diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java index 3a06a3be4d..d512c6670c 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java @@ -501,13 +501,16 @@ public final class IngestJobSettings { this.warnings.add(warning); } } else { - try (PythonObjectInputStream in = new PythonObjectInputStream(new FileInputStream(settingsFile.getAbsolutePath()))) { - settings = (IngestModuleIngestJobSettings) in.readObject(); - } catch (IOException | ClassNotFoundException exception) { - String warning = NbBundle.getMessage(IngestJobSettings.class, "IngestJobSettings.moduleSettingsLoad.warning", factory.getModuleDisplayName(), this.executionContext); //NON-NLS - logger.log(Level.WARNING, warning, exception); - this.warnings.add(warning); - } + // @@@ BC Jython serialization is currently broken and this + // throws an exception. (-2323). Commenting out so that + // Python modules will at least load with default settings. +// try (PythonObjectInputStream in = new PythonObjectInputStream(new FileInputStream(settingsFile.getAbsolutePath()))) { +// settings = (IngestModuleIngestJobSettings) in.readObject(); +// } catch (IOException | ClassNotFoundException exception) { +// String warning = NbBundle.getMessage(IngestJobSettings.class, "IngestJobSettings.moduleSettingsLoad.warning", factory.getModuleDisplayName(), this.executionContext); //NON-NLS +// logger.log(Level.WARNING, warning, exception); +// this.warnings.add(warning); +// } } } if (settings == null) { diff --git a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/AddMemoryImageTask.java b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/AddMemoryImageTask.java index 7490c3e7b1..e5f67909da 100644 --- a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/AddMemoryImageTask.java +++ b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/AddMemoryImageTask.java @@ -49,6 +49,7 @@ final class AddMemoryImageTask implements Runnable { private final DataSourceProcessorCallback callback; private volatile VolatilityProcessor volatilityProcessor; private volatile boolean isCancelled; + private final String profile; // empty for autodetect /** * Constructs a runnable that adds a memory image to a case database. @@ -57,6 +58,7 @@ final class AddMemoryImageTask implements Runnable { * associated with the data source that is intended * to be unique across multiple cases (e.g., a UUID). * @param memoryImagePath Path to the memory image file. + * @param profile Volatility profile to run or empty string to autodetect * @param pluginsToRun The Volatility plugins to run. * @param timeZone The time zone to use when processing dates and * times for the image, obtained from @@ -65,9 +67,10 @@ final class AddMemoryImageTask implements Runnable { * during processing. * @param callback Callback to call when processing is done. */ - AddMemoryImageTask(String deviceId, String memoryImagePath, List pluginsToRun, String timeZone, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) { + AddMemoryImageTask(String deviceId, String memoryImagePath, String profile, List pluginsToRun, String timeZone, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) { this.deviceId = deviceId; this.memoryImagePath = memoryImagePath; + this.profile = profile; this.pluginsToRun = pluginsToRun; this.timeZone = timeZone; this.callback = callback; @@ -94,7 +97,7 @@ final class AddMemoryImageTask implements Runnable { try { Image dataSource = addImageToCase(); dataSources.add(dataSource); - volatilityProcessor = new VolatilityProcessor(memoryImagePath, dataSource, pluginsToRun, progressMonitor); + volatilityProcessor = new VolatilityProcessor(memoryImagePath, dataSource, profile, pluginsToRun, progressMonitor); volatilityProcessor.run(); } catch (NoCurrentCaseException | TskCoreException | VolatilityProcessor.VolatilityProcessorException ex) { criticalErrorOccurred = true; diff --git a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/Bundle.properties b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/Bundle.properties index 007b78dc5a..1c7d3312da 100755 --- a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/Bundle.properties +++ b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/Bundle.properties @@ -3,11 +3,10 @@ # and open the template in the editor. MemoryDSInputPanel.pathLabel.AccessibleContext.accessibleName=Browse for a memory image file: -MemoryDSInputPanel.PluginsToRunLabel.text=Available plugins to run: -MemoryDSInputPanel.volExecutableLabel.text=Version of Volatility to Run: +MemoryDSInputPanel.PluginsToRunLabel.text=Plugins to run: MemoryDSInputPanel.pathLabel.text=Browse for a memory image file: MemoryDSInputPanel.pathTextField.text= MemoryDSInputPanel.errorLabel.text=Error Label MemoryDSInputPanel.browseButton.text=Browse -MemoryDSImputPanel.pathTextField.text= -MemoryDSInputPanel.timeZoneLabel.text=Please select the input timezone: \ No newline at end of file +MemoryDSInputPanel.timeZoneLabel.text=Timezone: +MemoryDSInputPanel.profileLabel.text=Profile: diff --git a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.form b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.form index 123f9b308b..f899eeb503 100644 --- a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.form +++ b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.form @@ -28,13 +28,15 @@ - - + + - - + + + + @@ -43,8 +45,8 @@ - + @@ -66,17 +68,17 @@ - + - - + + - + - + @@ -85,7 +87,7 @@ - + @@ -97,14 +99,17 @@ - + + + + - + @@ -117,14 +122,14 @@ - + - + @@ -139,27 +144,6 @@ - - - - - - - - - - - - - - - - - - - - - @@ -174,7 +158,7 @@ - + @@ -189,5 +173,20 @@ + + + + + + + + + + + + + + + diff --git a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.java b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.java index f96a9cc801..134cdbc914 100644 --- a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.java +++ b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSInputPanel.java @@ -26,7 +26,9 @@ import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.SimpleTimeZone; +import java.util.SortedSet; import java.util.TimeZone; +import java.util.TreeSet; import javax.swing.JFileChooser; import javax.swing.JPanel; import javax.swing.JTable; @@ -42,6 +44,7 @@ import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor; import org.sleuthkit.autopsy.coreutils.ModuleSettings; import org.sleuthkit.autopsy.coreutils.PathValidator; +@SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives final class MemoryDSInputPanel extends JPanel implements DocumentListener { private static final long serialVersionUID = 1L; //default @@ -53,13 +56,26 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { private final PluginListTableModel tableModel = new PluginListTableModel(); private final List PluginListNames = new ArrayList<>(); private final Map pluginListStates = new HashMap<>(); // is set by listeners when users select and deselect items - private final Boolean isEnabled = true; + private final SortedSet profileList = new TreeSet<>(Arrays.asList( + "VistaSP0x64", "VistaSP0x86", "VistaSP1x64", "VistaSP1x86", + "VistaSP2x64", "VistaSP2x86", "Win10x64", "Win10x64_10586", + "Win10x64_14393", "Win10x86", "Win10x86_10586", "Win10x86_14393", + "Win2003SP0x86", "Win2003SP1x64", "Win2003SP1x86", "Win2003SP2x64", + "Win2003SP2x86", "Win2008R2SP0x64", "Win2008R2SP1x64", "Win2008R2SP1x64_23418", + "Win2008SP1x64", "Win2008SP1x86", "Win2008SP2x64", "Win2008SP2x86", + "Win2012R2x64", "Win2012R2x64_18340", "Win2012x64", "Win2016x64_14393", + "Win7SP0x64", "Win7SP0x86", "Win7SP1x64", "Win7SP1x64_23418", "Win7SP1x86_23418", + "Win81U1x64", "Win81U1x86", "Win8SP0x64", "Win8SP0x86", "Win8SP1x64", + "Win8SP1x64_18340", "Win8SP1x86", "WinXPSP1x64", "WinXPSP2x64", "WinXPSP2x86", + "WinXPSP3x86")); + private final static String AUTODETECT_PROFILE = "Auto Detect"; + /** * Creates new MemoryDSInputPanel panel for user input */ private MemoryDSInputPanel(String context) { - this.pluginList = new String[]{"amcache", "cmdline", "cmdscan", "consoles", "malfind", "netscan", "notepad", "pslist", "psxview", "shellbags", "shimcache", "shutdown", "userassist", "apihooks", "connscan", "devicetree", "dlllist", "envars", "filescan", "gahti", "getservicesids", "getsids", "handles", "hashdump", "hivelist", "hivescan", "impscan", "ldrmodules", "lsadump", "modules", "mutantscan", "privs", "psscan", "pstree", "sockets", "svcscan", "shimcache", "timeliner", "unloadedmodules", "userhandles", "vadinfo", "verinfo"}; + this.pluginList = new String[]{"amcache", "cmdline", "cmdscan", "consoles", "malfind", "netscan", "notepad", "pslist", "psxview", "shellbags", "shimcache", "shutdown", "userassist", "apihooks", "connscan", "devicetree", "dlllist", "envars", "filescan", "gahti", "getservicesids", "getsids", "handles", "hashdump", "hivelist", "hivescan", "impscan", "ldrmodules", "lsadump", "modules", "mutantscan", "privs", "psscan", "pstree", "sockets", "svcscan", "shimcache", "timeliner", "unloadedmodules", "userhandles", "vadinfo", "verinfo", "dlldump", "moddump", "procdump", "dumpfiles", "dumpregistry"}; Arrays.sort(this.pluginList); initComponents(); @@ -82,7 +98,7 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { instance.postInit(); instance.customizePluginListTable(); instance.createTimeZoneList(); - instance.createVolatilityVersionList(); + instance.populateProfileCombobox(); instance.createPluginList(); return instance; @@ -95,14 +111,14 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { } private void customizePluginListTable() { - PluginList.setModel(tableModel); - PluginList.setTableHeader(null); - PluginList.setSelectionMode(ListSelectionModel.SINGLE_SELECTION); + pluginTable.setModel(tableModel); + pluginTable.setTableHeader(null); + pluginTable.setSelectionMode(ListSelectionModel.SINGLE_SELECTION); final int width = listsScrollPane.getPreferredSize().width; - PluginList.setAutoResizeMode(JTable.AUTO_RESIZE_NEXT_COLUMN); + pluginTable.setAutoResizeMode(JTable.AUTO_RESIZE_NEXT_COLUMN); TableColumn column; - for (int i = 0; i < PluginList.getColumnCount(); i++) { - column = PluginList.getColumnModel().getColumn(i); + for (int i = 0; i < pluginTable.getColumnCount(); i++) { + column = pluginTable.getColumnModel().getColumn(i); if (i == 0) { column.setPreferredWidth(((int) (width * 0.07))); } else { @@ -138,11 +154,12 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { timeZoneComboBox.setSelectedItem(formatted); } - private void createVolatilityVersionList() { - - volExecutableComboBox.addItem("2.6"); - volExecutableComboBox.addItem("2.5"); - + + private void populateProfileCombobox() { + profileComboBox.addItem(AUTODETECT_PROFILE); + profileList.forEach((profile) -> { + profileComboBox.addItem(profile); + }); } private void createPluginList() { @@ -157,8 +174,10 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { PluginListNames.add(plugin); if (allEnabled) { pluginListStates.put(plugin, true); + } else if ((pluginMap.containsKey(plugin) && pluginMap.get(plugin).equals("false"))) { + pluginListStates.put(plugin, false); } else { - pluginListStates.put(plugin, pluginMap.containsKey(plugin)); + pluginListStates.put(plugin, true); } } tableModel.fireTableDataChanged(); @@ -181,15 +200,20 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { errorLabel = new javax.swing.JLabel(); timeZoneLabel = new javax.swing.JLabel(); timeZoneComboBox = new javax.swing.JComboBox<>(); - volExecutableLabel = new javax.swing.JLabel(); - volExecutableComboBox = new javax.swing.JComboBox<>(); PluginsToRunLabel = new javax.swing.JLabel(); listsScrollPane = new javax.swing.JScrollPane(); - PluginList = new javax.swing.JTable(); + pluginTable = new javax.swing.JTable(); + profileLabel = new javax.swing.JLabel(); + profileComboBox = new javax.swing.JComboBox<>(); org.openide.awt.Mnemonics.setLocalizedText(pathLabel, org.openide.util.NbBundle.getMessage(MemoryDSInputPanel.class, "MemoryDSInputPanel.pathLabel.text")); // NOI18N pathTextField.setText(org.openide.util.NbBundle.getMessage(MemoryDSInputPanel.class, "MemoryDSInputPanel.pathTextField.text")); // NOI18N + pathTextField.