mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-09 06:39:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactored ExtractRegistry.getregistryfiles() to use several

Browse Source 
FileManager.findFiles calls in order to remove the raw SQL used to retrieve
registry files. Also renamed method to getRegistryFiles().
This commit is contained in:
Tim McIver 2012-11-27 17:34:38 -05:00
parent e8e9bd3558
commit 3824f90a0e
1 changed files with 42 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

93
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java
View File

@ -105,70 +105,61 @@ public class ExtractRegistry extends Extract implements IngestModuleImage {
public void setArguments(String args) { public void setArguments(String args) {
this.args = args; this.args = args;
} }
private void getregistryfiles(Image image, IngestImageWorkerController controller) { private void getRegistryFiles(Image image, IngestImageWorkerController controller) {
Case currentCase = Case.getCurrentCase(); // get the most updated case
SleuthkitCase tempDb = currentCase.getSleuthkitCase(); org.sleuthkit.autopsy.casemodule.services.FileManager fileManager = currentCase.getServices().getFileManager();
Collection<FileSystem> imageFS = tempDb.getFileSystems(image); List<FsContent> allRegistryFiles = new ArrayList<FsContent>();
List<String> fsIds = new LinkedList<String>();
for (FileSystem img : imageFS) {
Long tempID = img.getId();
fsIds.add(tempID.toString());
}
String allFS = new String();
for (int i = 0; i < fsIds.size(); i++) {
if (i == 0) {
allFS += " AND (0";
}
allFS += " OR fs_obj_id = '" + fsIds.get(i) + "'";
if (i == fsIds.size() - 1) {
allFS += ")";
}
}
List<FsContent> Regfiles = new ArrayList<FsContent>();
try { try {
ResultSet rs = tempDb.runQuery("select * from tsk_files where lower(name) = 'ntuser.dat' OR lower(parent_path) LIKE '%/system32/config%' and (name LIKE 'system' OR name LIKE 'software' OR name = 'SECURITY' OR name = 'SAM' OR name = 'default')" + allFS); allRegistryFiles.addAll(fileManager.findFiles("ntuser.dat"));
Regfiles = tempDb.resultSetToFsContents(rs); } catch (TskCoreException ex) {
} catch (SQLException ex) { logger.log(Level.WARNING, "Error fetching 'ntuser.dat' file.");
logger.log(Level.SEVERE, "Error querying the database for registry files: {0}", ex);
} }
// org.sleuthkit.autopsy.casemodule.services.FileManager fileManager = currentCase.getServices().getFileManager(); // try to find each of the listed registry files whose parent directory
// List<FsContent> Regfiles = null; // is like '%/system32/config%'
// try { String[] regFileNames = new String[] {"system", "software", "security", "sam", "default"};
// Regfiles = fileManager.findFiles("ntuser.dat", "Recent"); for (String regFileName : regFileNames) {
// } catch (TskCoreException ex) { try {
// logger.log(Level.WARNING, "Error fetching 'index.data' files for Internet Explorer history."); allRegistryFiles.addAll(fileManager.findFiles(regFileName, "%/system32/config%"));
// } } catch (TskCoreException ex) {
logger.log(Level.WARNING, "Error fetching registry file: " + regFileName);
}
}
// filter out those registry files that are not from this image
List<FsContent> regFiles = new ArrayList<FsContent>();
for (FsContent regFile : allRegistryFiles) {
try {
if (regFile.getImage().equals(image)) {
regFiles.add(regFile);
}
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Error when trying to get image from FsContent object.");
}
}
int j = 0; int j = 0;
for (FsContent regFile : regFiles) {
while (j < Regfiles.size()) { String regFileName = regFile.getName();
boolean Success; String temps = currentCase.getTempDirectory() + "\\" + regFileName;
Content orgFS = Regfiles.get(j);
long orgId = orgFS.getId();
String temps = currentCase.getTempDirectory() + "\\" + Regfiles.get(j).getName().toString();
try { try {
ContentUtils.writeToFile(Regfiles.get(j), new File(currentCase.getTempDirectory() + "\\" + Regfiles.get(j).getName())); ContentUtils.writeToFile(regFile, new File(currentCase.getTempDirectory() + "\\" + regFileName));
} catch (IOException ex) { } catch (IOException ex) {
logger.log(Level.SEVERE, "Error writing the temp registry file. {0}", ex); logger.log(Level.SEVERE, "Error writing the temp registry file. {0}", ex);
} }
File regFile = new File(temps); File aRegFile = new File(temps);
logger.log(Level.INFO, moduleName + "- Now getting registry information from " + temps); logger.log(Level.INFO, moduleName + "- Now getting registry information from " + temps);
String txtPath = executeRegRip(temps, j); String txtPath = executeRegRip(temps, j++);
if (txtPath.length() > 0) { if (txtPath.length() > 0) {
Success = parseReg(txtPath, orgId); if (parseReg(txtPath, regFile.getId()) == false) {
} else { continue;
Success = false; }
} }
//At this point pasco2 proccessed the index files. //At this point pasco2 proccessed the index files.
//Now fetch the results, parse them and the delete the files. //Now fetch the results, parse them and the delete the files.
if (Success) { aRegFile.delete();
//Delete dat file since it was succcessful
regFile.delete();
}
j++;
} }
} }
@ -404,7 +395,7 @@ public class ExtractRegistry extends Extract implements IngestModuleImage {
@Override @Override
public void process(Image image, IngestImageWorkerController controller) { public void process(Image image, IngestImageWorkerController controller) {
this.getregistryfiles(image, controller); this.getRegistryFiles(image, controller);
} }
@Override @Override