mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Resolve merge conflicts for develop branhc merge

Browse Source
This commit is contained in:
Richard Cordovano 2015-05-27 15:15:55 -04:00
commit 443918f8e2
38 changed files with 859 additions and 667 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Core/src/org/sleuthkit/autopsy/coreutils/ImageUtils.java
View File

@ -53,7 +53,7 @@ public class ImageUtils {
private static final Logger logger = Logger.getLogger(ImageUtils.class.getName());
private static final Image DEFAULT_ICON = new ImageIcon("/org/sleuthkit/autopsy/images/file-icon.png").getImage(); //NON-NLS
private static final List<String> SUPP_EXTENSIONS = Arrays.asList(ImageIO.getReaderFileSuffixes());
private static final List<String> SUPP_MIME_TYPES = new ArrayList(Arrays.asList(ImageIO.getReaderMIMETypes()));
private static final List<String> SUPP_MIME_TYPES = new ArrayList<>(Arrays.asList(ImageIO.getReaderMIMETypes()));
static {
SUPP_MIME_TYPES.add("image/x-ms-bmp");
}
@ -259,9 +259,10 @@ public class ImageUtils {
private static BufferedImage generateIcon(Content content, int iconSize) {
InputStream inputStream = null;
BufferedImage bi = null;
try {
inputStream = new ReadContentInputStream(content);
BufferedImage bi = ImageIO.read(inputStream);
bi = ImageIO.read(inputStream);
if (bi == null) {
logger.log(Level.WARNING, "No image reader for file: " + content.getName()); //NON-NLS
return null;
@ -269,7 +270,13 @@ public class ImageUtils {
BufferedImage biScaled = ScalrWrapper.resizeFast(bi, iconSize);
return biScaled;
} catch (OutOfMemoryError e) {
} catch (IllegalArgumentException e) {
// if resizing does not work due to extremely small height/width ratio,
// crop the image instead.
BufferedImage biCropped = ScalrWrapper.cropImage(bi, Math.min(iconSize, bi.getWidth()), Math.min(iconSize, bi.getHeight()));
return biCropped;
}
catch (OutOfMemoryError e) {
logger.log(Level.WARNING, "Could not scale image (too large): " + content.getName(), e); //NON-NLS
return null;
} catch (Exception e) {

6
Core/src/org/sleuthkit/autopsy/ingest/DataSourceIngestPipeline.java
View File

@ -24,6 +24,7 @@ import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.datamodel.Content;
/**
@ -110,6 +111,11 @@ final class DataSourceIngestPipeline {
logger.log(Level.INFO, "{0} analysis of {1} (jobId={2}) finished", new Object[]{module.getDisplayName(), this.job.getDataSource().getName(), this.job.getDataSource().getId()});
} catch (Throwable ex) { // Catch-all exception firewall
errors.add(new IngestModuleError(module.getDisplayName(), ex));
String msg = ex.getMessage();
// Jython run-time errors don't seem to have a message, but have details in toString.
if (msg == null)
msg = ex.toString();
MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
}
if (this.job.isCancelled()) {
break;

11
Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java
View File

@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.ingest;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.datamodel.AbstractFile;
/**
@ -119,6 +120,11 @@ final class FileIngestPipeline {
module.process(file);
} catch (Throwable ex) { // Catch-all exception firewall
errors.add(new IngestModuleError(module.getDisplayName(), ex));
String msg = ex.getMessage();
// Jython run-time errors don't seem to have a message, but have details in toString.
if (msg == null)
msg = ex.toString();
MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
}
if (this.job.isCancelled()) {
break;
@ -144,6 +150,11 @@ final class FileIngestPipeline {
module.shutDown();
} catch (Throwable ex) { // Catch-all exception firewall
errors.add(new IngestModuleError(module.getDisplayName(), ex));
String msg = ex.getMessage();
// Jython run-time errors don't seem to have a message, but have details in toString.
if (msg == null)
msg = ex.toString();
MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
}
}
this.running = false;

6
Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java
View File

@ -96,16 +96,16 @@ public class STIXReportModule implements GeneralReportModule {
/**
* .
*
* @param path path to save the report
* @param baseReportDir path to save the report
* @param progressPanel panel to update the report's progress
*/
@Override
public void generateReport(String path, ReportProgressPanel progressPanel) {
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
// Start the progress bar and setup the report
progressPanel.setIndeterminate(false);
progressPanel.start();
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "STIXReportModule.progress.readSTIX"));
reportPath = path + getRelativeFilePath();
reportPath = baseReportDir + getRelativeFilePath();
// Check if the user wants to display all output or just hits
reportAllResults = configPanel.getShowAllResults();

2
Core/src/org/sleuthkit/autopsy/python/Bundle.properties
View File

@ -1,2 +1,2 @@
JythonModuleLoader.errorMessages.failedToOpenModule=Failed to open {0}. See log for details.
JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0} from {1}. See log for details.
JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0}. {1}. See log for details.

3
Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java
View File

@ -81,8 +81,9 @@ public final class JythonModuleLoader {
objects.add( createObjectFromScript(script, className, interfaceClass));
} catch (Exception ex) {
logger.log(Level.SEVERE, String.format("Failed to load %s from %s", className, script.getAbsolutePath()), ex); //NON-NLS
// NOTE: using ex.toString() because the current version is always returning null for ex.getMessage().
DialogDisplayer.getDefault().notify(new NotifyDescriptor.Message(
NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, script.getAbsolutePath()),
NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, ex.toString()),
NotifyDescriptor.ERROR_MESSAGE));
}
}

4
Core/src/org/sleuthkit/autopsy/report/FileReportModule.java
View File

@ -29,9 +29,9 @@ import org.sleuthkit.datamodel.AbstractFile;
interface FileReportModule extends ReportModule {
/**
* Initialize the report which will be stored at the given path.
* @param path
* @param baseReportDir Base directory to store the report file in. Report should go into baseReportDir + getRelativeFilePath().
*/
public void startReport(String path);
public void startReport(String baseReportDir);
/**
* End the report.

4
Core/src/org/sleuthkit/autopsy/report/FileReportText.java
View File

@ -54,8 +54,8 @@ import org.sleuthkit.datamodel.AbstractFile;
}
@Override
public void startReport(String path) {
this.reportPath = path + FILE_NAME;
public void startReport(String baseReportDir) {
this.reportPath = baseReportDir + FILE_NAME;
try {
out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(this.reportPath)));
} catch (IOException ex) {

4
Core/src/org/sleuthkit/autopsy/report/GeneralReportModule.java
View File

@ -26,10 +26,10 @@ public interface GeneralReportModule extends ReportModule {
* Called to generate the report. Method is responsible for saving the file at the
* path specified and updating progress via the progressPanel object.
*
* @param reportPath path to save the report
* @param baseReportDir Base directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath().
* @param progressPanel panel to update the report's progress with
*/
public void generateReport(String reportPath, ReportProgressPanel progressPanel);
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel);
/**
* Returns the configuration panel for the report, which is displayed in

2
Core/src/org/sleuthkit/autopsy/report/GeneralReportModuleAdapter.java
View File

@ -38,7 +38,7 @@ public abstract class GeneralReportModuleAdapter implements GeneralReportModule
}
@Override
public abstract void generateReport(String reportPath, ReportProgressPanel progressPanel);
public abstract void generateReport(String baseReportDir, ReportProgressPanel progressPanel);
@Override
public JPanel getConfigurationPanel() {

7
Core/src/org/sleuthkit/autopsy/report/ReportBodyFile.java
View File

@ -63,16 +63,17 @@ import org.sleuthkit.datamodel.*;
/**
* Generates a body file format report for use with the MAC time tool.
* @param path path to save the report
* @param baseReportDir path to save the report
* @param progressPanel panel to update the report's progress
*/
@Override
public void generateReport(String path, ReportProgressPanel progressPanel) {
@SuppressWarnings("deprecation")
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
// Start the progress bar and setup the report
progressPanel.setIndeterminate(false);
progressPanel.start();
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportBodyFile.progress.querying"));
reportPath = path + "BodyFile.txt"; //NON-NLS
reportPath = baseReportDir + "BodyFile.txt"; //NON-NLS
currentCase = Case.getCurrentCase();
skCase = currentCase.getSleuthkitCase();

