From d4fefb4dc1d21d84137903ebddbcc1d19a036d04 Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Wed, 31 Oct 2018 13:19:19 -0400 Subject: [PATCH 01/70] First cut at creating a report module --- .../autopsy/report/Bundle.properties | 7 + .../autopsy/report/ReportCaseUco.java | 202 ++++++++++++++++++ 2 files changed, 209 insertions(+) create mode 100755 Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java diff --git a/Core/src/org/sleuthkit/autopsy/report/Bundle.properties b/Core/src/org/sleuthkit/autopsy/report/Bundle.properties index 8efbfd9178..e888990083 100644 --- a/Core/src/org/sleuthkit/autopsy/report/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/report/Bundle.properties @@ -45,6 +45,13 @@ ReportBodyFile.progress.processing=Now processing {0}... ReportBodyFile.getName.text=TSK Body File ReportBodyFile.getDesc.text=Body file format report with MAC times for every file. This format can be used for a timeline view. ReportBodyFile.getFilePath.text=BodyFile.txt +ReportCaseUco.progress.querying=Querying files... +ReportCaseUco.ingestWarning.text=Warning, this report was run before ingest services completed\! +ReportCaseUco.progress.loading=Loading files... +ReportCaseUco.progress.processing=Now processing {0}... +ReportCaseUco.getName.text=CASE/UCO +ReportCaseUco.getDesc.text=CASE/UCO format report with basic property fields for every file. +ReportCaseUco.getFilePath.text=CaseUco.txt ReportKML.progress.querying=Querying files... ReportKML.progress.loading=Loading files... ReportKML.getName.text=Google Earth KML diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java new file mode 100755 index 0000000000..1044080d8e --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java @@ -0,0 +1,202 @@ + /* + * + * Autopsy Forensic Browser + * + * Copyright 2012-2018 Basis Technology Corp. + * + * Copyright 2012 42six Solutions. + * Contact: aebadirad 42six com + * Project Contact/Architect: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.report; + +import java.io.BufferedWriter; +import java.io.FileWriter; +import java.io.IOException; +import java.util.List; +import java.util.logging.Level; +import javax.swing.JPanel; + +import org.openide.util.NbBundle; +import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; +import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.ingest.IngestManager; +import org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus; +import org.sleuthkit.datamodel.*; + +/** + * ReportCaseUco generates a report in the CASE/UCO format. It saves basic + * file info like full path, name, MIME type, times, and hash. + */ +class ReportCaseUco implements GeneralReportModule { + + private static final Logger logger = Logger.getLogger(ReportCaseUco.class.getName()); + private static ReportCaseUco instance = null; + + private Case currentCase; + private SleuthkitCase skCase; + + private String reportPath; + + // Hidden constructor for the report + private ReportCaseUco() { + } + + // Get the default implementation of this report + public static synchronized ReportCaseUco getDefault() { + if (instance == null) { + instance = new ReportCaseUco(); + } + return instance; + } + + /** + * Generates a CASE/UCO format report. + * + * @param baseReportDir path to save the report + * @param progressPanel panel to update the report's progress + */ + @Override + @SuppressWarnings("deprecation") + public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) { + // Start the progress bar and setup the report + try { + currentCase = Case.getCurrentCaseThrows(); + } catch (NoCurrentCaseException ex) { + logger.log(Level.SEVERE, "Exception while getting open case.", ex); + return; + } + progressPanel.setIndeterminate(false); + progressPanel.start(); + progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.querying")); + reportPath = baseReportDir + getRelativeFilePath(); //NON-NLS + + skCase = currentCase.getSleuthkitCase(); + + // Run query to get all files + try { + // exclude non-fs files/dirs and . and .. files + final String query = "type = " + TskData.TSK_DB_FILES_TYPE_ENUM.FS.getFileType() //NON-NLS + + " AND name != '.' AND name != '..'"; //NON-NLS + + progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.loading")); + List fs = skCase.findAllFilesWhere(query); + + // Check if ingest has finished + String ingestwarning = ""; + if (IngestManager.getInstance().isIngestRunning()) { + ingestwarning = NbBundle.getMessage(this.getClass(), "ReportCaseUco.ingestWarning.text"); + } + + int size = fs.size(); + progressPanel.setMaximumProgress(size / 100); + + BufferedWriter out = null; + try { + // MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime + out = new BufferedWriter(new FileWriter(reportPath, true)); + out.write(ingestwarning); + // Loop files and write info to report + int count = 0; + for (AbstractFile file : fs) { + if (progressPanel.getStatus() == ReportStatus.CANCELED) { + break; + } + if (count++ == 100) { + progressPanel.increment(); + progressPanel.updateStatusLabel( + NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.processing", + file.getName())); + count = 0; + } + + if (file.getMd5Hash() != null) { + out.write(file.getMd5Hash()); + } + out.write("|"); + if (file.getUniquePath() != null) { + out.write(file.getUniquePath()); + } + out.write("|"); + out.write(Long.toString(file.getMetaAddr())); + out.write("|"); + String modeString = file.getModesAsString(); + if (modeString != null) { + out.write(modeString); + } + out.write("|"); + out.write(Long.toString(file.getUid())); + out.write("|"); + out.write(Long.toString(file.getGid())); + out.write("|"); + out.write(Long.toString(file.getSize())); + out.write("|"); + out.write(Long.toString(file.getAtime())); + out.write("|"); + out.write(Long.toString(file.getMtime())); + out.write("|"); + out.write(Long.toString(file.getCtime())); + out.write("|"); + out.write(Long.toString(file.getCrtime())); + out.write("\n"); + } + } catch (IOException ex) { + logger.log(Level.WARNING, "Could not write the temp body file report.", ex); //NON-NLS + } finally { + try { + if (out != null) { + out.flush(); + out.close(); + Case.getCurrentCaseThrows().addReport(reportPath, + NbBundle.getMessage(this.getClass(), + "ReportCaseUco.generateReport.srcModuleName.text"), ""); + + } + } catch (IOException ex) { + logger.log(Level.WARNING, "Could not flush and close the BufferedWriter.", ex); //NON-NLS + } catch (TskCoreException | NoCurrentCaseException ex) { + String errorMessage = String.format("Error adding %s to case as a report", reportPath); //NON-NLS + logger.log(Level.SEVERE, errorMessage, ex); + } + } + progressPanel.complete(ReportStatus.COMPLETE); + } catch (TskCoreException ex) { + logger.log(Level.WARNING, "Failed to get the unique path.", ex); //NON-NLS + } + } + + @Override + public String getName() { + String name = NbBundle.getMessage(this.getClass(), "ReportCaseUco.getName.text"); + return name; + } + + @Override + public String getRelativeFilePath() { + return NbBundle.getMessage(this.getClass(), "ReportCaseUco.getFilePath.text"); + } + + @Override + public String getDescription() { + String desc = NbBundle.getMessage(this.getClass(), "ReportCaseUco.getDesc.text"); + return desc; + } + + @Override + public JPanel getConfigurationPanel() { + return null; // No configuration panel + } +} From 2193fad8a6cb92984570b11e653eb5d9eacba2ce Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Wed, 31 Oct 2018 16:30:14 -0400 Subject: [PATCH 02/70] More changes --- Core/ivy.xml | 2 + .../autopsy/report/ReportCaseUco.java | 60 +++++++++---------- 2 files changed, 29 insertions(+), 33 deletions(-) diff --git a/Core/ivy.xml b/Core/ivy.xml index f20453a141..3189cc9323 100644 --- a/Core/ivy.xml +++ b/Core/ivy.xml @@ -29,6 +29,8 @@ + + diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java index 1044080d8e..395b3b35da 100755 --- a/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java @@ -25,10 +25,15 @@ package org.sleuthkit.autopsy.report; import java.io.BufferedWriter; import java.io.FileWriter; import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; import java.util.List; import java.util.logging.Level; import javax.swing.JPanel; - +import com.fasterxml.jackson.core.JsonEncoding; +import com.fasterxml.jackson.core.JsonFactory; +import com.fasterxml.jackson.core.JsonGenerator; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -50,7 +55,10 @@ class ReportCaseUco implements GeneralReportModule { private SleuthkitCase skCase; private String reportPath; - + + private JsonFactory jsonGeneratorFactory; + private JsonGenerator masterCatalog; + // Hidden constructor for the report private ReportCaseUco() { } @@ -82,7 +90,21 @@ class ReportCaseUco implements GeneralReportModule { progressPanel.setIndeterminate(false); progressPanel.start(); progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.querying")); + + // Create the JSON generator + jsonGeneratorFactory = new JsonFactory(); + jsonGeneratorFactory.setRootValueSeparator("\r\n"); reportPath = baseReportDir + getRelativeFilePath(); //NON-NLS + Path catalogPath = Paths.get(reportPath); + try { + Files.createDirectories(catalogPath.getParent()); + java.io.File catalogFile = catalogPath.toFile(); + masterCatalog = jsonGeneratorFactory.createGenerator(catalogFile, JsonEncoding.UTF8); + } catch (IOException ex) { + logger.log(Level.SEVERE, "Error while initializing CASE/UCO report", ex); //NON-NLS + // ELTODO what else needs to be done here? + return; + } skCase = currentCase.getSleuthkitCase(); @@ -103,7 +125,7 @@ class ReportCaseUco implements GeneralReportModule { int size = fs.size(); progressPanel.setMaximumProgress(size / 100); - + BufferedWriter out = null; try { // MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime @@ -123,38 +145,10 @@ class ReportCaseUco implements GeneralReportModule { count = 0; } - if (file.getMd5Hash() != null) { - out.write(file.getMd5Hash()); - } - out.write("|"); - if (file.getUniquePath() != null) { - out.write(file.getUniquePath()); - } - out.write("|"); - out.write(Long.toString(file.getMetaAddr())); - out.write("|"); - String modeString = file.getModesAsString(); - if (modeString != null) { - out.write(modeString); - } - out.write("|"); - out.write(Long.toString(file.getUid())); - out.write("|"); - out.write(Long.toString(file.getGid())); - out.write("|"); - out.write(Long.toString(file.getSize())); - out.write("|"); - out.write(Long.toString(file.getAtime())); - out.write("|"); - out.write(Long.toString(file.getMtime())); - out.write("|"); - out.write(Long.toString(file.getCtime())); - out.write("|"); - out.write(Long.toString(file.getCrtime())); - out.write("\n"); + } } catch (IOException ex) { - logger.log(Level.WARNING, "Could not write the temp body file report.", ex); //NON-NLS + logger.log(Level.WARNING, "Could not write the temp CASE/UCO report.", ex); //NON-NLS } finally { try { if (out != null) { From 72bdae97df9c5b77523240254492529b8f1b6d9a Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Fri, 2 Nov 2018 09:21:34 -0400 Subject: [PATCH 03/70] Added dependecies --- Core/nbproject/project.properties | 1 + Core/nbproject/project.xml | 13 ++++++++----- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/Core/nbproject/project.properties b/Core/nbproject/project.properties index 1b0a695edd..e185baab75 100644 --- a/Core/nbproject/project.properties +++ b/Core/nbproject/project.properties @@ -4,6 +4,7 @@ file.reference.commons-compress-1.14.jar=release/modules/ext/commons-compress-1. file.reference.commons-dbcp2-2.1.1.jar=release\\modules\\ext\\commons-dbcp2-2.1.1.jar file.reference.commons-pool2-2.4.2.jar=release\\modules\\ext\\commons-pool2-2.4.2.jar file.reference.dd-plist-1.20.jar=release/modules/ext/dd-plist-1.20.jar +file.reference.jackson-core-2.9.7.jar=C:\\cygwin64\\home\\elivis\\autopsy\\Core\\release\\modules\\ext\\jackson-core-2.9.7.jar file.reference.jdom-2.0.5-contrib.jar=release/modules/ext/jdom-2.0.5-contrib.jar file.reference.jdom-2.0.5.jar=release/modules/ext/jdom-2.0.5.jar file.reference.jgraphx-v3.8.0.jar=release/modules/ext/jgraphx-v3.8.0.jar diff --git a/Core/nbproject/project.xml b/Core/nbproject/project.xml index d142e0b8c9..3ee4009128 100644 --- a/Core/nbproject/project.xml +++ b/Core/nbproject/project.xml @@ -338,7 +338,6 @@ org.sleuthkit.autopsy.modules.vmextractor org.sleuthkit.autopsy.progress org.sleuthkit.autopsy.report - org.sleuthkit.autopsy.tabulardatareader org.sleuthkit.datamodel @@ -357,6 +356,10 @@ ext/cxf-rt-transports-http-3.0.16.jar release/modules/ext/cxf-rt-transports-http-3.0.16.jar + + ext/sleuthkit-postgresql-4.6.3.jar + release/modules/ext/sleuthkit-postgresql-4.6.3.jar + ext/commons-validator-1.6.jar release/modules/ext/commons-validator-1.6.jar @@ -393,10 +396,6 @@ ext/sevenzipjbinding.jar release/modules/ext/sevenzipjbinding.jar - - ext/sleuthkit-postgresql-4.6.3.jar - release/modules/ext/sleuthkit-postgresql-4.6.3.jar - ext/mchange-commons-java-0.2.9.jar release/modules/ext/mchange-commons-java-0.2.9.jar @@ -433,6 +432,10 @@ ext/curator-client-2.8.0.jar release/modules/ext/curator-client-2.8.0.jar + + ext/jackson-core-2.9.7.jar + release/modules/ext/jackson-core-2.9.7.jar + ext/cxf-rt-frontend-jaxrs-3.0.16.jar release/modules/ext/cxf-rt-frontend-jaxrs-3.0.16.jar From 688bef2096c0e328330719c4943c52efa2620f4e Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Fri, 2 Nov 2018 11:12:46 -0400 Subject: [PATCH 04/70] Added JSON initialization and closing --- .../autopsy/report/Bundle.properties | 1 - .../autopsy/report/ReportCaseUco.java | 72 ++++++++----------- 2 files changed, 29 insertions(+), 44 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/report/Bundle.properties b/Core/src/org/sleuthkit/autopsy/report/Bundle.properties index e888990083..fc46085825 100644 --- a/Core/src/org/sleuthkit/autopsy/report/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/report/Bundle.properties @@ -51,7 +51,6 @@ ReportCaseUco.progress.loading=Loading files... ReportCaseUco.progress.processing=Now processing {0}... ReportCaseUco.getName.text=CASE/UCO ReportCaseUco.getDesc.text=CASE/UCO format report with basic property fields for every file. -ReportCaseUco.getFilePath.text=CaseUco.txt ReportKML.progress.querying=Querying files... ReportKML.progress.loading=Loading files... ReportKML.getName.text=Google Earth KML diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java index 395b3b35da..52a29118f8 100755 --- a/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java @@ -34,6 +34,7 @@ import javax.swing.JPanel; import com.fasterxml.jackson.core.JsonEncoding; import com.fasterxml.jackson.core.JsonFactory; import com.fasterxml.jackson.core.JsonGenerator; +import org.openide.util.Exceptions; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -58,6 +59,7 @@ class ReportCaseUco implements GeneralReportModule { private JsonFactory jsonGeneratorFactory; private JsonGenerator masterCatalog; + private static final String REPORT_FILE_NAME = "CaseUco.txt"; // Hidden constructor for the report private ReportCaseUco() { @@ -95,13 +97,11 @@ class ReportCaseUco implements GeneralReportModule { jsonGeneratorFactory = new JsonFactory(); jsonGeneratorFactory.setRootValueSeparator("\r\n"); reportPath = baseReportDir + getRelativeFilePath(); //NON-NLS - Path catalogPath = Paths.get(reportPath); + java.io.File reportFile = Paths.get(reportPath).toFile(); try { - Files.createDirectories(catalogPath.getParent()); - java.io.File catalogFile = catalogPath.toFile(); - masterCatalog = jsonGeneratorFactory.createGenerator(catalogFile, JsonEncoding.UTF8); + Files.createDirectories(Paths.get(reportFile.getParent())); } catch (IOException ex) { - logger.log(Level.SEVERE, "Error while initializing CASE/UCO report", ex); //NON-NLS + logger.log(Level.SEVERE, "Unable to create directory for CASE/UCO report", ex); //NON-NLS // ELTODO what else needs to be done here? return; } @@ -122,53 +122,39 @@ class ReportCaseUco implements GeneralReportModule { if (IngestManager.getInstance().isIngestRunning()) { ingestwarning = NbBundle.getMessage(this.getClass(), "ReportCaseUco.ingestWarning.text"); } + // ELTODO what to do with this warning? int size = fs.size(); progressPanel.setMaximumProgress(size / 100); - BufferedWriter out = null; - try { - // MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime - out = new BufferedWriter(new FileWriter(reportPath, true)); - out.write(ingestwarning); - // Loop files and write info to report - int count = 0; - for (AbstractFile file : fs) { - if (progressPanel.getStatus() == ReportStatus.CANCELED) { - break; - } - if (count++ == 100) { - progressPanel.increment(); - progressPanel.updateStatusLabel( - NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.processing", - file.getName())); - count = 0; - } - + masterCatalog = jsonGeneratorFactory.createGenerator(reportFile, JsonEncoding.UTF8); + // Loop files and write info to report + int count = 0; + for (AbstractFile file : fs) { + if (progressPanel.getStatus() == ReportStatus.CANCELED) { + break; } - } catch (IOException ex) { - logger.log(Level.WARNING, "Could not write the temp CASE/UCO report.", ex); //NON-NLS - } finally { - try { - if (out != null) { - out.flush(); - out.close(); - Case.getCurrentCaseThrows().addReport(reportPath, - NbBundle.getMessage(this.getClass(), - "ReportCaseUco.generateReport.srcModuleName.text"), ""); - - } - } catch (IOException ex) { - logger.log(Level.WARNING, "Could not flush and close the BufferedWriter.", ex); //NON-NLS - } catch (TskCoreException | NoCurrentCaseException ex) { - String errorMessage = String.format("Error adding %s to case as a report", reportPath); //NON-NLS - logger.log(Level.SEVERE, errorMessage, ex); + if (count++ == 100) { + progressPanel.increment(); + progressPanel.updateStatusLabel( + NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.processing", + file.getName())); + count = 0; } + } progressPanel.complete(ReportStatus.COMPLETE); } catch (TskCoreException ex) { - logger.log(Level.WARNING, "Failed to get the unique path.", ex); //NON-NLS + logger.log(Level.SEVERE, "Failed to get the unique path.", ex); //NON-NLS + } catch (IOException ex) { + logger.log(Level.SEVERE, "Failed to create JSON output for the CASE/UCO report", ex); //NON-NLS + } finally { + try { + masterCatalog.close(); + } catch (IOException ex) { + logger.log(Level.WARNING, "Failed to close JSON output file", ex); //NON-NLS + } } } @@ -180,7 +166,7 @@ class ReportCaseUco implements GeneralReportModule { @Override public String getRelativeFilePath() { - return NbBundle.getMessage(this.getClass(), "ReportCaseUco.getFilePath.text"); + return REPORT_FILE_NAME; } @Override From f7187deaa8c9d5f752de7cbb54dcfd71d0780066 Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Fri, 2 Nov 2018 11:28:03 -0400 Subject: [PATCH 05/70] Resolved merge conflicts --- Core/nbproject/project.properties | 2 +- Core/nbproject/project.xml | 7 ------- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/Core/nbproject/project.properties b/Core/nbproject/project.properties index 4d4ed48d7c..529eede29a 100644 --- a/Core/nbproject/project.properties +++ b/Core/nbproject/project.properties @@ -4,7 +4,7 @@ file.reference.commons-compress-1.14.jar=release/modules/ext/commons-compress-1. file.reference.commons-dbcp2-2.1.1.jar=release\\modules\\ext\\commons-dbcp2-2.1.1.jar file.reference.commons-pool2-2.4.2.jar=release\\modules\\ext\\commons-pool2-2.4.2.jar file.reference.dd-plist-1.20.jar=release/modules/ext/dd-plist-1.20.jar -file.reference.jackson-core-2.9.7.jar=C:\\cygwin64\\home\\elivis\\autopsy\\Core\\release\\modules\\ext\\jackson-core-2.9.7.jar +file.reference.jackson-core-2.9.7.jar=release/modules/ext/jackson-core-2.9.7.jar file.reference.jdom-2.0.5-contrib.jar=release/modules/ext/jdom-2.0.5-contrib.jar file.reference.jdom-2.0.5.jar=release/modules/ext/jdom-2.0.5.jar file.reference.jgraphx-v3.8.0.jar=release/modules/ext/jgraphx-v3.8.0.jar diff --git a/Core/nbproject/project.xml b/Core/nbproject/project.xml index c81dd49204..2ddde8e977 100644 --- a/Core/nbproject/project.xml +++ b/Core/nbproject/project.xml @@ -356,10 +356,6 @@ ext/cxf-rt-transports-http-3.0.16.jar release/modules/ext/cxf-rt-transports-http-3.0.16.jar - - ext/sleuthkit-postgresql-4.6.3.jar - release/modules/ext/sleuthkit-postgresql-4.6.3.jar - ext/commons-validator-1.6.jar release/modules/ext/commons-validator-1.6.jar @@ -397,13 +393,10 @@ release/modules/ext/sevenzipjbinding.jar -<<<<<<< HEAD -======= ext/sleuthkit-postgresql-4.6.4.jar release/modules/ext/sleuthkit-postgresql-4.6.4.jar ->>>>>>> 99cef00b523307020a96d534d4cded3cf14eae98 ext/mchange-commons-java-0.2.9.jar release/modules/ext/mchange-commons-java-0.2.9.jar From 35c00ec3882ed258f0144063264e4c920d0eff3e Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Fri, 2 Nov 2018 17:07:03 -0400 Subject: [PATCH 06/70] First cut at saving files --- .../autopsy/report/ReportCaseUco.java | 65 ++++++++++++++----- 1 file changed, 50 insertions(+), 15 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java index 52a29118f8..c8aa328983 100755 --- a/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java @@ -22,18 +22,16 @@ */ package org.sleuthkit.autopsy.report; -import java.io.BufferedWriter; -import java.io.FileWriter; import java.io.IOException; import java.nio.file.Files; -import java.nio.file.Path; import java.nio.file.Paths; -import java.util.List; import java.util.logging.Level; import javax.swing.JPanel; import com.fasterxml.jackson.core.JsonEncoding; import com.fasterxml.jackson.core.JsonFactory; import com.fasterxml.jackson.core.JsonGenerator; +import java.sql.ResultSet; +import java.sql.SQLException; import org.openide.util.Exceptions; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; @@ -110,13 +108,16 @@ class ReportCaseUco implements GeneralReportModule { // Run query to get all files try { + masterCatalog = jsonGeneratorFactory.createGenerator(reportFile, JsonEncoding.UTF8); + // exclude non-fs files/dirs and . and .. files - final String query = "type = " + TskData.TSK_DB_FILES_TYPE_ENUM.FS.getFileType() //NON-NLS + final String query = "select obj_id, name, size, ctime, crtime, atime, mtime, md5, parent_path, mime_type, extension from tsk_files where type = " + TskData.TSK_DB_FILES_TYPE_ENUM.FS.getFileType() //NON-NLS + " AND name != '.' AND name != '..'"; //NON-NLS progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.loading")); - List fs = skCase.findAllFilesWhere(query); + SleuthkitCase.CaseDbQuery queryResult = skCase.executeQuery(query); + ResultSet resultSet = queryResult.getResultSet(); // Check if ingest has finished String ingestwarning = ""; if (IngestManager.getInstance().isIngestRunning()) { @@ -124,24 +125,38 @@ class ReportCaseUco implements GeneralReportModule { } // ELTODO what to do with this warning? - int size = fs.size(); - progressPanel.setMaximumProgress(size / 100); + int numFiles = 1000; // ELTODO resultSet.size(); + progressPanel.setMaximumProgress(numFiles / 100); - masterCatalog = jsonGeneratorFactory.createGenerator(reportFile, JsonEncoding.UTF8); - // Loop files and write info to report int count = 0; - for (AbstractFile file : fs) { + while (resultSet.next()) { + if (progressPanel.getStatus() == ReportStatus.CANCELED) { break; } - if (count++ == 100) { + + Long objectId = resultSet.getLong(1); + String dataSourceName = resultSet.getString(2); + long size = resultSet.getLong("size"); + long ctime = resultSet.getLong("ctime"); + long crtime = resultSet.getLong("crtime"); + long atime = resultSet.getLong("atime"); + long mtime = resultSet.getLong("mtime"); + String md5Hash = resultSet.getString("md5"); + String parent_path = resultSet.getString("parent_path"); + String mime_type = resultSet.getString("mime_type"); + String extension = resultSet.getString("extension"); + + addFile(objectId, dataSourceName, parent_path, md5Hash, mime_type, masterCatalog); + + /* ELTODO if (count++ == 100) { progressPanel.increment(); progressPanel.updateStatusLabel( NbBundle.getMessage(this.getClass(), "ReportCaseUco.progress.processing", file.getName())); count = 0; - } + }*/ } progressPanel.complete(ReportStatus.COMPLETE); @@ -149,6 +164,8 @@ class ReportCaseUco implements GeneralReportModule { logger.log(Level.SEVERE, "Failed to get the unique path.", ex); //NON-NLS } catch (IOException ex) { logger.log(Level.SEVERE, "Failed to create JSON output for the CASE/UCO report", ex); //NON-NLS + } catch (SQLException ex) { + logger.log(Level.WARNING, "Unable to read result set", ex); //NON-NLS } finally { try { masterCatalog.close(); @@ -158,9 +175,26 @@ class ReportCaseUco implements GeneralReportModule { } } + private void addFile(Long objectId, String dataSourceName, String parent_path, String md5Hash, String mime_type, JsonGenerator catalog) throws IOException { + catalog.writeStartObject(); + catalog.writeStringField("@id", "file-"+objectId); + catalog.writeStringField("@type", "Trace"); + catalog.writeFieldName("propertyBundle"); + catalog.writeStartArray(); + catalog.writeStartObject(); + catalog.writeStringField("@type", "File"); + catalog.writeStringField("fileName", dataSourceName); + catalog.writeStringField("filePath", parent_path); + + catalog.writeEndObject(); + catalog.writeEndArray(); + catalog.writeEndObject(); + } + @Override public String getName() { - String name = NbBundle.getMessage(this.getClass(), "ReportCaseUco.getName.text"); + //String name = NbBundle.getMessage(this.getClass(), "ReportCaseUco.getName.text"); + String name = "CASE/UCO"; return name; } @@ -171,7 +205,8 @@ class ReportCaseUco implements GeneralReportModule { @Override public String getDescription() { - String desc = NbBundle.getMessage(this.getClass(), "ReportCaseUco.getDesc.text"); + //String desc = NbBundle.getMessage(this.getClass(), "ReportCaseUco.getDesc.text"); + String desc = "CASE/UCO Report"; return desc; } From 2db0e6a602210b74151abc211eadabaa401e6cf9 Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Mon, 5 Nov 2018 10:23:50 -0500 Subject: [PATCH 07/70] Changed layer.xml so that report is instanciated --- Core/src/org/sleuthkit/autopsy/core/layer.xml | 5 +++++ Core/src/org/sleuthkit/autopsy/report/Bundle.properties | 1 + Core/src/org/sleuthkit/autopsy/report/ReportCaseUco.java | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/core/layer.xml b/Core/src/org/sleuthkit/autopsy/core/layer.xml index 8bdde0f317..d87c169930 100644 --- a/Core/src/org/sleuthkit/autopsy/core/layer.xml +++ b/Core/src/org/sleuthkit/autopsy/core/layer.xml @@ -337,6 +337,11 @@ + + + + + - org.sleuthkit.autopsy.modules.e01verify.E01VerifierModuleFactory + org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityModuleFactory diff --git a/Core/src/org/sleuthkit/autopsy/modules/e01verify/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties similarity index 100% rename from Core/src/org/sleuthkit/autopsy/modules/e01verify/Bundle.properties rename to Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties diff --git a/Core/src/org/sleuthkit/autopsy/modules/e01verify/Bundle_ja.properties b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle_ja.properties similarity index 100% rename from Core/src/org/sleuthkit/autopsy/modules/e01verify/Bundle_ja.properties rename to Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle_ja.properties diff --git a/Core/src/org/sleuthkit/autopsy/modules/e01verify/E01VerifyIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java similarity index 76% rename from Core/src/org/sleuthkit/autopsy/modules/e01verify/E01VerifyIngestModule.java rename to Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java index 6f7e91d5b1..8b93d00f8f 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/e01verify/E01VerifyIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java @@ -16,7 +16,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package org.sleuthkit.autopsy.modules.e01verify; +package org.sleuthkit.autopsy.modules.dataSourceIntegrity; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; @@ -40,14 +40,12 @@ import org.openide.util.NbBundle; /** * Data source ingest module that verifies the integrity of an Expert Witness * Format (EWF) E01 image file by generating a hash of the file and comparing it - * to the value stored in the image. + * to the value stored in the image. Will also generate hashes for any image-type + * data source that has none. */ -@NbBundle.Messages({ - "UnableToCalculateHashes=Unable to calculate MD5 hashes." -}) -public class E01VerifyIngestModule implements DataSourceIngestModule { +public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { - private static final Logger logger = Logger.getLogger(E01VerifyIngestModule.class.getName()); + private static final Logger logger = Logger.getLogger(DataSourceIntegrityIngestModule.class.getName()); private static final long DEFAULT_CHUNK_SIZE = 32 * 1024; private static final IngestServices services = IngestServices.getInstance(); @@ -58,13 +56,13 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { private IngestJobContext context; - E01VerifyIngestModule(IngestSettings settings) { + DataSourceIntegrityIngestModule(IngestSettings settings) { computeHashes = settings.shouldComputeHashes(); verifyHashes = settings.shouldVerifyHashes(); } @NbBundle.Messages({ - "E01VerifyIngestModule.startup.noCheckboxesSelected=At least one of the checkboxes must be selected" + "DataSourceIntegrityIngestModule.startup.noCheckboxesSelected=At least one of the checkboxes must be selected" }) @Override public void startUp(IngestJobContext context) throws IngestModuleException { @@ -72,34 +70,34 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { // It's an error if the module is run without either option selected if (!(computeHashes || verifyHashes)) { - throw new IngestModuleException(Bundle.E01VerifyIngestModule_startup_noCheckboxesSelected()); + throw new IngestModuleException(Bundle.DataSourceIntegrityIngestModule_startup_noCheckboxesSelected()); } } @NbBundle.Messages({ "# {0} - imageName", - "E01VerifyIngestModule.process.skipCompute=Not computing new hashes for {0} since the option was disabled", + "DataSourceIntegrityIngestModule.process.skipCompute=Not computing new hashes for {0} since the option was disabled", "# {0} - imageName", - "E01VerifyIngestModule.process.skipVerify=Not verifying existing hashes for {0} since the option was disabled", + "DataSourceIntegrityIngestModule.process.skipVerify=Not verifying existing hashes for {0} since the option was disabled", "# {0} - hashName", - "E01VerifyIngestModule.process.hashAlgorithmError=Error creating message digest for {0} algorithm", + "DataSourceIntegrityIngestModule.process.hashAlgorithmError=Error creating message digest for {0} algorithm", "# {0} - hashName", - "E01VerifyIngestModule.process.hashMatch=
  • {0} hash verified
    • ", + "DataSourceIntegrityIngestModule.process.hashMatch=
  • {0} hash verified
    • ", "# {0} - hashName", - "E01VerifyIngestModule.process.hashNonMatch=
  • {0} hash not verified
    • ", + "DataSourceIntegrityIngestModule.process.hashNonMatch=
  • {0} hash not verified
    • ", "# {0} - calculatedHashValue", "# {1} - storedHashValue", - "E01VerifyIngestModule.process.hashList=
    • Calculated hash: {0}
    • Stored hash: {1}
    ", + "DataSourceIntegrityIngestModule.process.hashList=
    • Calculated hash: {0}
    • Stored hash: {1}
    ", "# {0} - hashName", "# {1} - calculatedHashValue", - "E01VerifyIngestModule.process.calcHashWithType=
  • Calculated {0} hash: {1}
    • ", + "DataSourceIntegrityIngestModule.process.calcHashWithType=
  • Calculated {0} hash: {1}
    • ", "# {0} - imageName", - "E01VerifyIngestModule.process.calculateHashDone=

