mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-16 09:47:42 +00:00
Merge pull request #3246 from dgrove727/3257_EncryptionDetectionConfiguration
Encryption Detection settings panel implemented.
This commit is contained in:
Richard Cordovano
GitHub
commit
51a1e843af
@ -0,0 +1,8 @@
|
||||
EncryptionDetectionIngestJobSettingsPanel.minimumEntropyLabel.text=Minimum Entropy:
|
||||
EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeLabel.text=Minimum File Size:
|
||||
EncryptionDetectionIngestJobSettingsPanel.fileSizeMultiplesEnforcedCheckbox.text=Consider only files with sizes that are multiples of 512.
|
||||
EncryptionDetectionIngestJobSettingsPanel.slackFilesAllowedCheckbox.text=Consider slack space files.
|
||||
EncryptionDetectionIngestJobSettingsPanel.minimumEntropyTextbox.text=
|
||||
EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeTextbox.text=
|
||||
EncryptionDetectionIngestJobSettingsPanel.mbLabel.text=MB
|
||||
EncryptionDetectionIngestJobSettingsPanel.detectionSettingsLabel.text=Detection Settings
|
||||
@ -45,8 +45,11 @@ import org.sleuthkit.datamodel.TskData;
|
||||
*/
|
||||
final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter {
|
||||
|
||||
private static final double ENTROPY_THRESHOLD = 7.5;
|
||||
private static final int FILE_SIZE_THRESHOLD = 5242880; // 5MB
|
||||
static final double DEFAULT_CONFIG_MINIMUM_ENTROPY = 7.5;
|
||||
static final int DEFAULT_CONFIG_MINIMUM_FILE_SIZE = 5242880; // 5MB;
|
||||
static final boolean DEFAULT_CONFIG_FILE_SIZE_MULTIPLE_ENFORCED = true;
|
||||
static final boolean DEFAULT_CONFIG_SLACK_FILES_ALLOWED = true;
|
||||
|
||||
private static final int FILE_SIZE_MODULUS = 512;
|
||||
private static final double ONE_OVER_LOG2 = 1.4426950408889634073599246810019; // (1 / log(2))
|
||||
private static final int BYTE_OCCURENCES_BUFFER_SIZE = 256;
|
||||
@ -55,13 +58,24 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
|
||||
private final Logger LOGGER = SERVICES.getLogger(EncryptionDetectionModuleFactory.getModuleName());
|
||||
private FileTypeDetector fileTypeDetector;
|
||||
private Blackboard blackboard;
|
||||
private double entropy;
|
||||
private double calculatedEntropy;
|
||||
|
||||
private final double minimumEntropy;
|
||||
private final int minimumFileSize;
|
||||
private final boolean fileSizeMultipleEnforced;
|
||||
private final boolean slackFilesAllowed;
|
||||
|
||||
/**
|
||||
* Create a EncryptionDetectionFileIngestModule object that will detect files
|
||||
* that are encrypted and create blackboard artifacts as appropriate.
|
||||
* Create a EncryptionDetectionFileIngestModule object that will detect
|
||||
* files that are encrypted and create blackboard artifacts as appropriate.
|
||||
* The supplied EncryptionDetectionIngestJobSettings object is used to
|
||||
* configure the module.
|
||||
*/
|
||||
EncryptionDetectionFileIngestModule() {
|
||||
EncryptionDetectionFileIngestModule(EncryptionDetectionIngestJobSettings settings) {
|
||||
minimumEntropy = settings.getMinimumEntropy();
|
||||
minimumFileSize = settings.getMinimumFileSize();
|
||||
fileSizeMultipleEnforced = settings.isFileSizeMultipleEnforced();
|
||||
slackFilesAllowed = settings.isSlackFilesAllowed();
|
||||
}
|
||||
|
||||
@Override
|
||||
@ -120,7 +134,7 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
|
||||
*/
|
||||
StringBuilder detailsSb = new StringBuilder();
|
||||
detailsSb.append("File: ").append(file.getParentPath()).append(file.getName()).append("<br/>\n");
|
||||
detailsSb.append("Entropy: ").append(entropy);
|
||||
detailsSb.append("Entropy: ").append(calculatedEntropy);
|
||||
|
||||
SERVICES.postMessage(IngestMessage.createDataMessage(EncryptionDetectionModuleFactory.getModuleName(),
|
||||
"Encryption Detected Match: " + file.getName(),
|
||||
@ -159,7 +173,8 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
|
||||
if (!file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
|
||||
&& !file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
|
||||
&& !file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR)
|
||||
&& !file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR)) {
|
||||
&& !file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR)
|
||||
&& (!file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK) || slackFilesAllowed)) {
|
||||
/*
|
||||
* Qualify the file against hash databases.