6
Core/src/org/sleuthkit/autopsy/report/ReportExcel.java
View File

@ -58,12 +58,12 @@ import org.sleuthkit.datamodel.TskCoreException;
/**
* Start the Excel report by creating the Workbook, initializing styles,
* and writing the summary.
* @param path path to save the report
* @param baseReportDir path to save the report
*/
@Override
public void startReport(String path) {
public void startReport(String baseReportDir) {
// Set the path and save it for when the report is written to disk.
this.reportPath = path + getRelativeFilePath();
this.reportPath = baseReportDir + getRelativeFilePath();
// Make a workbook.
wb = new XSSFWorkbook();

6
Core/src/org/sleuthkit/autopsy/report/ReportHTML.java
View File

@ -299,14 +299,14 @@ import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
/**
* Start this report by setting the path, refreshing member variables,
* and writing the skeleton for the HTML report.
* @param path path to save the report
* @param baseReportDir path to save the report
*/
@Override
public void startReport(String path) {
public void startReport(String baseReportDir) {
// Refresh the HTML report
refresh();
// Setup the path for the HTML report
this.path = path + "HTML Report" + File.separator; //NON-NLS
this.path = baseReportDir + "HTML Report" + File.separator; //NON-NLS
this.thumbsPath = this.path + "thumbs" + File.separator; //NON-NLS
try {
FileUtil.createFolder(new File(this.path));

8
Core/src/org/sleuthkit/autopsy/report/ReportKML.java
View File

@ -70,18 +70,18 @@ class ReportKML implements GeneralReportModule {
/**
* Generates a body file format report for use with the MAC time tool.
*
* @param path path to save the report
* @param baseReportDir path to save the report
* @param progressPanel panel to update the report's progress
*/
@Override
public void generateReport(String path, ReportProgressPanel progressPanel) {
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
// Start the progress bar and setup the report
progressPanel.setIndeterminate(false);
progressPanel.start();
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportKML.progress.querying"));
reportPath = path + "ReportKML.kml"; //NON-NLS
String reportPath2 = path + "ReportKML.txt"; //NON-NLS
reportPath = baseReportDir + "ReportKML.kml"; //NON-NLS
String reportPath2 = baseReportDir + "ReportKML.txt"; //NON-NLS
currentCase = Case.getCurrentCase();
skCase = currentCase.getSleuthkitCase();

8
Core/src/org/sleuthkit/autopsy/report/ReportModule.java
View File

@ -40,11 +40,11 @@ interface ReportModule {
/**
* Gets the relative path of the report file, if any, generated by this
* module. The path should be relative to the time stamp subdirectory of
* reports directory.
* module. The path should be relative to the location that gets passed in
* to generateReport() (or similar).
*
* @return Report file path relative to the time stamp subdirectory reports
* directory, may be null if the module does not produce a report file.
* @return Relative path to where report will be stored.
* May be null if the module does not produce a report file.
*/
public String getRelativeFilePath();
}

4
Core/src/org/sleuthkit/autopsy/report/TableReportModule.java
View File

@ -35,9 +35,9 @@ import java.util.List;
* Start the report. Open any output streams, initialize member variables,
* write summary and navigation pages. Considered the "constructor" of the report.
*
* @param path String path to save the report
* @param baseReportDir Directory to save the report file into. Report should go into baseReportDir + getRelativeFilePath().
*/
public void startReport(String path);
public void startReport(String baseReportDir);
/**
* End the report. Close all output streams and write any end-of-report

15
Core/src/org/sleuthkit/autopsy/timeline/TimeLineController.java
View File

@ -362,7 +362,7 @@ public class TimeLineController {
@SuppressWarnings("deprecation")
private long getCaseLastArtifactID(final SleuthkitCase sleuthkitCase) {
long caseLastArtfId = -1;
String query = "SELECT MAX(artifact_id) AS max_id FROM blackboard_artifacts"; // NON-NLS
String query = "select Max(artifact_id) as max_id from blackboard_artifacts"; // NON-NLS
try (CaseDbQuery dbQuery = sleuthkitCase.executeQuery(query)) {
ResultSet resultSet = dbQuery.getResultSet();
while (resultSet.next()) {
@ -573,6 +573,12 @@ public class TimeLineController {
monitorTask(selectTimeAndTypeTask);
}
/**
* submit a task for execution and add it to the list of tasks whose
* progress is monitored and displayed in the progress bar
*
* @param task
*/
synchronized public void monitorTask(final Task<?> task) {
if (task != null) {
Platform.runLater(() -> {
@ -606,9 +612,16 @@ public class TimeLineController {
break;
case SCHEDULED:
case RUNNING:
case SUCCEEDED:
case CANCELLED:
case FAILED:
tasks.remove(task);
if (tasks.isEmpty() == false) {
progress.bind(tasks.get(0).progressProperty());
message.bind(tasks.get(0).messageProperty());
taskTitle.bind(tasks.get(0).titleProperty());
}
break;
}
});

5
CoreLibs/src/org/sleuthkit/autopsy/corelibs/ScalrWrapper.java
View File

@ -20,6 +20,7 @@
package org.sleuthkit.autopsy.corelibs;
import java.awt.image.BufferedImage;
import java.awt.image.BufferedImageOp;
import org.imgscalr.Scalr;
import org.imgscalr.Scalr.Method;
@ -48,4 +49,8 @@ import org.imgscalr.Scalr.Method;
public static synchronized BufferedImage resizeFast(BufferedImage input, int width, int height) {
return Scalr.resize(input, Method.SPEED, Scalr.Mode.AUTOMATIC, width, height, Scalr.OP_ANTIALIAS);
}
public static synchronized BufferedImage cropImage(BufferedImage input, int width, int height) {
return Scalr.crop(input, width, height, (BufferedImageOp) null);
}
}

9
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java
View File

@ -95,23 +95,16 @@ public class CategorizeAction extends AddTagAction {
//remove old category tag if necessary
List<ContentTag> allContentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByContent(file);
boolean hadExistingCategory = false;
for (ContentTag ct : allContentTags) {
//this is bad: treating tags as categories as long as their names start with prefix
//TODO: abandon using tags for categories and instead add a new column to DrawableDB
if (ct.getName().getDisplayName().startsWith(Category.CATEGORY_PREFIX)) {
LOGGER.log(Level.INFO, "removing old category from {0}", file.getName());
//LOGGER.log(Level.INFO, "removing old category from {0}", file.getName());
Case.getCurrentCase().getServices().getTagsManager().deleteContentTag(ct);
controller.getDatabase().decrementCategoryCount(Category.fromDisplayName(ct.getName().getDisplayName()));
hadExistingCategory = true;
}
}
// If the image was uncategorized, decrement the uncategorized count
if(! hadExistingCategory){
controller.getDatabase().decrementCategoryCount(Category.ZERO);
}
controller.getDatabase().incrementCategoryCount(Category.fromDisplayName(tagName.getDisplayName()));
if (tagName != Category.ZERO.getTagName()) { // no tags for cat-0
Case.getCurrentCase().getServices().getTagsManager().addContentTag(file, tagName, comment);

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/Category.java
View File

@ -66,7 +66,7 @@ public enum Category implements Comparable<Category> {
private final static Set<CategoryListener> listeners = new HashSet<>();
public static void fireChange(Collection<Long> ids) {
Set<CategoryListener> listenersCopy = new HashSet<CategoryListener>(listeners);
Set<CategoryListener> listenersCopy = new HashSet<>();
synchronized (listeners) {
listenersCopy.addAll(listeners);
}

