From 919d8a83f899ac48711e82d509c38925553c22c6 Mon Sep 17 00:00:00 2001 From: APriestman Date: Tue, 3 Feb 2015 10:34:29 -0500 Subject: [PATCH 1/3] Added STIX module code to Autopsy. --- Core/nbproject/project.properties | 3 + Core/nbproject/project.xml | 8 + Core/src/org/sleuthkit/autopsy/core/layer.xml | 6 +- .../autopsy/modules/stix/Bundle.properties | 8 + .../autopsy/modules/stix/EvalAccountObj.java | 226 ++++++ .../autopsy/modules/stix/EvalAddressObj.java | 186 +++++ .../autopsy/modules/stix/EvalEmailObj.java | 274 +++++++ .../autopsy/modules/stix/EvalFileObj.java | 689 ++++++++++++++++++ .../modules/stix/EvalNetworkShareObj.java | 161 ++++ .../autopsy/modules/stix/EvalRegistryObj.java | 452 ++++++++++++ .../autopsy/modules/stix/EvalSystemObj.java | 302 ++++++++ .../autopsy/modules/stix/EvalURIObj.java | 149 ++++ .../modules/stix/EvalURLHistoryObj.java | 320 ++++++++ .../modules/stix/EvaluatableObject.java | 253 +++++++ .../modules/stix/ObservableResult.java | 198 +++++ .../modules/stix/STIXReportModule.java | 628 ++++++++++++++++ .../stix/STIXReportModuleConfigPanel.form | 101 +++ .../stix/STIXReportModuleConfigPanel.java | 193 +++++ .../modules/stix/StixArtifactData.java | 76 ++ 19 files changed, 4232 insertions(+), 1 deletion(-) create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/Bundle.properties create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalAccountObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalAddressObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalEmailObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalFileObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalNetworkShareObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalRegistryObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalSystemObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalURIObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvalURLHistoryObj.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/EvaluatableObject.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/ObservableResult.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModuleConfigPanel.form create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModuleConfigPanel.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/stix/StixArtifactData.java diff --git a/Core/nbproject/project.properties b/Core/nbproject/project.properties index 048f04de74..44efb40dac 100644 --- a/Core/nbproject/project.properties +++ b/Core/nbproject/project.properties @@ -1,10 +1,13 @@ file.reference.jdom-2.0.5-contrib.jar=release/modules/ext/jdom-2.0.5-contrib.jar file.reference.jdom-2.0.5.jar=release/modules/ext/jdom-2.0.5.jar file.reference.jython.jar=C:\\autopsy\\Core\\release\\modules\\ext\\jython.jar +file.reference.jython.jar-1=release/modules/ext/jython.jar file.reference.metadata-extractor-2.6.2.jar=release/modules/ext/metadata-extractor-2.6.2.jar +file.reference.Rejistry-1.0-SNAPSHOT.jar=release/modules/ext/Rejistry-1.0-SNAPSHOT.jar file.reference.sevenzipjbinding-AllPlatforms.jar=release/modules/ext/sevenzipjbinding-AllPlatforms.jar file.reference.sevenzipjbinding.jar=release/modules/ext/sevenzipjbinding.jar file.reference.sqlite-jdbc-3.7.15-M1.jar=release/modules/ext/sqlite-jdbc-3.7.15-M1.jar +file.reference.StixLib.jar=release/modules/ext/StixLib.jar file.reference.tika-core-1.2.jar=release/modules/ext/tika-core-1.2.jar file.reference.Tsk_DataModel.jar=release/modules/ext/Tsk_DataModel.jar file.reference.xmpcore.jar=release/modules/ext/xmpcore.jar diff --git a/Core/nbproject/project.xml b/Core/nbproject/project.xml index c9f8ec5aaa..178e1bd134 100644 --- a/Core/nbproject/project.xml +++ b/Core/nbproject/project.xml @@ -215,10 +215,18 @@ ext/jdom-2.0.5.jar release/modules/ext/jdom-2.0.5.jar + + ext/Rejistry-1.0-SNAPSHOT.jar + release/modules/ext/Rejistry-1.0-SNAPSHOT.jar + ext/sevenzipjbinding.jar release/modules/ext/sevenzipjbinding.jar + + ext/StixLib.jar + release/modules/ext/StixLib.jar + ext/sqlite-jdbc-3.7.15-M1.jar release/modules/ext/sqlite-jdbc-3.7.15-M1.jar diff --git a/Core/src/org/sleuthkit/autopsy/core/layer.xml b/Core/src/org/sleuthkit/autopsy/core/layer.xml index 60d4183118..2f36280e7a 100644 --- a/Core/src/org/sleuthkit/autopsy/core/layer.xml +++ b/Core/src/org/sleuthkit/autopsy/core/layer.xml @@ -320,7 +320,11 @@ - + + + + +