    Data Source Hash Calculation Results for {0}

    ", - "E01VerifyIngestModule.process.hashesCalculated= hashes calculated", + "DataSourceIntegrityIngestModule.process.calculateHashDone=

    Data Source Hash Calculation Results for {0}

    ", + "DataSourceIntegrityIngestModule.process.hashesCalculated= hashes calculated", "# {0} - imageName", - "E01VerifyIngestModule.process.errorSavingHashes= Error saving hashes for image {0} to the database", + "DataSourceIntegrityIngestModule.process.errorSavingHashes= Error saving hashes for image {0} to the database", "# {0} - imageName", - "E01VerifyIngestModule.process.errorLoadingHashes= Error loading hashes for image {0} from the database", + "DataSourceIntegrityIngestModule.process.errorLoadingHashes= Error loading hashes for image {0} from the database", }) @Override public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress statusHelper) { @@ -108,7 +106,7 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { // Skip non-images if (!(dataSource instanceof Image)) { logger.log(Level.INFO, "Skipping non-image {0}", imgName); //NON-NLS - services.postMessage(IngestMessage.createMessage(MessageType.INFO, E01VerifierModuleFactory.getModuleName(), + services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.process.skipNonEwf", imgName))); @@ -120,7 +118,7 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { long size = img.getSize(); if (size == 0) { logger.log(Level.WARNING, "Size of image {0} was 0 when queried.", imgName); //NON-NLS - services.postMessage(IngestMessage.createMessage(MessageType.ERROR, E01VerifierModuleFactory.getModuleName(), + services.postMessage(IngestMessage.createMessage(MessageType.ERROR, DataSourceIntegrityModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.process.errGetSizeOfImg", imgName))); @@ -142,8 +140,8 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { hashDataList.add(new HashData(HashType.SHA256, img.getSha256())); } } catch (TskCoreException ex) { - String msg = Bundle.E01VerifyIngestModule_process_errorLoadingHashes(imgName); - services.postMessage(IngestMessage.createMessage(MessageType.ERROR, E01VerifierModuleFactory.getModuleName(), msg)); + String msg = Bundle.DataSourceIntegrityIngestModule_process_errorLoadingHashes(imgName); + services.postMessage(IngestMessage.createMessage(MessageType.ERROR, DataSourceIntegrityModuleFactory.getModuleName(), msg)); logger.log(Level.SEVERE, msg, ex); return ProcessResult.ERROR; } @@ -159,13 +157,13 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { // If that mode was not enabled by the user, exit if (mode.equals(Mode.COMPUTE) && ! this.computeHashes) { logger.log(Level.INFO, "Not computing hashes for {0} since the option was disabled", imgName); //NON-NLS - services.postMessage(IngestMessage.createMessage(MessageType.INFO, E01VerifierModuleFactory.getModuleName(), - Bundle.E01VerifyIngestModule_process_skipCompute(imgName))); + services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), + Bundle.DataSourceIntegrityIngestModule_process_skipCompute(imgName))); return ProcessResult.OK; } else if (mode.equals(Mode.VERIFY) && ! this.verifyHashes) { logger.log(Level.INFO, "Not verifying hashes for {0} since the option was disabled", imgName); //NON-NLS - services.postMessage(IngestMessage.createMessage(MessageType.INFO, E01VerifierModuleFactory.getModuleName(), - Bundle.E01VerifyIngestModule_process_skipVerify(imgName))); + services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), + Bundle.DataSourceIntegrityIngestModule_process_skipVerify(imgName))); return ProcessResult.OK; } @@ -182,8 +180,8 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { try { hashData.digest = MessageDigest.getInstance(hashData.type.getName()); } catch (NoSuchAlgorithmException ex) { - String msg = Bundle.E01VerifyIngestModule_process_hashAlgorithmError(hashData.type.getName()); - services.postMessage(IngestMessage.createMessage(MessageType.ERROR, E01VerifierModuleFactory.getModuleName(), msg)); + String msg = Bundle.DataSourceIntegrityIngestModule_process_hashAlgorithmError(hashData.type.getName()); + services.postMessage(IngestMessage.createMessage(MessageType.ERROR, DataSourceIntegrityModuleFactory.getModuleName(), msg)); logger.log(Level.SEVERE, msg, ex); return ProcessResult.ERROR; } @@ -204,7 +202,7 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { } else { logger.log(Level.INFO, "Starting hash calculation for {0}", img.getName()); //NON-NLS } - services.postMessage(IngestMessage.createMessage(MessageType.INFO, E01VerifierModuleFactory.getModuleName(), + services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.process.startingImg", imgName))); @@ -224,7 +222,7 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { } catch (TskCoreException ex) { String msg = NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.process.errReadImgAtChunk", imgName, i); - services.postMessage(IngestMessage.createMessage(MessageType.ERROR, E01VerifierModuleFactory.getModuleName(), msg)); + services.postMessage(IngestMessage.createMessage(MessageType.ERROR, DataSourceIntegrityModuleFactory.getModuleName(), msg)); logger.log(Level.SEVERE, msg, ex); return ProcessResult.ERROR; } @@ -258,12 +256,12 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { for (HashData hashData:hashDataList) { if (hashData.storedHash.equals(hashData.calculatedHash)) { - hashResults += Bundle.E01VerifyIngestModule_process_hashMatch(hashData.type.name); + hashResults += Bundle.DataSourceIntegrityIngestModule_process_hashMatch(hashData.type.name); } else { verified = false; - hashResults += Bundle.E01VerifyIngestModule_process_hashNonMatch(hashData.type.name); + hashResults += Bundle.DataSourceIntegrityIngestModule_process_hashNonMatch(hashData.type.name); } - hashResults += Bundle.E01VerifyIngestModule_process_hashList(hashData.calculatedHash, hashData.storedHash); + hashResults += Bundle.DataSourceIntegrityIngestModule_process_hashList(hashData.calculatedHash, hashData.storedHash); } String verificationResultStr; @@ -279,13 +277,13 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { detailedResults += NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.shutDown.resultLi", verificationResultStr); detailedResults += hashResults; - services.postMessage(IngestMessage.createMessage(messageType, E01VerifierModuleFactory.getModuleName(), + services.postMessage(IngestMessage.createMessage(messageType, DataSourceIntegrityModuleFactory.getModuleName(), imgName + verificationResultStr, detailedResults)); } else { // Store the hashes in the database and update the image try { - String results = Bundle.E01VerifyIngestModule_process_calculateHashDone(imgName); + String results = Bundle.DataSourceIntegrityIngestModule_process_calculateHashDone(imgName); for (HashData hashData:hashDataList) { switch (hashData.type) { @@ -301,16 +299,16 @@ public class E01VerifyIngestModule implements DataSourceIngestModule { default: break; } - results += Bundle.E01VerifyIngestModule_process_calcHashWithType(hashData.type.name, hashData.calculatedHash); + results += Bundle.DataSourceIntegrityIngestModule_process_calcHashWithType(hashData.type.name, hashData.calculatedHash); } // Write the inbox message - services.postMessage(IngestMessage.createMessage(MessageType.INFO, E01VerifierModuleFactory.getModuleName(), - imgName + Bundle.E01VerifyIngestModule_process_hashesCalculated(), results)); + services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), + imgName + Bundle.DataSourceIntegrityIngestModule_process_hashesCalculated(), results)); } catch (TskCoreException ex) { - String msg = Bundle.E01VerifyIngestModule_process_errorSavingHashes(imgName); - services.postMessage(IngestMessage.createMessage(MessageType.ERROR, E01VerifierModuleFactory.getModuleName(), msg)); + String msg = Bundle.DataSourceIntegrityIngestModule_process_errorSavingHashes(imgName); + services.postMessage(IngestMessage.createMessage(MessageType.ERROR, DataSourceIntegrityModuleFactory.getModuleName(), msg)); logger.log(Level.SEVERE, "Error saving hash for image " + imgName + " to database", ex); return ProcessResult.ERROR; } diff --git a/Core/src/org/sleuthkit/autopsy/modules/e01verify/E01VerifierModuleFactory.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java similarity index 87% rename from Core/src/org/sleuthkit/autopsy/modules/e01verify/E01VerifierModuleFactory.java rename to Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java index 6adb514df9..7747ffc6b7 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/e01verify/E01VerifierModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java @@ -16,7 +16,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package org.sleuthkit.autopsy.modules.e01verify; +package org.sleuthkit.autopsy.modules.dataSourceIntegrity; import org.openide.util.NbBundle; import org.openide.util.lookup.ServiceProvider; @@ -33,10 +33,10 @@ import org.sleuthkit.autopsy.ingest.NoIngestModuleIngestJobSettings; * of Expert Witness Format (EWF), i.e., .e01 files . */ @ServiceProvider(service = IngestModuleFactory.class) -public class E01VerifierModuleFactory extends IngestModuleFactoryAdapter { +public class DataSourceIntegrityModuleFactory extends IngestModuleFactoryAdapter { static String getModuleName() { - return NbBundle.getMessage(E01VerifyIngestModule.class, + return NbBundle.getMessage(DataSourceIntegrityIngestModule.class, "EwfVerifyIngestModule.moduleName.text"); } @@ -47,7 +47,7 @@ public class E01VerifierModuleFactory extends IngestModuleFactoryAdapter { @Override public String getModuleDescription() { - return NbBundle.getMessage(E01VerifyIngestModule.class, + return NbBundle.getMessage(DataSourceIntegrityIngestModule.class, "EwfVerifyIngestModule.moduleDesc.text"); } @@ -64,13 +64,13 @@ public class E01VerifierModuleFactory extends IngestModuleFactoryAdapter { @Override public DataSourceIngestModule createDataSourceIngestModule(IngestModuleIngestJobSettings settings) { if (settings instanceof IngestSettings) { - return new E01VerifyIngestModule((IngestSettings) settings); + return new DataSourceIntegrityIngestModule((IngestSettings) settings); } /* * Compatibility check for older versions. */ if (settings instanceof NoIngestModuleIngestJobSettings) { - return new E01VerifyIngestModule(new IngestSettings()); + return new DataSourceIntegrityIngestModule(new IngestSettings()); } throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings"); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java index e4d6ae5dd8..eac3ffd3d2 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java @@ -60,7 +60,7 @@ import org.sleuthkit.autopsy.commonfilesearch.DataSourceLoader; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeValue; import org.sleuthkit.autopsy.commonfilesearch.CommonAttributeValueList; import org.sleuthkit.autopsy.datamodel.DisplayableItemNode; -import org.sleuthkit.autopsy.modules.e01verify.E01VerifierModuleFactory; +import org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityModuleFactory; import org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory; import org.sleuthkit.autopsy.modules.exif.ExifParserModuleFactory; import org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleFactory; @@ -183,8 +183,8 @@ class InterCaseTestUtils { final IngestModuleTemplate hashLookupTemplate = IngestUtils.getIngestModuleTemplate(new HashLookupModuleFactory()); final IngestModuleTemplate vmExtractorTemplate = IngestUtils.getIngestModuleTemplate(new VMExtractorIngestModuleFactory()); final IngestModuleTemplate photoRecTemplate = IngestUtils.getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()); - final IngestModuleTemplate e01VerifierTemplate = IngestUtils.getIngestModuleTemplate(new E01VerifierModuleFactory()); - final IngestModuleTemplate eamDbTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.centralrepository.ingestmodule.IngestModuleFactory()); + final IngestModuleTemplate dataSourceIntegrityTemplate = IngestUtils.getIngestModuleTemplate(new DataSourceIntegrityModuleFactory()); + final IngestModuleTemplate eamDbTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory()); final IngestModuleTemplate fileExtMismatchDetectorTemplate = IngestUtils.getIngestModuleTemplate(new FileExtMismatchDetectorModuleFactory()); //TODO we need to figure out how to get ahold of these objects because they are required for properly filling the CR with test data // final IngestModuleTemplate objectDetectorTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.experimental.objectdetection.ObjectDetectionModuleFactory()); @@ -217,10 +217,10 @@ class InterCaseTestUtils { kitchenSink.add(hashLookupTemplate); kitchenSink.add(vmExtractorTemplate); kitchenSink.add(photoRecTemplate); - kitchenSink.add(e01VerifierTemplate); + kitchenSink.add(dataSourceIntegrityTemplate); kitchenSink.add(eamDbTemplate); kitchenSink.add(fileExtMismatchDetectorTemplate); - //TODO this list should probably be populated by way of loading the appropriate modules based on finding all of the @ServiceProvider(service = IngestModuleFactory.class) types + //TODO this list should probably be populated by way of loading the appropriate modules based on finding all of the @ServiceProvider(service = CentralRepoIngestModuleFactory.class) types // kitchenSink.add(objectDetectorTemplate); // kitchenSink.add(emailParserTemplate); // kitchenSink.add(recentActivityTemplate); From 75dda5f70b85bf37e7740d3661a2693f244da6c8 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Fri, 30 Nov 2018 10:11:39 -0500 Subject: [PATCH 40/70] Including FilesIdentifierIngestModule. --- .../FilesIdentifierIngestModule.java | 54 +++++++++++-------- 1 file changed, 31 insertions(+), 23 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java index 88eea65dda..0e0160b9b9 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java @@ -106,12 +106,15 @@ final class FilesIdentifierIngestModule implements FileIngestModule { @Override @Messages({"FilesIdentifierIngestModule.indexError.message=Failed to index interesting file hit artifact for keyword search."}) public ProcessResult process(AbstractFile file) { + Case currentCase; try { - blackboard = Case.getCurrentCaseThrows().getServices().getBlackboard(); + currentCase = Case.getCurrentCaseThrows(); } catch (NoCurrentCaseException ex) { logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS return ProcessResult.ERROR; } + blackboard = currentCase.getServices().getBlackboard(); + // Skip slack space files. if (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) { return ProcessResult.OK; @@ -126,7 +129,7 @@ final class FilesIdentifierIngestModule implements FileIngestModule { // Post an interesting files set hit artifact to the // blackboard. String moduleName = InterestingItemsIngestModuleFactory.getModuleName(); - BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); + Collection attributes = new ArrayList<>(); // Add a set name attribute to the artifact. This adds a @@ -141,29 +144,34 @@ final class FilesIdentifierIngestModule implements FileIngestModule { // interesting files set membership rule that was satisfied. BlackboardAttribute ruleNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, moduleName, ruleSatisfied); attributes.add(ruleNameAttribute); + + org.sleuthkit.datamodel.Blackboard tskBlackboard = currentCase.getSleuthkitCase().getBlackboard(); + // Create artifact if it doesn't already exist. + if (!tskBlackboard.artifactExists(file, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, attributes)) { + BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); + artifact.addAttributes(attributes); + + try { + // index the artifact for keyword search + blackboard.indexArtifact(artifact); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, "Unable to index blackboard artifact " + artifact.getArtifactID(), ex); //NON-NLS + MessageNotifyUtil.Notify.error(Bundle.FilesIdentifierIngestModule_indexError_message(), artifact.getDisplayName()); + } - artifact.addAttributes(attributes); - try { - // index the artifact for keyword search - blackboard.indexArtifact(artifact); - } catch (Blackboard.BlackboardException ex) { - logger.log(Level.SEVERE, "Unable to index blackboard artifact " + artifact.getArtifactID(), ex); //NON-NLS - MessageNotifyUtil.Notify.error(Bundle.FilesIdentifierIngestModule_indexError_message(), artifact.getDisplayName()); + services.fireModuleDataEvent(new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, Collections.singletonList(artifact))); + + // make an ingest inbox message + StringBuilder detailsSb = new StringBuilder(); + detailsSb.append("File: " + file.getParentPath() + file.getName() + "
    \n"); + detailsSb.append("Rule Set: " + filesSet.getName()); + + services.postMessage(IngestMessage.createDataMessage(InterestingItemsIngestModuleFactory.getModuleName(), + "Interesting File Match: " + filesSet.getName() + "(" + file.getName() +")", + detailsSb.toString(), + file.getName(), + artifact)); } - - services.fireModuleDataEvent(new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, Collections.singletonList(artifact))); - - // make an ingest inbox message - StringBuilder detailsSb = new StringBuilder(); - detailsSb.append("File: " + file.getParentPath() + file.getName() + "
    \n"); - detailsSb.append("Rule Set: " + filesSet.getName()); - - services.postMessage(IngestMessage.createDataMessage(InterestingItemsIngestModuleFactory.getModuleName(), - "Interesting File Match: " + filesSet.getName() + "(" + file.getName() +")", - detailsSb.toString(), - file.getName(), - artifact)); - } catch (TskCoreException ex) { FilesIdentifierIngestModule.logger.log(Level.SEVERE, "Error posting to the blackboard", ex); //NOI18N NON-NLS } From 5beca03856e84b4f06f33fc68a8aed9c8788822b Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Fri, 30 Nov 2018 10:19:58 -0500 Subject: [PATCH 41/70] Removed comment. --- .../centralrepository/eventlisteners/IngestEventsListener.java | 1 - 1 file changed, 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 7a1b8a5fce..841b4b0958 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -164,7 +164,6 @@ public class IngestEventsListener { AbstractFile abstractFile = tskCase.getAbstractFileById(bbArtifact.getObjectID()); org.sleuthkit.datamodel.Blackboard tskBlackboard = tskCase.getBlackboard(); // Create artifact if it doesn't already exist. - //DLG: Do I use AbstractFile, or BlackboardArtifact for the input? if (!tskBlackboard.artifactExists(abstractFile, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT, attributes)) { BlackboardArtifact tifArtifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT); tifArtifact.addAttributes(attributes); From 8e75dd44acf3646d161384fec948f3b94b84b237 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Fri, 30 Nov 2018 15:18:35 -0500 Subject: [PATCH 42/70] 4380 simplify / correct iccid validation regex --- .../datamodel/CorrelationAttributeNormalizer.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeNormalizer.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeNormalizer.java index f13e82b160..ba8fa4540d 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeNormalizer.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeNormalizer.java @@ -219,7 +219,7 @@ final public class CorrelationAttributeNormalizer { * valid ICCID */ private static String normalizeIccid(String data) throws CorrelationAttributeNormalizationException { - final String validIccidRegex = "^([8][9][f0-9]{17,22})$"; + final String validIccidRegex = "^89[f0-9]{17,22}$"; final String iccidWithoutSeperators = data.toLowerCase().replaceAll(SEPERATORS_REGEX, ""); if (iccidWithoutSeperators.matches(validIccidRegex)) { return iccidWithoutSeperators; From e6cea140ecb41361d374e1f90120e3ec433fe469 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Sun, 2 Dec 2018 23:20:12 -0500 Subject: [PATCH 43/70] Moved logic to normalize extension inputs. --- .../modules/interestingitems/FilesSet.java | 48 ++++++++++++------- .../interestingitems/FilesSetRulePanel.java | 7 ++- 2 files changed, 38 insertions(+), 17 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java index 87d25453e7..3fd18957e5 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java @@ -833,7 +833,7 @@ public final class FilesSet implements Serializable { // If there is a leading ".", strip it since // AbstractFile.getFileNameExtension() returns just the // extension chars and not the dot. - super(extension.startsWith(".") ? extension.substring(1) : extension, false); + super(normalize(extension), false); } /** @@ -842,10 +842,10 @@ public final class FilesSet implements Serializable { * @param extensions The file name extensions to be matched. */ public ExtensionCondition(List extensions) { - // If there is a leading ".", strip it since + // If there is a leading "." in any list value, strip it since // AbstractFile.getFileNameExtension() returns just the // extension chars and not the dot. - super(extensions); + super(normalize(extensions)); } /** @@ -862,6 +862,34 @@ public final class FilesSet implements Serializable { public boolean passes(AbstractFile file) { return this.textMatches(file.getNameExtension()); } + + /** + * Strip "." from the start of extensions in the provided list. + * + * @param extensions The list of extensions to be processed. + * + * @return A post-processed list of extensions. + */ + private static List normalize(List extensions) { + List values = new ArrayList<>(extensions); + + for (int i=0; i < values.size(); i++) { + values.set(i, normalize(values.get(i))); + } + + return values; + } + + /** + * Strip "." from the start of the provided extension. + * + * @param extensions The extension to be processed. + * + * @return A post-processed extension. + */ + private static String normalize(String extension) { + return extension.startsWith(".") ? extension.substring(1) : extension; + } } @@ -986,19 +1014,7 @@ public final class FilesSet implements Serializable { * match. */ CaseInsensitiveMultiValueStringComparisionMatcher(List valuesToMatch) { - List values = new ArrayList<>(valuesToMatch); - for (int i=0; i < values.size(); i++) { - // Remove leading and trailing whitespace. - String tempValue = values.get(i).trim(); - - // Strip "." from the start of the extension if it exists. - if (tempValue.startsWith(".")) { - tempValue = tempValue.substring(1); - } - - values.set(i, tempValue); - } - this.valuesToMatch = values; + this.valuesToMatch = valuesToMatch; } @Override diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetRulePanel.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetRulePanel.java index 7f8285c4a1..9744b0c5bf 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetRulePanel.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSetRulePanel.java @@ -485,7 +485,12 @@ final class FilesSetRulePanel extends javax.swing.JPanel { if (this.fullNameRadioButton.isSelected()) { condition = new FilesSet.Rule.FullNameCondition(this.nameTextField.getText()); } else { - condition = new FilesSet.Rule.ExtensionCondition(Arrays.asList(this.nameTextField.getText().split(","))); + List extensions = Arrays.asList(this.nameTextField.getText().split(",")); + for (int i=0; i < extensions.size(); i++) { + // Remove leading and trailing whitespace. + extensions.set(i, extensions.get(i).trim()); + } + condition = new FilesSet.Rule.ExtensionCondition(extensions); } } else { logger.log(Level.SEVERE, "Attempt to get name condition with illegal chars"); // NON-NLS From c13331388ed03bdfee5b2725e5b222716fcf6df3 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Sun, 2 Dec 2018 23:32:32 -0500 Subject: [PATCH 44/70] Typo fixed. --- .../sleuthkit/autopsy/modules/interestingitems/FilesSet.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java index 3fd18957e5..0e91869151 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java @@ -883,7 +883,7 @@ public final class FilesSet implements Serializable { /** * Strip "." from the start of the provided extension. * - * @param extensions The extension to be processed. + * @param extension The extension to be processed. * * @return A post-processed extension. */ From 6926a8bbf5d28a7034fe44e4ac262d213dc822d1 Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Mon, 3 Dec 2018 07:16:01 -0500 Subject: [PATCH 45/70] New icons for wifi network adapter, sim card, bluetooth adapter, device info --- .../autopsy/datamodel/ExtractedContent.java | 8 ++++++++ .../src/org/sleuthkit/autopsy/images/sim_card.png | Bin 0 -> 306 bytes .../org/sleuthkit/autopsy/report/ReportHTML.java | 12 ++++++++++++ 3 files changed, 20 insertions(+) create mode 100644 Core/src/org/sleuthkit/autopsy/images/sim_card.png diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java index e950d0e870..cd5c93e954 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java @@ -158,6 +158,14 @@ public class ExtractedContent implements AutopsyVisitableItem { return filePath + "face.png"; //NON-NLS } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WIFI_NETWORK.getTypeID()) { return filePath + "network-wifi.png"; //NON-NLS + } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_WIFI_NETWORK_ADAPTER.getTypeID()) { + return filePath + "network-wifi.png"; //NON-NLS + } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_SIM_ATTACHED.getTypeID()) { + return filePath + "sim_card.png"; //NON-NLS + } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_ADAPTER.getTypeID()) { + return filePath + "Bluetooth.png"; //NON-NLS + } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_INFO.getTypeID()) { + return filePath + "phone.png"; //NON-NLS } return filePath + "artifact-icon.png"; //NON-NLS } diff --git a/Core/src/org/sleuthkit/autopsy/images/sim_card.png b/Core/src/org/sleuthkit/autopsy/images/sim_card.png new file mode 100644 index 0000000000000000000000000000000000000000..1f326dffead6a9fa38f305230803313400df5250 GIT binary patch literal 306 zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`oCO|{#S9GG!XV7ZFl&wkP>{XE z)7O>#5x1NOAD5~5xfMX6i=HlyAr`0C2JPl;HW1m<5WTE(f%<&OJ4@P{P6@TDX1NtK zx=inq6q3ThgdE{Xb5bI$?(Q!CR&Bjh#Nzq%b+6YIBuKQeH#lE5F`l>Q zy*fikXsYRo*H+Vl?rAK2zOr*Uce8?l+%btm1~!ZtnoG-=#Xs4&i?|v#SU<1X&B&nQ z$#nmFKf||p$rlP%7r+0_XUm*r#r?%oaPo>X&-AsAbQpaO=qOxh`p;4ESnG|D9McQJ zH!RYd{CDhEQCP=vdEGXalw6 Date: Mon, 3 Dec 2018 07:21:09 -0500 Subject: [PATCH 46/70] Adding missing settings panel --- .../dataSourceIntegrity/Bundle.properties | 6 +- .../DataSourceIntegrityIngestModule.java | 2 +- .../DataSourceIntegrityIngestSettings.java | 96 ++++++++++++++ ...ataSourceIntegrityIngestSettingsPanel.form | 83 ++++++++++++ ...ataSourceIntegrityIngestSettingsPanel.java | 120 ++++++++++++++++++ .../DataSourceIntegrityModuleFactory.java | 14 +- 6 files changed, 310 insertions(+), 11 deletions(-) create mode 100644 Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettings.java create mode 100644 Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form create mode 100644 Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties index fe77c40832..234b75cd78 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties @@ -13,7 +13,7 @@ EwfVerifyIngestModule.shutDown.verifyResultsHeader=

