From 0739778c381fc3637975bc29d1d190c8eeb59571 Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Thu, 27 Feb 2025 16:31:44 -0500 Subject: [PATCH 1/7] Update about panel Update about panel --- .../autopsy/corecomponents/AboutWindowPanel.form | 12 +++--------- .../autopsy/corecomponents/AboutWindowPanel.java | 8 +++----- .../autopsy/corecomponents/Bundle.properties | 2 +- .../autopsy/corecomponents/Bundle.properties-MERGED | 3 ++- 4 files changed, 9 insertions(+), 16 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.form b/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.form index 961034106d..9d6d2d3d66 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.form +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.form @@ -45,10 +45,10 @@ - + + + - - @@ -119,9 +119,6 @@ - - - @@ -130,9 +127,6 @@ - - - diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.java b/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.java index 720f0dd462..72cdd6484f 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/AboutWindowPanel.java @@ -139,7 +139,6 @@ public final class AboutWindowPanel extends JPanel implements HyperlinkListener description.setContentType("text/html"); // NOI18N jScrollPane2.setViewportView(description); - verboseLoggingButton.setBackground(new java.awt.Color(255, 255, 255)); verboseLoggingButton.setText("Activate verbose logging"); verboseLoggingButton.addActionListener(new java.awt.event.ActionListener() { public void actionPerformed(java.awt.event.ActionEvent evt) { @@ -147,7 +146,6 @@ public final class AboutWindowPanel extends JPanel implements HyperlinkListener } }); - jButton2.setBackground(new java.awt.Color(255, 255, 255)); jButton2.setText(NbBundle.getMessage(AboutWindowPanel.class, "LBL_Close")); // NOI18N jButton2.addActionListener(new java.awt.event.ActionListener() { public void actionPerformed(java.awt.event.ActionEvent evt) { @@ -178,10 +176,10 @@ public final class AboutWindowPanel extends JPanel implements HyperlinkListener .addContainerGap() .addComponent(logoLabel) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) - .addComponent(jScrollPane3, javax.swing.GroupLayout.PREFERRED_SIZE, 140, javax.swing.GroupLayout.PREFERRED_SIZE) + .addComponent(jScrollPane3, javax.swing.GroupLayout.DEFAULT_SIZE, 184, Short.MAX_VALUE) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) + .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 130, javax.swing.GroupLayout.PREFERRED_SIZE) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) - .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 139, javax.swing.GroupLayout.PREFERRED_SIZE) - .addGap(18, 18, Short.MAX_VALUE) .addComponent(verboseLoggingButton) .addGap(18, 18, 18) .addComponent(jButton2) diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties b/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties index d11006a6fe..9748f88b12 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties @@ -17,7 +17,7 @@ DataContentViewerHex.pageLabel2.text=Page # Product Information panel LBL_Description=
\n Product Version: {0} ({9})
Sleuth Kit Version: {7}
Netbeans RCP Build: {8}
Java: {1}; {2}
System: {3}; {4}; {5}
Userdir: {6}
Format_OperatingSystem_Value={0} version {1} running on {2} -LBL_Copyright=
Autopsy™ is a digital forensics platform based on The Sleuth Kit™ and other tools.
Copyright © 2003-2020.
+LBL_Copyright=
Autopsy™ is a digital forensics platform based on The Sleuth Kit™ and other tools.
Copyright © 2003-2025 Sleuth Kit Labs, Inc.