95
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java
View File

@ -50,6 +50,8 @@ import org.sleuthkit.autopsy.imagegallery.grouping.GroupManager;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy;
import static org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy.GROUP_BY_VALUE;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.ContentTag;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TagName;
@ -1123,6 +1125,56 @@ public class DrawableDB {
}
}
/*
* The following groups of functions are used to store information in memory instead
* of in the database. Due to the change listeners in the GUI, this data is requested
* many, many times when browsing the images, and especially when making any
* changes to things like categories.
*
* I don't like having multiple copies of the data, but these were causing major
* bottlenecks when they were all database lookups.
*/
@GuardedBy("hashSetMap")
private final Map<Long, Set<String>> hashSetMap = new HashMap<>();
@GuardedBy("hashSetMap")
public boolean isInHashSet(Long id){
if(! hashSetMap.containsKey(id)){
updateHashSetsForFile(id);
}
return (! hashSetMap.get(id).isEmpty());
}
@GuardedBy("hashSetMap")
public Set<String> getHashSetsForFile(Long id){
if(! isInHashSet(id)){
updateHashSetsForFile(id);
}
return hashSetMap.get(id);
}
@GuardedBy("hashSetMap")
public void updateHashSetsForFile(Long id){
try {
List<BlackboardArtifact> arts = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, id);
Set<String> hashNames = new HashSet<>();
for(BlackboardArtifact a:arts){
List<BlackboardAttribute> attrs = a.getAttributes();
for(BlackboardAttribute attr:attrs){
if(attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()){
hashNames.add(attr.getValueString());
}
}
}
hashSetMap.put(id, hashNames);
} catch (IllegalStateException | TskCoreException ex) {
LOGGER.log(Level.WARNING, "could not access case during updateHashSetsForFile()", ex);
}
}
/**
* For performance reasons, keep a list of all file IDs currently in the image database.
* Otherwise the database is queried many times to retrieve the same data.
@ -1148,6 +1200,12 @@ public class DrawableDB {
}
}
public int getNumberOfImageFilesInList(){
synchronized (fileIDlist){
return fileIDlist.size();
}
}
public void initializeImageList(){
synchronized (fileIDlist){
dbReadLock();
@ -1173,50 +1231,40 @@ public class DrawableDB {
private final Map<Category, Integer> categoryCounts = new HashMap<>();
public void incrementCategoryCount(Category cat) throws TskCoreException{
if(cat != Category.ZERO){
synchronized(categoryCounts){
int count = getCategoryCount(cat);
count++;
categoryCounts.put(cat, count);
}
}
}
public void decrementCategoryCount(Category cat) throws TskCoreException{
if(cat != Category.ZERO){
synchronized(categoryCounts){
int count = getCategoryCount(cat);
count--;
categoryCounts.put(cat, count);
}
}
}
public int getCategoryCount(Category cat) throws TskCoreException{
synchronized(categoryCounts){
if(categoryCounts.containsKey(cat)){
if(cat == Category.ZERO){
// Keeping track of the uncategorized files is a bit tricky while ingest
// is going on, so always use the list of file IDs we already have along with the
// other category counts instead of trying to track it separately.
int allOtherCatCount = getCategoryCount(Category.ONE) + getCategoryCount(Category.TWO) + getCategoryCount(Category.THREE) +
getCategoryCount(Category.FOUR) + getCategoryCount(Category.FIVE);
return getNumberOfImageFilesInList() - allOtherCatCount;
}
else if(categoryCounts.containsKey(cat)){
return categoryCounts.get(cat);
}
else{
try {
if (cat == Category.ZERO) {
// Category Zero (Uncategorized) files will not be tagged as such -
// this is really just the default setting. So we count the number of files
// tagged with the other categories and subtract from the total.
int allOtherCatCount = 0;
TagName[] tns = {Category.FOUR.getTagName(), Category.THREE.getTagName(), Category.TWO.getTagName(), Category.ONE.getTagName(), Category.FIVE.getTagName()};
for (TagName tn : tns) {
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn);
for (ContentTag ct : contentTags) {
if(ct.getContent() instanceof AbstractFile){
AbstractFile f = (AbstractFile)ct.getContent();
if(this.isImageFile(f.getId())){
allOtherCatCount++;
}
}
}
}
categoryCounts.put(cat, this.countAllFiles() - allOtherCatCount);
return categoryCounts.get(cat);
} else {
int fileCount = 0;
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(cat.getTagName());
for (ContentTag ct : contentTags) {
@ -1229,7 +1277,6 @@ public class DrawableDB {
}
categoryCounts.put(cat, fileCount);
return fileCount;
}
} catch(IllegalStateException ex){
throw new TskCoreException("Case closed while getting files");
}

12
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java
View File

@ -35,6 +35,7 @@ import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.text.WordUtils;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryModule;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
@ -97,8 +98,6 @@ public abstract class DrawableFile<T extends AbstractFile> extends AbstractFile
private final SimpleObjectProperty<Category> category = new SimpleObjectProperty<>(null);
private Collection<String> hashHitSetNames;
private String make;
private String model;
@ -116,16 +115,11 @@ public abstract class DrawableFile<T extends AbstractFile> extends AbstractFile
public abstract boolean isVideo();
public Collection<String> getHashHitSetNames() {
updateHashSets();
synchronized public Collection<String> getHashHitSetNames() {
Collection<String> hashHitSetNames = ImageGalleryController.getDefault().getDatabase().getHashSetsForFile(getId());
return hashHitSetNames;
}
@SuppressWarnings("unchecked")
private void updateHashSets() {
hashHitSetNames = (Collection<String>) getValuesOfBBAttribute(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME);
}
@Override
public boolean isRoot() {
return false;

20
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/DrawableGroup.java
View File

@ -25,8 +25,6 @@ import javafx.collections.FXCollections;
import javafx.collections.ObservableList;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Represents a set of image/video files in a group. The UI listens to changes
@ -65,18 +63,26 @@ public class DrawableGroup implements Comparable<DrawableGroup>{
return getFilesWithHashSetHitsCount() / (double) getSize();
}
/**
* Call to indicate that an image has been added or removed from the group,
* so the hash counts may not longer be accurate.
*/
synchronized public void invalidateHashSetHitsCount() {
filesWithHashSetHitsCount = -1;
}
synchronized public int getFilesWithHashSetHitsCount() {
//TODO: use the drawable db for this ? -jm
if (filesWithHashSetHitsCount < 0) {
filesWithHashSetHitsCount = 0;
for (Long fileID : fileIds()) {
try {
long artcount = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, fileID);
if (artcount > 0) {
if (ImageGalleryController.getDefault().getDatabase().isInHashSet(fileID)) {
filesWithHashSetHitsCount++;
}
} catch (IllegalStateException | TskCoreException ex) {
LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()", ex);
} catch (IllegalStateException | NullPointerException ex) {
LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()");
break;
}
}
@ -109,12 +115,14 @@ public class DrawableGroup implements Comparable<DrawableGroup>{
}
synchronized public void addFile(Long f) {
invalidateHashSetHitsCount();
if (fileIDs.contains(f) == false) {
fileIDs.add(f);
}
}
synchronized public void removeFile(Long f) {
invalidateHashSetHitsCount();
fileIDs.removeAll(f);
}

32
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/GroupManager.java
View File