    Data Source Verification R EwfVerifyIngestModule.shutDown.resultLi=

  • Result\:{0}
    • EwfVerifyIngestModule.shutDown.calcHashLi=
  • Calculated hash\: {0}
    • EwfVerifyIngestModule.shutDown.storedHashLi=
  • Stored hash\: {0}
    • -IngestSettingsPanel.verifyHashesCheckbox.text=Verify existing data source hashes IngestSettingsPanel.computeHashesCheckbox.text=Calculate data source hashes if none are present -IngestSettingsPanel.jLabel3.text=Ingest Settings -IngestSettingsPanel.jLabel1.text=Note that this module will not run on logical files +DataSourceIntegrityIngestSettingsPanel.jLabel1.text=Note that this module will not run on logical files +DataSourceIntegrityIngestSettingsPanel.jLabel3.text=Ingest Settings +DataSourceIntegrityIngestSettingsPanel.verifyHashesCheckbox.text=Verify existing data source hashes diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java index 8b93d00f8f..4432b327e4 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java @@ -56,7 +56,7 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { private IngestJobContext context; - DataSourceIntegrityIngestModule(IngestSettings settings) { + DataSourceIntegrityIngestModule(DataSourceIntegrityIngestSettings settings) { computeHashes = settings.shouldComputeHashes(); verifyHashes = settings.shouldVerifyHashes(); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettings.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettings.java new file mode 100644 index 0000000000..e5e4bf3d50 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettings.java @@ -0,0 +1,96 @@ +/* + * Central Repository + * + * Copyright 2018 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.modules.dataSourceIntegrity; + +import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings; + +/** + * Ingest job settings for the E01 Verify module. + */ +final class DataSourceIntegrityIngestSettings implements IngestModuleIngestJobSettings { + + private static final long serialVersionUID = 1L; + + static final boolean DEFAULT_COMPUTE_HASHES = true; + static final boolean DEFAULT_VERIFY_HASHES = true; + + private boolean computeHashes; + private boolean verifyHashes; + + /** + * Instantiate the ingest job settings with default values. + */ + DataSourceIntegrityIngestSettings() { + this.computeHashes = DEFAULT_COMPUTE_HASHES; + this.verifyHashes = DEFAULT_VERIFY_HASHES; + } + + /** + * Instantiate the ingest job settings. + * + * @param computeHashes Compute hashes if none are present + * @param verifyHashes Verify hashes if any are present + */ + DataSourceIntegrityIngestSettings(boolean computeHashes, boolean verifyHashes) { + this.computeHashes = computeHashes; + this.verifyHashes = verifyHashes; + } + + @Override + public long getVersionNumber() { + return serialVersionUID; + } + + /** + * Should hashes be computed if none are present? + * + * @return true if hashes should be computed, false otherwise + */ + boolean shouldComputeHashes() { + return computeHashes; + } + + /** + * Set whether hashes should be computed. + * + * @param computeHashes true if hashes should be computed + */ + void setComputeHashes(boolean computeHashes) { + this.computeHashes = computeHashes; + } + + + /** + * Should hashes be verified if at least one is present? + * + * @return true if hashes should be verified, false otherwise + */ + boolean shouldVerifyHashes() { + return verifyHashes; + } + + /** + * Set whether hashes should be verified. + * + * @param verifyHashes true if hashes should be verified + */ + void setVerifyHashes(boolean verifyHashes) { + this.verifyHashes = verifyHashes; + } +} diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form new file mode 100644 index 0000000000..1d1d8af13d --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form @@ -0,0 +1,83 @@ + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java new file mode 100644 index 0000000000..079c9a8507 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java @@ -0,0 +1,120 @@ +/* + * Central Repository + * + * Copyright 2018 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.modules.dataSourceIntegrity; + +import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings; +import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel; + +/** + * Ingest job settings panel for the Correlation Engine module. + */ +@SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives +final class DataSourceIntegrityIngestSettingsPanel extends IngestModuleIngestJobSettingsPanel { + + /** + * Creates new form IngestSettingsPanel + */ + public DataSourceIntegrityIngestSettingsPanel(DataSourceIntegrityIngestSettings settings) { + initComponents(); + customizeComponents(settings); + } + + /** + * Update components with values from the ingest job settings. + * + * @param settings The ingest job settings. + */ + private void customizeComponents(DataSourceIntegrityIngestSettings settings) { + computeHashesCheckbox.setSelected(settings.shouldComputeHashes()); + verifyHashesCheckbox.setSelected(settings.shouldVerifyHashes()); + } + + @Override + public IngestModuleIngestJobSettings getSettings() { + return new DataSourceIntegrityIngestSettings(computeHashesCheckbox.isSelected(), verifyHashesCheckbox.isSelected()); + } + + /** + * This method is called from within the constructor to initialize the form. + * WARNING: Do NOT modify this code. The content of this method is always + * regenerated by the Form Editor. + */ + @SuppressWarnings("unchecked") + // //GEN-BEGIN:initComponents + private void initComponents() { + + computeHashesCheckbox = new javax.swing.JCheckBox(); + verifyHashesCheckbox = new javax.swing.JCheckBox(); + jLabel3 = new javax.swing.JLabel(); + jLabel1 = new javax.swing.JLabel(); + + org.openide.awt.Mnemonics.setLocalizedText(computeHashesCheckbox, org.openide.util.NbBundle.getMessage(DataSourceIntegrityIngestSettingsPanel.class, "DataSourceIntegrityIngestSettingsPanel.computeHashesCheckbox.text")); // NOI18N + computeHashesCheckbox.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + computeHashesCheckboxActionPerformed(evt); + } + }); + + org.openide.awt.Mnemonics.setLocalizedText(verifyHashesCheckbox, org.openide.util.NbBundle.getMessage(DataSourceIntegrityIngestSettingsPanel.class, "DataSourceIntegrityIngestSettingsPanel.verifyHashesCheckbox.text")); // NOI18N + + jLabel3.setFont(new java.awt.Font("Tahoma", 1, 11)); // NOI18N + org.openide.awt.Mnemonics.setLocalizedText(jLabel3, org.openide.util.NbBundle.getMessage(DataSourceIntegrityIngestSettingsPanel.class, "DataSourceIntegrityIngestSettingsPanel.jLabel3.text")); // NOI18N + + org.openide.awt.Mnemonics.setLocalizedText(jLabel1, org.openide.util.NbBundle.getMessage(DataSourceIntegrityIngestSettingsPanel.class, "DataSourceIntegrityIngestSettingsPanel.jLabel1.text")); // NOI18N + + javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); + this.setLayout(layout); + layout.setHorizontalGroup( + layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addGroup(layout.createSequentialGroup() + .addGap(20, 20, 20) + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addComponent(jLabel1) + .addComponent(verifyHashesCheckbox) + .addComponent(computeHashesCheckbox) + .addComponent(jLabel3)) + .addContainerGap(115, Short.MAX_VALUE)) + ); + layout.setVerticalGroup( + layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addGroup(layout.createSequentialGroup() + .addContainerGap() + .addComponent(jLabel3) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) + .addComponent(computeHashesCheckbox) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) + .addComponent(verifyHashesCheckbox) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) + .addComponent(jLabel1) + .addContainerGap(198, Short.MAX_VALUE)) + ); + }// //GEN-END:initComponents + + private void computeHashesCheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_computeHashesCheckboxActionPerformed + // TODO add your handling code here: + }//GEN-LAST:event_computeHashesCheckboxActionPerformed + + // Variables declaration - do not modify//GEN-BEGIN:variables + private javax.swing.JCheckBox computeHashesCheckbox; + private javax.swing.JLabel jLabel1; + private javax.swing.JLabel jLabel3; + private javax.swing.JCheckBox verifyHashesCheckbox; + // End of variables declaration//GEN-END:variables + +} diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java index 7747ffc6b7..cb32d2788b 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java @@ -63,14 +63,14 @@ public class DataSourceIntegrityModuleFactory extends IngestModuleFactoryAdapter @Override public DataSourceIngestModule createDataSourceIngestModule(IngestModuleIngestJobSettings settings) { - if (settings instanceof IngestSettings) { - return new DataSourceIntegrityIngestModule((IngestSettings) settings); + if (settings instanceof DataSourceIntegrityIngestSettings) { + return new DataSourceIntegrityIngestModule((DataSourceIntegrityIngestSettings) settings); } /* * Compatibility check for older versions. */ if (settings instanceof NoIngestModuleIngestJobSettings) { - return new DataSourceIntegrityIngestModule(new IngestSettings()); + return new DataSourceIntegrityIngestModule(new DataSourceIntegrityIngestSettings()); } throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings"); @@ -78,7 +78,7 @@ public class DataSourceIntegrityModuleFactory extends IngestModuleFactoryAdapter @Override public IngestModuleIngestJobSettings getDefaultIngestJobSettings() { - return new IngestSettings(); + return new DataSourceIntegrityIngestSettings(); } @Override @@ -88,14 +88,14 @@ public class DataSourceIntegrityModuleFactory extends IngestModuleFactoryAdapter @Override public IngestModuleIngestJobSettingsPanel getIngestJobSettingsPanel(IngestModuleIngestJobSettings settings) { - if (settings instanceof IngestSettings) { - return new IngestSettingsPanel((IngestSettings) settings); + if (settings instanceof DataSourceIntegrityIngestSettings) { + return new DataSourceIntegrityIngestSettingsPanel((DataSourceIntegrityIngestSettings) settings); } /* * Compatibility check for older versions. */ if (settings instanceof NoIngestModuleIngestJobSettings) { - return new IngestSettingsPanel(new IngestSettings()); + return new DataSourceIntegrityIngestSettingsPanel(new DataSourceIntegrityIngestSettings()); } throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings"); From 31f1938a175d7c4c22978de1b366bb8e8ae84a45 Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Mon, 3 Dec 2018 07:50:57 -0500 Subject: [PATCH 47/70] Resizing panel --- .../autopsy/modules/dataSourceIntegrity/Bundle.properties | 2 +- .../DataSourceIntegrityIngestSettingsPanel.form | 6 +++--- .../DataSourceIntegrityIngestSettingsPanel.java | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties index 234b75cd78..d46727901e 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties @@ -13,7 +13,7 @@ EwfVerifyIngestModule.shutDown.verifyResultsHeader=