|
||||
*/
|
||||
@ -168,17 +183,19 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
|
||||
* Qualify the size.
|
||||
*/
|
||||
long contentSize = file.getSize();
|
||||
if (contentSize >= FILE_SIZE_THRESHOLD && (contentSize % FILE_SIZE_MODULUS) == 0) {
|
||||
/*
|
||||
* Qualify the MIME type.
|
||||
*/
|
||||
try {
|
||||
String mimeType = fileTypeDetector.getFileType(file);
|
||||
if (mimeType != null && mimeType.equals("application/octet-stream")) {
|
||||
possiblyEncrypted = true;
|
||||
if (contentSize >= minimumFileSize) {
|
||||
if (!fileSizeMultipleEnforced || (contentSize % FILE_SIZE_MODULUS) == 0) {
|
||||
/*
|
||||
* Qualify the MIME type.
|
||||
*/
|
||||
try {
|
||||
String mimeType = fileTypeDetector.getFileType(file);
|
||||
if (mimeType != null && mimeType.equals("application/octet-stream")) {
|
||||
possiblyEncrypted = true;
|
||||
}
|
||||
} catch (TskCoreException ex) {
|
||||
throw new TskCoreException("Failed to detect the file type.", ex);
|
||||
}
|
||||
} catch (TskCoreException ex) {
|
||||
throw new TskCoreException("Failed to detect the file type.", ex);
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -186,8 +203,8 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
|
||||
|
||||
if (possiblyEncrypted) {
|
||||
try {
|
||||
entropy = calculateEntropy(file);
|
||||
if (entropy > ENTROPY_THRESHOLD) {
|
||||
calculatedEntropy = calculateEntropy(file);
|
||||
if (calculatedEntropy >= minimumEntropy) {
|
||||
return true;
|
||||
}
|
||||
} catch (IOException ex) {
|
||||
|
||||
@ -0,0 +1,133 @@
|
||||
/*
|
||||
* Autopsy Forensic Browser
|
||||
*
|
||||
* Copyright 2017 Basis Technology Corp.
|
||||
* Contact: carrier <at> sleuthkit <dot> org
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.sleuthkit.autopsy.modules.encryptiondetection;
|
||||
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
|
||||
|
||||
/**
|
||||
* Ingest job settings for the Encryption Detection module.
|
||||
*/
|
||||
final class EncryptionDetectionIngestJobSettings implements IngestModuleIngestJobSettings {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
private double minimumEntropy;
|
||||
private int minimumFileSize;
|
||||
private boolean fileSizeMultipleEnforced;
|
||||
private boolean slackFilesAllowed;
|
||||
|
||||
/**
|
||||
* Instantiate the ingest job settings with default values.
|
||||
*/
|
||||
EncryptionDetectionIngestJobSettings() {
|
||||
this.minimumEntropy = EncryptionDetectionFileIngestModule.DEFAULT_CONFIG_MINIMUM_ENTROPY;
|
||||
this.minimumFileSize = EncryptionDetectionFileIngestModule.DEFAULT_CONFIG_MINIMUM_FILE_SIZE;
|
||||
this.fileSizeMultipleEnforced = EncryptionDetectionFileIngestModule.DEFAULT_CONFIG_FILE_SIZE_MULTIPLE_ENFORCED;
|
||||
this.slackFilesAllowed = EncryptionDetectionFileIngestModule.DEFAULT_CONFIG_SLACK_FILES_ALLOWED;
|
||||
}
|
||||
|
||||
/**
|
||||
* Instantiate the ingest job settings.