@ -281,6 +281,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
final DrawableGroup group = getGroupForKey(groupKey);
if (group != null) {
group.removeFile(fileID);
// If we're grouping by category, we don't want to remove empty groups.
if (group.groupKey.getValueDisplayName().startsWith("CAT-")) {
return;
} else {
if (group.fileIds().isEmpty()) {
synchronized (groupMap) {
groupMap.remove(groupKey, group);
@ -292,7 +297,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
}
});
}
}
}
}
@ -487,7 +492,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
for (TagName tn : tns) {
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn);
for (ContentTag ct : contentTags) {
if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
files.add(ct.getContent().getId());
}
}
@ -499,7 +504,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
List<Long> files = new ArrayList<>();
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(category.getTagName());
for (ContentTag ct : contentTags) {
if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
files.add(ct.getContent().getId());
}
}
@ -516,8 +522,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
* Count the number of files with the given category.
* This is faster than getFileIDsWithCategory and should be used if only the
* counts are needed and not the file IDs.
*
* @param category Category to match against
*
* @return Number of files with the given category
*
* @throws TskCoreException
*/
public int countFilesWithCategory(Category category) throws TskCoreException {
@ -529,7 +538,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
List<Long> files = new ArrayList<>();
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tagName);
for (ContentTag ct : contentTags) {
if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
files.add(ct.getContent().getId());
}
}
@ -608,15 +618,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
}
}
/**
* an executor to submit async ui related background tasks to.
*/
final ExecutorService regroupExecutor = Executors.newSingleThreadExecutor(new BasicThreadFactory.Builder().namingPattern("ui task -%d").build());
public ReadOnlyDoubleProperty regroupProgress() {
return regroupProgress.getReadOnlyProperty();
}
@ -625,6 +631,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
* handle {@link FileUpdateEvent} sent from Db when files are
* inserted/updated
*
* TODO: why isn't this just two methods!
*
* @param evt
*/
@Override
@ -649,6 +657,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
if (checkAnalyzed != null) { // => the group is analyzed, so add it to the ui
populateAnalyzedGroup(gk, checkAnalyzed);
}
} else {
g.invalidateHashSetHitsCount();
}
}
}
@ -669,6 +679,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
*/
for (final long fileId : fileIDs) {
db.updateHashSetsForFile(fileId);
//get grouping(s) this file would be in
Set<GroupKey<?>> groupsForFile = getGroupKeysForFileID(fileId);
@ -688,13 +700,13 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
}
}
}
if (evt.getChangedAttribute() == DrawableAttribute.CATEGORY) {
Category.fireChange(fileIDs);
}
if (evt.getChangedAttribute() == DrawableAttribute.TAGS) {
TagUtils.fireChange(fileIDs);
}
break;
}
}

9
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/DrawableView.java
View File

@ -1,6 +1,7 @@
package org.sleuthkit.autopsy.imagegallery.gui;
import java.util.Collection;
import java.util.logging.Level;
import javafx.application.Platform;
import javafx.scene.layout.Border;
import javafx.scene.layout.BorderStroke;
@ -9,6 +10,7 @@ import javafx.scene.layout.BorderWidths;
import javafx.scene.layout.CornerRadii;
import javafx.scene.layout.Region;
import javafx.scene.paint.Color;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.ThreadConfined;
import org.sleuthkit.autopsy.imagegallery.TagUtils;
import org.sleuthkit.autopsy.imagegallery.datamodel.Category;
@ -56,7 +58,14 @@ public interface DrawableView extends Category.CategoryListener, TagUtils.TagLis
void handleTagsChanged(Collection<Long> ids);
default boolean hasHashHit() {
try{
return getFile().getHashHitSetNames().isEmpty() == false;
} catch (NullPointerException ex){
// I think this happens when we're in the process of removing images from the view while
// also trying to update it?
Logger.getLogger(DrawableView.class.getName()).log(Level.WARNING, "Error looking up hash set hits");
return false;
}
}
static Border getCategoryBorder(Category category) {

122
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java
View File

@ -1,8 +1,28 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013-15 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.imagegallery.gui.navpanel;
import static java.util.Objects.isNull;
import java.util.Optional;
import javafx.application.Platform;
import javafx.beans.InvalidationListener;
import javafx.beans.Observable;
import javafx.scene.Node;
import javafx.scene.control.OverrunStyle;
import javafx.scene.control.Tooltip;
import javafx.scene.control.TreeCell;
@ -13,93 +33,95 @@ import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute;
import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
/**
* A {@link Node} in the tree that listens to its associated group. Manages
* visual representation of TreeNode in Tree. Listens to properties of group
* that don't impact hierarchy and updates ui to reflect them
* A cell in the NavPanel tree that listens to its associated group's fileids.
* Manages visual representation of TreeNode in Tree. Listens to properties of
* group that don't impact hierarchy and updates ui to reflect them
*/
class GroupTreeCell extends TreeCell<TreeNode> {
/**
* icon to use if this cell's TreeNode doesn't represent a group but just a
* folder(with no DrawableFiles) in the hierarchy.
* folder(with no DrawableFiles) in the file system hierarchy.
*/
private static final Image EMPTY_FOLDER_ICON = new Image("org/sleuthkit/autopsy/imagegallery/images/folder.png");
/**
* reference to listener that allows us to remove it from a group when a new
* group is assigned to this Cell
*/
private InvalidationListener listener;
public GroupTreeCell() {
//TODO: move this to .css file
//adjust indent, default is 10 which uses up a lot of space.
setStyle("-fx-indent:5;");
//since end of path is probably more interesting put ellipsis at front
setTextOverrun(OverrunStyle.LEADING_ELLIPSIS);
Platform.runLater(() -> {
prefWidthProperty().bind(getTreeView().widthProperty().subtract(15));
});
}
@Override
synchronized protected void updateItem(final TreeNode tNode, boolean empty) {
super.updateItem(tNode, empty);
prefWidthProperty().bind(getTreeView().widthProperty().subtract(15));
protected synchronized void updateItem(final TreeNode tNode, boolean empty) {
//if there was a previous group, remove the listener
Optional.ofNullable(getItem())
.map(TreeNode::getGroup)
.ifPresent((DrawableGroup t) -> {
t.fileIds().removeListener(listener);
});
if (tNode == null || empty) {
super.updateItem(tNode, empty);
if (isNull(tNode) || empty) {
Platform.runLater(() -> {
setTooltip(null);
setText(null);
setGraphic(null);
});
} else {
final String name = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN);
Platform.runLater(() -> {
setTooltip(new Tooltip(name));
});
final String groupName = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN);
if (tNode.getGroup() == null) {
if (isNull(tNode.getGroup())) {
//"dummy" group in file system tree <=> a folder with no drawables
Platform.runLater(() -> {
setText(name);
setTooltip(new Tooltip(groupName));
setText(groupName);
setGraphic(new ImageView(EMPTY_FOLDER_ICON));
});
} else {
//if number of files in this group changes (eg file is recategorized), update counts
tNode.getGroup().fileIds().addListener((Observable o) -> {
listener = (Observable o) -> {
final String countsText = getCountsText();
Platform.runLater(() -> {
setText(name + " (" + getNumerator() + getDenominator() + ")");
});
setText(groupName + countsText);
});
};
//if number of files in this group changes (eg file is recategorized), update counts via listener
tNode.getGroup().fileIds().addListener(listener);
Platform.runLater(() -> {
//this TreeNode has a group so append counts to name ...
setText(name + " (" + getNumerator() + getDenominator() + ")");
//... and use icon corresponding to group type
setGraphic(new ImageView(tNode.getGroup().groupKey.getAttribute().getIcon()));
final Image icon = tNode.getGroup().groupKey.getAttribute().getIcon();
final String countsText = getCountsText();
Platform.runLater(() -> {
setTooltip(new Tooltip(groupName));
setGraphic(new ImageView(icon));
setText(groupName + countsText);
});
}
}
}
/**
* @return the Numerator of the count to append to the group name = number
* of hashset hits + "/"
*/
synchronized private String getNumerator() {
try {
final String numerator = (getItem().getGroup().groupKey.getAttribute() != DrawableAttribute.HASHSET)
? getItem().getGroup().getFilesWithHashSetHitsCount() + "/"
: "";
return numerator;
} catch (NullPointerException e) {
//instead of this try catch block, remove the listener when assigned a null treeitem / group
return "";
}
}
private synchronized String getCountsText() {
final String counts = Optional.ofNullable(getItem())
.map(TreeNode::getGroup)
.map((DrawableGroup t) -> {
return " (" + ((t.groupKey.getAttribute() == DrawableAttribute.HASHSET)
? Integer.toString(t.getSize())
: t.getFilesWithHashSetHitsCount() + "/" + t.getSize()) + ")";
}).orElse(""); //if item is null or group is null
/**
* @return the Denominator of the count to append to the group name = number
* of files in group
*/
synchronized private Integer getDenominator() {
try {
return getItem().getGroup().getSize();
} catch (NullPointerException ex) {
return 0;
}
return counts;
}
}