    Data Source Verification R EwfVerifyIngestModule.shutDown.resultLi=

  • Result\:{0}
    • EwfVerifyIngestModule.shutDown.calcHashLi=
  • Calculated hash\: {0}
    • EwfVerifyIngestModule.shutDown.storedHashLi=
  • Stored hash\: {0}
    • -IngestSettingsPanel.computeHashesCheckbox.text=Calculate data source hashes if none are present +DataSourceIntegrityIngestSettingsPanel.computeHashesCheckbox.text=Calculate data source hashes if none are present DataSourceIntegrityIngestSettingsPanel.jLabel1.text=Note that this module will not run on logical files DataSourceIntegrityIngestSettingsPanel.jLabel3.text=Ingest Settings DataSourceIntegrityIngestSettingsPanel.verifyHashesCheckbox.text=Verify existing data source hashes diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form index 1d1d8af13d..b9fc6f08b1 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.form @@ -17,14 +17,14 @@ - + - + @@ -39,7 +39,7 @@ - + diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java index 079c9a8507..706861207c 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java @@ -83,13 +83,13 @@ final class DataSourceIntegrityIngestSettingsPanel extends IngestModuleIngestJob layout.setHorizontalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createSequentialGroup() - .addGap(20, 20, 20) + .addContainerGap() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addComponent(jLabel1) .addComponent(verifyHashesCheckbox) .addComponent(computeHashesCheckbox) .addComponent(jLabel3)) - .addContainerGap(115, Short.MAX_VALUE)) + .addContainerGap(47, Short.MAX_VALUE)) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) @@ -102,7 +102,7 @@ final class DataSourceIntegrityIngestSettingsPanel extends IngestModuleIngestJob .addComponent(verifyHashesCheckbox) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addComponent(jLabel1) - .addContainerGap(198, Short.MAX_VALUE)) + .addContainerGap(53, Short.MAX_VALUE)) ); }// //GEN-END:initComponents From f2558b0220b974204e5d0a0f7be6ee9fa4fc0075 Mon Sep 17 00:00:00 2001 From: Eugene Livis Date: Mon, 3 Dec 2018 13:30:59 -0500 Subject: [PATCH 48/70] Adding CASE-UCO report to Report section of the tree --- .../sleuthkit/autopsy/modules/case_uco/ReportCaseUco.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/case_uco/ReportCaseUco.java b/Core/src/org/sleuthkit/autopsy/modules/case_uco/ReportCaseUco.java index 38b9296c34..bde76ecb70 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/case_uco/ReportCaseUco.java +++ b/Core/src/org/sleuthkit/autopsy/modules/case_uco/ReportCaseUco.java @@ -3,9 +3,6 @@ * Autopsy Forensic Browser * * Copyright 2012-2018 Basis Technology Corp. - * - * Copyright 2012 42six Solutions. - * Contact: aebadirad 42six com * Project Contact/Architect: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -85,7 +82,8 @@ class ReportCaseUco implements GeneralReportModule { "ReportCaseUco.initializing=Creating directories...", "ReportCaseUco.querying=Querying files...", "ReportCaseUco.ingestWarning=Warning, this report will be created before ingest services completed", - "ReportCaseUco.processing=Saving files in CASE-UCO format..." + "ReportCaseUco.processing=Saving files in CASE-UCO format...", + "ReportCaseUco.srcModuleName.text=CASE-UCO Report" }) @Override @SuppressWarnings("deprecation") @@ -187,6 +185,8 @@ class ReportCaseUco implements GeneralReportModule { // create the required CASE-UCO entries at the end of the output file finilizeJsonOutputFile(jsonGenerator); + Case.getCurrentCaseThrows().addReport(reportPath, Bundle.ReportCaseUco_srcModuleName_text(), ""); + progressPanel.complete(ReportStatus.COMPLETE); } catch (TskCoreException ex) { logger.log(Level.SEVERE, "Failed to get list of files from case database", ex); //NON-NLS From 73f2cec18961e536821d4658f50350928f13d2c3 Mon Sep 17 00:00:00 2001 From: esaunders Date: Mon, 3 Dec 2018 13:58:29 -0500 Subject: [PATCH 49/70] Apply limit on number of nodes to display in results table. --- .../corecomponents/TableFilterChildren.java | 71 +++++++++++++++---- 1 file changed, 57 insertions(+), 14 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java b/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java index d5715845a3..799550b897 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java @@ -18,9 +18,14 @@ */ package org.sleuthkit.autopsy.corecomponents; +import javax.swing.JOptionPane; +import javax.swing.SwingUtilities; import org.openide.nodes.Children; import org.openide.nodes.FilterNode; import org.openide.nodes.Node; +import org.openide.util.NbBundle; +import org.openide.windows.WindowManager; +import org.sleuthkit.autopsy.core.UserPreferences; /** * A Children implementation for a @@ -31,17 +36,21 @@ import org.openide.nodes.Node; */ class TableFilterChildren extends FilterNode.Children { + private int numberOfNodesCreated; + private static volatile boolean maxResultsDialogShown = false; + /** * Creates a Children object for a TableFilterNode. A TableFilterNode - creates at most one layer of child nodes for the node it wraps. It is - designed to be used in the results view to ensure the individual viewers - display only the first layer of child nodes. + * creates at most one layer of child nodes for the node it wraps. It is + * designed to be used in the results view to ensure the individual viewers + * display only the first layer of child nodes. * - * @param wrappedNode The node wrapped by the TableFilterNode. + * @param wrappedNode The node wrapped by the TableFilterNode. * @param createChildren True if a children (child factory) object should be - * created for the wrapped node. + * created for the wrapped node. * - * @return A children (child factory) object for a node wrapped by a TableFilterNode. + * @return A children (child factory) object for a node wrapped by a + * TableFilterNode. */ public static Children createInstance(Node wrappedNode, boolean createChildren) { @@ -53,21 +62,21 @@ class TableFilterChildren extends FilterNode.Children { } /** - * Constructs a children (child factory) implementation for a - * TableFilterNode. A - * TableFilterNode creates at most one layer of - * child nodes for the node it wraps. It is designed to be used for nodes - * displayed in Autopsy table views. + * Constructs a children (child factory) implementation for a + * TableFilterNode. A TableFilterNode creates at + * most one layer of child nodes for the node it wraps. It is designed to be + * used for nodes displayed in Autopsy table views. * * @param wrappedNode The node wrapped by the TableFilterNode. */ TableFilterChildren(Node wrappedNode) { super(wrappedNode); + numberOfNodesCreated = 0; } /** - * Copies a TableFilterNode, with the create children - (child factory) flag set to false. + * Copies a TableFilterNode, with the create children (child factory) flag + * set to false. * * @param nodeToCopy The TableFilterNode to copy. * @@ -87,7 +96,41 @@ class TableFilterChildren extends FilterNode.Children { * @return */ @Override + @NbBundle.Messages({"# {0} - The results limit", + "TableFilterChildren.createNodes.limitReached.msg=" + + "The limit on the number of results to display has been reached." + + " Only the first {0} results will be shown." + + " The limit can be modified in the View Options screen."}) protected Node[] createNodes(Node key) { - return new Node[]{this.copyNode(key)}; + int maxNodesToCreate = UserPreferences.getMaximumNumberOfResults(); + + if (maxNodesToCreate == 0 || numberOfNodesCreated < maxNodesToCreate) { + // We either haven't hit the limit yet, or we don't have a limit. + + /** + * We only want to apply the limit to "our" nodes (i.e. not the + * wait node). If we don't do this the "Please wait..." + * node causes the number of results in the table to be off by one. + * Using the Bundle to get the value so that we are not tied to a + * particular locale. + */ + if (!key.getDisplayName().equalsIgnoreCase(NbBundle.getMessage(Node.class, "LBL_WAIT"))) { + numberOfNodesCreated++; + + // If we have a limit and the creation of this node reaches it, + // tell the user if they haven't already been told. + if (numberOfNodesCreated == maxNodesToCreate && !maxResultsDialogShown) { + maxResultsDialogShown = true; + + SwingUtilities.invokeLater(() + -> JOptionPane.showMessageDialog(WindowManager.getDefault().getMainWindow(), + Bundle.TableFilterChildren_createNodes_limitReached_msg(maxNodesToCreate)) + ); + } + } + return new Node[]{this.copyNode(key)}; + } else { + return new Node[]{}; + } } } From 3fd75203ec58b41277a642e4a3325e8484b9c524 Mon Sep 17 00:00:00 2001 From: esaunders Date: Mon, 3 Dec 2018 14:30:24 -0500 Subject: [PATCH 50/70] Updated DeletedContent to use results limit from UserPreferences. Also fixed a bug where deleted content was not handling virtual directories. --- .../autopsy/datamodel/DeletedContent.java | 35 +++++-------------- 1 file changed, 9 insertions(+), 26 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java index 55384344bc..1566f870d4 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java @@ -29,8 +29,6 @@ import java.util.Observable; import java.util.Observer; import java.util.Set; import java.util.logging.Level; -import javax.swing.JOptionPane; -import javax.swing.SwingUtilities; import org.openide.nodes.AbstractNode; import org.openide.nodes.ChildFactory; import org.openide.nodes.Children; @@ -38,14 +36,11 @@ import org.openide.nodes.Node; import org.openide.nodes.Sheet; import org.openide.util.NbBundle; import org.openide.util.lookup.Lookups; -import org.openide.windows.WindowManager; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.CasePreferences; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.core.UserPreferences; import org.sleuthkit.autopsy.coreutils.Logger; -import static org.sleuthkit.autopsy.datamodel.Bundle.*; -import org.sleuthkit.autopsy.deletedFiles.DeletedFilePreferences; import org.sleuthkit.autopsy.ingest.IngestManager; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.Content; @@ -57,6 +52,7 @@ import org.sleuthkit.datamodel.LayoutFile; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskData; +import org.sleuthkit.datamodel.VirtualDirectory; /** * deleted content view nodes @@ -404,25 +400,8 @@ public class DeletedContent implements AutopsyVisitableItem { } @Override - @NbBundle.Messages({"# {0} - The deleted files threshold", - "DeletedContent.createKeys.maxObjects.msg=" - + "There are more Deleted Files than can be displayed." - + " Only the first {0} Deleted Files will be shown."}) protected boolean createKeys(List list) { - DeletedFilePreferences deletedPreferences = DeletedFilePreferences.getDefault(); - List queryList = runFsQuery(); - if (deletedPreferences.getShouldLimitDeletedFiles() && queryList.size() == deletedPreferences.getDeletedFilesLimit()) { - queryList.remove(queryList.size() - 1); - // only show the dialog once - not each time we refresh - if (maxFilesDialogShown == false) { - maxFilesDialogShown = true; - SwingUtilities.invokeLater(() - -> JOptionPane.showMessageDialog(WindowManager.getDefault().getMainWindow(), - DeletedContent_createKeys_maxObjects_msg(deletedPreferences.getDeletedFilesLimit() - 1)) - ); - } - } - list.addAll(queryList); + list.addAll(runFsQuery()); return true; } @@ -467,9 +446,8 @@ public class DeletedContent implements AutopsyVisitableItem { if (Objects.equals(CasePreferences.getGroupItemsInTreeByDataSource(), true)) { query += " AND data_source_obj_id = " + filteringDSObjId; } - DeletedFilePreferences deletedPreferences = DeletedFilePreferences.getDefault(); - if (deletedPreferences.getShouldLimitDeletedFiles()) { - query += " LIMIT " + deletedPreferences.getDeletedFilesLimit(); //NON-NLS + if (UserPreferences.getMaximumNumberOfResults() != 0) { + query += " LIMIT " + UserPreferences.getMaximumNumberOfResults(); //NON-NLS } return query; } @@ -531,6 +509,11 @@ public class DeletedContent implements AutopsyVisitableItem { return new FileNode(f, false); } + @Override + public FileNode visit(VirtualDirectory f) { + return new FileNode(f, false); + } + @Override protected AbstractNode defaultVisit(Content di) { throw new UnsupportedOperationException("Not supported for this type of Displayable Item: " + di.toString()); From 641f3871070c2a388321619533591b92dcd83bfd Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dsmyda" Date: Mon, 3 Dec 2018 14:47:08 -0500 Subject: [PATCH 51/70] Added special admin file and had it disable ability to add datasource when its present --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index eaaa8f9926..ca32f43a4b 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -1120,7 +1120,12 @@ public class Case { /* * Enable the case-specific actions. */ - CallableSystemAction.get(AddImageAction.class).setEnabled(true); + + //Deny ability to add a data source if the special admin access file is present. + File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "child_lock"); + if(!denyAddDataSourcePermissions.exists()) { + CallableSystemAction.get(AddImageAction.class).setEnabled(true); + } CallableSystemAction.get(CaseCloseAction.class).setEnabled(true); CallableSystemAction.get(CasePropertiesAction.class).setEnabled(true); CallableSystemAction.get(CaseDeleteAction.class).setEnabled(true); From 8a3693f39d08a10253f5598ba949f3e973ab2d75 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dsmyda" Date: Mon, 3 Dec 2018 14:50:46 -0500 Subject: [PATCH 52/70] Made the file name less fun --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index ca32f43a4b..96af6ac274 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -1122,7 +1122,7 @@ public class Case { */ //Deny ability to add a data source if the special admin access file is present. - File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "child_lock"); + File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "adminAccess"); if(!denyAddDataSourcePermissions.exists()) { CallableSystemAction.get(AddImageAction.class).setEnabled(true); } From 46c5d8889fd664e021748b03227a34ffd3906615 Mon Sep 17 00:00:00 2001 From: esaunders Date: Mon, 3 Dec 2018 14:50:49 -0500 Subject: [PATCH 53/70] No need to get file from database if is has been stored in the BlackboardArtifactNode lookup. --- .../autopsy/datamodel/KeywordHits.java | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java b/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java index 9e60fba7f8..c80069c7ef 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/KeywordHits.java @@ -858,14 +858,17 @@ public class KeywordHits implements AutopsyVisitableItem { try { BlackboardArtifact art = skCase.getBlackboardArtifact(artifactId); BlackboardArtifactNode n = new BlackboardArtifactNode(art); - AbstractFile file; - try { - file = skCase.getAbstractFileById(art.getObjectID()); - } catch (TskCoreException ex) { - logger.log(Level.SEVERE, "TskCoreException while constructing BlackboardArtifact Node from KeywordHitsKeywordChildren", ex); //NON-NLS - return n; + // The associated file should be available through the Lookup that + // gets created when the BlackboardArtifactNode is constructed. + AbstractFile file = n.getLookup().lookup(AbstractFile.class); + if (file == null) { + try { + file = skCase.getAbstractFileById(art.getObjectID()); + } catch (TskCoreException ex) { + logger.log(Level.SEVERE, "TskCoreException while constructing BlackboardArtifact Node from KeywordHitsKeywordChildren", ex); //NON-NLS + return n; + } } - /* * It is possible to get a keyword hit on artifacts generated for * the underlying image in which case MAC times are not From 0eeab71f8dff241e59524f86a7cc10426b000e82 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dsmyda" Date: Mon, 3 Dec 2018 14:59:07 -0500 Subject: [PATCH 54/70] Made the admin file name more unique --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index 96af6ac274..aab5aafdeb 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -1122,7 +1122,7 @@ public class Case { */ //Deny ability to add a data source if the special admin access file is present. - File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "adminAccess"); + File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "addDataSourceChildLock"); if(!denyAddDataSourcePermissions.exists()) { CallableSystemAction.get(AddImageAction.class).setEnabled(true); } From ca9199f0e48745611b67bd0e2c4036f4676780b0 Mon Sep 17 00:00:00 2001 From: esaunders Date: Mon, 3 Dec 2018 16:12:59 -0500 Subject: [PATCH 55/70] Changed catalog url to use https instead of http. --- nbproject/platform.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nbproject/platform.properties b/nbproject/platform.properties index 86a5375b54..898ac95983 100644 --- a/nbproject/platform.properties +++ b/nbproject/platform.properties @@ -7,7 +7,7 @@ nbplatform.active.dir=${suite.dir}/netbeans-plat/${netbeans-plat-version} harness.dir=${nbplatform.active.dir}/harness bootstrap.url=http://bits.netbeans.org/dev/nbms-and-javadoc/lastSuccessfulBuild/artifact/nbbuild/netbeans/harness/tasks.jar # Where we get the platform from. To see what versions are available, open URL in browser up to the .../updates part of the URL -autoupdate.catalog.url=http://updates.netbeans.org/netbeans/updates/${netbeans-plat-version}/uc/final/distribution/catalog.xml.gz +autoupdate.catalog.url=https://updates.netbeans.org/netbeans/updates/${netbeans-plat-version}/uc/final/distribution/catalog.xml.gz cluster.path=\ ${nbplatform.active.dir}/harness:\ ${nbplatform.active.dir}/java:\ From 8837170d2a89c7df3225c5a58413eca19535a014 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Mon, 3 Dec 2018 17:17:21 -0500 Subject: [PATCH 56/70] Ignore creation of attributes without text. --- .../exif/ExifParserFileIngestModule.java | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java index b0894cbdd9..3b6de236bc 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java @@ -76,7 +76,6 @@ public final class ExifParserFileIngestModule implements FileIngestModule { private final IngestServices services = IngestServices.getInstance(); private final AtomicInteger filesProcessed = new AtomicInteger(0); private volatile boolean filesToFire = false; - private final List listOfFacesDetectedArtifacts = new ArrayList<>(); private long jobId; private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter(); private FileTypeDetector fileTypeDetector; @@ -196,13 +195,25 @@ public final class ExifParserFileIngestModule implements FileIngestModule { ExifIFD0Directory devDir = metadata.getFirstDirectoryOfType(ExifIFD0Directory.class); if (devDir != null) { String model = devDir.getString(ExifIFD0Directory.TAG_MODEL); - if (model != null && !model.isEmpty()) { - attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, ExifParserModuleFactory.getModuleName(), model)); + if (model != null) { + int testSize = model.length(); //DLG: + model = model.trim(); + if (!model.isEmpty()) { + attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, ExifParserModuleFactory.getModuleName(), model)); + } else if (testSize > 0) { + System.out.println(); //DLG: Put breakpoint here! + } } String make = devDir.getString(ExifIFD0Directory.TAG_MAKE); - if (make != null && !make.isEmpty()) { - attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, ExifParserModuleFactory.getModuleName(), make)); + if (make != null) { + int testSize = make.length(); //DLG: + make = make.trim(); + if (!make.isEmpty()) { + attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, ExifParserModuleFactory.getModuleName(), make)); + }else if (testSize > 0) { + System.out.println(); //DLG: Put breakpoint here! + } } } From 5f2345441010bdca9a8cd994ce6d9d73233f3471 Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Tue, 4 Dec 2018 08:42:01 -0500 Subject: [PATCH 57/70] Updating names --- .../dataSourceIntegrity/Bundle.properties | 28 +++++++++---------- .../dataSourceIntegrity/Bundle_ja.properties | 28 +++++++++---------- .../DataSourceIntegrityIngestModule.java | 26 ++++++++--------- ...ataSourceIntegrityIngestSettingsPanel.java | 2 +- .../DataSourceIntegrityModuleFactory.java | 6 ++-- 5 files changed, 45 insertions(+), 45 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties index d46727901e..30624f41bb 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle.properties @@ -1,18 +1,18 @@ OpenIDE-Module-Name=ewfVerify -EwfVerifyIngestModule.moduleName.text=Data Source Integrity -EwfVerifyIngestModule.moduleDesc.text=Calculates and validates hashes of data sources. -EwfVerifyIngestModule.process.errProcImg=Error processing {0} -EwfVerifyIngestModule.process.skipNonEwf=Skipping non-disk image data source {0} -EwfVerifyIngestModule.process.noStoredHash=Image {0} does not have stored hash. -EwfVerifyIngestModule.process.startingImg=Starting {0} -EwfVerifyIngestModule.process.errGetSizeOfImg=Error getting size of {0}. Image will not be processed. -EwfVerifyIngestModule.process.errReadImgAtChunk=Error reading {0} at chunk {1} -EwfVerifyIngestModule.shutDown.verified=\ verified -EwfVerifyIngestModule.shutDown.notVerified=\ not verified -EwfVerifyIngestModule.shutDown.verifyResultsHeader=

    Data Source Verification Results for {0}

    -EwfVerifyIngestModule.shutDown.resultLi=
  • Result\:{0}
    • -EwfVerifyIngestModule.shutDown.calcHashLi=
  • Calculated hash\: {0}
    • -EwfVerifyIngestModule.shutDown.storedHashLi=
  • Stored hash\: {0}
    • +DataSourceIntegrityModuleFactory.moduleName.text=Data Source Integrity +DataSourceIntegrityModuleFactory.moduleDesc.text=Calculates and validates hashes of data sources. +DataSourceIntegrityIngestModule.process.errProcImg=Error processing {0} +DataSourceIntegrityIngestModule.process.skipNonEwf=Skipping non-disk image data source {0} +DataSourceIntegrityIngestModule.process.noStoredHash=Image {0} does not have stored hash. +DataSourceIntegrityIngestModule.process.startingImg=Starting {0} +DataSourceIntegrityIngestModule.process.errGetSizeOfImg=Error getting size of {0}. Image will not be processed. +DataSourceIntegrityIngestModule.process.errReadImgAtChunk=Error reading {0} at chunk {1} +DataSourceIntegrityIngestModule.shutDown.verified=\ verified +DataSourceIntegrityIngestModule.shutDown.notVerified=\ not verified +DataSourceIntegrityIngestModule.shutDown.verifyResultsHeader=

