mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial Bit locker support

Browse Source 
Initial Bitlocker support
This commit is contained in:
Mark McKinnon 2024-12-13 10:40:18 -05:00
parent d2ae93e6ba
commit 471c99a661
10 changed files with 92 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Core/src/org/sleuthkit/autopsy/casemodule/AddImageTask.java
View File

@ -319,9 +319,9 @@ class AddImageTask implements Runnable {
String sha1; String sha1;
String sha256; String sha256;
ImageWriterSettings imageWriterSettings; ImageWriterSettings imageWriterSettings;
String bitlockerPassword; String password;
ImageDetails(String deviceId, Image image, int sectorSize, String timeZone, boolean ignoreFatOrphanFiles, String md5, String sha1, String sha256, ImageWriterSettings imageWriterSettings, String bitlockerPassword) { ImageDetails(String deviceId, Image image, int sectorSize, String timeZone, boolean ignoreFatOrphanFiles, String md5, String sha1, String sha256, ImageWriterSettings imageWriterSettings, String password) {
this.deviceId = deviceId; this.deviceId = deviceId;
this.image = image; this.image = image;
this.sectorSize = sectorSize; this.sectorSize = sectorSize;
@ -331,7 +331,7 @@ class AddImageTask implements Runnable {
this.sha1 = sha1; this.sha1 = sha1;
this.sha256 = sha256; this.sha256 = sha256;
this.imageWriterSettings = imageWriterSettings; this.imageWriterSettings = imageWriterSettings;
this.bitlockerPassword = bitlockerPassword; this.password = password;
} }
String getImagePath() { String getImagePath() {

4
Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties
View File

@ -270,5 +270,5 @@ LocalFilesPanel.timestampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.accessTimeCheckBox.text=Access Time - Can be changed when the file is opened LocalFilesPanel.accessTimeCheckBox.text=Access Time - Can be changed when the file is opened
LocalFilesPanel.timeStampToIncludeLabel.text=Timestamps To Include: LocalFilesPanel.timeStampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.timeStampNoteLabel.text=NOTE: Time stamps may have changed when the files were copied to the current location. LocalFilesPanel.timeStampNoteLabel.text=NOTE: Time stamps may have changed when the files were copied to the current location.
ImageFilePanel.bitlockerPasswordLabel.text=Bitlocker Password (optional): ImageFilePanel.passwordLabel.text=Bitlocker Password (optional):
ImageFilePanel.bitlockerPasswordTextField.text= ImageFilePanel.passwordTextField.text=

6
Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED
View File

@ -151,7 +151,7 @@ GeneralFilter.encaseImageDesc.text=Encase Images (*.e01)
GeneralFilter.executableDesc.text=Executables (*.exe) GeneralFilter.executableDesc.text=Executables (*.exe)
GeneralFilter.graphicImageDesc.text=Images (*.png, *.jpg, *.jpeg, *.gif, *.bmp) GeneralFilter.graphicImageDesc.text=Images (*.png, *.jpg, *.jpeg, *.gif, *.bmp)
GeneralFilter.rawImageDesc.text=Raw Images (*.img, *.dd, *.001, *.aa, *.raw, *.bin) GeneralFilter.rawImageDesc.text=Raw Images (*.img, *.dd, *.001, *.aa, *.raw, *.bin)
GeneralFilter.virtualMachineImageDesc.text=Virtual Machines (*.vmdk, *.vhd) GeneralFilter.virtualMachineImageDesc.text=Virtual Machines (*.vmdk, *.vhd, *.vhdx)
ImageFilePanel.000.confirmationMessage=The selected file has extenson .001 but there is a .000 file in the sequence of raw images.\nShould the .000 file be used as the start, instead of the selected .001 file?\n ImageFilePanel.000.confirmationMessage=The selected file has extenson .001 but there is a .000 file in the sequence of raw images.\nShould the .000 file be used as the start, instead of the selected .001 file?\n
ImageFilePanel.moduleErr=Module Error ImageFilePanel.moduleErr=Module Error
ImageFilePanel.moduleErr.msg=A module caused an error listening to ImageFilePanel updates. See log to determine which module. Some data could be incomplete.\n ImageFilePanel.moduleErr.msg=A module caused an error listening to ImageFilePanel updates. See log to determine which module. Some data could be incomplete.\n
@ -504,5 +504,5 @@ LocalFilesPanel.timestampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.accessTimeCheckBox.text=Access Time - Can be changed when the file is opened LocalFilesPanel.accessTimeCheckBox.text=Access Time - Can be changed when the file is opened
LocalFilesPanel.timeStampToIncludeLabel.text=Timestamps To Include: LocalFilesPanel.timeStampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.timeStampNoteLabel.text=NOTE: Time stamps may have changed when the files were copied to the current location. LocalFilesPanel.timeStampNoteLabel.text=NOTE: Time stamps may have changed when the files were copied to the current location.
ImageFilePanel.bitlockerPasswordLabel.text=Bitlocker Password (optional): ImageFilePanel.passwordLabel.text=Bitlocker Password (optional):
ImageFilePanel.bitlockerPasswordTextField.text=jTextField1 ImageFilePanel.passwordTextField.text=

