mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
Updated python examples and docs
This commit is contained in:
Brian Carrier
parent
91648425fb
commit
60a41bcfbc
@ -113,7 +113,7 @@ ALWAYS_DETAILED_SEC = NO
|
||||
# members were ordinary class members. Constructors, destructors and assignment
|
||||
# operators of the base classes will not be shown.
|
||||
|
||||
INLINE_INHERITED_MEMB = NO
|
||||
INLINE_INHERITED_MEMB = YES
|
||||
|
||||
# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full
|
||||
# path before files name in the file list and in the header files. If set
|
||||
|
||||
@ -60,7 +60,7 @@ To distribute and share your Python module, ZIP up the folder and send it around
|
||||
Jython allows you to access all of the Java classes. So, you should read the following sections of this document. All you should ignore is the Java environment setup sections.
|
||||
|
||||
There are only two types of modules that you can make with Python. Those (along with a sample file) are listed below:
|
||||
- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/ingestmodule.py
|
||||
- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/
|
||||
- Report Modules: https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/reportmodule.py
|
||||
|
||||
*/
|
||||
|
||||
@ -100,10 +100,12 @@ Before we cover the specific interfaces of the two different types of modules, l
|
||||
|
||||
To create a data source ingest module:
|
||||
-# Create the ingest module class by either:
|
||||
- Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE
|
||||
- Copy and paste the sample modules from:
|
||||
- Java: Core/src/org/sleuthkit/autopsy/examples/SampleDataSourceIngestModule.java
|
||||
- Python: pythonExamples/dataSourceIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
|
||||
- Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE
|
||||
will complain that you have not implemented one or more of the required methods.
|
||||
You can use its "hints" to automatically generate stubs for the missing methods.
|
||||
- Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py.
|
||||
-# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isDataSourceIngestModuleFactory() method to return true and have the createDataSourceIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code:
|
||||
|
||||
\code
|
||||
@ -119,8 +121,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
|
||||
\endcode
|
||||
-# Use this page, the sample, and the documentation for the
|
||||
org.sleuthkit.autopsy.ingest.DataSourceIngestModule interfaces to implement the startUp() and process() methods.
|
||||
|
||||
The process() method is where all of the work of a data source ingest module is
|
||||
- org.sleuthkit.autopsy.ingest.DataSourceIngestModule.startUp() is where any initialiation occurs. If your module has a critical failure and will not be able to run, your startUp method should throw an IngestModuleException to stop ingest.
|
||||
- org.sleuthkit.autopsy.ingest.DataSourceIngestModule.process() is where all of the work of a data source ingest module is
|
||||
done. It will be called exactly once. The
|
||||
process() method receives a reference to an org.sleuthkit.datamodel.Content object
|
||||
and an org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress object.
|
||||
@ -140,10 +142,12 @@ org.sleuthkit.autopsy.casemodule.services.FileManager class. See
|
||||
To create a file ingest module:
|
||||
To create a data source ingest module:
|
||||
-# Create the ingest module class by either:
|
||||
- Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE
|
||||
- Copy and paste the sample modules from:
|
||||
- Java: Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java
|
||||
- Python: pythonExamples/fileIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
|
||||
- Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE
|
||||
will complain that you have not implemented one or more of the required methods.
|
||||
You can use its "hints" to automatically generate stubs for the missing methods.
|
||||
- Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py.
|
||||
-# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isFileIngestModuleFactory() method to return true and have the createFileIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code:
|
||||
|
||||
\code
|
||||
@ -160,9 +164,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
|
||||
|
||||
-# Use this page, the sample, and the documentation for the
|
||||
org.sleuthkit.autopsy.ingest.FileIngestModule interface to implement the startUp(), and process(), and shutDown() methods.
|
||||
|
||||
|
||||
The process() method is where all of the work of a file ingest module is
|
||||
- org.sleuthkit.autopsy.ingest.FileIngestModule.startUp() should have any code that you need to initialize your module. If you have any startup errors, be sure to throw a IngestModuleException exception to stop ingest.