Maintained by: Sleuth Kit Labs https://www.sleuthkitlabs.com

Sponsored by: Cyber Triage https://www.cybertriage.com
URL_ON_IMG=http://www.sleuthkit.org/ FILE_FOR_LOCAL_HELP=file:/// INDEX_FOR_LOCAL_HELP=/docs/index.html diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties-MERGED index 0636340b0b..cac308ca8f 100755 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties-MERGED @@ -26,6 +26,7 @@ AutopsyOptionsPanel_storeTempDir_onError_title=Error Saving Temporary Directory # {0} - path AutopsyOptionsPanel_tempDirectoryBrowseButtonActionPerformed_onInvalidPath_description=Unable to create temporary directory within specified path: {0} AutopsyOptionsPanel_tempDirectoryBrowseButtonActionPerformed_onInvalidPath_title=Path cannot be used +CTL_CustomAboutAction=About CTL_DataContentAction=DataContent CTL_DataContentTopComponent=Data Content CTL_OfflineHelpAction=Offline Autopsy Documentation @@ -77,7 +78,7 @@ DataContentViewerHex.pageLabel2.text=Page # Product Information panel LBL_Description=
\n Product Version: {0} ({9})
Sleuth Kit Version: {7}
Netbeans RCP Build: {8}
Java: {1}; {2}
System: {3}; {4}; {5}
Userdir: {6}
Format_OperatingSystem_Value={0} version {1} running on {2} -LBL_Copyright=
Autopsy™ is a digital forensics platform based on The Sleuth Kit™ and other tools.
Copyright © 2003-2020.
+LBL_Copyright=
Autopsy™ is a digital forensics platform based on The Sleuth Kit™ and other tools.
Copyright © 2003-2025 Sleuth Kit Labs, Inc.

Maintained by: Sleuth Kit Labs https://www.sleuthkitlabs.com

Sponsored by: Cyber Triage https://www.cybertriage.com
SortChooser.dialogTitle=Choose Sort Criteria ThumbnailViewChildren.progress.cancelling=(Cancelling) # {0} - file name From ee683d7f893af8532a0f70f0a612e1a69a24409f Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Fri, 28 Feb 2025 10:16:21 -0500 Subject: [PATCH 2/7] Update Release Numbers Update Release Numbers --- Core/nbproject/project.properties | 4 ++-- Core/nbproject/project.xml | 8 ++++---- TSKVersion.xml | 2 +- .../org/netbeans/core/windows/view/ui/Bundle.properties | 6 +++--- docs/doxygen-user/Doxyfile | 4 ++-- docs/doxygen/Doxyfile | 4 ++-- nbproject/project.properties | 2 +- unix_setup.sh | 2 +- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/Core/nbproject/project.properties b/Core/nbproject/project.properties index 78007a1805..8c81dceaa9 100644 --- a/Core/nbproject/project.properties +++ b/Core/nbproject/project.properties @@ -93,8 +93,8 @@ file.reference.okio-jvm-3.6.0.jar=release/modules/ext/okio-jvm-3.6.0.jar file.reference.postgresql-42.7.3.jar=release/modules/ext/postgresql-42.7.3.jar file.reference.sevenzipjbinding-AllPlatforms.jar=release/modules/ext/sevenzipjbinding-AllPlatforms.jar file.reference.sevenzipjbinding.jar=release/modules/ext/sevenzipjbinding.jar -file.reference.sleuthkit-4.12.1.jar=release/modules/ext/sleuthkit-4.12.1.jar -file.reference.sleuthkit-caseuco-4.12.1.jar=release/modules/ext/sleuthkit-caseuco-4.12.1.jar +file.reference.sleuthkit-4.13.0.jar=release/modules/ext/sleuthkit-4.13.0.jar +file.reference.sleuthkit-caseuco-4.13.0.jar=release/modules/ext/sleuthkit-caseuco-4.13.0.jar file.reference.slf4j-api-1.7.30.jar=release/modules/ext/slf4j-api-1.7.30.jar file.reference.snakeyaml-2.3.jar=release/modules/ext/snakeyaml-2.3.jar file.reference.spotbugs-annotations-4.8.6.jar=release/modules/ext/spotbugs-annotations-4.8.6.jar