42
Core/src/org/sleuthkit/autopsy/casemodule/ImageDSProcessor.java
View File

@ -82,7 +82,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
private String sha1; private String sha1;
private String sha256; private String sha256;
private Host host = null; private Host host = null;
private String bitlockerPassword; private String password;
static { static {
filtersList.add(allFilter); filtersList.add(allFilter);
@ -207,7 +207,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
this.host = host; this.host = host;
try { try {
image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(), image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, this.host); new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, this.host, this.password);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex); logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
final List<String> errors = new ArrayList<>(); final List<String> errors = new ArrayList<>();
@ -216,7 +216,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
return; return;
} }
doAddImageProcess(deviceId, imagePath, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, progressMonitor, callback); doAddImageProcess(deviceId, imagePath, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, this.password, progressMonitor, callback);
} }
/** /**
@ -271,7 +271,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
// Set up the data source before creating the ingest stream // Set up the data source before creating the ingest stream
try { try {
image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(), image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, this.host); new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, this.host, this.password);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex); logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
final List<String> errors = new ArrayList<>(); final List<String> errors = new ArrayList<>();
@ -291,7 +291,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
ingestStream = new DefaultIngestStream(); ingestStream = new DefaultIngestStream();
} }
doAddImageProcess(deviceId, imagePath, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, progress, callBack); doAddImageProcess(deviceId, imagePath, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, this.password, progress, callBack);
} }
/** /**
@ -316,9 +316,9 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
if (sha256.isEmpty()) { if (sha256.isEmpty()) {
sha256 = null; sha256 = null;
} }
bitlockerPassword = configPanel.getBitlockerPassword(); password = configPanel.getPassword();
if (bitlockerPassword.isEmpty()) { if (password.isEmpty()) {
bitlockerPassword = null; password = null;
} }
} }
@ -366,7 +366,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
return; return;
} }
doAddImageProcess(deviceId, imagePath, 0, timeZone, ignoreFatOrphanFiles, null, null, null, progressMonitor, callback); doAddImageProcess(deviceId, imagePath, 0, timeZone, ignoreFatOrphanFiles, null, null, null, this.password, progressMonitor, callback);
} }
/** /**
@ -398,7 +398,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
* during processing. * during processing.
* @param callback Callback to call when processing is done. * @param callback Callback to call when processing is done.
*/ */
private void doAddImageProcess(String deviceId, String imagePath, int sectorSize, String timeZone, boolean ignoreFatOrphanFiles, String md5, String sha1, String sha256, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) { private void doAddImageProcess(String deviceId, String imagePath, int sectorSize, String timeZone, boolean ignoreFatOrphanFiles, String md5, String sha1, String sha256, String password, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) {
// If the data source or ingest stream haven't been initialized, stop processing // If the data source or ingest stream haven't been initialized, stop processing
if (ingestStream == null) { if (ingestStream == null) {
@ -418,7 +418,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
return; return;
} }
AddImageTask.ImageDetails imageDetails = new AddImageTask.ImageDetails(deviceId, image, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, null, null); AddImageTask.ImageDetails imageDetails = new AddImageTask.ImageDetails(deviceId, image, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, null, password);
addImageTask = new AddImageTask(imageDetails, addImageTask = new AddImageTask(imageDetails,
progressMonitor, progressMonitor,
new StreamingAddDataSourceCallbacks(ingestStream), new StreamingAddDataSourceCallbacks(ingestStream),
@ -454,7 +454,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
timeZone = null; timeZone = null;
ignoreFatOrphanFiles = false; ignoreFatOrphanFiles = false;
host = null; host = null;
bitlockerPassword = null; password = null;
configPanel.reset(); configPanel.reset();
} }
@ -476,11 +476,21 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
} }
try { try {
if (password == null) {
// verify that the image has a file system that TSK can process // verify that the image has a file system that TSK can process
if (!DataSourceUtils.imageHasFileSystem(dataSourcePath)) { if (!DataSourceUtils.imageHasFileSystem(dataSourcePath)) {
// image does not have a file system that TSK can process // image does not have a file system that TSK can process
return 0; return 0;
} }
} else {
// verify that the image has a file system that TSK can process
if (!DataSourceUtils.imageHasFileSystem(dataSourcePath, password)) {
// image does not have a file system that TSK can process
return 0;
}
}
} catch (Exception ex) { } catch (Exception ex) {
throw new AutoIngestDataSourceProcessorException("Exception inside canProcess() method", ex); throw new AutoIngestDataSourceProcessorException("Exception inside canProcess() method", ex);
} }
@ -507,7 +517,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
ingestStream = new DefaultIngestStream(); ingestStream = new DefaultIngestStream();
try { try {
image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(), image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
new String[]{imagePath}, sectorSize, timeZone, "", "", "", deviceId, host); new String[]{imagePath}, sectorSize, timeZone, "", "", "", deviceId, host, this.password);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex); logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
final List<String> errors = new ArrayList<>(); final List<String> errors = new ArrayList<>();
@ -516,7 +526,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
return; return;
} }
doAddImageProcess(deviceId, dataSourcePath.toString(), sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, progressMonitor, callBack); doAddImageProcess(deviceId, dataSourcePath.toString(), sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, null, progressMonitor, callBack);
} }
@Override @Override
@ -537,7 +547,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
// Set up the data source before creating the ingest stream // Set up the data source before creating the ingest stream
try { try {
image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(), image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, host); new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, host, this.password);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex); logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
final List<String> errors = new ArrayList<>(); final List<String> errors = new ArrayList<>();
@ -557,7 +567,7 @@ public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSour
return null; return null;
} }
doAddImageProcess(deviceId, dataSourcePath.toString(), sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, progressMonitor, callBack); doAddImageProcess(deviceId, dataSourcePath.toString(), sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, null, progressMonitor, callBack);
return ingestStream; return ingestStream;
} }