|
||||
- org.sleuthkit.autopsy.ingest.FileIngestModule.process() is where all of the work of a file ingest module is
|
||||
done. It will be called repeatedly between startUp() and shutDown(), once for
|
||||
each file Autopsy feeds into the pipeline of which the module instance is a part. The
|
||||
process() method receives a reference to a org.sleuthkit.datamodel.AbstractFile
|
||||
|
||||
@ -1,7 +1,13 @@
|
||||
reportmodule.py -> Report module which implements GeneralReportModuleAdapter.
|
||||
simpleingestmodule -> Data source ingest module without any GUI example code.
|
||||
ingestmodule.py -> Both data source ingest module as well as file ingest module WITH an example of GUI code.
|
||||
This folder contains sample python module files. They are public
|
||||
domain, so you are free to copy and paste them and modify them to
|
||||
your needs.
|
||||
|
||||
See the developer guide for more details and how to use and load
|
||||
the modules.
|
||||
|
||||
http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html
|
||||
|
||||
Each module in this folder should have a brief description about what they
|
||||
can do.
|
||||
|
||||
|
||||
NOTE: The Python modules must be inside folder inside the folder opened by Tools > Plugins.
|
||||
For example, place the ingestmodule.py inside folder ingest. Move that ingest folder inside opened by Tools > Plugins
|
||||
The directory opened by Tools > Plugins is cleared every time the project is cleaned.
|
||||
@ -27,6 +27,10 @@
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
# Simple data source-level ingest module for Autopsy.
|
||||
# Search for TODO for the things that you need to change
|
||||
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from org.sleuthkit.datamodel import SleuthkitCase
|
||||
@ -35,87 +39,112 @@ from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.casemodule.services import FileManager
|
||||
|
||||
# Sample factory that defines basic functionality and features of the module
|
||||
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
|
||||
# Factory that defines the name and details of the module and allows Autopsy
|
||||
# to create instances of the modules that will do the analysis.
|
||||
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
|
||||
class SampleJythonDataSourceIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
|
||||
# TODO: give it a unique name. Will be shown in module list, logs, etc.
|
||||
moduleName = "Sample Data Source Module"
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return "Sample Jython ingest module"
|
||||
|
||||
return self.moduleName
|
||||
|
||||
# TODO: Give it a description
|
||||
def getModuleDescription(self):
|
||||
return "Sample Jython Ingest Module without GUI example code"
|
||||
return "Sample module that does X, Y, and Z."
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
# Return true if module wants to get passed in a data source
|
||||
def isDataSourceIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isDataSourceIngestModuleFactory returns false
|
||||
def createDataSourceIngestModule(self, ingestOptions):
|
||||
# TODO: Change the class name to the name you'll make below
|
||||
return SampleJythonDataSourceIngestModule()
|
||||
|
||||
# Return true if module wants to get called for each file
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isFileIngestModuleFactory returns false
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleJythonFileIngestModule()
|
||||
|
||||
|
||||
# Data Source-level ingest module. One gets created per data source.
|
||||
# Queries for various files.
|
||||
# If you don't need a data source-level module, delete this class.
|
||||
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
|
||||
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
|
||||
# Where any setup and configuration is done
|
||||
# TODO: Add any setup code that you need here.
|
||||
def startUp(self, context):
|
||||
self.context = context
|
||||
|
||||
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
|
||||
# raise IngestModuleException(IngestModule(), "Oh No!")
|
||||
|
||||
# Where the analysis is done.
|
||||
# TODO: Add your analysis code in here.
|
||||
def process(self, dataSource, progressBar):
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
logger = Logger.getLogger(SampleJythonDataSourceIngestModuleFactory.moduleName)
|
||||
|
||||
# Configure progress bar for 2 tasks
|
||||
progressBar.switchToDeterminate(2)
|
||||
# we don't know how much work there is yet
|
||||
progressBar.switchToIndeterminate()
|
||||
|
||||
autopsyCase = Case.getCurrentCase()
|
||||
sleuthkitCase = autopsyCase.getSleuthkitCase()
|
||||
services = Services(sleuthkitCase)
|
||||
fileManager = services.getFileManager()
|
||||
|
||||
# Get count of files with "test" in name.
|
||||
fileCount = 0;
|
||||
# For our example, we will use FileManager to get all
|
||||
# files with the word "test"
|
||||
# in the name and then count and read them
|
||||
files = fileManager.findFiles(dataSource, "%test%")
|
||||
|
||||
numFiles = len(files)
|
||||
logger.info("found " + str(numFiles) + " files")
|
||||
progressBar.switchToDeterminate(numFiles)
|
||||
fileCount = 0;
|
||||
for file in files:
|
||||
|
||||
# Check if the user pressed cancel while we were busy
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
logger.info("Processing file: " + file.getName())
|
||||
fileCount += 1
|
||||
progressBar.progress(1)