59
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java
View File

@ -37,10 +37,28 @@ import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
*/
class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeItem> {
static GroupTreeItem getTreeItemForGroup(GroupTreeItem root, DrawableGroup grouping) {
if (Objects.equals(root.getValue().getGroup(), grouping)) {
return root;
} else {
synchronized (root.getChildren()) {
for (TreeItem<TreeNode> child : root.getChildren()) {
final GroupTreeItem childGTI = (GroupTreeItem) child;
GroupTreeItem val = getTreeItemForGroup(childGTI, grouping);
if (val != null) {
return val;
}
}
}
}
return null;
}
/**
* maps a path segment to the child item of this item with that path segment
*/
private Map<String, GroupTreeItem> childMap = new HashMap<>();
private final Map<String, GroupTreeItem> childMap = new HashMap<>();
/**
* the comparator if any used to sort the children of this item
*/
@ -88,13 +106,10 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
prefixTreeItem = newTreeItem;
childMap.put(prefix, prefixTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
}
}
});
}
@ -109,16 +124,13 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
newTreeItem.setExpanded(true);
childMap.put(path, newTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
if (comp != null) {
FXCollections.sort(getChildren(), comp);
}
}
}
});
}
@ -147,13 +159,10 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
prefixTreeItem = newTreeItem;
childMap.put(prefix, prefixTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
}
}
});
}
@ -169,16 +178,13 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
newTreeItem.setExpanded(true);
childMap.put(path.get(0), newTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
if (comp != null) {
FXCollections.sort(getChildren(), comp);
}
}
}
});
}
}
@ -189,24 +195,6 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
return comp.compare(this, o);
}
static GroupTreeItem getTreeItemForGroup(GroupTreeItem root, DrawableGroup grouping) {
if (Objects.equals(root.getValue().getGroup(), grouping)) {
return root;
} else {
synchronized (root.getChildren()) {
for (TreeItem<TreeNode> child : root.getChildren()) {
final GroupTreeItem childGTI = (GroupTreeItem) child;
GroupTreeItem val = getTreeItemForGroup(childGTI, grouping);
if (val != null) {
return val;
}
}
}
}
return null;
}
GroupTreeItem getTreeItemForPath(List<String> path) {
// end of recursion
if (path.isEmpty()) {
@ -253,4 +241,5 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
ti.resortChildren(comp);
}
}
}

91
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/NavPanel.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Copyright 2013-15 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.imagegallery.gui.navpanel;
import java.net.URL;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import java.util.ResourceBundle;
import javafx.application.Platform;
@ -41,23 +40,21 @@ import javafx.scene.control.TreeView;
import javafx.scene.layout.Priority;
import javafx.scene.layout.VBox;
import org.apache.commons.lang3.StringUtils;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.coreutils.ThreadConfined;
import org.sleuthkit.autopsy.coreutils.ThreadConfined.ThreadType;
import org.sleuthkit.autopsy.imagegallery.FXMLConstructor;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile;
import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupKey;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupViewState;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Display two trees. one shows all folders (groups) and calls out folders with
* images. the user can select folders with images to see them in the main
* GroupPane The other shows folders with hash set hits.
*
* //TODO: there is too much code duplication between the navTree and the
* hashTree. Extract the common code to some new class.
*/
public class NavPanel extends TabPane {
@ -177,17 +174,8 @@ public class NavPanel extends TabPane {
}
if (wasPermuted) {
// Remove everything and add it again in the new order
for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){
removeFromNavTree(g);
removeFromHashTree(g);
}
for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){
insertIntoNavTree(g);
if (g.getFilesWithHashSetHitsCount() > 0) {
insertIntoHashTree(g);
}
}
rebuildTrees();
}
});
@ -205,6 +193,27 @@ public class NavPanel extends TabPane {
});
}
private void rebuildTrees() {
navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
hashTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
ObservableList<DrawableGroup> groups = controller.getGroupManager().getAnalyzedGroups();
for (DrawableGroup g : groups) {
insertIntoNavTree(g);
if (g.getFilesWithHashSetHitsCount() > 0) {
insertIntoHashTree(g);
}
}
Platform.runLater(() -> {
navTree.setRoot(navTreeRoot);
navTreeRoot.setExpanded(true);
hashTree.setRoot(hashTreeRoot);
hashTreeRoot.setExpanded(true);
});
}
private void updateControllersGroup() {
final TreeItem<TreeNode> selectedItem = activeTreeProperty.get().getSelectionModel().getSelectedItem();
if (selectedItem != null && selectedItem.getValue() != null && selectedItem.getValue().getGroup() != null) {
@ -216,11 +225,6 @@ public class NavPanel extends TabPane {
hashTreeRoot.resortChildren(sortByBox.getSelectionModel().getSelectedItem());
}
private void insertIntoHashTree(DrawableGroup g) {
initHashTree();
hashTreeRoot.insert(g.groupKey.getValueDisplayName(), g, false);
}
/**
* Set the tree to the passed in group
*
@ -235,10 +239,13 @@ public class NavPanel extends TabPane {
if (treeItemForGroup != null) {
/* When we used to run the below code on the FX thread, it would
* get into infinite loops when the next group button was pressed quickly
* because the udpates became out of order and History could not keep
* track of what was current. Currently (4/2/15), this method is
* already on the FX thread, so it is OK. */
* get into infinite loops when the next group button was pressed
* quickly because the udpates became out of order and History could
* not
* keep track of what was current.
*
* Currently (4/2/15), this method is already on the FX thread, so
* it is OK. */
//Platform.runLater(() -> {
TreeItem<TreeNode> ti = treeItemForGroup;
while (ti != null) {
@ -250,11 +257,10 @@ public class NavPanel extends TabPane {
activeTreeProperty.get().getSelectionModel().select(treeItemForGroup);
activeTreeProperty.get().scrollTo(row);
}
//});
//}); //end Platform.runLater
}
}
@SuppressWarnings("fallthrough")
private static List<String> groupingToPath(DrawableGroup g) {
if (g.groupKey.getAttribute() == DrawableAttribute.PATH) {
@ -269,11 +275,14 @@ public class NavPanel extends TabPane {
}
}
private void insertIntoHashTree(DrawableGroup g) {
initHashTree();
hashTreeRoot.insert(groupingToPath(g), g, false);
}
private void insertIntoNavTree(DrawableGroup g) {
initNavTree();
List<String> path = groupingToPath(g);
navTreeRoot.insert(path, g, true);
navTreeRoot.insert(groupingToPath(g), g, true);
}
private void removeFromNavTree(DrawableGroup g) {
@ -313,22 +322,4 @@ public class NavPanel extends TabPane {
});
}
}
//these are not used anymore, but could be usefull at some point
//TODO: remove them or find a use and undeprecate
@Deprecated
private void rebuildNavTree() {
navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
ObservableList<DrawableGroup> groups = controller.getGroupManager().getAnalyzedGroups();
for (DrawableGroup g : groups) {
insertIntoNavTree(g);
}
Platform.runLater(() -> {
navTree.setRoot(navTreeRoot);
navTreeRoot.setExpanded(true);
});
}
}

2
docs/doxygen/Doxyfile
View File

@ -133,7 +133,7 @@ ALWAYS_DETAILED_SEC = NO
# operators of the base classes will not be shown.
# The default value is: NO.
INLINE_INHERITED_MEMB = NO
INLINE_INHERITED_MEMB = YES
# If the FULL_PATH_NAMES tag is set to YES, doxygen will prepend the full path
# before files name in the file list and in the header files. If set to NO the

