488809de8088c6896490014015a5beb5f0 GIT binary patch literal 958 zcmV;v13~Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn z4jTXf02y>eSaefwW^{L9a%BK_cXuvnZfkR6VQ^(GZ*pgw?mQX*00SOLL_t(IPmPj2 zY#VhL#(#I`^T*kD{z_syA2@E@q){NKkjrHR_aj$^xLpY8Mc?tJ_mXJF)+{vUdNdf)eXrM_ncf3@zA zRHwyntw zGjIdy-8R1B(0bS=>MvkKvpBv>Qvhc39?!2_6m}JPM9G9tFbo0|N2cHEpebPz5tW_a zP0lR5!I`yn7FUWC7jrzjw92D{6#wiz7+J@FXpknR#8KulVEH(KsHW9pIe!5y<>5&K zqH35aJ&P1`Nl(b!+x!opFE@yV3;{7nr*a%vRqp+{%l!N)f`NhG&tSDun5Is}v!wH|f#W(Pvpb}7574z38#5c2yKTae2(l!JEV~Khkc2E6azuo>T4E|+ z;?o=N^TRhkkWWBW&%>LyO#U{1;K(Z^qt?A6%Z zZxSy|vi{t8a;XAARHjjXOh}IKOu5X`^u`$Q*u2kPcc1)>!j1QCbLZwS)LKt?_u4z0 zI~!xGc|fyLr)f6n=pNl zrzKclK22^VN46lMw09{N7DrZO*Kx6Gj3h~4r|ci&8x5Q()m^FxJ+tdo5Nv| zPRyce*9byBx-@|?86N|DhSJ#~`FD(7V~gseE_!>C zWMzR3?d2o$NJlg1_B=lM@NH_{30`~kb&B(|$KPZ5BAJfWA!+CkI(|IX5ny!a+G5|s gAr$3kEdNvRFVrnyOyAjydjJ3c07*qoM6N<$f_xFYNB{r; literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/images/gps_trackpoint.png b/Core/src/org/sleuthkit/autopsy/report/images/gps_trackpoint.png new file mode 100644 index 0000000000000000000000000000000000000000..78f1f97dcc3026b5cbe20a356df6eb7ea56d97ff GIT binary patch literal 661 zcmV;G0&4wPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf02y>eSaefwW^{L9 za%BKPWN%_+AW3auXJt}lVPtu6$z?nM00IR`L_t(IPmPmJYZFlvhMzmhOoK`lt5P?9 z5UC5HA_Wn_trel*#;Uj}f@0mc7eVkx*p(J>Q57jwH?9OX)e0?C5TT*9>Y~=#*qCI} zNoMZ#Oy&xSO^Of9aPFD+y!YIXQ6}d5eaz3tU^FPjrWhj{2es=Gs{0Dc1V4dTaBLH3SRhKUbP$t|xC1Uo2{U5e!lcV69MaixIAL7q&H^I&=m z+^tCsv4QN9sYx6u$~DD8ex3Pzss1ed@>wb>7T1#8w?ZTunO&=-MrzaXPMfNDg${k$ zey(ecC(CI?HLB8g=rpWOB{g#F%2bw2^l~q%>nP67ciP6NsrkjXnZlmW$q$3a2*+crw8~df1 zriL4F_77rwIo?V|;>$L>k+ue^t5@FJ(0)9QEXwP&nT>2};ARK# vdIs&NHEj(_WuIK_FrPb4kzZ^051N2KzYqffdU?>O00000NkvXXu0mjf+oC0# literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/images/gpsfav.png b/Core/src/org/sleuthkit/autopsy/report/images/gpsfav.png new file mode 100644 index 0000000000000000000000000000000000000000..721dba3d50d257656fffe7fd2b738a6aa7bf277c GIT binary patch literal 643 zcmV-}0(||6P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0vJg|K~y+Tm6Oj; z(_kEjpN*}stw;jfVjBDv@CVTV#-N8?lw>C^UQLKsj~+ew4;bTtD;JD21iV0qF+q$s z=8`GFjlo=`fM~7IRU{0^e$=jOre!helYG0g z^K5d$9{n2*L1Ax~&sveE&(n;ICmDa4F}uau;vaAbetgf9Ror~adq^owj4t{K-(RP4 zxMwFCaR|1*ePMO0iNvzXo3(wCg;uuqJ9zXYZ6_LW2;MF(v8Id6BsJ3cW_CTtXkY(G z^lH#fG~y7vN^G#XlBZlb#NBlU??I7Bn@nGCmz`*&E-06Z^z}#>AMRkx-C|IlO7cUvDS`K|B&MGIH6F8?(S|P zw;wYhXbGx6m?iT05Cj32%T+T}1&Kt$7#kZiG)=2c9hg_Ms#2-g9Vf`LY(%3`V`yl| dZv792@e}l(Ea-jz89M*~002ovPDHLkV1kaz8e{+f literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/images/speeddialentry.png b/Core/src/org/sleuthkit/autopsy/report/images/speeddialentry.png new file mode 100644 index 0000000000000000000000000000000000000000..498c9e4bd2b398a2a5388b0a6f1565e32104c576 GIT binary patch literal 724 zcmV;_0xSKAP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0%=J^K~y+Tb&}0% z6Hye!f0N84k(y{yTKb8gSdCRQ&_!$A6j2wtkh<)~zo6*K(xvFig@1v#DJ}#T7SSpc z{3wcTA&R1Q(N?jwwV2PDWM(p%dA^jPO=)`I4sYH)_uO-5E)rs|xG~ZuM7m#;ru&5W zJSZk^AKArG{KGCJq6*71SI|%hsR2GMY|uCS-p_7hOJJb?3}ZL1gXdyfVR}z3l02rO z>mIR0knwSYLmdZc?{4MJy$8(Af2oyi3%q)Ap9{n1A*(|`P>H_8ENiGi_%Nl=67J!2 zsuMcmJbme$OM(vvRB^A?&~Cg4~US1WvdYa;9nIHq4!CxBgqat6=L60vPgcE(7a z$m11qXw?iek9As_Dk#E`B63V0+X7BmhO|~GqPZr~1M3K9ors&`;|qhXW|gkEq}S|M zCD%ut1DPoOLzJ^Ja){6@VXMf(tbzSk(A!-lJn=E3UcqQ70fBm>Cpj11qodeNN#=+94jx$rH$Tk@;wSNUj!vCE0g*PnkBMn@eUPE;x7RJvPL6xnK%7*M!7 znPqNK?v0Py{f-z)A+8O|eQuCz5IZj-8scnH*>SgbApQep2|_7&C)ExB0000