18
Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.form
View File

@ -67,9 +67,9 @@
</Group> </Group>
<Component id="hashValuesNoteLabel" alignment="0" min="-2" max="-2" attributes="0"/> <Component id="hashValuesNoteLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0"> <Group type="102" alignment="0" attributes="0">
<Component id="bitlockerPasswordLabel" min="-2" max="-2" attributes="0"/> <Component id="passwordLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/> <EmptySpace max="-2" attributes="0"/>
<Component id="bitlockerPasswordTextField" max="32767" attributes="0"/> <Component id="passwordTextField" max="32767" attributes="0"/>
</Group> </Group>
<Component id="hashValuesLabel" alignment="0" min="-2" max="-2" attributes="0"/> <Component id="hashValuesLabel" alignment="0" min="-2" max="-2" attributes="0"/>
</Group> </Group>
@ -100,8 +100,8 @@
</Group> </Group>
<EmptySpace type="unrelated" max="-2" attributes="0"/> <EmptySpace type="unrelated" max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0"> <Group type="103" groupAlignment="3" attributes="0">
<Component id="bitlockerPasswordLabel" alignment="3" min="-2" max="-2" attributes="0"/> <Component id="passwordLabel" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="bitlockerPasswordTextField" alignment="3" min="-2" max="-2" attributes="0"/> <Component id="passwordTextField" alignment="3" min="-2" max="-2" attributes="0"/>
</Group> </Group>
<EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/> <EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/>
<Component id="hashValuesLabel" min="-2" max="-2" attributes="0"/> <Component id="hashValuesLabel" min="-2" max="-2" attributes="0"/>
@ -124,7 +124,7 @@
<Component id="hashValuesNoteLabel" min="-2" max="-2" attributes="0"/> <Component id="hashValuesNoteLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/> <EmptySpace type="separate" max="-2" attributes="0"/>
<Component id="errorLabel" min="-2" max="-2" attributes="0"/> <Component id="errorLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace pref="52" max="32767" attributes="0"/> <EmptySpace max="32767" attributes="0"/>
</Group> </Group>
</Group> </Group>
</DimensionLayout> </DimensionLayout>
@ -273,17 +273,17 @@
<Property name="enabled" type="boolean" value="false"/> <Property name="enabled" type="boolean" value="false"/>
</Properties> </Properties>
</Component> </Component>
<Component class="javax.swing.JLabel" name="bitlockerPasswordLabel"> <Component class="javax.swing.JLabel" name="passwordLabel">
<Properties> <Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor"> <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="ImageFilePanel.bitlockerPasswordLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/> <ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="ImageFilePanel.passwordLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property> </Property>
</Properties> </Properties>
</Component> </Component>
<Component class="javax.swing.JTextField" name="bitlockerPasswordTextField"> <Component class="javax.swing.JTextField" name="passwordTextField">
<Properties> <Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor"> <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="ImageFilePanel.bitlockerPasswordTextField.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/> <ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="ImageFilePanel.passwordTextField.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property> </Property>
</Properties> </Properties>
</Component> </Component>