|
||||
*
|
||||
* @param minimumEntropy The minimum entropy.
|
||||
* @param minimumFileSize The minimum file size.
|
||||
* @param fileSizeMultipleEnforced Files must be a multiple of 512 to be
|
||||
* processed.
|
||||
* @param slackFilesAllowed Slack files can be processed.
|
||||
*/
|
||||
EncryptionDetectionIngestJobSettings(double minimumEntropy, int minimumFileSize, boolean fileSizeMultipleEnforced, boolean slackFilesAllowed) {
|
||||
this.minimumEntropy = minimumEntropy;
|
||||
this.minimumFileSize = minimumFileSize;
|
||||
this.fileSizeMultipleEnforced = fileSizeMultipleEnforced;
|
||||
this.slackFilesAllowed = slackFilesAllowed;
|
||||
}
|
||||
|
||||
@Override
|
||||
public long getVersionNumber() {
|
||||
return serialVersionUID;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the minimum entropy necessary for the creation of blackboard
|
||||
* artifacts.
|
||||
*
|
||||
* @return The minimum entropy.
|
||||
*/
|
||||
double getMinimumEntropy() {
|
||||
return minimumEntropy;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the minimum entropy necessary for the creation of blackboard
|
||||
* artifacts.
|
||||
*/
|
||||
void setMinimumEntropy(double minimumEntropy) {
|
||||
this.minimumEntropy = minimumEntropy;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the minimum file size necessary for the creation of blackboard
|
||||
* artifacts.
|
||||
*
|
||||
* @return The minimum file size.
|
||||
*/
|
||||
int getMinimumFileSize() {
|
||||
return minimumFileSize;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the minimum file size necessary for the creation of blackboard
|
||||
* artifacts.
|
||||
*/
|
||||
void setMinimumFileSize(int minimumFileSize) {
|
||||
this.minimumFileSize = minimumFileSize;
|
||||
}
|
||||
|
||||
/**
|
||||
* Is the file size multiple enforced?
|
||||
*
|
||||
* @return True if enforcement is enabled; otherwise false.
|
||||
*/
|
||||
boolean isFileSizeMultipleEnforced() {
|
||||
return fileSizeMultipleEnforced;
|
||||
}
|
||||
|
||||
/**
|
||||
* Enable or disable file size multiple enforcement.
|
||||
*/
|
||||
void setFileSizeMultipleEnforced(boolean fileSizeMultipleEnforced) {
|
||||
this.fileSizeMultipleEnforced = fileSizeMultipleEnforced;
|
||||
}
|
||||
|
||||
/**
|
||||
* Are slack files allowed for processing?
|
||||
*
|
||||
* @return True if slack files are allowed; otherwise false.
|
||||
*/
|
||||
boolean isSlackFilesAllowed() {
|
||||
return slackFilesAllowed;
|
||||
}
|
||||
|
||||
/**
|
||||
* Allow or disallow slack files for processing.