2
docs/doxygen/modDevPython.dox
View File

@ -60,7 +60,7 @@ To distribute and share your Python module, ZIP up the folder and send it around
Jython allows you to access all of the Java classes. So, you should read the following sections of this document. All you should ignore is the Java environment setup sections.
There are only two types of modules that you can make with Python. Those (along with a sample file) are listed below:
- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/ingestmodule.py
- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/
- Report Modules: https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/reportmodule.py
*/

21
docs/doxygen/modIngest.dox
View File

@ -100,10 +100,12 @@ Before we cover the specific interfaces of the two different types of modules, l
To create a data source ingest module:
-# Create the ingest module class by either:
- Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE
- Copy and paste the sample modules from:
- Java: Core/src/org/sleuthkit/autopsy/examples/SampleDataSourceIngestModule.java
- Python: pythonExamples/dataSourceIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
- Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE
will complain that you have not implemented one or more of the required methods.
You can use its "hints" to automatically generate stubs for the missing methods.
- Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py.
-# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isDataSourceIngestModuleFactory() method to return true and have the createDataSourceIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code:
\code
@ -119,8 +121,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
\endcode
-# Use this page, the sample, and the documentation for the
org.sleuthkit.autopsy.ingest.DataSourceIngestModule interfaces to implement the startUp() and process() methods.
The process() method is where all of the work of a data source ingest module is
- org.sleuthkit.autopsy.ingest.DataSourceIngestModule.startUp() is where any initialiation occurs. If your module has a critical failure and will not be able to run, your startUp method should throw an IngestModuleException to stop ingest.
- org.sleuthkit.autopsy.ingest.DataSourceIngestModule.process() is where all of the work of a data source ingest module is
done. It will be called exactly once. The
process() method receives a reference to an org.sleuthkit.datamodel.Content object
and an org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress object.
@ -140,10 +142,12 @@ org.sleuthkit.autopsy.casemodule.services.FileManager class. See
To create a file ingest module:
To create a data source ingest module:
-# Create the ingest module class by either:
- Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE
- Copy and paste the sample modules from:
- Java: Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java
- Python: pythonExamples/fileIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
- Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE
will complain that you have not implemented one or more of the required methods.
You can use its "hints" to automatically generate stubs for the missing methods.
- Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py.
-# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isFileIngestModuleFactory() method to return true and have the createFileIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code:
\code
@ -160,9 +164,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
-# Use this page, the sample, and the documentation for the
org.sleuthkit.autopsy.ingest.FileIngestModule interface to implement the startUp(), and process(), and shutDown() methods.
The process() method is where all of the work of a file ingest module is
- org.sleuthkit.autopsy.ingest.FileIngestModule.startUp() should have any code that you need to initialize your module. If you have any startup errors, be sure to throw a IngestModuleException exception to stop ingest.
- org.sleuthkit.autopsy.ingest.FileIngestModule.process() is where all of the work of a file ingest module is
done. It will be called repeatedly between startUp() and shutDown(), once for
each file Autopsy feeds into the pipeline of which the module instance is a part. The
process() method receives a reference to a org.sleuthkit.datamodel.AbstractFile

18
pythonExamples/README.txt
View File

@ -1,7 +1,13 @@
reportmodule.py -> Report module which implements GeneralReportModuleAdapter.
simpleingestmodule -> Data source ingest module without any GUI example code.
ingestmodule.py -> Both data source ingest module as well as file ingest module WITH an example of GUI code.
This folder contains sample python module files. They are public
domain, so you are free to copy and paste them and modify them to
your needs.
See the developer guide for more details and how to use and load
the modules.
http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html
Each module in this folder should have a brief description about what they
can do.
NOTE: The Python modules must be inside folder inside the folder opened by Tools > Plugins.
For example, place the ingestmodule.py inside folder ingest. Move that ingest folder inside opened by Tools > Plugins
The directory opened by Tools > Plugins is cleared every time the project is cleaned.

127
pythonExamples/simpleingestmodule.py → pythonExamples/dataSourceIngestModule.py
View File

@ -27,95 +27,125 @@
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Simple data source-level ingest module for Autopsy.
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
import jarray
from java.lang import System
from java.util.logging import Level
from org.sleuthkit.datamodel import SleuthkitCase
from org.sleuthkit.datamodel import AbstractFile
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.coreutils import Logger
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.casemodule.services import FileManager
# Sample factory that defines basic functionality and features of the module
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
# Factory that defines the name and details of the module and allows Autopsy
# to create instances of the modules that will do the analysis.
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
class SampleJythonDataSourceIngestModuleFactory(IngestModuleFactoryAdapter):
# TODO: give it a unique name. Will be shown in module list, logs, etc.
moduleName = "Sample Data Source Module"
def getModuleDisplayName(self):
return "Sample Jython ingest module"
return self.moduleName
# TODO: Give it a description
def getModuleDescription(self):
return "Sample Jython Ingest Module without GUI example code"
return "Sample module that does X, Y, and Z."
def getModuleVersionNumber(self):
return "1.0"
# Return true if module wants to get passed in a data source
def isDataSourceIngestModuleFactory(self):
return True
# can return null if isDataSourceIngestModuleFactory returns false
def createDataSourceIngestModule(self, ingestOptions):
# TODO: Change the class name to the name you'll make below
return SampleJythonDataSourceIngestModule()
# Return true if module wants to get called for each file
def isFileIngestModuleFactory(self):
return True
# can return null if isFileIngestModuleFactory returns false
def createFileIngestModule(self, ingestOptions):
return SampleJythonFileIngestModule()
# Data Source-level ingest module. One gets created per data source.
# Queries for various files.
# If you don't need a data source-level module, delete this class.
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
def __init__(self):
self.context = None
# Where any setup and configuration is done
# TODO: Add any setup code that you need here.
def startUp(self, context):
self.context = context
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
# raise IngestModuleException(IngestModule(), "Oh No!")
# Where the analysis is done.
# TODO: Add your analysis code in here.
def process(self, dataSource, progressBar):
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Configure progress bar for 2 tasks
progressBar.switchToDeterminate(2)
logger = Logger.getLogger(SampleJythonDataSourceIngestModuleFactory.moduleName)
# we don't know how much work there is yet
progressBar.switchToIndeterminate()
autopsyCase = Case.getCurrentCase()
sleuthkitCase = autopsyCase.getSleuthkitCase()
services = Services(sleuthkitCase)
fileManager = services.getFileManager()
# Get count of files with "test" in name.
fileCount = 0;
# For our example, we will use FileManager to get all
# files with the word "test"
# in the name and then count and read them
files = fileManager.findFiles(dataSource, "%test%")
for file in files:
fileCount += 1
progressBar.progress(1)
numFiles = len(files)
logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "found " + str(numFiles) + " files")
progressBar.switchToDeterminate(numFiles)
fileCount = 0;
for file in files:
# Check if the user pressed cancel while we were busy
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Get files by creation time.
currentTime = System.currentTimeMillis() / 1000
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
for otherFile in otherFiles:
logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "Processing file: " + file.getName())
fileCount += 1
progressBar.progress(1);
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK;
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
# artfiact. Refer to the developer docs for other examples.
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonDataSourceIngestModuleFactory.moduleName, "Test file")
art.addAttribute(att)
# To further the example, this code will read the contents of the file and count the number of bytes
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
readLen = inputStream.read(buffer)
while (readLen != -1):
totLen = totLen + readLen
readLen = inputStream.read(buffer)
# Update the progress bar
progressBar.progress(fileCount)
#Post a message to the ingest messages in box.
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
@ -123,38 +153,3 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK;
# File-level ingest module. One gets created per thread.
# Looks at the attributes of the passed in file.
# if you don't need a file-level module, delete this class.
class SampleJythonFileIngestModule(FileIngestModule):
def startUp(self, context):
pass
def process(self, file):
# If the file has a txt extension, post an artifact to the blackboard.
if file.getName().find("test") != -1:
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), "Sample Jython File Ingest Module", "Text Files")
art.addAttribute(att)
# Read the contents of the file.
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
len = inputStream.read(buffer)
while (len != -1):
totLen = totLen + len
len = inputStream.read(buffer)
# Send the size of the file to the ingest messages in box.
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule", msgText)
ingestServices = IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK
def shutDown(self):
pass