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + pathTextFieldActionPerformed(evt); + } + }); org.openide.awt.Mnemonics.setLocalizedText(browseButton, org.openide.util.NbBundle.getMessage(MemoryDSInputPanel.class, "MemoryDSInputPanel.browseButton.text")); // NOI18N browseButton.addActionListener(new java.awt.event.ActionListener() { @@ -205,18 +229,9 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { timeZoneComboBox.setMaximumRowCount(30); - org.openide.awt.Mnemonics.setLocalizedText(volExecutableLabel, org.openide.util.NbBundle.getMessage(MemoryDSInputPanel.class, "MemoryDSInputPanel.volExecutableLabel.text")); // NOI18N - - volExecutableComboBox.setEnabled(false); - volExecutableComboBox.addActionListener(new java.awt.event.ActionListener() { - public void actionPerformed(java.awt.event.ActionEvent evt) { - volExecutableComboBoxActionPerformed(evt); - } - }); - org.openide.awt.Mnemonics.setLocalizedText(PluginsToRunLabel, org.openide.util.NbBundle.getMessage(MemoryDSInputPanel.class, "MemoryDSInputPanel.PluginsToRunLabel.text")); // NOI18N - PluginList.setModel(new javax.swing.table.DefaultTableModel( + pluginTable.setModel(new javax.swing.table.DefaultTableModel( new Object [][] { {}, {}, @@ -227,7 +242,15 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { } )); - listsScrollPane.setViewportView(PluginList); + listsScrollPane.setViewportView(pluginTable); + + org.openide.awt.Mnemonics.setLocalizedText(profileLabel, org.openide.util.NbBundle.getMessage(MemoryDSInputPanel.class, "MemoryDSInputPanel.profileLabel.text")); // NOI18N + + profileComboBox.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + profileComboBoxActionPerformed(evt); + } + }); javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); this.setLayout(layout); @@ -241,18 +264,19 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addComponent(pathLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 218, javax.swing.GroupLayout.PREFERRED_SIZE) .addGroup(layout.createSequentialGroup() - .addComponent(timeZoneLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 168, javax.swing.GroupLayout.PREFERRED_SIZE) + .addComponent(timeZoneLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 134, javax.swing.GroupLayout.PREFERRED_SIZE) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(volExecutableComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE) - .addComponent(timeZoneComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, 199, javax.swing.GroupLayout.PREFERRED_SIZE) - .addComponent(listsScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 248, javax.swing.GroupLayout.PREFERRED_SIZE)))) + .addComponent(listsScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 248, javax.swing.GroupLayout.PREFERRED_SIZE) + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING, false) + .addComponent(profileComboBox, javax.swing.GroupLayout.Alignment.LEADING, 0, 243, Short.MAX_VALUE) + .addComponent(timeZoneComboBox, javax.swing.GroupLayout.Alignment.LEADING, 0, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))))) .addGap(0, 163, Short.MAX_VALUE)) .addGroup(layout.createSequentialGroup() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addComponent(errorLabel) - .addComponent(volExecutableLabel) - .addComponent(PluginsToRunLabel)) + .addComponent(PluginsToRunLabel) + .addComponent(profileLabel)) .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) ); layout.setVerticalGroup( @@ -269,15 +293,15 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { .addComponent(timeZoneComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addComponent(errorLabel) - .addGap(18, 18, 18) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) - .addComponent(volExecutableLabel) - .addComponent(volExecutableComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)) + .addComponent(profileLabel) + .addComponent(profileComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addComponent(PluginsToRunLabel) - .addComponent(listsScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 132, javax.swing.GroupLayout.PREFERRED_SIZE)) - .addContainerGap(30, Short.MAX_VALUE)) + .addComponent(listsScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 122, javax.swing.GroupLayout.PREFERRED_SIZE)) + .addContainerGap(73, Short.MAX_VALUE)) ); pathLabel.getAccessibleContext().setAccessibleName(org.openide.util.NbBundle.getMessage(MemoryDSInputPanel.class, "MemoryDSInputPanel.pathLabel.AccessibleContext.accessibleName")); // NOI18N @@ -298,12 +322,15 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { } }//GEN-LAST:event_browseButtonActionPerformed - private void volExecutableComboBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_volExecutableComboBoxActionPerformed + private void profileComboBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_profileComboBoxActionPerformed // TODO add your handling code here: - }//GEN-LAST:event_volExecutableComboBoxActionPerformed + }//GEN-LAST:event_profileComboBoxActionPerformed + + private void pathTextFieldActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_pathTextFieldActionPerformed + // TODO add your handling code here: + }//GEN-LAST:event_pathTextFieldActionPerformed // Variables declaration - do not modify//GEN-BEGIN:variables - private javax.swing.JTable PluginList; private javax.swing.JLabel PluginsToRunLabel; private javax.swing.JButton browseButton; private javax.swing.JLabel errorLabel; @@ -311,10 +338,11 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { private javax.swing.JScrollPane listsScrollPane; private javax.swing.JLabel pathLabel; private javax.swing.JTextField pathTextField; + private javax.swing.JTable pluginTable; + private javax.swing.JComboBox profileComboBox; + private javax.swing.JLabel profileLabel; private javax.swing.JComboBox timeZoneComboBox; private javax.swing.JLabel timeZoneLabel; - private javax.swing.JComboBox volExecutableComboBox; - private javax.swing.JLabel volExecutableLabel; // End of variables declaration//GEN-END:variables /** * Get the path of the user selected image. @@ -325,17 +353,28 @@ final class MemoryDSInputPanel extends JPanel implements DocumentListener { return pathTextField.getText(); } + /** + * + * @return Profile or empty string if auto detect + */ + String getProfile() { + String profile = (String)profileComboBox.getSelectedItem(); + if (profile.equals(AUTODETECT_PROFILE)) { + return ""; + } + return profile; + } + List getPluginsToRun() { List enabledPlugins = new ArrayList<>(); - Map pluginMap = new HashMap<>(); + Map pluginSettingsToSave = new HashMap<>(); for (String plugin : PluginListNames) { if (pluginListStates.get(plugin)) { enabledPlugins.add(plugin); - pluginMap.put(plugin, ""); } + pluginSettingsToSave.put(plugin, pluginListStates.get(plugin).toString()); } - - ModuleSettings.setConfigSettings(this.contextName, pluginMap); + ModuleSettings.setConfigSettings(this.contextName, pluginSettingsToSave); // @@ Could return keys of set return enabledPlugins; } diff --git a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSProcessor.java b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSProcessor.java index 9791ad1f09..dc05cb8376 100644 --- a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSProcessor.java +++ b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/MemoryDSProcessor.java @@ -117,7 +117,7 @@ public class MemoryDSProcessor implements DataSourceProcessor { @Override public void run(DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) { configPanel.storeSettings(); - run(UUID.randomUUID().toString(), configPanel.getImageFilePath(), configPanel.getPluginsToRun(), configPanel.getTimeZone(), progressMonitor, callback); + run(UUID.randomUUID().toString(), configPanel.getImageFilePath(), configPanel.getProfile(), configPanel.getPluginsToRun(), configPanel.getTimeZone(), progressMonitor, callback); } /** @@ -131,6 +131,7 @@ public class MemoryDSProcessor implements DataSourceProcessor { * associated with the data source that is intended * to be unique across multiple cases (e.g., a UUID). * @param memoryImagePath Path to the memory image file. + * @param profile Volatility profile to run or empty string to autodetect * @param pluginsToRun The Volatility plugins to run. * @param timeZone The time zone to use when processing dates and * times for the image, obtained from @@ -139,8 +140,8 @@ public class MemoryDSProcessor implements DataSourceProcessor { * processing. * @param callback Callback to call when processing is done. */ - private void run(String deviceId, String memoryImagePath, List pluginsToRun, String timeZone, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) { - addImageTask = new AddMemoryImageTask(deviceId, memoryImagePath, pluginsToRun, timeZone, progressMonitor, callback); + private void run(String deviceId, String