|
||||
*/
|
||||
void setSlackFilesAllowed(boolean slackFilesAllowed) {
|
||||
this.slackFilesAllowed = slackFilesAllowed;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,132 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
|
||||
<Form version="1.5" maxVersion="1.9" type="org.netbeans.modules.form.forminfo.JPanelFormInfo">
|
||||
<AuxValues>
|
||||
<AuxValue name="FormSettings_autoResourcing" type="java.lang.Integer" value="1"/>
|
||||
<AuxValue name="FormSettings_autoSetComponentName" type="java.lang.Boolean" value="false"/>
|
||||
<AuxValue name="FormSettings_generateFQN" type="java.lang.Boolean" value="true"/>
|
||||
<AuxValue name="FormSettings_generateMnemonicsCode" type="java.lang.Boolean" value="true"/>
|
||||
<AuxValue name="FormSettings_i18nAutoMode" type="java.lang.Boolean" value="true"/>
|
||||
<AuxValue name="FormSettings_layoutCodeTarget" type="java.lang.Integer" value="1"/>
|
||||
<AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
|
||||
<AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
|
||||
<AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
|
||||
</AuxValues>
|
||||
|
||||
<Layout>
|
||||
<DimensionLayout dim="0">
|
||||
<Group type="103" groupAlignment="0" attributes="0">
|
||||
<Group type="102" alignment="0" attributes="0">
|
||||
<EmptySpace max="-2" attributes="0"/>
|
||||
<Group type="103" groupAlignment="0" attributes="0">
|
||||
<Component id="slackFilesAllowedCheckbox" min="-2" max="-2" attributes="0"/>
|
||||
<Component id="detectionSettingsLabel" alignment="0" min="-2" max="-2" attributes="0"/>
|
||||
<Group type="102" attributes="0">
|
||||
<Group type="103" groupAlignment="1" attributes="0">
|
||||
<Group type="102" alignment="0" attributes="0">
|
||||
<Component id="minimumFileSizeLabel" min="-2" max="-2" attributes="0"/>
|
||||
<EmptySpace type="unrelated" max="-2" attributes="0"/>
|
||||
<Component id="minimumFileSizeTextbox" min="-2" pref="32" max="-2" attributes="0"/>
|
||||
</Group>
|
||||
<Group type="102" alignment="0" attributes="0">
|
||||
<Component id="minimumEntropyLabel" min="-2" max="-2" attributes="0"/>
|
||||
<EmptySpace type="unrelated" max="-2" attributes="0"/>
|
||||
<Component id="minimumEntropyTextbox" min="-2" pref="32" max="-2" attributes="0"/>
|
||||
</Group>
|
||||
</Group>
|
||||
<EmptySpace max="-2" attributes="0"/>
|
||||
<Component id="mbLabel" min="-2" max="-2" attributes="0"/>
|
||||
</Group>
|
||||
<Component id="fileSizeMultiplesEnforcedCheckbox" alignment="0" min="-2" max="-2" attributes="0"/>
|
||||
</Group>
|
||||
<EmptySpace pref="15" max="32767" attributes="0"/>
|
||||
</Group>
|
||||
</Group>
|
||||
</DimensionLayout>
|
||||
<DimensionLayout dim="1">
|
||||
<Group type="103" groupAlignment="0" attributes="0">
|
||||
<Group type="102" alignment="0" attributes="0">
|
||||
<EmptySpace max="-2" attributes="0"/>
|
||||
<Component id="detectionSettingsLabel" min="-2" max="-2" attributes="0"/>
|
||||
<EmptySpace min="-2" pref="16" max="-2" attributes="0"/>
|
||||
<Group type="103" groupAlignment="3" attributes="0">
|
||||
<Component id="minimumEntropyTextbox" alignment="3" min="-2" max="-2" attributes="0"/>
|
||||
<Component id="minimumEntropyLabel" alignment="3" min="-2" max="-2" attributes="0"/>
|
||||
</Group>
|
||||
<EmptySpace max="-2" attributes="0"/>
|
||||
<Group type="103" groupAlignment="3" attributes="0">
|
||||
<Component id="minimumFileSizeTextbox" alignment="3" min="-2" max="-2" attributes="0"/>
|
||||
<Component id="mbLabel" alignment="3" min="-2" max="-2" attributes="0"/>
|
||||
<Component id="minimumFileSizeLabel" alignment="3" min="-2" max="-2" attributes="0"/>
|
||||
</Group>
|
||||
<EmptySpace type="unrelated" max="-2" attributes="0"/>
|
||||
<Component id="fileSizeMultiplesEnforcedCheckbox" min="-2" max="-2" attributes="0"/>