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
|
||||
# artfiact. Refer to the developer docs for other examples.
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonDataSourceIngestModuleFactory.moduleName, "Test file")
|
||||
art.addAttribute(att)
|
||||
|
||||
# Get files by creation time.
|
||||
currentTime = System.currentTimeMillis() / 1000
|
||||
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
|
||||
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
|
||||
for otherFile in otherFiles:
|
||||
fileCount += 1
|
||||
progressBar.progress(1);
|
||||
|
||||
# To further the example, this code will read the contents of the file and count the number of bytes
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
readLen = inputStream.read(buffer)
|
||||
while (readLen != -1):
|
||||
totLen = totLen + readLen
|
||||
readLen = inputStream.read(buffer)
|
||||
|
||||
|
||||
# Update the progress bar
|
||||
progressBar.progress(fileCount)
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
#Post a message to the ingest messages in box.
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
|
||||
@ -123,38 +152,3 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
|
||||
IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
|
||||
# File-level ingest module. One gets created per thread.
|
||||
# Looks at the attributes of the passed in file.
|
||||
# if you don't need a file-level module, delete this class.
|
||||
class SampleJythonFileIngestModule(FileIngestModule):
|
||||
|
||||
def startUp(self, context):
|
||||
pass
|
||||
|
||||
def process(self, file):
|
||||
# If the file has a txt extension, post an artifact to the blackboard.
|
||||
if file.getName().find("test") != -1:
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), "Sample Jython File Ingest Module", "Text Files")
|
||||
art.addAttribute(att)
|
||||
|
||||
# Read the contents of the file.
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
len = inputStream.read(buffer)
|
||||
while (len != -1):
|
||||
totLen = totLen + len
|
||||
len = inputStream.read(buffer)
|
||||
|
||||
# Send the size of the file to the ingest messages in box.
|
||||
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule", msgText)
|
||||
ingestServices = IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
def shutDown(self):
|
||||
pass
|
||||
128
pythonExamples/fileIngestModule.py
Executable file
128
pythonExamples/fileIngestModule.py
Executable file
@ -0,0 +1,128 @@
|
||||
# Sample module in the public domain. Feel free to use this as a template
|
||||
# for your modules (and you can remove this header and take complete credit
|
||||
# and liability)
|
||||
#
|
||||
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
|
||||
#
|
||||
# This is free and unencumbered software released into the public domain.
|
||||
#
|
||||
# Anyone is free to copy, modify, publish, use, compile, sell, or
|
||||
# distribute this software, either in source code form or as a compiled
|
||||
# binary, for any purpose, commercial or non-commercial, and by any
|
||||
# means.
|
||||
#
|
||||
# In jurisdictions that recognize copyright laws, the author or authors
|
||||
# of this software dedicate any and all copyright interest in the
|
||||
# software to the public domain. We make this dedication for the benefit
|
||||
# of the public at large and to the detriment of our heirs and
|
||||
# successors. We intend this dedication to be an overt act of
|
||||
# relinquishment in perpetuity of all present and future rights to this
|
||||
# software under copyright law.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
|
||||
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
# Simple file-level ingest module for Autopsy.
|
||||
# Search for TODO for the things that you need to change
|
||||
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from org.sleuthkit.datamodel import SleuthkitCase
|
||||
from org.sleuthkit.datamodel import AbstractFile
|
||||
from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.casemodule.services import FileManager
|
||||
|
||||
# Factory that defines the name and details of the module and allows Autopsy
|
||||
# to create instances of the modules that will do the anlaysis.
|
||||
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
|
||||
class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
|
||||
# TODO: give it a unique name. Will be shown in module list, logs, etc.
|
||||
moduleName = "Sample file ingest Module"
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return self.moduleName
|
||||
|
||||
# TODO: Give it a description
|
||||
def getModuleDescription(self):
|
||||
return "Sample module that does X, Y, and Z."