diff --git a/Core/nbproject/project.xml b/Core/nbproject/project.xml index 5f67399107..ec2748c7c7 100644 --- a/Core/nbproject/project.xml +++ b/Core/nbproject/project.xml @@ -742,12 +742,12 @@ release/modules/ext/sevenzipjbinding.jar - ext/sleuthkit-4.12.1.jar - release/modules/ext/sleuthkit-4.12.1.jar + ext/sleuthkit-4.13.0.jar + release/modules/ext/sleuthkit-4.13.0.jar - ext/sleuthkit-caseuco-4.12.1.jar - release/modules/ext/sleuthkit-caseuco-4.12.1.jar + ext/sleuthkit-caseuco-4.13.0.jar + release/modules/ext/sleuthkit-caseuco-4.13.0.jar ext/slf4j-api-1.7.30.jar diff --git a/TSKVersion.xml b/TSKVersion.xml index 7f6a1a8848..aaf7bb7ed1 100644 --- a/TSKVersion.xml +++ b/TSKVersion.xml @@ -1,3 +1,3 @@ - + diff --git a/branding/modules/org-netbeans-core-windows.jar/org/netbeans/core/windows/view/ui/Bundle.properties b/branding/modules/org-netbeans-core-windows.jar/org/netbeans/core/windows/view/ui/Bundle.properties index 9f44e2301b..597e2e8bdd 100644 --- a/branding/modules/org-netbeans-core-windows.jar/org/netbeans/core/windows/view/ui/Bundle.properties +++ b/branding/modules/org-netbeans-core-windows.jar/org/netbeans/core/windows/view/ui/Bundle.properties @@ -1,4 +1,4 @@ #Updated by build script -#Fri, 03 Jan 2025 17:15:38 -0500 -CTL_MainWindow_Title=Autopsy 4.21.0 -CTL_MainWindow_Title_No_Project=Autopsy 4.21.0 +#Thu, 27 Feb 2025 16:58:14 -0500 +CTL_MainWindow_Title=Autopsy 4.22.0 +CTL_MainWindow_Title_No_Project=Autopsy 4.22.0 diff --git a/docs/doxygen-user/Doxyfile b/docs/doxygen-user/Doxyfile index 3a09612a74..24cfe1aa9b 100644 --- a/docs/doxygen-user/Doxyfile +++ b/docs/doxygen-user/Doxyfile @@ -38,7 +38,7 @@ PROJECT_NAME = "Autopsy User Documentation" # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 4.21.0 +PROJECT_NUMBER = 4.22.0 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a @@ -1025,7 +1025,7 @@ GENERATE_HTML = YES # The default directory is: html. # This tag requires that the tag GENERATE_HTML is set to YES. -HTML_OUTPUT = 4.21.0 +HTML_OUTPUT = 4.22.0 # The HTML_FILE_EXTENSION tag can be used to specify the file extension for each # generated HTML page (for example: .htm, .php, .asp). diff --git a/docs/doxygen/Doxyfile b/docs/doxygen/Doxyfile index b0fdaea78c..11a3f3f4e6 100644 --- a/docs/doxygen/Doxyfile +++ b/docs/doxygen/Doxyfile @@ -38,7 +38,7 @@ PROJECT_NAME = "Autopsy" # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 4.21.0 +PROJECT_NUMBER = 4.22.0 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears a the top of each page and should give viewer a @@ -1066,7 +1066,7 @@ GENERATE_HTML = YES # The default directory is: html. # This tag requires that the tag GENERATE_HTML is set to YES. -HTML_OUTPUT = api-docs/4.21.0/ +HTML_OUTPUT = api-docs/4.22.0/ # The HTML_FILE_EXTENSION tag can be used to specify the file extension for each # generated HTML page (for example: .htm, .php, .asp). diff --git a/nbproject/project.properties b/nbproject/project.properties index d613ea09d4..972ac0dae1 100644 --- a/nbproject/project.properties +++ b/nbproject/project.properties @@ -4,7 +4,7 @@ app.title=Autopsy ### lowercase version of above app.name=${branding.token} ### if left unset, version will default to today's date -app.version=4.21.0 +app.version=4.22.0 ### build.type must be one of: DEVELOPMENT, RELEASE #build.type=RELEASE build.type=DEVELOPMENT diff --git a/unix_setup.sh b/unix_setup.sh index ab2d1094f6..95b04b48ee 100644 --- a/unix_setup.sh +++ b/unix_setup.sh @@ -5,7 +5,7 @@ # NOTE: update_sleuthkit_version.pl updates this value and relies # on it keeping the same name and whitespace. Don't change it. -TSK_VERSION=4.12.1 +TSK_VERSION=4.13.0 usage() { From 608561563cd03e351accf8640c87e7334bc3201e Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Mon, 10 Mar 2025 20:14:37 -0400 Subject: [PATCH 3/7] Update nbm versions Update the nbm versions --- Core/manifest.mf | 2 +- Core/nbproject/project.properties | 2 +- Experimental/manifest.mf | 2 +- Experimental/nbproject/project.properties | 2 +- Experimental/nbproject/project.xml | 2 +- ImageGallery/nbproject/project.xml | 2 +- KeywordSearch/nbproject/project.xml | 2 +- RecentActivity/manifest.mf | 2 +- RecentActivity/nbproject/project.xml | 2 +- Testing/nbproject/project.xml | 2 +- thunderbirdparser/nbproject/project.xml | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/Core/manifest.mf b/Core/manifest.mf index 683690ef1b..1320292842 100644 --- a/Core/manifest.mf +++ b/Core/manifest.mf @@ -2,7 +2,7 @@ Manifest-Version: 1.0 OpenIDE-Module: org.sleuthkit.autopsy.core/10 OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/core/Bundle.properties OpenIDE-Module-Layer: org/sleuthkit/autopsy/core/layer.xml -OpenIDE-Module-Implementation-Version: 38 +OpenIDE-Module-Implementation-Version: 39 OpenIDE-Module-Requires: org.openide.windows.WindowManager AutoUpdate-Show-In-Client: true AutoUpdate-Essential-Module: true diff --git a/Core/nbproject/project.properties b/Core/nbproject/project.properties index 8c81dceaa9..e655a6e120 100644 --- a/Core/nbproject/project.properties +++ b/Core/nbproject/project.properties @@ -113,4 +113,4 @@ license.file=../LICENSE-2.0.txt nbm.homepage=http\://www.sleuthkit.org/ nbm.module.author=Brian Carrier nbm.needs.restart=true -spec.version.base=10.25 +spec.version.base=10.26 diff --git a/Experimental/manifest.mf b/Experimental/manifest.mf index ddddfe9c58..0f27b6bc92 100644 --- a/Experimental/manifest.mf +++ b/Experimental/manifest.mf @@ -1,7 +1,7 @@ Manifest-Version: 1.0 AutoUpdate-Show-In-Client: true OpenIDE-Module: org.sleuthkit.autopsy.experimental/1 -OpenIDE-Module-Implementation-Version: 1 +OpenIDE-Module-Implementation-Version: 2 OpenIDE-Module-Layer: org/sleuthkit/autopsy/experimental/autoingest/layer.xml OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/experimental/autoingest/Bundle.properties OpenIDE-Module-Requires: org.openide.windows.WindowManager diff --git a/Experimental/nbproject/project.properties b/Experimental/nbproject/project.properties index bbab824d65..a40cb26945 100644 --- a/Experimental/nbproject/project.properties +++ b/Experimental/nbproject/project.properties @@ -1,4 +1,4 @@ file.reference.jtidy-r938.jar=release/modules/ext/jtidy-r938.jar javac.compilerargs=-Xlint -Xlint\:-serial javac.source=17 -spec.version.base=1.0 +spec.version.base=1.1 diff --git a/Experimental/nbproject/project.xml b/Experimental/nbproject/project.xml index 79af40a112..e0488e5d6e 100644 --- a/Experimental/nbproject/project.xml +++ b/Experimental/nbproject/project.xml @@ -144,7 +144,7 @@ 10 - 10.25 + 10.26 diff --git a/ImageGallery/nbproject/project.xml b/ImageGallery/nbproject/project.xml index 