32
Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.java
View File

@ -129,8 +129,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
return sha256HashTextField; return sha256HashTextField;
} }
private JTextField getBitlockerPasswordTextField() { private JTextField getPasswordTextField() {
return bitlockerPasswordTextField; return passwordTextField;
} }
private JFileChooser getChooser() { private JFileChooser getChooser() {
@ -173,8 +173,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
md5HashLabel = new javax.swing.JLabel(); md5HashLabel = new javax.swing.JLabel();
hashValuesLabel = new javax.swing.JLabel(); hashValuesLabel = new javax.swing.JLabel();
hashValuesNoteLabel = new javax.swing.JLabel(); hashValuesNoteLabel = new javax.swing.JLabel();
bitlockerPasswordLabel = new javax.swing.JLabel(); passwordLabel = new javax.swing.JLabel();
bitlockerPasswordTextField = new javax.swing.JTextField(); passwordTextField = new javax.swing.JTextField();
setMinimumSize(new java.awt.Dimension(0, 65)); setMinimumSize(new java.awt.Dimension(0, 65));
setPreferredSize(new java.awt.Dimension(403, 65)); setPreferredSize(new java.awt.Dimension(403, 65));
@ -226,9 +226,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
org.openide.awt.Mnemonics.setLocalizedText(hashValuesNoteLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.hashValuesNoteLabel.text")); // NOI18N org.openide.awt.Mnemonics.setLocalizedText(hashValuesNoteLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.hashValuesNoteLabel.text")); // NOI18N
hashValuesNoteLabel.setEnabled(false); hashValuesNoteLabel.setEnabled(false);
org.openide.awt.Mnemonics.setLocalizedText(bitlockerPasswordLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.bitlockerPasswordLabel.text")); // NOI18N org.openide.awt.Mnemonics.setLocalizedText(passwordLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.passwordLabel.text")); // NOI18N
bitlockerPasswordTextField.setText(org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.bitlockerPasswordTextField.text")); // NOI18N passwordTextField.setText(org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.passwordTextField.text")); // NOI18N
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
this.setLayout(layout); this.setLayout(layout);
@ -269,9 +269,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
.addComponent(sha256HashTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 455, javax.swing.GroupLayout.PREFERRED_SIZE)) .addComponent(sha256HashTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 455, javax.swing.GroupLayout.PREFERRED_SIZE))
.addComponent(hashValuesNoteLabel) .addComponent(hashValuesNoteLabel)
.addGroup(layout.createSequentialGroup() .addGroup(layout.createSequentialGroup()
.addComponent(bitlockerPasswordLabel) .addComponent(passwordLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(bitlockerPasswordTextField)) .addComponent(passwordTextField))
.addComponent(hashValuesLabel)) .addComponent(hashValuesLabel))
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
); );
@ -295,8 +295,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
.addComponent(sectorSizeLabel)) .addComponent(sectorSizeLabel))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(bitlockerPasswordLabel) .addComponent(passwordLabel)
.addComponent(bitlockerPasswordTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)) .addComponent(passwordTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(hashValuesLabel) .addComponent(hashValuesLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
@ -315,7 +315,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
.addComponent(hashValuesNoteLabel) .addComponent(hashValuesNoteLabel)
.addGap(18, 18, 18) .addGap(18, 18, 18)
.addComponent(errorLabel) .addComponent(errorLabel)
.addContainerGap(52, Short.MAX_VALUE)) .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
); );
}// </editor-fold>//GEN-END:initComponents }// </editor-fold>//GEN-END:initComponents
@ -362,8 +362,6 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
}//GEN-LAST:event_browseButtonActionPerformed }//GEN-LAST:event_browseButtonActionPerformed
// Variables declaration - do not modify//GEN-BEGIN:variables // Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JLabel bitlockerPasswordLabel;
private javax.swing.JTextField bitlockerPasswordTextField;
private javax.swing.JButton browseButton; private javax.swing.JButton browseButton;
private javax.swing.JLabel errorLabel; private javax.swing.JLabel errorLabel;
private javax.swing.JLabel hashValuesLabel; private javax.swing.JLabel hashValuesLabel;
@ -371,6 +369,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
private javax.swing.JLabel md5HashLabel; private javax.swing.JLabel md5HashLabel;
private javax.swing.JTextField md5HashTextField; private javax.swing.JTextField md5HashTextField;
private javax.swing.JCheckBox noFatOrphansCheckbox; private javax.swing.JCheckBox noFatOrphansCheckbox;
private javax.swing.JLabel passwordLabel;
private javax.swing.JTextField passwordTextField;
private javax.swing.JLabel pathLabel; private javax.swing.JLabel pathLabel;
private javax.swing.JTextField pathTextField; private javax.swing.JTextField pathTextField;
private javax.swing.JComboBox<String> sectorSizeComboBox; private javax.swing.JComboBox<String> sectorSizeComboBox;
@ -456,8 +456,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
return this.sha256HashTextField.getText(); return this.sha256HashTextField.getText();
} }
String getBitlockerPassword() { String getPassword() {
return this.bitlockerPasswordTextField.getText(); return this.passwordTextField.getText();
} }
public void reset() { public void reset() {
@ -466,7 +466,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
this.md5HashTextField.setText(null); this.md5HashTextField.setText(null);
this.sha1HashTextField.setText(null); this.sha1HashTextField.setText(null);
this.sha256HashTextField.setText(null); this.sha256HashTextField.setText(null);
this.bitlockerPasswordTextField.setText(null); this.passwordTextField.setText(null);
} }
/** /**