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
# Return true if module wants to get called for each file
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isFileIngestModuleFactory returns false
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleJythonFileIngestModule()
|
||||
|
||||
|
||||
# File-level ingest module. One gets created per thread.
|
||||
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
|
||||
# Looks at the attributes of the passed in file.
|
||||
class SampleJythonFileIngestModule(FileIngestModule):
|
||||
|
||||
# Where any setup and configuration is done
|
||||
# TODO: Add any setup code that you need here.
|
||||
def startUp(self, context):
|
||||
self.logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName)
|
||||
self.filesFound = 0
|
||||
|
||||
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
|
||||
# raise IngestModuleException(IngestModule(), "Oh No!")
|
||||
pass
|
||||
|
||||
# Where the analysis is done. Each file will be passed into here.
|
||||
# TODO: Add your analysis code in here.
|
||||
def process(self, file):
|
||||
|
||||
# For an example, we will flag files with .txt in the name and make a blackboard artifact.
|
||||
if file.getName().find(".txt") != -1:
|
||||
|
||||
self.logger.info("Found a text file: " + file.getName())
|
||||
self.filesFound+=1
|
||||
|
||||
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
|
||||
# artfiact. Refer to the developer docs for other examples.
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonFileIngestModuleFactory.moduleName, "Text Files")
|
||||
art.addAttribute(att)
|
||||
|
||||
|
||||
# To further the example, this code will read the contents of the file and count the number of bytes
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
len = inputStream.read(buffer)
|
||||
while (len != -1):
|
||||
totLen = totLen + len
|
||||
len = inputStream.read(buffer)
|
||||
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Where any shutdown code is run and resources are freed.
|
||||
# TODO: Add any shutdown code that you need here.
|
||||
def shutDown(self):
|
||||
# As a final part of this example, we'll send a message to the ingest inbox with the number of files found (in this thread)
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName, str(self.filesFound) + " files found")
|
||||
ingestServices = IngestServices.getInstance().postMessage(message)
|
||||
203
pythonExamples/fileIngestModuleWithGui.py
Executable file
203
pythonExamples/fileIngestModuleWithGui.py
Executable file
@ -0,0 +1,203 @@
|
||||
# Sample module in the public domain. Feel free to use this as a template
|
||||
# for your modules (and you can remove this header and take complete credit
|
||||
# and liability)
|
||||
#
|
||||
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
|
||||
#
|
||||
# This is free and unencumbered software released into the public domain.
|
||||
#
|
||||
# Anyone is free to copy, modify, publish, use, compile, sell, or
|
||||
# distribute this software, either in source code form or as a compiled
|
||||
# binary, for any purpose, commercial or non-commercial, and by any
|
||||
# means.
|
||||
#
|
||||
# In jurisdictions that recognize copyright laws, the author or authors
|
||||
# of this software dedicate any and all copyright interest in the
|
||||
# software to the public domain. We make this dedication for the benefit
|
||||
# of the public at large and to the detriment of our heirs and
|
||||
# successors. We intend this dedication to be an overt act of
|
||||
# relinquishment in perpetuity of all present and future rights to this
|
||||
# software under copyright law.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
|
||||
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
|
||||
# Ingest module for Autopsy with GUI
|
||||
#
|
||||
# Difference between other modules in this folder is that it has a GUI
|
||||
# for user options. This is not needed for very basic modules. If you
|
||||
# don't need a configuration UI, start with the other sample module.
|
||||
#
|
||||
# Search for TODO for the things that you need to change
|
||||
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
|
||||
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from javax.swing import JCheckBox
|
||||
from javax.swing import BoxLayout
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from java.lang import IllegalArgumentException
|
||||
|
||||
# TODO: Rename this to something more specific
|
||||
class SampleFileIngestModuleWithUIFactory(IngestModuleFactoryAdapter):
|
||||
def __init__(self):
|
||||
self.settings = None
|
||||
|
||||
# TODO: give it a unique name. Will be shown in module list, logs, etc.
|
||||
moduleName = "Sample Data Source Module with UI"
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return self.moduleName
|
||||
|
||||
# TODO: Give it a description
|
||||
def getModuleDescription(self):
|
||||
return "Sample module that does X, Y, and Z."