memoryImagePath, String profile, List pluginsToRun, String timeZone, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) { + addImageTask = new AddMemoryImageTask(deviceId, memoryImagePath, profile, pluginsToRun, timeZone, progressMonitor, callback); new Thread(addImageTask).start(); } diff --git a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/VolatilityProcessor.java b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/VolatilityProcessor.java index 50246f5255..9d3fcd15d5 100644 --- a/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/VolatilityProcessor.java +++ b/Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/VolatilityProcessor.java @@ -29,7 +29,6 @@ import java.util.List; import java.util.Set; import java.util.logging.Level; import org.openide.modules.InstalledFileLocator; -import org.openide.util.Lookup; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -41,13 +40,13 @@ import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.PlatformUtil; import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; -import org.sleuthkit.autopsy.keywordsearchservice.KeywordSearchService; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; +import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Image; -import org.sleuthkit.datamodel.Report; import org.sleuthkit.datamodel.TskCoreException; +import org.sleuthkit.datamodel.TskData.EncodingType; import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM; /** @@ -70,6 +69,8 @@ class VolatilityProcessor { private String moduleOutputPath; private FileManager fileManager; private volatile boolean isCancelled; + private Content outputVirtDir; + private String profile; /** * Constructs a processor that runs Volatility on a given memory image file @@ -77,11 +78,13 @@ class VolatilityProcessor { * * @param memoryImagePath Path to memory image file. * @param dataSource The memory image data source. + * @param profile Volatility profile to run or empty string to autodetect * @param plugInToRuns Volatility plugins to run. * @param progressMonitor Progress monitor for reporting progress during * processing. */ - VolatilityProcessor(String memoryImagePath, Image dataSource, List plugInToRun, DataSourceProcessorProgressMonitor progressMonitor) { + VolatilityProcessor(String memoryImagePath, Image dataSource, String profile, List plugInToRun, DataSourceProcessorProgressMonitor progressMonitor) { + this.profile = profile; this.memoryImagePath = memoryImagePath; this.pluginsToRun = plugInToRun; this.dataSource = dataSource; @@ -117,6 +120,13 @@ class VolatilityProcessor { fileManager = currentCase.getServices().getFileManager(); + try { + // make a virtual directory to store the reports + outputVirtDir = currentCase.getSleuthkitCase().addVirtualDirectory(dataSource.getId(), "ModuleOutput"); + } catch (TskCoreException ex) { + throw new VolatilityProcessorException("Error creating virtual directory", ex); + } + /* * Make an output folder unique to this data source. */ @@ -124,9 +134,14 @@ class VolatilityProcessor { moduleOutputPath = Paths.get(currentCase.getModuleDirectory(), VOLATILITY, dataSourceId.toString()).toString(); File directory = new File(String.valueOf(moduleOutputPath)); if (!directory.exists()) { - directory.mkdirs(); + directory.mkdirs(); + } + + // if they did not specify a profile, then run imageinfo to get one + if (profile.isEmpty() ) { progressMonitor.setProgressText(Bundle.VolatilityProcessor_progressMessage_runningImageInfo("imageinfo")); //NON-NLS runVolatilityPlugin("imageinfo"); //NON-NLS + profile = getProfileFromImageInfoOutput(); } progressMonitor.setIndeterminate(false); @@ -177,24 +192,38 @@ class VolatilityProcessor { commandLine.add("\"" + executableFile + "\""); //NON-NLS File memoryImage = new File(memoryImagePath); commandLine.add("--filename=" + memoryImage.getName()); //NON-NLS - - File imageInfoOutputFile = new File(moduleOutputPath + "\\imageinfo.txt"); //NON-NLS - if (imageInfoOutputFile.exists()) { - String memoryProfile = parseImageInfoOutput(imageInfoOutputFile); - commandLine.add("--profile=" + memoryProfile); //NON-NLS + if (!profile.isEmpty()) { + commandLine.add("--profile=" + profile); //NON-NLS } - commandLine.add(pluginToRun); - String outputFile = moduleOutputPath + "\\" + pluginToRun + ".txt"; //NON-NLS + switch (pluginToRun) { + case "dlldump": + case "moddump": + case "procdump": + case "dumpregistry": + case "dumpfiles": + String outputDir = moduleOutputPath + File.separator + pluginToRun; + File directory = new File(outputDir); + if (!directory.exists()) { + directory.mkdirs(); + } + commandLine.add("--dump-dir=" + outputDir); //NON-NLS + break; + default: + break; + } + + String outputFileAsString = moduleOutputPath + File.separator + pluginToRun + ".txt"; //NON-NLS ProcessBuilder processBuilder = new ProcessBuilder(commandLine); /* * Add an environment variable to force Volatility to run with the same * permissions Autopsy uses. */ processBuilder.environment().put("__COMPAT_LAYER", "RunAsInvoker"); //NON-NLS - processBuilder.redirectOutput(new File(outputFile)); - processBuilder.redirectError(new File(moduleOutputPath + "\\Volatility_Run.err")); //NON-NLS + File outputFile = new File(outputFileAsString); + processBuilder.redirectOutput(outputFile); + processBuilder.redirectError(new File(moduleOutputPath + File.separator + "Volatility_err.txt")); //NON-NLS processBuilder.directory(new File(memoryImage.getParent())); try { @@ -210,32 +239,16 @@ class VolatilityProcessor { if (isCancelled) { return; } - - /* - * Add the plugin output file to the case as a report. - */ + try { - Report report = currentCase.getSleuthkitCase().addReport(outputFile, VOLATILITY, VOLATILITY + " " + pluginToRun + " Plugin"); //NON-NLS - try { - KeywordSearchService searchService = Lookup.getDefault().lookup(KeywordSearchService.class); - if (searchService != null) { - searchService.index(report); - } else { - errorMsgs.add(Bundle.VolatilityProcessor_exceptionMessage_searchServiceNotFound(pluginToRun)); - /* - * Log the exception as well as add it to the error - * messages, to ensure that the stack trace is not lost. - */ - logger.log(Level.WARNING, Bundle.VolatilityProcessor_exceptionMessage_errorIndexingOutput(pluginToRun)); - } - } catch (TskCoreException ex) { - throw new VolatilityProcessorException(Bundle.VolatilityProcessor_exceptionMessage_errorIndexingOutput(pluginToRun), ex); - } + String relativePath = new File(currentCase.getCaseDirectory()).toURI().relativize(new File(outputFileAsString).toURI()).getPath(); + fileManager.addDerivedFile(pluginToRun, relativePath, outputFile.length(), 0, 0, 0, 0, true, outputVirtDir, null, null, null, null, EncodingType.NONE); } catch (TskCoreException ex) { - throw new VolatilityProcessorException(Bundle.VolatilityProcessor_exceptionMessage_errorAddingOutput(pluginToRun), ex); + errorMsgs.add("Error adding " + pluginToRun + " volatility report as a file"); + logger.log(Level.WARNING, "Error adding report as derived file", ex); } - - createArtifactsFromPluginOutput(pluginToRun, new File(outputFile)); + + createArtifactsFromPluginOutput(pluginToRun, new File(outputFileAsString)); } /** @@ -264,12 +277,18 @@ class VolatilityProcessor { @NbBundle.Messages({ "VolatilityProcessor_exceptionMessage_failedToParseImageInfo=Could not parse image info" }) - private String parseImageInfoOutput(File imageOutputFile) throws VolatilityProcessorException { + private String getProfileFromImageInfoOutput() throws VolatilityProcessorException { + File imageOutputFile = new File(moduleOutputPath + File.separator + "imageinfo.txt"); //NON-NLS try (BufferedReader br = new BufferedReader(new FileReader(imageOutputFile))) { String fileRead = br.readLine(); - String[] profileLine = fileRead.split(":"); //NON-NLS - String[] memProfile = profileLine[1].split(",|\\("); //NON-NLS - return memProfile[0].replaceAll("\\s+", ""); //NON-NLS + if (fileRead != null) { + String[] profileLine = fileRead.split(":"); //NON-NLS + String[] memProfile = profileLine[1].split(",|\\("); //NON-NLS + return memProfile[0].replaceAll("\\s+", ""); //NON-NLS + } + else { + throw new VolatilityProcessorException(Bundle.VolatilityProcessor_exceptionMessage_failedToParseImageInfo()); + } } catch (IOException ex) { throw new VolatilityProcessorException(Bundle.VolatilityProcessor_exceptionMessage_failedToParseImageInfo(), ex); }