36f06cff28..742f8d3178 100644 --- a/ImageGallery/nbproject/project.xml +++ b/ImageGallery/nbproject/project.xml @@ -127,7 +127,7 @@ 10 - 10.25 + 10.26 diff --git a/KeywordSearch/nbproject/project.xml b/KeywordSearch/nbproject/project.xml index 0a55bf9789..8b0645bd77 100644 --- a/KeywordSearch/nbproject/project.xml +++ b/KeywordSearch/nbproject/project.xml @@ -128,7 +128,7 @@ 10 - 10.25 + 10.26 diff --git a/RecentActivity/manifest.mf b/RecentActivity/manifest.mf index 6ab9cc4ccc..807429ccb5 100644 --- a/RecentActivity/manifest.mf +++ b/RecentActivity/manifest.mf @@ -1,6 +1,6 @@ Manifest-Version: 1.0 OpenIDE-Module: org.sleuthkit.autopsy.recentactivity/6 -OpenIDE-Module-Implementation-Version: 20 +OpenIDE-Module-Implementation-Version: 21 OpenIDE-Module-Layer: org/sleuthkit/autopsy/recentactivity/layer.xml OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/recentactivity/Bundle.properties OpenIDE-Module-Requires: diff --git a/RecentActivity/nbproject/project.xml b/RecentActivity/nbproject/project.xml index 208d1d0e51..bdeec938be 100644 --- a/RecentActivity/nbproject/project.xml +++ b/RecentActivity/nbproject/project.xml @@ -69,7 +69,7 @@ 10 - 10.24 + 10.26 diff --git a/Testing/nbproject/project.xml b/Testing/nbproject/project.xml index cee5e3ed5b..6a7d9447d4 100644 --- a/Testing/nbproject/project.xml +++ b/Testing/nbproject/project.xml @@ -47,7 +47,7 @@ 10 - 10.25 + 10.26 diff --git a/thunderbirdparser/nbproject/project.xml b/thunderbirdparser/nbproject/project.xml index c9a66fe5db..0f815998b9 100644 --- a/thunderbirdparser/nbproject/project.xml +++ b/thunderbirdparser/nbproject/project.xml @@ -54,7 +54,7 @@ 10 - 10.25 + 10.26 From 89595cff141bda657f591c59df6006597edf1820 Mon Sep 17 00:00:00 2001 From: "eugene.livis" Date: Tue, 11 Mar 2025 11:53:51 -0400 Subject: [PATCH 4/7] Bug fixes --- .../casemodule/services/TagSetDefinition.java | 85 ++++++++++++++++++- 1 file changed, 83 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java index 6303e2736e..55ca3cb772 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java @@ -6,6 +6,15 @@ package org.sleuthkit.autopsy.casemodule.services; import com.google.gson.Gson; +import com.google.gson.GsonBuilder; +import com.google.gson.JsonArray; +import com.google.gson.JsonDeserializationContext; +import com.google.gson.JsonDeserializer; +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonParseException; +import com.google.gson.JsonSyntaxException; +import java.lang.reflect.Type; import java.io.File; import java.io.FileWriter; import java.io.IOException; @@ -17,13 +26,19 @@ import java.util.List; import javax.annotation.concurrent.Immutable; import java.io.FileFilter; import java.io.FileReader; +import java.util.logging.Level; +import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.PlatformUtil; +import org.sleuthkit.datamodel.TagName; +import org.sleuthkit.datamodel.TskData; /** * Definition of a tag set. */ @Immutable final public class TagSetDefinition { + + private static final Logger LOGGER = Logger.getLogger(TagSetDefinition.class.getName()); private final static String FILE_NAME_TEMPLATE = "%s-tag-set.json"; private final static Path TAGS_USER_CONFIG_DIR = Paths.get(PlatformUtil.getUserConfigDirectory(), "tags"); @@ -102,10 +117,24 @@ final public class TagSetDefinition { } File[] fileList = dir.listFiles(new