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
# TODO: Update class name to one that you create below
|
||||
def getDefaultIngestJobSettings(self):
|
||||
return SampleFileIngestModuleWithUISettings()
|
||||
|
||||
# TODO: Keep enabled only if you need ingest job-specific settings UI
|
||||
def hasIngestJobSettingsPanel(self):
|
||||
return True
|
||||
|
||||
# TODO: Update class names to ones that you create below
|
||||
def getIngestJobSettingsPanel(self, settings):
|
||||
if not isinstance(settings, SampleFileIngestModuleWithUISettings):
|
||||
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
|
||||
self.settings = settings
|
||||
return SampleFileIngestModuleWithUISettingsPanel(self.settings)
|
||||
|
||||
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
|
||||
# TODO: Update class name to one that you create below
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleFileIngestModuleWithUI(self.settings)
|
||||
|
||||
|
||||
# File-level ingest module. One gets created per thread.
|
||||
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
|
||||
# Looks at the attributes of the passed in file.
|
||||
class SampleFileIngestModuleWithUI(FileIngestModule):
|
||||
|
||||
# Autopsy will pass in the settings from the UI panel
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
|
||||
|
||||
# Where any setup and configuration is done
|
||||
# TODO: Add any setup code that you need here.
|
||||
def startUp(self, context):
|
||||
self.logger = Logger.getLogger(SampleFileIngestModuleWithUIFactory.moduleName)
|
||||
|
||||
# As an example, determine if user configured a flag in UI
|
||||
if self.local_settings.getFlag():
|
||||
self.logger.info("flag is set")
|
||||
else:
|
||||
self.logger.info("flag is not set")
|
||||
|
||||
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
|
||||
# raise IngestModuleException(IngestModule(), "Oh No!")
|
||||
pass
|
||||
|
||||
# Where the analysis is done. Each file will be passed into here.
|
||||
# TODO: Add your analysis code in here.
|
||||
def process(self, file):
|
||||
# See code in pythonExamples/fileIngestModule.py for example code
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Where any shutdown code is run and resources are freed.
|
||||
# TODO: Add any shutdown code that you need here.
|
||||
def shutDown(self):
|
||||
pass
|
||||
|
||||
# Stores the settings that can be changed for each ingest job
|
||||
# All fields in here must be serializable. It will be written to disk.
|
||||
# TODO: Rename this class
|
||||
class SampleFileIngestModuleWithUISettings(IngestModuleIngestJobSettings):
|
||||
serialVersionUID = 1L
|
||||
|
||||
def __init__(self):
|
||||
self.flag = False
|
||||
|
||||
def getVersionNumber(self):
|
||||
return serialVersionUID
|
||||
|
||||
# TODO: Define getters and settings for data you want to store from UI
|
||||
def getFlag(self):
|
||||
return self.flag
|
||||
|
||||
def setFlag(self, flag):
|
||||
self.flag = flag
|
||||
|
||||
|
||||
# UI that is shown to user for each ingest job so they can configure the job.
|
||||
# TODO: Rename this
|
||||
class SampleFileIngestModuleWithUISettingsPanel(IngestModuleIngestJobSettingsPanel):