    Data Source Verification Results for {0}

    +DataSourceIntegrityIngestModule.shutDown.resultLi=
  • Result\:{0}
    • +DataSourceIntegrityIngestModule.shutDown.calcHashLi=
  • Calculated hash\: {0}
    • +DataSourceIntegrityIngestModule.shutDown.storedHashLi=
  • Stored hash\: {0}
    • DataSourceIntegrityIngestSettingsPanel.computeHashesCheckbox.text=Calculate data source hashes if none are present DataSourceIntegrityIngestSettingsPanel.jLabel1.text=Note that this module will not run on logical files DataSourceIntegrityIngestSettingsPanel.jLabel3.text=Ingest Settings diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle_ja.properties b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle_ja.properties index 1bd226b8db..e0028e2703 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle_ja.properties +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/Bundle_ja.properties @@ -1,15 +1,15 @@ OpenIDE-Module-Name=EWFVerify -EwfVerifyIngestModule.process.errProcImg={0}\u3092\u51e6\u7406\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f -EwfVerifyIngestModule.moduleName.text=E01\u8a8d\u8a3c\u30c4\u30fc\u30eb -EwfVerifyIngestModule.moduleDesc.text=E01\u30d5\u30a1\u30a4\u30eb\u306e\u6574\u5408\u6027\u3092\u8a8d\u8a3c\u3057\u307e\u3059\u3002 -EwfVerifyIngestModule.process.skipNonEwf=E01\u30a4\u30e1\u30fc\u30b8\u3067\u306f\u306a\u3044{0}\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u3066\u3044\u307e\u3059 -EwfVerifyIngestModule.process.noStoredHash=\u30a4\u30e1\u30fc\u30b8{0}\u306f\u4fdd\u5b58\u3055\u308c\u3066\u3044\u308b\u30cf\u30c3\u30b7\u30e5\u304c\u3042\u308a\u307e\u305b\u3093\u3002 -EwfVerifyIngestModule.process.startingImg={0}\u3092\u958b\u59cb\u4e2d -EwfVerifyIngestModule.process.errGetSizeOfImg={0}\u306e\u30b5\u30a4\u30ba\u306e\u53d6\u5f97\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u30a4\u30e1\u30fc\u30b8\u306f\u51e6\u7406\u3055\u308c\u307e\u305b\u3093\u3002 -EwfVerifyIngestModule.process.errReadImgAtChunk={0}\u306e\u30c1\u30e3\u30f3\u30af{1}\u306e\u8aad\u307f\u53d6\u308a\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f -EwfVerifyIngestModule.shutDown.calcHashLi=
  • \u8a08\u7b97\u3055\u308c\u305f\u30cf\u30c3\u30b7\u30e5\u5024\uff1a{0}
    • -EwfVerifyIngestModule.shutDown.notVerified=\u8a8d\u8a3c\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f -EwfVerifyIngestModule.shutDown.resultLi=
  • \u7d50\u679c\uff1a{0}
    • -EwfVerifyIngestModule.shutDown.storedHashLi=
  • \u4fdd\u5b58\u3055\u308c\u305f\u30cf\u30c3\u30b7\u30e5\uff1a {0}
    • -EwfVerifyIngestModule.shutDown.verifyResultsHeader=

    {0}\u306eEWF\u30d9\u30ea\u30d5\u30a3\u30b1\u30fc\u30b7\u30e7\u30f3\u7d50\u679c

    -EwfVerifyIngestModule.shutDown.verified=\u8a8d\u8a3c\u3055\u308c\u307e\u3057\u305f \ No newline at end of file +DataSourceIntegrityIngestModule.process.errProcImg={0}\u3092\u51e6\u7406\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f +DataSourceIntegrityModuleFactory.moduleName.text=E01\u8a8d\u8a3c\u30c4\u30fc\u30eb +DataSourceIntegrityModuleFactory.moduleDesc.text=E01\u30d5\u30a1\u30a4\u30eb\u306e\u6574\u5408\u6027\u3092\u8a8d\u8a3c\u3057\u307e\u3059\u3002 +DataSourceIntegrityIngestModule.process.skipNonEwf=E01\u30a4\u30e1\u30fc\u30b8\u3067\u306f\u306a\u3044{0}\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u3066\u3044\u307e\u3059 +DataSourceIntegrityIngestModule.process.noStoredHash=\u30a4\u30e1\u30fc\u30b8{0}\u306f\u4fdd\u5b58\u3055\u308c\u3066\u3044\u308b\u30cf\u30c3\u30b7\u30e5\u304c\u3042\u308a\u307e\u305b\u3093\u3002 +DataSourceIntegrityIngestModule.process.startingImg={0}\u3092\u958b\u59cb\u4e2d +DataSourceIntegrityIngestModule.process.errGetSizeOfImg={0}\u306e\u30b5\u30a4\u30ba\u306e\u53d6\u5f97\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u30a4\u30e1\u30fc\u30b8\u306f\u51e6\u7406\u3055\u308c\u307e\u305b\u3093\u3002 +DataSourceIntegrityIngestModule.process.errReadImgAtChunk={0}\u306e\u30c1\u30e3\u30f3\u30af{1}\u306e\u8aad\u307f\u53d6\u308a\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f +DataSourceIntegrityIngestModule.shutDown.calcHashLi=
  • \u8a08\u7b97\u3055\u308c\u305f\u30cf\u30c3\u30b7\u30e5\u5024\uff1a{0}
    • +DataSourceIntegrityIngestModule.shutDown.notVerified=\u8a8d\u8a3c\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f +DataSourceIntegrityIngestModule.shutDown.resultLi=
  • \u7d50\u679c\uff1a{0}
    • +DataSourceIntegrityIngestModule.shutDown.storedHashLi=
  • \u4fdd\u5b58\u3055\u308c\u305f\u30cf\u30c3\u30b7\u30e5\uff1a {0}
    • +DataSourceIntegrityIngestModule.shutDown.verifyResultsHeader=

    {0}\u306eEWF\u30d9\u30ea\u30d5\u30a3\u30b1\u30fc\u30b7\u30e7\u30f3\u7d50\u679c

    +EwfVerifyIDataSourceIntegrityIngestModulengestModule.shutDown.verified=\u8a8d\u8a3c\u3055\u308c\u307e\u3057\u305f \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java index 4432b327e4..21dcf95d65 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestModule.java @@ -82,17 +82,17 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { "# {0} - hashName", "DataSourceIntegrityIngestModule.process.hashAlgorithmError=Error creating message digest for {0} algorithm", "# {0} - hashName", - "DataSourceIntegrityIngestModule.process.hashMatch=
  • {0} hash verified
    • ", + "DataSourceIntegrityIngestModule.process.hashMatch=
  • {0} hash verified
    • ", "# {0} - hashName", - "DataSourceIntegrityIngestModule.process.hashNonMatch=
  • {0} hash not verified
    • ", + "DataSourceIntegrityIngestModule.process.hashNonMatch=
  • {0} hash not verified
    • ", "# {0} - calculatedHashValue", "# {1} - storedHashValue", - "DataSourceIntegrityIngestModule.process.hashList=
    • Calculated hash: {0}
    • Stored hash: {1}
    ", + "DataSourceIntegrityIngestModule.process.hashList=
    • Calculated hash: {0}
    • Stored hash: {1}
    ", "# {0} - hashName", "# {1} - calculatedHashValue", - "DataSourceIntegrityIngestModule.process.calcHashWithType=
  • Calculated {0} hash: {1}
    • ", + "DataSourceIntegrityIngestModule.process.calcHashWithType=
  • Calculated {0} hash: {1}
    • ", "# {0} - imageName", - "DataSourceIntegrityIngestModule.process.calculateHashDone=