7
Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskDSProcessor.java
View File

@ -59,6 +59,7 @@ public class LocalDiskDSProcessor implements DataSourceProcessor {
private Host host; private Host host;
private ImageWriterSettings imageWriterSettings; private ImageWriterSettings imageWriterSettings;
private boolean ignoreFatOrphanFiles; private boolean ignoreFatOrphanFiles;
private String password;
/** /**
* Constructs a local drive data source processor that implements the * Constructs a local drive data source processor that implements the
@ -172,7 +173,7 @@ public class LocalDiskDSProcessor implements DataSourceProcessor {
try { try {
image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(), image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
new String[]{drivePath}, sectorSize, new String[]{drivePath}, sectorSize,
timeZone, null, null, null, deviceId, this.host); timeZone, null, null, null, deviceId, this.host, this.password);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error adding local disk with path " + drivePath + " to database", ex); logger.log(Level.SEVERE, "Error adding local disk with path " + drivePath + " to database", ex);
final List<String> errors = new ArrayList<>(); final List<String> errors = new ArrayList<>();
@ -182,7 +183,7 @@ public class LocalDiskDSProcessor implements DataSourceProcessor {
} }
addDiskTask = new AddImageTask( addDiskTask = new AddImageTask(
new AddImageTask.ImageDetails(deviceId, image, sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, imageWriterSettings), new AddImageTask.ImageDetails(deviceId, image, sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, imageWriterSettings, password),
progressMonitor, progressMonitor,
new StreamingAddDataSourceCallbacks(new DefaultIngestStream()), new StreamingAddDataSourceCallbacks(new DefaultIngestStream()),
new StreamingAddImageTaskCallback(new DefaultIngestStream(), callback)); new StreamingAddImageTaskCallback(new DefaultIngestStream(), callback));
@ -250,7 +251,7 @@ public class LocalDiskDSProcessor implements DataSourceProcessor {
return; return;
} }
addDiskTask = new AddImageTask(new AddImageTask.ImageDetails(deviceId, image, sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, imageWriterSettings), addDiskTask = new AddImageTask(new AddImageTask.ImageDetails(deviceId, image, sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, imageWriterSettings, password),
progressMonitor, progressMonitor,
new StreamingAddDataSourceCallbacks(new DefaultIngestStream()), new StreamingAddDataSourceCallbacks(new DefaultIngestStream()),
new StreamingAddImageTaskCallback(new DefaultIngestStream(), callback)); new StreamingAddImageTaskCallback(new DefaultIngestStream(), callback));