|
||||
<EmptySpace max="-2" attributes="0"/>
|
||||
<Component id="slackFilesAllowedCheckbox" min="-2" max="-2" attributes="0"/>
|
||||
<EmptySpace pref="160" max="32767" attributes="0"/>
|
||||
</Group>
|
||||
</Group>
|
||||
</DimensionLayout>
|
||||
</Layout>
|
||||
<SubComponents>
|
||||
<Component class="javax.swing.JTextField" name="minimumEntropyTextbox">
|
||||
<Properties>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.minimumEntropyTextbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
<Component class="javax.swing.JTextField" name="minimumFileSizeTextbox">
|
||||
<Properties>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeTextbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
<Component class="javax.swing.JCheckBox" name="fileSizeMultiplesEnforcedCheckbox">
|
||||
<Properties>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.fileSizeMultiplesEnforcedCheckbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
<Component class="javax.swing.JCheckBox" name="slackFilesAllowedCheckbox">
|
||||
<Properties>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.slackFilesAllowedCheckbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
<Component class="javax.swing.JLabel" name="minimumEntropyLabel">
|
||||
<Properties>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.minimumEntropyLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
<Component class="javax.swing.JLabel" name="minimumFileSizeLabel">
|
||||
<Properties>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
<Component class="javax.swing.JLabel" name="mbLabel">
|
||||
<Properties>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.mbLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
<Component class="javax.swing.JLabel" name="detectionSettingsLabel">
|
||||
<Properties>
|
||||
<Property name="font" type="java.awt.Font" editor="org.netbeans.beaninfo.editors.FontEditor">
|
||||
<Font name="Tahoma" size="11" style="1"/>
|
||||
</Property>
|
||||
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
|
||||
<ResourceString bundle="org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties" key="EncryptionDetectionIngestJobSettingsPanel.detectionSettingsLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, "{key}")"/>
|
||||
</Property>
|
||||
</Properties>
|
||||
</Component>
|
||||
</SubComponents>
|
||||
</Form>
|
||||
@ -0,0 +1,201 @@
|
||||
/*
|
||||
* Autopsy Forensic Browser
|
||||
*
|
||||
* Copyright 2017 Basis Technology Corp.
|
||||
* Contact: carrier <at> sleuthkit <dot> org
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.sleuthkit.autopsy.modules.encryptiondetection;
|
||||
|
||||
import org.openide.util.NbBundle;
|
||||
import org.openide.util.NbBundle.Messages;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
|
||||
|
||||
/**
|
||||
* Ingest job settings panel for the Encryption Detection module.
|
||||
*/
|
||||
final class EncryptionDetectionIngestJobSettingsPanel extends IngestModuleIngestJobSettingsPanel {
|
||||
|
||||
private static final int MEGABYTE_SIZE = 1048576;
|
||||
private static final double MINIMUM_ENTROPY_INPUT_RANGE_MIN = 6.0;
|
||||
private static final double MINIMUM_ENTROPY_INPUT_RANGE_MAX = 8.0;
|
||||
private static final int MINIMUM_FILE_SIZE_INPUT_RANGE_MIN = 1;
|
||||
|
||||
/**
|
||||
* Instantiate the ingest job settings panel.
|
||||
*
|
||||
* @param settings The ingest job settings.
|
||||
*/
|
||||
public EncryptionDetectionIngestJobSettingsPanel(EncryptionDetectionIngestJobSettings settings) {
|
||||
initComponents();
|
||||
customizeComponents(settings);
|
||||
}
|
||||
|
||||
/**
|
||||
* Update components with values from the ingest job settings.
|
||||
*
|
||||
* @param settings The ingest job settings.