TagSetJsonFileFilter()); - Gson gson = new Gson(); + if (fileList == null) { + return tagSetList; + } + + Gson gson = new GsonBuilder() + .registerTypeAdapter(TagSetDefinition.class, new TagSetDefinitionDeserializer()) // Use custom deserializer + .create(); + for (File file : fileList) { try (FileReader reader = new FileReader(file)) { - tagSetList.add(gson.fromJson(reader, TagSetDefinition.class)); + TagSetDefinition tagSet = gson.fromJson(reader, TagSetDefinition.class); + if (tagSet != null) { + tagSetList.add(tagSet); + } + } catch (JsonSyntaxException e) { + LOGGER.log(Level.SEVERE, "Skipping invalid JSON file: " + file.getName() + " - " + e.getMessage()); + } catch (IOException e) { + LOGGER.log(Level.SEVERE, "Error reading file: " + file.getName() + " - " + e.getMessage()); } } @@ -132,4 +161,56 @@ final public class TagSetDefinition { } } + + // Custom JSON Deserializer for TagSetDefinition to support legacy user tags and tag set JSON files. + // In release 4.13.0 we: + // 1) renamed "TskData.KnownStatus" to "TskData.TagType" + // 2) renamed "TagSetDefinition.knownStatus" to "TagSetDefinition.tagType" + // 3) renamed "TskData.KnownStatus" of "unknown" used to carry a score if "suspicious". + // Now "TskData.TagType" of "unknown" used to carries a score if "unknown". + // + private static class TagSetDefinitionDeserializer implements JsonDeserializer { + + @Override + public TagSetDefinition deserialize(JsonElement json, Type typeOfT, JsonDeserializationContext context) throws JsonParseException { + JsonObject jsonObject = json.getAsJsonObject(); + + String name = jsonObject.has("name") ? jsonObject.get("name").getAsString() : null; + JsonArray tagArray = jsonObject.has("tagNameDefinitionList") ? jsonObject.getAsJsonArray("tagNameDefinitionList") : new JsonArray(); + List tagNameDefinitions = new ArrayList<>(); + + for (JsonElement element : tagArray) { + JsonObject tagObject = element.getAsJsonObject(); + + String displayName = tagObject.has("displayName") ? tagObject.get("displayName").getAsString() : null; + String description = tagObject.has("description") ? tagObject.get("description").getAsString() : null; + TagName.HTML_COLOR color = context.deserialize(tagObject.get("color"), TagName.HTML_COLOR.class); + + TskData.TagType tagType = null; + // Handle tagType vs knownStatus + if (tagObject.has("tagType") && !tagObject.get("tagType").isJsonNull()) { + tagType = context.deserialize(tagObject.get("tagType"), TskData.TagType.class); + } else if (tagObject.has("knownStatus") && !tagObject.get("knownStatus").isJsonNull()) { + TskData.TagType legacyStatus = context.deserialize(tagObject.get("knownStatus"), TskData.TagType.class); + + // Before release 4.13.0 "UNKNOWN" tag type used to carry an automatic "SUSPICIOUS" score. + // If knownStatus was "UNKNOWN", use "SUSPICIOUS" instead + if (legacyStatus == TskData.TagType.UNKNOWN) { + tagType = TskData.TagType.SUSPICIOUS; + } else { + tagType = legacyStatus; + } + } + + if (tagType == null) { + LOGGER.log(Level.SEVERE, "Failed to initialize tagType for tag: {0}. Skipping entry.", displayName); + continue; + } + + tagNameDefinitions.add(new TagNameDefinition(displayName, description, color, tagType)); + } + + return new TagSetDefinition(name, tagNameDefinitions); + } + } } From 0ae5675b086692fbd2d194bfcdcb8a53ca8e71e0 Mon Sep 17 00:00:00 2001 From: "eugene.livis" Date: Tue, 11 Mar 2025 11:57:01 -0400 Subject: [PATCH 5/7] Added comments --- .../autopsy/casemodule/services/TagSetDefinition.