23
Core/src/org/sleuthkit/autopsy/coreutils/DataSourceUtils.java
View File

@ -21,6 +21,8 @@ package org.sleuthkit.autopsy.coreutils;
import org.sleuthkit.datamodel.SleuthkitJNI; import org.sleuthkit.datamodel.SleuthkitJNI;
import java.io.IOException; import java.io.IOException;
import java.nio.file.Path; import java.nio.file.Path;
import java.text.MessageFormat;
import org.apache.commons.lang3.StringUtils;
/** /**
* Utility methods for working with data sources. * Utility methods for working with data sources.
@ -41,4 +43,25 @@ public class DataSourceUtils {
public static boolean imageHasFileSystem(Path dataSourcePath) throws IOException { public static boolean imageHasFileSystem(Path dataSourcePath) throws IOException {
return SleuthkitJNI.isImageSupported(dataSourcePath.toString()); return SleuthkitJNI.isImageSupported(dataSourcePath.toString());
} }
public static boolean imageHasFileSystem(Path dataSourcePath, String password) throws IOException {
try {
// LOGGER.info("Testing if disk image {} can be opened", hostPath);
SleuthkitJNI.TestOpenImageResult openImageResult = SleuthkitJNI.testOpenImage(dataSourcePath.toString(), password);
if (!openImageResult.wasSuccessful()) {
String message = MessageFormat.format("An error occurred while opening {0}: {1}",
dataSourcePath.toString(),
openImageResult == null || StringUtils.isBlank(openImageResult.getMessage())
? "<unknown>"
: openImageResult.getMessage());
return false;
}
} catch (Throwable ex) {
String message = "An error occurred while opening " + dataSourcePath.toString();
return false;
}
return SleuthkitJNI.isImageSupported(dataSourcePath.toString());
}
} }

2
Core/src/org/sleuthkit/autopsy/logicalimager/dsp/AddMultipleImagesTask.java
View File

@ -128,7 +128,7 @@ class AddMultipleImagesTask implements Runnable {
for (String imageFilePath : imageFilePaths) { for (String imageFilePath : imageFilePaths) {
try { try {
currentImage = SleuthkitJNI.addImageToDatabase(currentCase.getSleuthkitCase(), new String[]{imageFilePath}, currentImage = SleuthkitJNI.addImageToDatabase(currentCase.getSleuthkitCase(), new String[]{imageFilePath},
0, timeZone, "", "", "", deviceId, host); 0, timeZone, "", "", "", deviceId, host, null);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error adding image " + imageFilePath + " to database", ex); LOGGER.log(Level.SEVERE, "Error adding image " + imageFilePath + " to database", ex);
errorMessages.add(Bundle.AddMultipleImagesTask_imageError(imageFilePath)); errorMessages.add(Bundle.AddMultipleImagesTask_imageError(imageFilePath));

2
Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java
View File

@ -1230,7 +1230,7 @@ public class PortableCaseReportModule implements ReportModule {
if (content instanceof Image) { if (content instanceof Image) {
Image image = (Image) content; Image image = (Image) content;
newContent = portableSkCase.addImage(image.getType(), image.getSsize(), image.getSize(), image.getName(), newContent = portableSkCase.addImage(image.getType(), image.getSsize(), image.getSize(), image.getName(),
new ArrayList<>(), image.getTimeZone(), md5, sha1, sha256, image.getDeviceId(), newHost, trans); new ArrayList<>(), image.getTimeZone(), md5, sha1, sha256, image.getDeviceId(), newHost, null, trans);
} else if (content instanceof VolumeSystem) { } else if (content instanceof VolumeSystem) {
VolumeSystem vs = (VolumeSystem) content; VolumeSystem vs = (VolumeSystem) content;
newContent = portableSkCase.addVolumeSystem(parentId, vs.getType(), vs.getOffset(), vs.getBlockSize(), trans); newContent = portableSkCase.addVolumeSystem(parentId, vs.getType(), vs.getOffset(), vs.getBlockSize(), trans);