|
||||
*/
|
||||
private void customizeComponents(EncryptionDetectionIngestJobSettings settings) {
|
||||
minimumEntropyTextbox.setText(String.valueOf(settings.getMinimumEntropy()));
|
||||
minimumFileSizeTextbox.setText(String.valueOf(settings.getMinimumFileSize() / MEGABYTE_SIZE));
|
||||
fileSizeMultiplesEnforcedCheckbox.setSelected(settings.isFileSizeMultipleEnforced());
|
||||
slackFilesAllowedCheckbox.setSelected(settings.isSlackFilesAllowed());
|
||||
}
|
||||
|
||||
@Override
|
||||
public IngestModuleIngestJobSettings getSettings() {
|
||||
validateMinimumEntropy();
|
||||
validateMinimumFileSize();
|
||||
|
||||
return new EncryptionDetectionIngestJobSettings(
|
||||
Double.valueOf(minimumEntropyTextbox.getText()),
|
||||
Integer.valueOf(minimumFileSizeTextbox.getText()) * MEGABYTE_SIZE,
|
||||
fileSizeMultiplesEnforcedCheckbox.isSelected(),
|
||||
slackFilesAllowedCheckbox.isSelected());
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate the minimum entropy input.
|
||||
*
|
||||
* @throws IllegalArgumentException If the input is empty, invalid, or out
|
||||
* of range.
|
||||
*/
|
||||
@Messages({
|
||||
"EncryptionDetectionIngestJobSettingsPanel.minimumEntropyInput.validationError.text=Minimum entropy input must be a number between 6.0 and 8.0."
|
||||
})
|
||||
private void validateMinimumEntropy() throws IllegalArgumentException {
|
||||
try {
|
||||
double minimumEntropy = Double.valueOf(minimumEntropyTextbox.getText());
|
||||
if (minimumEntropy < MINIMUM_ENTROPY_INPUT_RANGE_MIN || minimumEntropy > MINIMUM_ENTROPY_INPUT_RANGE_MAX) {
|
||||
throw new IllegalArgumentException(NbBundle.getMessage(this.getClass(), "EncryptionDetectionIngestJobSettingsPanel.minimumEntropyInput.validationError.text"));
|
||||
}
|
||||
} catch (NumberFormatException ex) {
|
||||
throw new IllegalArgumentException(NbBundle.getMessage(this.getClass(), "EncryptionDetectionIngestJobSettingsPanel.minimumEntropyInput.validationError.text"));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate the minimum file size input.
|
||||
*
|
||||
* @throws IllegalArgumentException If the input is empty, invalid, or out
|
||||
* of range.
|
||||
*/
|
||||
@Messages({
|
||||
"EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeInput.validationError.text=Minimum file size input must be an integer (in megabytes) of 1 or greater."
|
||||
})
|
||||
private void validateMinimumFileSize() throws IllegalArgumentException {
|
||||
try {
|
||||
int minimumFileSize = Integer.valueOf(minimumFileSizeTextbox.getText());
|
||||
if (minimumFileSize < MINIMUM_FILE_SIZE_INPUT_RANGE_MIN) {
|
||||
throw new IllegalArgumentException(NbBundle.getMessage(this.getClass(), "EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeInput.validationError.text"));
|
||||
}
|
||||
} catch (NumberFormatException ex) {
|
||||
throw new IllegalArgumentException(NbBundle.getMessage(this.getClass(), "EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeInput.validationError.text"));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* This method is called from within the constructor to initialize the form.
|
||||
* WARNING: Do NOT modify this code. The content of this method is always
|
||||
* regenerated by the Form Editor.