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java index 55ca3cb772..64c0d3a56b 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java @@ -163,7 +163,7 @@ final public class TagSetDefinition { } // Custom JSON Deserializer for TagSetDefinition to support legacy user tags and tag set JSON files. - // In release 4.13.0 we: + // In TSK release 4.13.0 and Autopsy release 4.22.0 we: // 1) renamed "TskData.KnownStatus" to "TskData.TagType" // 2) renamed "TagSetDefinition.knownStatus" to "TagSetDefinition.tagType" // 3) renamed "TskData.KnownStatus" of "unknown" used to carry a score if "suspicious". @@ -193,7 +193,7 @@ final public class TagSetDefinition { } else if (tagObject.has("knownStatus") && !tagObject.get("knownStatus").isJsonNull()) { TskData.TagType legacyStatus = context.deserialize(tagObject.get("knownStatus"), TskData.TagType.class); - // Before release 4.13.0 "UNKNOWN" tag type used to carry an automatic "SUSPICIOUS" score. + // "UNKNOWN" tag type used to carry an automatic "SUSPICIOUS" score. // If knownStatus was "UNKNOWN", use "SUSPICIOUS" instead if (legacyStatus == TskData.TagType.UNKNOWN) { tagType = TskData.TagType.SUSPICIOUS; From decfb0c6db0a51127e0c680028b3ee603f42f584 Mon Sep 17 00:00:00 2001 From: "eugene.livis" Date: Tue, 11 Mar 2025 11:58:18 -0400 Subject: [PATCH 6/7] Minor --- .../autopsy/casemodule/services/TagSetDefinition.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java index 64c0d3a56b..ed91b8e8fa 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java @@ -166,8 +166,8 @@ final public class TagSetDefinition { // In TSK release 4.13.0 and Autopsy release 4.22.0 we: // 1) renamed "TskData.KnownStatus" to "TskData.TagType" // 2) renamed "TagSetDefinition.knownStatus" to "TagSetDefinition.tagType" - // 3) renamed "TskData.KnownStatus" of "unknown" used to carry a score if "suspicious". - // Now "TskData.TagType" of "unknown" used to carries a score if "unknown". + // 3) "TskData.KnownStatus" of "unknown" used to carry a score if "suspicious". + // Now "TskData.TagType" of "unknown" carries a score if "unknown". // private static class TagSetDefinitionDeserializer implements JsonDeserializer { From 09e1b3e6ee887a26d16c84a45700ecf7b073af66 Mon Sep 17 00:00:00 2001 From: "eugene.livis" Date: Tue, 11 Mar 2025 11:59:19 -0400 Subject: [PATCH 7/7] Minor --- .../autopsy/casemodule/services/TagSetDefinition.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java index ed91b8e8fa..a771d5d067 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/TagSetDefinition.java @@ -166,8 +166,8 @@ final public class TagSetDefinition { // In TSK release 4.13.0 and Autopsy release 4.22.0 we: // 1) renamed "TskData.KnownStatus" to "TskData.TagType" // 2) renamed "TagSetDefinition.knownStatus" to "TagSetDefinition.tagType" - // 3) "TskData.KnownStatus" of "unknown" used to carry a score if "suspicious". - // Now "TskData.TagType" of "unknown" carries a score if "unknown". + // 3) "TskData.KnownStatus" of "unknown" used to carry a score of "suspicious". + // Now "TskData.TagType" of "unknown" carries a score of "unknown". // private static class TagSetDefinitionDeserializer implements JsonDeserializer {