    Data Source Hash Calculation Results for {0}

    ", + "DataSourceIntegrityIngestModule.process.calculateHashDone=

    Data Source Hash Calculation Results for {0}

    ", "DataSourceIntegrityIngestModule.process.hashesCalculated= hashes calculated", "# {0} - imageName", "DataSourceIntegrityIngestModule.process.errorSavingHashes= Error saving hashes for image {0} to the database", @@ -108,7 +108,7 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { logger.log(Level.INFO, "Skipping non-image {0}", imgName); //NON-NLS services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(), - "EwfVerifyIngestModule.process.skipNonEwf", + "DataSourceIntegrityIngestModule.process.skipNonEwf", imgName))); return ProcessResult.OK; } @@ -120,7 +120,7 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { logger.log(Level.WARNING, "Size of image {0} was 0 when queried.", imgName); //NON-NLS services.postMessage(IngestMessage.createMessage(MessageType.ERROR, DataSourceIntegrityModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(), - "EwfVerifyIngestModule.process.errGetSizeOfImg", + "DataSourceIntegrityIngestModule.process.errGetSizeOfImg", imgName))); } @@ -204,7 +204,7 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { } services.postMessage(IngestMessage.createMessage(MessageType.INFO, DataSourceIntegrityModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(), - "EwfVerifyIngestModule.process.startingImg", + "DataSourceIntegrityIngestModule.process.startingImg", imgName))); // Set up the progress bar @@ -221,7 +221,7 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { read = img.read(data, i * chunkSize, chunkSize); } catch (TskCoreException ex) { String msg = NbBundle.getMessage(this.getClass(), - "EwfVerifyIngestModule.process.errReadImgAtChunk", imgName, i); + "DataSourceIntegrityIngestModule.process.errReadImgAtChunk", imgName, i); services.postMessage(IngestMessage.createMessage(MessageType.ERROR, DataSourceIntegrityModuleFactory.getModuleName(), msg)); logger.log(Level.SEVERE, msg, ex); return ProcessResult.ERROR; @@ -251,7 +251,7 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { // Check that each hash matches boolean verified = true; String detailedResults = NbBundle - .getMessage(this.getClass(), "EwfVerifyIngestModule.shutDown.verifyResultsHeader", imgName); + .getMessage(this.getClass(), "DataSourceIntegrityIngestModule.shutDown.verifyResultsHeader", imgName); String hashResults = ""; for (HashData hashData:hashDataList) { @@ -268,13 +268,13 @@ public class DataSourceIntegrityIngestModule implements DataSourceIngestModule { MessageType messageType; if (verified) { messageType = MessageType.INFO; - verificationResultStr = NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.shutDown.verified"); + verificationResultStr = NbBundle.getMessage(this.getClass(), "DataSourceIntegrityIngestModule.shutDown.verified"); } else { messageType = MessageType.WARNING; - verificationResultStr = NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.shutDown.notVerified"); + verificationResultStr = NbBundle.getMessage(this.getClass(), "DataSourceIntegrityIngestModule.shutDown.notVerified"); } - detailedResults += NbBundle.getMessage(this.getClass(), "EwfVerifyIngestModule.shutDown.resultLi", verificationResultStr); + detailedResults += NbBundle.getMessage(this.getClass(), "DataSourceIntegrityIngestModule.shutDown.resultLi", verificationResultStr); detailedResults += hashResults; services.postMessage(IngestMessage.createMessage(messageType, DataSourceIntegrityModuleFactory.getModuleName(), diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java index 706861207c..30e3b11b05 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityIngestSettingsPanel.java @@ -28,7 +28,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel; final class DataSourceIntegrityIngestSettingsPanel extends IngestModuleIngestJobSettingsPanel { /** - * Creates new form IngestSettingsPanel + * Creates new form DataSourceIntegrityIngestSettingsPanel */ public DataSourceIntegrityIngestSettingsPanel(DataSourceIntegrityIngestSettings settings) { initComponents(); diff --git a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java index cb32d2788b..0773672e2b 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/modules/dataSourceIntegrity/DataSourceIntegrityModuleFactory.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2014 Basis Technology Corp. + * Copyright 2014-2018 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -37,7 +37,7 @@ public class DataSourceIntegrityModuleFactory extends IngestModuleFactoryAdapter static String getModuleName() { return NbBundle.getMessage(DataSourceIntegrityIngestModule.class, - "EwfVerifyIngestModule.moduleName.text"); + "DataSourceIntegrityModuleFactory.moduleName.text"); } @Override @@ -48,7 +48,7 @@ public class DataSourceIntegrityModuleFactory extends IngestModuleFactoryAdapter @Override public String getModuleDescription() { return NbBundle.getMessage(DataSourceIntegrityIngestModule.class, - "EwfVerifyIngestModule.moduleDesc.text"); + "DataSourceIntegrityModuleFactory.moduleDesc.text"); } @Override From d0fbff0f8f104d8bf1938576a448e87f0da35989 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Tue, 4 Dec 2018 09:59:27 -0500 Subject: [PATCH 58/70] Took out test lines. --- .../autopsy/modules/exif/ExifParserFileIngestModule.java | 6 ------ 1 file changed, 6 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java index 3b6de236bc..a43c1e8f1e 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java @@ -196,23 +196,17 @@ public final class ExifParserFileIngestModule implements FileIngestModule { if (devDir != null) { String model = devDir.getString(ExifIFD0Directory.TAG_MODEL); if (model != null) { - int testSize = model.length(); //DLG: model = model.trim(); if (!model.isEmpty()) { attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, ExifParserModuleFactory.getModuleName(), model)); - } else if (testSize > 0) { - System.out.println(); //DLG: Put breakpoint here! } } String make = devDir.getString(ExifIFD0Directory.TAG_MAKE); if (make != null) { - int testSize = make.length(); //DLG: make = make.trim(); if (!make.isEmpty()) { attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, ExifParserModuleFactory.getModuleName(), make)); - }else if (testSize > 0) { - System.out.println(); //DLG: Put breakpoint here! } } } From 5deef17322c7f6dc615187d35ce641641314c78a Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Tue, 4 Dec 2018 10:21:32 -0500 Subject: [PATCH 59/70] New device info icon --- .../autopsy/datamodel/ExtractedContent.java | 2 +- Core/src/org/sleuthkit/autopsy/images/devices.png | Bin 0 -> 342 bytes .../org/sleuthkit/autopsy/report/ReportHTML.java | 10 +++++----- 3 files changed, 6 insertions(+), 6 deletions(-) create mode 100644 Core/src/org/sleuthkit/autopsy/images/devices.png diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java index cd5c93e954..5f7f5b9d1c 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ExtractedContent.java @@ -165,7 +165,7 @@ public class ExtractedContent implements AutopsyVisitableItem { } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_ADAPTER.getTypeID()) { return filePath + "Bluetooth.png"; //NON-NLS } else if (typeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_INFO.getTypeID()) { - return filePath + "phone.png"; //NON-NLS + return filePath + "devices.png"; //NON-NLS } return filePath + "artifact-icon.png"; //NON-NLS } diff --git a/Core/src/org/sleuthkit/autopsy/images/devices.png b/Core/src/org/sleuthkit/autopsy/images/devices.png new file mode 100644 index 0000000000000000000000000000000000000000..bcb132a1a87fa8ea9f6f92eb38f0d9a2dd329ffa GIT binary patch literal 342 zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`oCO|{#S9GG!XV7ZFl&wkP>{XE z)7O>#5f2NWw&YQNp*uh!+02lL66gHf+|;}hAeVu`xhOTUBsE2$JhLQ2!QIn0AVn{g z9VmXr)5S5w;&k$#|NrfqcYYQ&Wn*ib&9kHN*U7y`+c$U`C}!L33~ytU?&aSguwiB+ z5IBZBnBi3QD{f6uPnuu<|Hqd!^eQGe2K^AQ+bkVXaB{=ueXZH^EQ{6JYO1QNn3|T;|BN4Rk-aJE!^0C{GMQn9ga(Ta z4-o8pIzwpBoOp>TOFNAnWM{Lm|Mq4DI&Cfs?}4cFVdQ&MBb@06eL7$^ZZW literal 0 HcmV?d00001 diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java index abce289459..5f3eaa470f 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java @@ -272,19 +272,19 @@ class ReportHTML implements TableReportModule { in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/accounts.png"); //NON-NLS break; case TSK_WIFI_NETWORK: - in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/network-wifi.png"); //NON-NLS + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/network-wifi.png"); //NON-NLS break; case TSK_WIFI_NETWORK_ADAPTER: - in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/network-wifi.png"); //NON-NLS + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/network-wifi.png"); //NON-NLS break; case TSK_SIM_ATTACHED: - in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/sim_card.png"); //NON-NLS + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/sim_card.png"); //NON-NLS break; case TSK_BLUETOOTH_ADAPTER: - in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/Bluetooth.png"); //NON-NLS + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/Bluetooth.png"); //NON-NLS break; case TSK_DEVICE_INFO: - in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/phone.png"); //NON-NLS + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/devices.png"); //NON-NLS break; default: logger.log(Level.WARNING, "useDataTypeIcon: unhandled artifact type = {0}", dataType); //NON-NLS From ebc394cc04a12311efccdebabeebbc45447d0bde Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Tue, 4 Dec 2018 11:11:55 -0500 Subject: [PATCH 60/70] Change CR ingest module name back temporarily --- ...{CentralRepoIngestModule.java => IngestModule.java} | 10 +++++----- ...gestModuleFactory.java => IngestModuleFactory.java} | 6 +++--- .../centralrepository/ingestmodule/IngestSettings.java | 2 +- .../autopsy/commonfilesearch/CommonAttributePanel.java | 4 ++-- .../autopsy/ingest/IngestModuleFactoryLoader.java | 4 ++-- .../autopsy/commonfilessearch/InterCaseTestUtils.java | 4 ++-- 6 files changed, 15 insertions(+), 15 deletions(-) rename Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/{CentralRepoIngestModule.java => IngestModule.java} (97%) rename Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/{CentralRepoIngestModuleFactory.java => IngestModuleFactory.java} (94%) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModule.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModule.java similarity index 97% rename from Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModule.java rename to Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModule.java index 261af7373f..bb1653b0ce 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModule.java @@ -58,11 +58,11 @@ import org.sleuthkit.autopsy.healthmonitor.TimingMetric; */ @Messages({"CentralRepoIngestModule.prevTaggedSet.text=Previously Tagged As Notable (Central Repository)", "CentralRepoIngestModule.prevCaseComment.text=Previous Case: "}) -final class CentralRepoIngestModule implements FileIngestModule { +final class IngestModule implements FileIngestModule { static final boolean DEFAULT_FLAG_TAGGED_NOTABLE_ITEMS = true; - private final static Logger logger = Logger.getLogger(CentralRepoIngestModule.class.getName()); + private final static Logger logger = Logger.getLogger(IngestModule.class.getName()); private final IngestServices services = IngestServices.getInstance(); private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter(); private static final IngestModuleReferenceCounter warningMsgRefCounter = new IngestModuleReferenceCounter(); @@ -78,7 +78,7 @@ final class CentralRepoIngestModule implements FileIngestModule { * * @param settings The ingest settings for the module instance. */ - CentralRepoIngestModule(IngestSettings settings) { + IngestModule(IngestSettings settings) { flagTaggedNotableItems = settings.isFlagTaggedNotableItems(); } @@ -317,7 +317,7 @@ final class CentralRepoIngestModule implements FileIngestModule { private void postCorrelatedBadFileToBlackboard(AbstractFile abstractFile, List caseDisplayNames) { try { - String MODULE_NAME = CentralRepoIngestModuleFactory.getModuleName(); + String MODULE_NAME = IngestModuleFactory.getModuleName(); BlackboardArtifact tifArtifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); BlackboardAttribute att = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, MODULE_NAME, Bundle.CentralRepoIngestModule_prevTaggedSet_text()); @@ -389,7 +389,7 @@ final class CentralRepoIngestModule implements FileIngestModule { detailsSb.append(""); //NON-NLS - services.postMessage(IngestMessage.createDataMessage(CentralRepoIngestModuleFactory.getModuleName(), + services.postMessage(IngestMessage.createDataMessage(IngestModuleFactory.getModuleName(), Bundle.CentralRepoIngestModule_postToBB_knownBadMsg(name), detailsSb.toString(), name + md5Hash, diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModuleFactory.java similarity index 94% rename from Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java rename to Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModuleFactory.java index 078c3a5ac9..8d3654384f 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModuleFactory.java @@ -35,7 +35,7 @@ import org.sleuthkit.autopsy.ingest.NoIngestModuleIngestJobSettings; @ServiceProvider(service = org.sleuthkit.autopsy.ingest.IngestModuleFactory.class) @NbBundle.Messages({"CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine", "CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation"}) -public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter { +public class IngestModuleFactory extends IngestModuleFactoryAdapter { /** * Get the name of the module. @@ -69,13 +69,13 @@ public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter { @Override public FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings settings) { if (settings instanceof IngestSettings) { - return new CentralRepoIngestModule((IngestSettings) settings); + return new IngestModule((IngestSettings) settings); } /* * Compatibility check for older versions. */ if (settings instanceof NoIngestModuleIngestJobSettings) { - return new CentralRepoIngestModule(new IngestSettings()); + return new IngestModule(new IngestSettings()); } throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings"); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java index e591ad5a7e..32ab9e9f2d 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java @@ -33,7 +33,7 @@ final class IngestSettings implements IngestModuleIngestJobSettings { * Instantiate the ingest job settings with default values. */ IngestSettings() { - this.flagTaggedNotableItems = CentralRepoIngestModule.DEFAULT_FLAG_TAGGED_NOTABLE_ITEMS; + this.flagTaggedNotableItems = IngestModule.DEFAULT_FLAG_TAGGED_NOTABLE_ITEMS; } /** diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java index 1b59598d55..f73eaf020f 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java @@ -48,7 +48,7 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; -import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory; +import org.sleuthkit.autopsy.centralrepository.ingestmodule.IngestModuleFactory; import org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer; import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent; import org.sleuthkit.autopsy.corecomponents.DataResultViewerTable; @@ -706,7 +706,7 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer } //if the eamdb is enabled and an instance is able to be retrieved check if each data source has been processed into the cr HashMap dataSourceCorrelationMap = new HashMap<>(); //keep track of the status of all data sources that have been ingested - String correlationEngineModuleName = CentralRepoIngestModuleFactory.getModuleName(); + String correlationEngineModuleName = IngestModuleFactory.getModuleName(); SleuthkitCase skCase = Case.getCurrentCaseThrows().getSleuthkitCase(); List correlatedDataSources = EamDb.getInstance().getDataSources(); List ingestJobs = skCase.getIngestJobs(); diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java index 3001036693..0611fdefd5 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java @@ -39,7 +39,7 @@ import org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModu import org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory; import org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory; import org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory; -import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory; +//import org.sleuthkit.autopsy.centralrepository.ingestmodule.IngestModuleFactory; import org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModuleFactory; import org.sleuthkit.autopsy.python.JythonModuleLoader; @@ -64,7 +64,7 @@ final class IngestModuleFactoryLoader { add("org.sleuthkit.autopsy.thunderbirdparser.EmailParserModuleFactory"); //NON-NLS add(EncryptionDetectionModuleFactory.class.getCanonicalName()); add(InterestingItemsIngestModuleFactory.class.getCanonicalName()); - add(CentralRepoIngestModuleFactory.class.getCanonicalName()); + //add(IngestModuleFactory.class.getCanonicalName()); add(PhotoRecCarverIngestModuleFactory.class.getCanonicalName()); add(VMExtractorIngestModuleFactory.class.getCanonicalName()); add(DataSourceIntegrityModuleFactory.class.getCanonicalName()); diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java index eac3ffd3d2..e2857baad7 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java @@ -184,7 +184,7 @@ class InterCaseTestUtils { final IngestModuleTemplate vmExtractorTemplate = IngestUtils.getIngestModuleTemplate(new VMExtractorIngestModuleFactory()); final IngestModuleTemplate photoRecTemplate = IngestUtils.getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()); final IngestModuleTemplate dataSourceIntegrityTemplate = IngestUtils.getIngestModuleTemplate(new DataSourceIntegrityModuleFactory()); - final IngestModuleTemplate eamDbTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory()); + final IngestModuleTemplate eamDbTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.centralrepository.ingestmodule.IngestModuleFactory()); final IngestModuleTemplate fileExtMismatchDetectorTemplate = IngestUtils.getIngestModuleTemplate(new FileExtMismatchDetectorModuleFactory()); //TODO we need to figure out how to get ahold of these objects because they are required for properly filling the CR with test data // final IngestModuleTemplate objectDetectorTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.experimental.objectdetection.ObjectDetectionModuleFactory()); @@ -220,7 +220,7 @@ class InterCaseTestUtils { kitchenSink.add(dataSourceIntegrityTemplate); kitchenSink.add(eamDbTemplate); kitchenSink.add(fileExtMismatchDetectorTemplate); - //TODO this list should probably be populated by way of loading the appropriate modules based on finding all of the @ServiceProvider(service = CentralRepoIngestModuleFactory.class) types + //TODO this list should probably be populated by way of loading the appropriate modules based on finding all of the @ServiceProvider(service = IngestModuleFactory.class) types // kitchenSink.add(objectDetectorTemplate); // kitchenSink.add(emailParserTemplate); // kitchenSink.add(recentActivityTemplate); From 80cec70c610c834382604ad73311ae5a738b0dbe Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Tue, 4 Dec 2018 11:21:27 -0500 Subject: [PATCH 61/70] Do CR name change again --- ...{IngestModule.java => CentralRepoIngestModule.java} | 10 +++++----- ...actory.java => CentralRepoIngestModuleFactory.java} | 6 +++--- .../centralrepository/ingestmodule/IngestSettings.java | 4 ++-- .../autopsy/commonfilesearch/CommonAttributePanel.java | 4 ++-- .../autopsy/ingest/IngestModuleFactoryLoader.java | 6 +++--- .../autopsy/commonfilessearch/InterCaseTestUtils.java | 4 ++-- 6 files changed, 17 insertions(+), 17 deletions(-) rename Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/{IngestModule.java => CentralRepoIngestModule.java} (97%) rename Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/{IngestModuleFactory.java => CentralRepoIngestModuleFactory.java} (94%) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModule.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModule.java similarity index 97% rename from Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModule.java rename to Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModule.java index 5c8bbf0392..97450a223a 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModule.java @@ -58,12 +58,12 @@ import org.sleuthkit.autopsy.healthmonitor.TimingMetric; */ @Messages({"CentralRepoIngestModule.prevTaggedSet.text=Previously Tagged As Notable (Central Repository)", "CentralRepoIngestModule.prevCaseComment.text=Previous Case: "}) -final class IngestModule implements FileIngestModule { +final class CentralRepoIngestModule implements FileIngestModule { static final boolean DEFAULT_FLAG_TAGGED_NOTABLE_ITEMS = true; static final boolean DEFAULT_FLAG_PREVIOUS_DEVICES = true; - private final static Logger logger = Logger.getLogger(IngestModule.class.getName()); + private final static Logger logger = Logger.getLogger(CentralRepoIngestModule.class.getName()); private final IngestServices services = IngestServices.getInstance(); private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter(); private static final IngestModuleReferenceCounter warningMsgRefCounter = new IngestModuleReferenceCounter(); @@ -80,7 +80,7 @@ final class IngestModule implements FileIngestModule { * * @param settings The ingest settings for the module instance. */ - IngestModule(IngestSettings settings) { + CentralRepoIngestModule(IngestSettings settings) { flagTaggedNotableItems = settings.isFlagTaggedNotableItems(); flagPreviouslySeenDevices = settings.isFlagPreviousDevices(); } @@ -323,7 +323,7 @@ final class IngestModule implements FileIngestModule { private void postCorrelatedBadFileToBlackboard(AbstractFile abstractFile, List caseDisplayNames) { try { - String MODULE_NAME = IngestModuleFactory.getModuleName(); + String MODULE_NAME = CentralRepoIngestModuleFactory.getModuleName(); BlackboardArtifact tifArtifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); BlackboardAttribute att = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, MODULE_NAME, Bundle.CentralRepoIngestModule_prevTaggedSet_text()); @@ -395,7 +395,7 @@ final class IngestModule implements FileIngestModule { detailsSb.append(""); //NON-NLS - services.postMessage(IngestMessage.createDataMessage(IngestModuleFactory.getModuleName(), + services.postMessage(IngestMessage.createDataMessage(CentralRepoIngestModuleFactory.getModuleName(), Bundle.CentralRepoIngestModule_postToBB_knownBadMsg(name), detailsSb.toString(), name + md5Hash, diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModuleFactory.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java similarity index 94% rename from Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModuleFactory.java rename to Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java index 8d3654384f..078c3a5ac9 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java @@ -35,7 +35,7 @@ import org.sleuthkit.autopsy.ingest.NoIngestModuleIngestJobSettings; @ServiceProvider(service = org.sleuthkit.autopsy.ingest.IngestModuleFactory.class) @NbBundle.Messages({"CentralRepoIngestModuleFactory.ingestmodule.name=Correlation Engine", "CentralRepoIngestModuleFactory.ingestmodule.desc=Saves properties to the central repository for later correlation"}) -public class IngestModuleFactory extends IngestModuleFactoryAdapter { +public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter { /** * Get the name of the module. @@ -69,13 +69,13 @@ public class IngestModuleFactory extends IngestModuleFactoryAdapter { @Override public FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings settings) { if (settings instanceof IngestSettings) { - return new IngestModule((IngestSettings) settings); + return new CentralRepoIngestModule((IngestSettings) settings); } /* * Compatibility check for older versions. */ if (settings instanceof NoIngestModuleIngestJobSettings) { - return new IngestModule(new IngestSettings()); + return new CentralRepoIngestModule(new IngestSettings()); } throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings"); diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java index 5a0580adf4..74ad3537d8 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/IngestSettings.java @@ -34,8 +34,8 @@ final class IngestSettings implements IngestModuleIngestJobSettings { * Instantiate the ingest job settings with default values. */ IngestSettings() { - this.flagTaggedNotableItems = IngestModule.DEFAULT_FLAG_TAGGED_NOTABLE_ITEMS; - this.flagPreviousDevices = IngestModule.DEFAULT_FLAG_PREVIOUS_DEVICES; + this.flagTaggedNotableItems = CentralRepoIngestModule.DEFAULT_FLAG_TAGGED_NOTABLE_ITEMS; + this.flagPreviousDevices = CentralRepoIngestModule.DEFAULT_FLAG_PREVIOUS_DEVICES; } /** diff --git a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java index f73eaf020f..1b59598d55 100644 --- a/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java +++ b/Core/src/org/sleuthkit/autopsy/commonfilesearch/CommonAttributePanel.java @@ -48,7 +48,7 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDb; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; -import org.sleuthkit.autopsy.centralrepository.ingestmodule.IngestModuleFactory; +import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory; import org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer; import org.sleuthkit.autopsy.corecomponents.DataResultTopComponent; import org.sleuthkit.autopsy.corecomponents.DataResultViewerTable; @@ -706,7 +706,7 @@ final class CommonAttributePanel extends javax.swing.JDialog implements Observer } //if the eamdb is enabled and an instance is able to be retrieved check if each data source has been processed into the cr HashMap dataSourceCorrelationMap = new HashMap<>(); //keep track of the status of all data sources that have been ingested - String correlationEngineModuleName = IngestModuleFactory.getModuleName(); + String correlationEngineModuleName = CentralRepoIngestModuleFactory.getModuleName(); SleuthkitCase skCase = Case.getCurrentCaseThrows().getSleuthkitCase(); List correlatedDataSources = EamDb.getInstance().getDataSources(); List ingestJobs = skCase.getIngestJobs(); diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java index 0611fdefd5..672ffd6807 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactoryLoader.java @@ -39,7 +39,7 @@ import org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModu import org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory; import org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory; import org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory; -//import org.sleuthkit.autopsy.centralrepository.ingestmodule.IngestModuleFactory; +import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory; import org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModuleFactory; import org.sleuthkit.autopsy.python.JythonModuleLoader; @@ -64,7 +64,7 @@ final class IngestModuleFactoryLoader { add("org.sleuthkit.autopsy.thunderbirdparser.EmailParserModuleFactory"); //NON-NLS add(EncryptionDetectionModuleFactory.class.getCanonicalName()); add(InterestingItemsIngestModuleFactory.class.getCanonicalName()); - //add(IngestModuleFactory.class.getCanonicalName()); + add(CentralRepoIngestModuleFactory.class.getCanonicalName()); add(PhotoRecCarverIngestModuleFactory.class.getCanonicalName()); add(VMExtractorIngestModuleFactory.class.getCanonicalName()); add(DataSourceIntegrityModuleFactory.class.getCanonicalName()); @@ -79,7 +79,7 @@ final class IngestModuleFactoryLoader { * removed between invocations. * * @return A list of objects that implement the IngestModuleFactory - * interface. + * interface. */ static List getIngestModuleFactories() { // A hash set of display names and a hash map of class names to diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java index e2857baad7..eac3ffd3d2 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/commonfilessearch/InterCaseTestUtils.java @@ -184,7 +184,7 @@ class InterCaseTestUtils { final IngestModuleTemplate vmExtractorTemplate = IngestUtils.getIngestModuleTemplate(new VMExtractorIngestModuleFactory()); final IngestModuleTemplate photoRecTemplate = IngestUtils.getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()); final IngestModuleTemplate dataSourceIntegrityTemplate = IngestUtils.getIngestModuleTemplate(new DataSourceIntegrityModuleFactory()); - final IngestModuleTemplate eamDbTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.centralrepository.ingestmodule.IngestModuleFactory()); + final IngestModuleTemplate eamDbTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory()); final IngestModuleTemplate fileExtMismatchDetectorTemplate = IngestUtils.getIngestModuleTemplate(new FileExtMismatchDetectorModuleFactory()); //TODO we need to figure out how to get ahold of these objects because they are required for properly filling the CR with test data // final IngestModuleTemplate objectDetectorTemplate = IngestUtils.getIngestModuleTemplate(new org.sleuthkit.autopsy.experimental.objectdetection.ObjectDetectionModuleFactory()); @@ -220,7 +220,7 @@ class InterCaseTestUtils { kitchenSink.add(dataSourceIntegrityTemplate); kitchenSink.add(eamDbTemplate); kitchenSink.add(fileExtMismatchDetectorTemplate); - //TODO this list should probably be populated by way of loading the appropriate modules based on finding all of the @ServiceProvider(service = IngestModuleFactory.class) types + //TODO this list should probably be populated by way of loading the appropriate modules based on finding all of the @ServiceProvider(service = CentralRepoIngestModuleFactory.class) types // kitchenSink.add(objectDetectorTemplate); // kitchenSink.add(emailParserTemplate); // kitchenSink.add(recentActivityTemplate); From 683925bd1e77fb6c7e725095284651bcc368ff82 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dgrove" Date: Tue, 4 Dec 2018 13:52:55 -0500 Subject: [PATCH 62/70] Using StringUtils. --- .../modules/exif/ExifParserFileIngestModule.java | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java index a43c1e8f1e..b025a6fd60 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java @@ -37,6 +37,7 @@ import java.util.List; import java.util.TimeZone; import java.util.concurrent.atomic.AtomicInteger; import java.util.logging.Level; +import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; import org.openide.util.NbBundle.Messages; import org.sleuthkit.autopsy.casemodule.Case; @@ -195,19 +196,13 @@ public final class ExifParserFileIngestModule implements FileIngestModule { ExifIFD0Directory devDir = metadata.getFirstDirectoryOfType(ExifIFD0Directory.class); if (devDir != null) { String model = devDir.getString(ExifIFD0Directory.TAG_MODEL); - if (model != null) { - model = model.trim(); - if (!model.isEmpty()) { - attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, ExifParserModuleFactory.getModuleName(), model)); - } + if (StringUtils.isNotBlank(model)) { + attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, ExifParserModuleFactory.getModuleName(), model)); } String make = devDir.getString(ExifIFD0Directory.TAG_MAKE); - if (make != null) { - make = make.trim(); - if (!make.isEmpty()) { - attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, ExifParserModuleFactory.getModuleName(), make)); - } + if (StringUtils.isNotBlank(make)) { + attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, ExifParserModuleFactory.getModuleName(), make)); } } From d8c3f9f7cf13b9e3a2e9afe8a7290f858da5a813 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Tue, 4 Dec 2018 15:07:21 -0500 Subject: [PATCH 63/70] 4380 add examples and error messages for new correlation attr types --- .../OtherCasesSearchDialog.java | 99 +++++++++++++------ 1 file changed, 68 insertions(+), 31 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java b/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java index 6fe9ec8ce3..4320290ba8 100755 --- a/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java +++ b/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java @@ -56,19 +56,25 @@ import org.sleuthkit.autopsy.datamodel.EmptyNode; "OtherCasesSearchDialog.validation.invalidEmail=The supplied value is not a valid e-mail address.", "OtherCasesSearchDialog.validation.invalidDomain=The supplied value is not a valid domain.", "OtherCasesSearchDialog.validation.invalidPhone=The supplied value is not a valid phone number.", + "OtherCasesSearchDialog.validation.invalidSsid=The supplied value is not a valid wireless network.", + "OtherCasesSearchDialog.validation.invalidMac=The supplied value is not a valid MAC address.", + "OtherCasesSearchDialog.validation.invalidImei=The supplied value is not a valid IMEI number.", + "OtherCasesSearchDialog.validation.invalidImsi=The supplied value is not a valid IMSI number.", + "OtherCasesSearchDialog.validation.invalidIccid=The supplied value is not a valid ICCID number.", "OtherCasesSearchDialog.validation.genericMessage=The supplied value is not valid.", "# {0} - number of cases", "OtherCasesSearchDialog.caseLabel.text=The current Central Repository contains {0} case(s)." }) /** - * The Search Other Cases dialog allows users to search for specific - * types of correlation properties in the Central Repository. + * The Search Other Cases dialog allows users to search for specific types of + * correlation properties in the Central Repository. */ @SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives final class OtherCasesSearchDialog extends javax.swing.JDialog { + private static final Logger logger = Logger.getLogger(OtherCasesSearchDialog.class.getName()); private static final long serialVersionUID = 1L; - + private final List correlationTypes; private CorrelationAttributeInstance.Type selectedCorrelationType; private TextPrompt correlationValueTextFieldPrompt; @@ -82,20 +88,20 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { initComponents(); customizeComponents(); } - + /** * Perform the other cases search. - * - * @param type The correlation type. + * + * @param type The correlation type. * @param value The value to be matched. */ private void search(CorrelationAttributeInstance.Type type, String value) { new SwingWorker, Void>() { - + @Override protected List doInBackground() { List correlationInstances = new ArrayList<>(); - + try { correlationInstances = EamDb.getInstance().getArtifactInstancesByTypeValue(type, value); } catch (EamDbException ex) { @@ -115,10 +121,10 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { DataResultViewerTable table = new DataResultViewerTable(); Collection viewers = new ArrayList<>(1); viewers.add(table); - + OtherCasesSearchNode searchNode = new OtherCasesSearchNode(correlationInstances); TableFilterNode tableFilterNode = new TableFilterNode(searchNode, true, searchNode.getName()); - + String resultsText = String.format("%s (%s; \"%s\")", Bundle.OtherCasesSearchDialog_resultsTitle_text(), type.getDisplayName(), value); final TopComponent searchResultWin; @@ -235,7 +241,7 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { private void searchButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_searchButtonActionPerformed CorrelationAttributeInstance.Type correlationType = selectedCorrelationType; String correlationValue = correlationValueTextField.getText().trim(); - + if (validateInputs(correlationType, correlationValue)) { search(correlationType, correlationValue); dispose(); @@ -254,23 +260,38 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { case CorrelationAttributeInstance.PHONE_TYPE_ID: validationMessage = Bundle.OtherCasesSearchDialog_validation_invalidPhone(); break; + case CorrelationAttributeInstance.SSID_TYPE_ID: + validationMessage = Bundle.OtherCasesSearchDialog_validation_invalidSsid(); + break; + case CorrelationAttributeInstance.MAC_TYPE_ID: + validationMessage = Bundle.OtherCasesSearchDialog_validation_invalidMac(); + break; + case CorrelationAttributeInstance.IMEI_TYPE_ID: + validationMessage = Bundle.OtherCasesSearchDialog_validation_invalidImei(); + break; + case CorrelationAttributeInstance.IMSI_TYPE_ID: + validationMessage = Bundle.OtherCasesSearchDialog_validation_invalidImsi(); + break; + case CorrelationAttributeInstance.ICCID_TYPE_ID: + validationMessage = Bundle.OtherCasesSearchDialog_validation_invalidIccid(); + break; default: validationMessage = Bundle.OtherCasesSearchDialog_validation_genericMessage(); break; - + } errorLabel.setText(validationMessage); searchButton.setEnabled(false); correlationValueTextField.grabFocus(); } }//GEN-LAST:event_searchButtonActionPerformed - + /** * Validate the supplied input. - * - * @param type The correlation type. + * + * @param type The correlation type. * @param value The value to be validated. - * + * * @return True if the input is valid for the given type; otherwise false. */ private boolean validateInputs(CorrelationAttributeInstance.Type type, String value) { @@ -280,16 +301,16 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { // No need to log this. return false; } - + return true; } - + /** * Further customize the components beyond the standard initialization. */ private void customizeComponents() { searchButton.setEnabled(false); - + /* * Add correlation types to the combo-box. */ @@ -307,7 +328,7 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { correlationTypeComboBox.addItem(type.getDisplayName()); } correlationTypeComboBox.setSelectedIndex(0); - + correlationTypeComboBox.addItemListener(new ItemListener() { @Override public void itemStateChanged(ItemEvent e) { @@ -316,9 +337,9 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { updateSearchButton(); } }); - + updateSelectedType(); - + /* * Create listener for text input. */ @@ -338,17 +359,21 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { updateSearchButton(); } }); - + updateCorrelationValueTextFieldPrompt(); } - + @Messages({ "OtherCasesSearchDialog.correlationValueTextField.filesExample=Example: \"f0e1d2c3b4a5968778695a4b3c2d1e0f\"", "OtherCasesSearchDialog.correlationValueTextField.domainExample=Example: \"domain.com\"", "OtherCasesSearchDialog.correlationValueTextField.emailExample=Example: \"user@host.com\"", "OtherCasesSearchDialog.correlationValueTextField.phoneExample=Example: \"(800)123-4567\"", "OtherCasesSearchDialog.correlationValueTextField.usbExample=Example: \"4&1234567&0\"", - "OtherCasesSearchDialog.correlationValueTextField.ssidExample=Example: \"WirelessNetwork-5G\"" + "OtherCasesSearchDialog.correlationValueTextField.ssidExample=Example: \"WirelessNetwork-5G\"", + "OtherCasesSearchDialog.correlationValueTextField.macExample=Example: \"0C-14-F2-01-AF-45\"", + "OtherCasesSearchDialog.correlationValueTextField.imeiExample=Example: \"351756061523999\"", + "OtherCasesSearchDialog.correlationValueTextField.imsiExample=Example: \"310150123456789\"", + "OtherCasesSearchDialog.correlationValueTextField.iccidExample=Example: \"89 91 19 1299 99 329451 0\"" }) /** * Update the text prompt of the name text field based on the input type @@ -359,7 +384,7 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { * Add text prompt to the text field. */ String text; - switch(selectedCorrelationType.getId()) { + switch (selectedCorrelationType.getId()) { case CorrelationAttributeInstance.FILES_TYPE_ID: text = Bundle.OtherCasesSearchDialog_correlationValueTextField_filesExample(); break; @@ -378,22 +403,34 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { case CorrelationAttributeInstance.SSID_TYPE_ID: text = Bundle.OtherCasesSearchDialog_correlationValueTextField_ssidExample(); break; + case CorrelationAttributeInstance.MAC_TYPE_ID: + text = Bundle.OtherCasesSearchDialog_correlationValueTextField_macExample(); + break; + case CorrelationAttributeInstance.IMEI_TYPE_ID: + text = Bundle.OtherCasesSearchDialog_correlationValueTextField_imeiExample(); + break; + case CorrelationAttributeInstance.IMSI_TYPE_ID: + text = Bundle.OtherCasesSearchDialog_correlationValueTextField_imsiExample(); + break; + case CorrelationAttributeInstance.ICCID_TYPE_ID: + text = Bundle.OtherCasesSearchDialog_correlationValueTextField_iccidExample(); + break; default: text = ""; break; } correlationValueTextFieldPrompt = new TextPrompt(text, correlationValueTextField); - + /** * Sets the foreground color and transparency of the text prompt. */ correlationValueTextFieldPrompt.setForeground(Color.LIGHT_GRAY); correlationValueTextFieldPrompt.changeAlpha(0.9f); // Mostly opaque - + validate(); repaint(); } - + /** * Update the 'selectedCorrelationType' value to match the selected type * from the combo-box. @@ -406,7 +443,7 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { } } } - + /** * Enable or disable the Search button depending on whether or not text has * been provided for the correlation property value. @@ -433,4 +470,4 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { private javax.swing.JLabel errorLabel; private javax.swing.JButton searchButton; // End of variables declaration//GEN-END:variables -} \ No newline at end of file +} From 549f8a6589adcd2fe04b005fa2990809be593046 Mon Sep 17 00:00:00 2001 From: esaunders Date: Tue, 4 Dec 2018 16:14:49 -0500 Subject: [PATCH 64/70] Update autoupdate.catalog.url --- ImageGallery/nbproject/platform.properties | 2 +- ScalpelCarver/nbproject/platform.properties | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ImageGallery/nbproject/platform.properties b/ImageGallery/nbproject/platform.properties index 351256334b..0c717f4f53 100644 --- a/ImageGallery/nbproject/platform.properties +++ b/ImageGallery/nbproject/platform.properties @@ -7,7 +7,7 @@ nbplatform.active.dir=${suite.dir}/netbeans-plat/${netbeans-plat-version} harness.dir=${nbplatform.active.dir}/harness bootstrap.url=http://bits.netbeans.org/dev/nbms-and-javadoc/lastSuccessfulBuild/artifact/nbbuild/netbeans/harness/tasks.jar # Where we get the platform from. To see what versions are available, open URL in browser up to the .../updates part of the URL -autoupdate.catalog.url=http://updates.netbeans.org/netbeans/updates/${netbeans-plat-version}/uc/final/distribution/catalog.xml.gz +autoupdate.catalog.url=https://updates.netbeans.org/netbeans/updates/${netbeans-plat-version}/uc/final/distribution/catalog.xml.gz cluster.path=\ ${nbplatform.active.dir}/harness:\ ${nbplatform.active.dir}/java:\ diff --git a/ScalpelCarver/nbproject/platform.properties b/ScalpelCarver/nbproject/platform.properties index bff2a507cf..1562be66c8 100644 --- a/ScalpelCarver/nbproject/platform.properties +++ b/ScalpelCarver/nbproject/platform.properties @@ -8,7 +8,7 @@ nbplatform.active.dir=${suite.dir}/netbeans-plat/${netbeans-plat-version} harness.dir=${nbplatform.active.dir}/harness bootstrap.url=http://bits.netbeans.org/dev/nbms-and-javadoc/lastSuccessfulBuild/artifact/nbbuild/netbeans/harness/tasks.jar # Where we get the platform from. To see what versions are available, open URL in browser up to the .../updates part of the URL -autoupdate.catalog.url=http://updates.netbeans.org/netbeans/updates/${netbeans-plat-version}/uc/final/distribution/catalog.xml.gz +autoupdate.catalog.url=https://updates.netbeans.org/netbeans/updates/${netbeans-plat-version}/uc/final/distribution/catalog.xml.gz cluster.path=\ ${nbplatform.active.dir}/harness:\ ${nbplatform.active.dir}/java:\ From 3f6ecd4402b8d7e3e01f58e01f6264fe1df9e459 Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Wed, 5 Dec 2018 08:53:07 -0500 Subject: [PATCH 65/70] Changed device info icon --- .../org/sleuthkit/autopsy/images/devices.png | Bin 342 -> 483 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/images/devices.png b/Core/src/org/sleuthkit/autopsy/images/devices.png index bcb132a1a87fa8ea9f6f92eb38f0d9a2dd329ffa..757488a9aed15e8e83085867193f279f3c1e5503 100644 GIT binary patch delta 389 zcmV;00eb${0^b3DO2v=GkTWih41_Q@jQ+F0-PdH}etD-}_H9*ug9qr=p&KRw=2tyXbe zmt-<26;VvPExtZ#yuYPb*j<-8yO; jy@C*8m|)Tsd=gmS2f2a-7>mvi00000NkvXXu0mjf5S*@} delta 275 zcmV+u0qp+c1J(kNBqa%ONLh0L01FcU01FcV0GgZ_00007bV*G`2jUC_4l5bOPZHdb zTPuG6%t=H+R5;6H{Qv(ygSqn)H3kNTn+&*t`pLaAx3EbtA!|OlSB3!_jSsL8u$h5@ zfq_9(;Fv;s`d+MZjAl-c|KrjqE_jeZQuq))vm01&$*{A&g=?NUb0&s-dU`qo0|P?? zqnXp=|C2j04fyo&8N=#TbBPKAhQEIq7?@+3(PaKJ4JoEDQ_` z47uf)61<#W7?h=nGe8}i1PA*|1qKF&odgZQl|*qR9NL5dJ^)QH)Nui}G(pIK1_G{W Z007tUIE+@cu)Y8Q002ovPDHLkV1l?hYJ~s* From 39017768b1839f147f7da87efdbe246d056895be Mon Sep 17 00:00:00 2001 From: esaunders Date: Wed, 5 Dec 2018 10:24:51 -0500 Subject: [PATCH 66/70] Updated message displayed when limit is reached. --- .../sleuthkit/autopsy/corecomponents/TableFilterChildren.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java b/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java index 799550b897..1133101e88 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/TableFilterChildren.java @@ -100,7 +100,7 @@ class TableFilterChildren extends FilterNode.Children { "TableFilterChildren.createNodes.limitReached.msg=" + "The limit on the number of results to display has been reached." + " Only the first {0} results will be shown." - + " The limit can be modified in the View Options screen."}) + + " The limit can be modified under Tools, Options, View."}) protected Node[] createNodes(Node key) { int maxNodesToCreate = UserPreferences.getMaximumNumberOfResults(); From 1f67e0428bdf28060ca2b2b754f8f34ff56a0f99 Mon Sep 17 00:00:00 2001 From: William Schaefer Date: Wed, 5 Dec 2018 12:30:09 -0500 Subject: [PATCH 67/70] 4380 adjust behavior of error messages to reset when changes made --- .../OtherCasesSearchDialog.form | 6 ++++++ .../OtherCasesSearchDialog.java | 21 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.form b/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.form index cd033f994d..30995524b2 100755 --- a/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.form +++ b/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.form @@ -91,6 +91,9 @@ + + +     @@ -116,6 +119,9 @@ + + + diff --git a/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java b/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java index 4320290ba8..e7f2ae16b5 100755 --- a/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java +++ b/Core/src/org/sleuthkit/autopsy/othercasessearch/OtherCasesSearchDialog.java @@ -169,6 +169,11 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { org.openide.awt.Mnemonics.setLocalizedText(correlationValueLabel, org.openide.util.NbBundle.getMessage(OtherCasesSearchDialog.class, "OtherCasesSearchDialog.correlationValueLabel.text")); // NOI18N correlationValueTextField.setText(org.openide.util.NbBundle.getMessage(OtherCasesSearchDialog.class, "OtherCasesSearchDialog.correlationValueTextField.text")); // NOI18N + correlationValueTextField.addKeyListener(new java.awt.event.KeyAdapter() { + public void keyReleased(java.awt.event.KeyEvent evt) { + valueFieldKeyReleaseListener(evt); + } + }); org.openide.awt.Mnemonics.setLocalizedText(searchButton, org.openide.util.NbBundle.getMessage(OtherCasesSearchDialog.class, "OtherCasesSearchDialog.searchButton.text")); // NOI18N searchButton.addActionListener(new java.awt.event.ActionListener() { @@ -177,6 +182,12 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { } }); + correlationTypeComboBox.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + correlationTypeComboBoxActionPerformed(evt); + } + }); + org.openide.awt.Mnemonics.setLocalizedText(correlationTypeLabel, org.openide.util.NbBundle.getMessage(OtherCasesSearchDialog.class, "OtherCasesSearchDialog.correlationTypeLabel.text")); // NOI18N errorLabel.setForeground(new java.awt.Color(255, 0, 0)); @@ -286,6 +297,16 @@ final class OtherCasesSearchDialog extends javax.swing.JDialog { } }//GEN-LAST:event_searchButtonActionPerformed + private void correlationTypeComboBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_correlationTypeComboBoxActionPerformed + //make error message go away when combo box is selected + errorLabel.setText(""); + }//GEN-LAST:event_correlationTypeComboBoxActionPerformed + + private void valueFieldKeyReleaseListener(java.awt.event.KeyEvent evt) {//GEN-FIRST:event_valueFieldKeyReleaseListener + //make error message go away when the user enters anything in the value field + errorLabel.setText(""); + }//GEN-LAST:event_valueFieldKeyReleaseListener + /** * Validate the supplied input. * From f8ab800593d29a68eba95ea74cdefd82406260b2 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dsmyda" Date: Thu, 6 Dec 2018 14:06:51 -0500 Subject: [PATCH 68/70] Made the permissions file name even more boring --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index aab5aafdeb..e8b54b4daf 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -1122,7 +1122,7 @@ public class Case { */ //Deny ability to add a data source if the special admin access file is present. - File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "addDataSourceChildLock"); + File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "_source"); if(!denyAddDataSourcePermissions.exists()) { CallableSystemAction.get(AddImageAction.class).setEnabled(true); } From 75744e76ba5fc3e03e0bdc93d15d96695ffce288 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dsmyda" Date: Thu, 6 Dec 2018 14:14:18 -0500 Subject: [PATCH 69/70] New name --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index e8b54b4daf..034812bfcd 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -1122,7 +1122,7 @@ public class Case { */ //Deny ability to add a data source if the special admin access file is present. - File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "_source"); + File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "_dsp"); if(!denyAddDataSourcePermissions.exists()) { CallableSystemAction.get(AddImageAction.class).setEnabled(true); } From b47a3fcbc69dacda84ca2a166eefa3574065ec65 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\dsmyda" Date: Thu, 6 Dec 2018 14:14:54 -0500 Subject: [PATCH 70/70] New new name --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index 034812bfcd..7f4ee150c1 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -1122,7 +1122,7 @@ public class Case { */ //Deny ability to add a data source if the special admin access file is present. - File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "_dsp"); + File denyAddDataSourcePermissions = new File(PlatformUtil.getUserConfigDirectory(), "_ndsp"); if(!denyAddDataSourcePermissions.exists()) { CallableSystemAction.get(AddImageAction.class).setEnabled(true); }