|
||||
*/
|
||||
@SuppressWarnings("unchecked")
|
||||
// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
|
||||
private void initComponents() {
|
||||
|
||||
minimumEntropyTextbox = new javax.swing.JTextField();
|
||||
minimumFileSizeTextbox = new javax.swing.JTextField();
|
||||
fileSizeMultiplesEnforcedCheckbox = new javax.swing.JCheckBox();
|
||||
slackFilesAllowedCheckbox = new javax.swing.JCheckBox();
|
||||
minimumEntropyLabel = new javax.swing.JLabel();
|
||||
minimumFileSizeLabel = new javax.swing.JLabel();
|
||||
mbLabel = new javax.swing.JLabel();
|
||||
detectionSettingsLabel = new javax.swing.JLabel();
|
||||
|
||||
minimumEntropyTextbox.setText(org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.minimumEntropyTextbox.text")); // NOI18N
|
||||
|
||||
minimumFileSizeTextbox.setText(org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeTextbox.text")); // NOI18N
|
||||
|
||||
org.openide.awt.Mnemonics.setLocalizedText(fileSizeMultiplesEnforcedCheckbox, org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.fileSizeMultiplesEnforcedCheckbox.text")); // NOI18N
|
||||
|
||||
org.openide.awt.Mnemonics.setLocalizedText(slackFilesAllowedCheckbox, org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.slackFilesAllowedCheckbox.text")); // NOI18N
|
||||
|
||||
org.openide.awt.Mnemonics.setLocalizedText(minimumEntropyLabel, org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.minimumEntropyLabel.text")); // NOI18N
|
||||
|
||||
org.openide.awt.Mnemonics.setLocalizedText(minimumFileSizeLabel, org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.minimumFileSizeLabel.text")); // NOI18N
|
||||
|
||||
org.openide.awt.Mnemonics.setLocalizedText(mbLabel, org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.mbLabel.text")); // NOI18N
|
||||
|
||||
detectionSettingsLabel.setFont(new java.awt.Font("Tahoma", 1, 11)); // NOI18N
|
||||
org.openide.awt.Mnemonics.setLocalizedText(detectionSettingsLabel, org.openide.util.NbBundle.getMessage(EncryptionDetectionIngestJobSettingsPanel.class, "EncryptionDetectionIngestJobSettingsPanel.detectionSettingsLabel.text")); // NOI18N
|
||||
|
||||
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
|
||||
this.setLayout(layout);
|
||||
layout.setHorizontalGroup(
|
||||
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
|
||||
.addGroup(layout.createSequentialGroup()
|
||||
.addContainerGap()
|
||||
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
|
||||
.addComponent(slackFilesAllowedCheckbox)
|
||||
.addComponent(detectionSettingsLabel)
|
||||
.addGroup(layout.createSequentialGroup()
|
||||
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
|
||||
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
|
||||
.addComponent(minimumFileSizeLabel)
|
||||
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
|
||||
.addComponent(minimumFileSizeTextbox, javax.swing.GroupLayout.PREFERRED_SIZE, 32, javax.swing.GroupLayout.PREFERRED_SIZE))
|
||||
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
|
||||
.addComponent(minimumEntropyLabel)
|
||||
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
|
||||
.addComponent(minimumEntropyTextbox, javax.swing.GroupLayout.PREFERRED_SIZE, 32, javax.swing.GroupLayout.PREFERRED_SIZE)))
|
||||
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
|
||||
.addComponent(mbLabel))
|
||||
.addComponent(fileSizeMultiplesEnforcedCheckbox))
|
||||
.addContainerGap(15, Short.MAX_VALUE))
|
||||
);
|
||||
layout.setVerticalGroup(
|
||||
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
|
||||
.addGroup(layout.createSequentialGroup()
|
||||
.addContainerGap()
|
||||
.addComponent(detectionSettingsLabel)
|
||||
.addGap(16, 16, 16)
|
||||
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
|
||||
.addComponent(minimumEntropyTextbox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
|
||||
.addComponent(minimumEntropyLabel))
|
||||
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
|
||||
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
|
||||
.addComponent(minimumFileSizeTextbox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
|
||||
.addComponent(mbLabel)
|
||||
.addComponent(minimumFileSizeLabel))
|
||||
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
|
||||
.addComponent(fileSizeMultiplesEnforcedCheckbox)
|
||||
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
|
||||
.addComponent(slackFilesAllowedCheckbox)
|
||||
.addContainerGap(160, Short.MAX_VALUE))
|
||||
);
|
||||
}// </editor-fold>//GEN-END:initComponents
|
||||
|
||||
// Variables declaration - do not modify//GEN-BEGIN:variables
|
||||
private javax.swing.JLabel detectionSettingsLabel;
|
||||
private javax.swing.JCheckBox fileSizeMultiplesEnforcedCheckbox;
|
||||
private javax.swing.JLabel mbLabel;
|
||||
private javax.swing.JLabel minimumEntropyLabel;
|
||||
private javax.swing.JTextField minimumEntropyTextbox;
|
||||
private javax.swing.JLabel minimumFileSizeLabel;
|
||||
private javax.swing.JTextField minimumFileSizeTextbox;
|
||||
private javax.swing.JCheckBox slackFilesAllowedCheckbox;
|
||||
// End of variables declaration//GEN-END:variables
|
||||
}
|
||||
@ -22,10 +22,12 @@ import org.openide.util.NbBundle;
|
||||
import org.openide.util.NbBundle.Messages;
|
||||
import org.openide.util.lookup.ServiceProvider;
|
||||
import org.sleuthkit.autopsy.coreutils.Version;
|
||||
import org.sleuthkit.autopsy.ingest.DataSourceIngestModule;
|
||||
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleFactory;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleGlobalSettingsPanel;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
|
||||
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
|
||||
|
||||
/**
|
||||
* A factory that creates file ingest modules that detect encryption.