129
pythonExamples/fileIngestModule.py Executable file
View File

@ -0,0 +1,129 @@
# Sample module in the public domain. Feel free to use this as a template
# for your modules (and you can remove this header and take complete credit
# and liability)
#
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
# binary, for any purpose, commercial or non-commercial, and by any
# means.
#
# In jurisdictions that recognize copyright laws, the author or authors
# of this software dedicate any and all copyright interest in the
# software to the public domain. We make this dedication for the benefit
# of the public at large and to the detriment of our heirs and
# successors. We intend this dedication to be an overt act of
# relinquishment in perpetuity of all present and future rights to this
# software under copyright law.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Simple file-level ingest module for Autopsy.
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
import jarray
from java.lang import System
from java.util.logging import Level
from org.sleuthkit.datamodel import SleuthkitCase
from org.sleuthkit.datamodel import AbstractFile
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.coreutils import Logger
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.casemodule.services import FileManager
# Factory that defines the name and details of the module and allows Autopsy
# to create instances of the modules that will do the anlaysis.
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter):
# TODO: give it a unique name. Will be shown in module list, logs, etc.
moduleName = "Sample file ingest Module"
def getModuleDisplayName(self):
return self.moduleName
# TODO: Give it a description
def getModuleDescription(self):
return "Sample module that does X, Y, and Z."
def getModuleVersionNumber(self):
return "1.0"
# Return true if module wants to get called for each file
def isFileIngestModuleFactory(self):
return True
# can return null if isFileIngestModuleFactory returns false
def createFileIngestModule(self, ingestOptions):
return SampleJythonFileIngestModule()
# File-level ingest module. One gets created per thread.
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
# Looks at the attributes of the passed in file.
class SampleJythonFileIngestModule(FileIngestModule):
# Where any setup and configuration is done
# TODO: Add any setup code that you need here.
def startUp(self, context):
self.logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName)
self.filesFound = 0
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
# raise IngestModuleException(IngestModule(), "Oh No!")
pass
# Where the analysis is done. Each file will be passed into here.
# TODO: Add your analysis code in here.
def process(self, file):
# For an example, we will flag files with .txt in the name and make a blackboard artifact.
if file.getName().find(".txt") != -1:
self.logger.logp(Level.INFO, SampleJythonFileIngestModule.__name__, "process", "Found a text file: " + file.getName())
self.filesFound+=1
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
# artfiact. Refer to the developer docs for other examples.
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonFileIngestModuleFactory.moduleName, "Text Files")
art.addAttribute(att)
# To further the example, this code will read the contents of the file and count the number of bytes
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
len = inputStream.read(buffer)
while (len != -1):
totLen = totLen + len
len = inputStream.read(buffer)
return IngestModule.ProcessResult.OK
# Where any shutdown code is run and resources are freed.
# TODO: Add any shutdown code that you need here.
def shutDown(self):
# As a final part of this example, we'll send a message to the ingest inbox with the number of files found (in this thread)
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName, str(self.filesFound) + " files found")
ingestServices = IngestServices.getInstance().postMessage(message)

204
pythonExamples/fileIngestModuleWithGui.py Executable file
View File

@ -0,0 +1,204 @@
# Sample module in the public domain. Feel free to use this as a template
# for your modules (and you can remove this header and take complete credit
# and liability)
#
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
# binary, for any purpose, commercial or non-commercial, and by any
# means.
#
# In jurisdictions that recognize copyright laws, the author or authors
# of this software dedicate any and all copyright interest in the
# software to the public domain. We make this dedication for the benefit
# of the public at large and to the detriment of our heirs and
# successors. We intend this dedication to be an overt act of
# relinquishment in perpetuity of all present and future rights to this
# software under copyright law.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Ingest module for Autopsy with GUI
#
# Difference between other modules in this folder is that it has a GUI
# for user options. This is not needed for very basic modules. If you
# don't need a configuration UI, start with the other sample module.
#
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
import jarray
from java.lang import System
from java.util.logging import Level
from javax.swing import JCheckBox
from javax.swing import BoxLayout
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.autopsy.coreutils import Logger
from java.lang import IllegalArgumentException
# TODO: Rename this to something more specific
class SampleFileIngestModuleWithUIFactory(IngestModuleFactoryAdapter):
def __init__(self):
self.settings = None
# TODO: give it a unique name. Will be shown in module list, logs, etc.
moduleName = "Sample Data Source Module with UI"
def getModuleDisplayName(self):
return self.moduleName
# TODO: Give it a description
def getModuleDescription(self):
return "Sample module that does X, Y, and Z."
def getModuleVersionNumber(self):
return "1.0"
# TODO: Update class name to one that you create below
def getDefaultIngestJobSettings(self):
return SampleFileIngestModuleWithUISettings()
# TODO: Keep enabled only if you need ingest job-specific settings UI
def hasIngestJobSettingsPanel(self):
return True
# TODO: Update class names to ones that you create below
def getIngestJobSettingsPanel(self, settings):
if not isinstance(settings, SampleFileIngestModuleWithUISettings):
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
self.settings = settings
return SampleFileIngestModuleWithUISettingsPanel(self.settings)
def isFileIngestModuleFactory(self):
return True
# TODO: Update class name to one that you create below
def createFileIngestModule(self, ingestOptions):
return SampleFileIngestModuleWithUI(self.settings)
# File-level ingest module. One gets created per thread.
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
# Looks at the attributes of the passed in file.
class SampleFileIngestModuleWithUI(FileIngestModule):
# Autopsy will pass in the settings from the UI panel
def __init__(self, settings):
self.local_settings = settings
# Where any setup and configuration is done
# TODO: Add any setup code that you need here.
def startUp(self, context):
self.logger = Logger.getLogger(SampleFileIngestModuleWithUIFactory.moduleName)
# As an example, determine if user configured a flag in UI
if self.local_settings.getFlag():
self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is set")
else:
self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is not set")
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
# raise IngestModuleException(IngestModule(), "Oh No!")
pass
# Where the analysis is done. Each file will be passed into here.
# TODO: Add your analysis code in here.
def process(self, file):
# See code in pythonExamples/fileIngestModule.py for example code
return IngestModule.ProcessResult.OK
# Where any shutdown code is run and resources are freed.
# TODO: Add any shutdown code that you need here.
def shutDown(self):
pass
# Stores the settings that can be changed for each ingest job
# All fields in here must be serializable. It will be written to disk.
# TODO: Rename this class
class SampleFileIngestModuleWithUISettings(IngestModuleIngestJobSettings):
serialVersionUID = 1L
def __init__(self):
self.flag = False
def getVersionNumber(self):
return serialVersionUID
# TODO: Define getters and settings for data you want to store from UI
def getFlag(self):
return self.flag
def setFlag(self, flag):
self.flag = flag
# UI that is shown to user for each ingest job so they can configure the job.
# TODO: Rename this
class SampleFileIngestModuleWithUISettingsPanel(IngestModuleIngestJobSettingsPanel):
# Note, we can't use a self.settings instance variable.
# Rather, self.local_settings is used.
# https://wiki.python.org/jython/UserGuide#javabean-properties
# Jython Introspector generates a property - 'settings' on the basis
# of getSettings() defined in this class. Since only getter function
# is present, it creates a read-only 'settings' property. This auto-
# generated read-only property overshadows the instance-variable -
# 'settings'
# We get passed in a previous version of the settings so that we can
# prepopulate the UI
# TODO: Update this for your UI
def __init__(self, settings):
self.local_settings = settings
self.initComponents()
self.customizeComponents()
# TODO: Update this for your UI
def checkBoxEvent(self, event):
if self.checkbox.isSelected():
self.local_settings.setFlag(True)
else:
self.local_settings.setFlag(False)
# TODO: Update this for your UI
def initComponents(self):
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
self.add(self.checkbox)
# TODO: Update this for your UI
def customizeComponents(self):
self.checkbox.setSelected(self.local_settings.getFlag())
# Return the settings used
def getSettings(self):
return self.local_settings

266
pythonExamples/ingestmodule.py
View File

@ -1,266 +0,0 @@
# Sample module in the public domain. Feel free to use this as a template
# for your modules (and you can remove this header and take complete credit
# and liability)
#
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
# binary, for any purpose, commercial or non-commercial, and by any
# means.
#
# In jurisdictions that recognize copyright laws, the author or authors
# of this software dedicate any and all copyright interest in the
# software to the public domain. We make this dedication for the benefit
# of the public at large and to the detriment of our heirs and
# successors. We intend this dedication to be an overt act of
# relinquishment in perpetuity of all present and future rights to this
# software under copyright law.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
import jarray
from java.lang import System
from javax.swing import JCheckBox
from javax.swing import BoxLayout
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.autopsy.coreutils import Logger
from java.lang import IllegalArgumentException
# Sample factory that defines basic functionality and features of the module
# It implements IngestModuleFactoryAdapter which is a no-op implementation of
# IngestModuleFactory.
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
def __init__(self):
self.settings = None
def getModuleDisplayName(self):
return "Sample Jython(GUI) ingest module"
def getModuleDescription(self):
return "Sample Jython Ingest Module with GUI example code"
def getModuleVersionNumber(self):
return "1.0"
def getDefaultIngestJobSettings(self):
return SampleIngestModuleSettings()
def hasIngestJobSettingsPanel(self):
return True
def getIngestJobSettingsPanel(self, settings):
if not isinstance(settings, SampleIngestModuleSettings):
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
self.settings = settings
return SampleIngestModuleSettingsPanel(self.settings)
# Return true if module wants to get passed in a data source
def isDataSourceIngestModuleFactory(self):
return True
# can return null if isDataSourceIngestModuleFactory returns false
def createDataSourceIngestModule(self, ingestOptions):
return SampleJythonDataSourceIngestModule(self.settings)
# Return true if module wants to get called for each file
def isFileIngestModuleFactory(self):
return True
# can return null if isFileIngestModuleFactory returns false
def createFileIngestModule(self, ingestOptions):
return SampleJythonFileIngestModule(self.settings)
def hasGlobalSettingsPanel(self):
return True
def getGlobalSettingsPanel(self):
globalSettingsPanel = SampleIngestModuleGlobalSettingsPanel();
return globalSettingsPanel
class SampleIngestModuleGlobalSettingsPanel(IngestModuleGlobalSettingsPanel):
def __init__(self):
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
checkbox = JCheckBox("Flag inside the Global Settings Panel")
self.add(checkbox)
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
'''
Data Source-level ingest module. One gets created per data source.
Queries for various files. If you don't need a data source-level module,
delete this class.
'''
def __init__(self, settings):
self.local_settings = settings
self.context = None
def startUp(self, context):
# Used to verify if the GUI checkbox event been recorded or not.
logger = Logger.getLogger("SampleJythonFileIngestModule")
if self.local_settings.getFlag():
logger.info("flag is set")
else:
logger.info("flag is not set")
self.context = context
def process(self, dataSource, progressBar):
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Configure progress bar for 2 tasks
progressBar.switchToDeterminate(2)
autopsyCase = Case.getCurrentCase()
sleuthkitCase = autopsyCase.getSleuthkitCase()
services = Services(sleuthkitCase)
fileManager = services.getFileManager()
# Get count of files with "test" in name.
fileCount = 0;
files = fileManager.findFiles(dataSource, "%test%")
for file in files:
fileCount += 1
progressBar.progress(1)
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Get files by creation time.
currentTime = System.currentTimeMillis() / 1000
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
for otherFile in otherFiles:
fileCount += 1
progressBar.progress(1);
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK;
# Post a message to the ingest messages in box.
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
"Sample Jython Data Source Ingest Module", "Found %d files" % fileCount)
IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK;
class SampleJythonFileIngestModule(FileIngestModule):
'''
File-level ingest module. One gets created per thread. Looks at the
attributes of the passed in file. if you don't need a file-level module,
delete this class.
'''
def __init__(self, settings):
self.local_settings = settings
def startUp(self, context):
# Used to verify if the GUI checkbox event been recorded or not.
logger = Logger.getLogger("SampleJythonFileIngestModule")
if self.local_settings.getFlag():
logger.info("flag is set")
else:
logger.info("flag is not set")
pass
def process(self, file):
# If the file has a txt extension, post an artifact to the blackboard.
if file.getName().find("test") != -1:
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(),
"Sample Jython File Ingest Module", "Text Files")
art.addAttribute(att)
# Read the contents of the file.
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
len = inputStream.read(buffer)
while (len != -1):
totLen = totLen + len
len = inputStream.read(buffer)
# Send the size of the file to the ingest messages in box.
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule",
msgText)
ingestServices = IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK
def shutDown(self):
pass
class SampleIngestModuleSettings(IngestModuleIngestJobSettings):
serialVersionUID = 1L
def __init__(self):
self.flag = False
def getVersionNumber(self):
return serialVersionUID
def getFlag(self):
return self.flag
def setFlag(self, flag):
self.flag = flag
class SampleIngestModuleSettingsPanel(IngestModuleIngestJobSettingsPanel):
# self.settings instance variable not used. Rather, self.local_settings is used.
# https://wiki.python.org/jython/UserGuide#javabean-properties
# Jython Introspector generates a property - 'settings' on the basis
# of getSettings() defined in this class. Since only getter function
# is present, it creates a read-only 'settings' property. This auto-
# generated read-only property overshadows the instance-variable -
# 'settings'
def checkBoxEvent(self, event):
if self.checkbox.isSelected():
self.local_settings.setFlag(True)
else:
self.local_settings.setFlag(False)
def initComponents(self):
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
self.add(self.checkbox)
def customizeComponents(self):
self.checkbox.setSelected(self.local_settings.getFlag())
def __init__(self, settings):
self.local_settings = settings
self.initComponents()
self.customizeComponents()
def getSettings(self):
return self.local_settings

20
pythonExamples/reportmodule.py
View File

@ -27,24 +27,35 @@
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Report module for Autopsy.
#
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
from java.lang import System
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
# Sample module that writes a file with the number of files
# created in the last 2 weeks.
# TODO: Rename this to something more specific
class SampleGeneralReportModule(GeneralReportModuleAdapter):
# TODO: Rename this. Will be shown to users when making a report
def getName(self):
return "Sample Jython Report Module"
# TODO: rewrite this
def getDescription(self):
return "A sample Jython report module"
# TODO: Update this to reflect where the report file will be written to
def getRelativeFilePath(self):
return "sampleReport.txt"
def generateReport(self, reportPath, progressBar):
# TODO: Update this method to make a report
def generateReport(self, baseReportDir, progressBar):
# For an example, we write a file with the number of files created in the past 2 weeks
# Configure progress bar for 2 tasks
progressBar.setIndeterminate(False)
progressBar.start()
@ -62,9 +73,10 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
progressBar.increment()
# Write the result to the report file.
report = open(reportPath + '\\' + self.getRelativeFilePath(), 'w')
report = open(baseReportDir + '\\' + self.getRelativeFilePath(), 'w')
report.write("file count = %d" % fileCount)
Case.getCurrentCase().addReport(report.name, "SampleGeneralReportModule", "Sample Python Report");
report.close()
progressBar.increment()
progressBar.complete()