|
||||
@ -33,9 +35,9 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
|
||||
@ServiceProvider(service = IngestModuleFactory.class)
|
||||
@Messages({
|
||||
"EncryptionDetectionFileIngestModule.moduleName.text=Encryption Detection",
|
||||
"EncryptionDetectionFileIngestModule.getDesc.text=Looks for large files with high entropy."
|
||||
"EncryptionDetectionFileIngestModule.getDesc.text=Looks for files with the specified minimum entropy."
|
||||
})
|
||||
public class EncryptionDetectionModuleFactory extends IngestModuleFactoryAdapter {
|
||||
public class EncryptionDetectionModuleFactory implements IngestModuleFactory {
|
||||
|
||||
@Override
|
||||
public String getModuleDisplayName() {
|
||||
@ -44,7 +46,7 @@ public class EncryptionDetectionModuleFactory extends IngestModuleFactoryAdapter
|
||||
|
||||
/**
|
||||
* Get the name of the module.
|
||||
*
|
||||
*
|
||||
* @return The module name.
|
||||
*/
|
||||
static String getModuleName() {
|
||||
@ -67,7 +69,48 @@ public class EncryptionDetectionModuleFactory extends IngestModuleFactoryAdapter
|
||||
}
|
||||
|
||||
@Override
|
||||
public FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings ingestOptions) {
|
||||
return new EncryptionDetectionFileIngestModule();
|
||||
public FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings settings) {
|
||||
if (!(settings instanceof EncryptionDetectionIngestJobSettings)) {
|
||||
throw new IllegalArgumentException("Expected settings argument to be an instance of EncryptionDetectionIngestJobSettings.");
|
||||
}
|
||||
return new EncryptionDetectionFileIngestModule((EncryptionDetectionIngestJobSettings) settings);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean hasGlobalSettingsPanel() {
|
||||
return false;
|
||||
}
|
||||
|
||||
@Override
|
||||
public IngestModuleGlobalSettingsPanel getGlobalSettingsPanel() {
|
||||
throw new UnsupportedOperationException();
|
||||
}
|
||||
|
||||
@Override
|
||||
public IngestModuleIngestJobSettings getDefaultIngestJobSettings() {
|
||||
return new EncryptionDetectionIngestJobSettings();
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean hasIngestJobSettingsPanel() {
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public IngestModuleIngestJobSettingsPanel getIngestJobSettingsPanel(IngestModuleIngestJobSettings settings) {
|
||||
if (!(settings instanceof EncryptionDetectionIngestJobSettings)) {
|
||||
throw new IllegalArgumentException("Expected settings argument to be an instance of EncryptionDetectionIngestJobSettings");
|
||||
}
|
||||
return new EncryptionDetectionIngestJobSettingsPanel((EncryptionDetectionIngestJobSettings) settings);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isDataSourceIngestModuleFactory() {
|
||||
return false;
|
||||
}
|
||||
|
||||
@Override
|
||||
public DataSourceIngestModule createDataSourceIngestModule(IngestModuleIngestJobSettings settings) {
|
||||
throw new UnsupportedOperationException();
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user