|
||||
# Note, we can't use a self.settings instance variable.
|
||||
# Rather, self.local_settings is used.
|
||||
# https://wiki.python.org/jython/UserGuide#javabean-properties
|
||||
# Jython Introspector generates a property - 'settings' on the basis
|
||||
# of getSettings() defined in this class. Since only getter function
|
||||
# is present, it creates a read-only 'settings' property. This auto-
|
||||
# generated read-only property overshadows the instance-variable -
|
||||
# 'settings'
|
||||
|
||||
# We get passed in a previous version of the settings so that we can
|
||||
# prepopulate the UI
|
||||
# TODO: Update this for your UI
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
self.initComponents()
|
||||
self.customizeComponents()
|
||||
|
||||
# TODO: Update this for your UI
|
||||
def checkBoxEvent(self, event):
|
||||
if self.checkbox.isSelected():
|
||||
self.local_settings.setFlag(True)
|
||||
else:
|
||||
self.local_settings.setFlag(False)
|
||||
|
||||
# TODO: Update this for your UI
|
||||
def initComponents(self):
|
||||
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
|
||||
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
|
||||
self.add(self.checkbox)
|
||||
|
||||
# TODO: Update this for your UI
|
||||
def customizeComponents(self):
|
||||
self.checkbox.setSelected(self.local_settings.getFlag())
|
||||
|
||||
# Return the settings used
|
||||
def getSettings(self):
|
||||
return self.local_settings
|
||||
|
||||
|
||||
@ -1,266 +0,0 @@
|
||||
# Sample module in the public domain. Feel free to use this as a template
|
||||
# for your modules (and you can remove this header and take complete credit
|
||||
# and liability)
|
||||
#
|
||||
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
|
||||
#
|
||||
# This is free and unencumbered software released into the public domain.
|
||||
#
|
||||
# Anyone is free to copy, modify, publish, use, compile, sell, or
|
||||
# distribute this software, either in source code form or as a compiled
|
||||
# binary, for any purpose, commercial or non-commercial, and by any
|
||||
# means.
|
||||
#
|
||||
# In jurisdictions that recognize copyright laws, the author or authors
|
||||
# of this software dedicate any and all copyright interest in the
|
||||
# software to the public domain. We make this dedication for the benefit
|
||||
# of the public at large and to the detriment of our heirs and
|
||||
# successors. We intend this dedication to be an overt act of
|
||||
# relinquishment in perpetuity of all present and future rights to this
|
||||
# software under copyright law.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
|
||||
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from javax.swing import JCheckBox
|
||||
from javax.swing import BoxLayout
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from java.lang import IllegalArgumentException
|
||||
|
||||
# Sample factory that defines basic functionality and features of the module
|
||||
# It implements IngestModuleFactoryAdapter which is a no-op implementation of
|
||||
# IngestModuleFactory.
|
||||
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
def __init__(self):
|
||||
self.settings = None
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return "Sample Jython(GUI) ingest module"
|
||||
|
||||
def getModuleDescription(self):
|
||||
return "Sample Jython Ingest Module with GUI example code"
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
def getDefaultIngestJobSettings(self):
|
||||
return SampleIngestModuleSettings()
|
||||
|
||||
def hasIngestJobSettingsPanel(self):
|
||||
return True
|
||||
|
||||
def getIngestJobSettingsPanel(self, settings):
|
||||
if not isinstance(settings, SampleIngestModuleSettings):
|
||||
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
|
||||
self.settings = settings
|
||||
return SampleIngestModuleSettingsPanel(self.settings)
|
||||
|
||||
# Return true if module wants to get passed in a data source
|
||||
def isDataSourceIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isDataSourceIngestModuleFactory returns false
|
||||
def createDataSourceIngestModule(self, ingestOptions):
|
||||
return SampleJythonDataSourceIngestModule(self.settings)
|
||||
|
||||
# Return true if module wants to get called for each file
|
||||
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isFileIngestModuleFactory returns false
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleJythonFileIngestModule(self.settings)
|
||||
|
||||
def hasGlobalSettingsPanel(self):
|
||||
return True
|
||||
|
||||
def getGlobalSettingsPanel(self):
|
||||
globalSettingsPanel = SampleIngestModuleGlobalSettingsPanel();
|
||||
return globalSettingsPanel
|
||||
|
||||
|
||||
class SampleIngestModuleGlobalSettingsPanel(IngestModuleGlobalSettingsPanel):
|
||||
def __init__(self):
|
||||
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
|
||||
checkbox = JCheckBox("Flag inside the Global Settings Panel")
|
||||
self.add(checkbox)
|
||||
|
||||
|
||||
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
|
||||
'''
|
||||
Data Source-level ingest module. One gets created per data source.
|
||||
Queries for various files. If you don't need a data source-level module,
|
||||
delete this class.
|
||||
'''
|
||||
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
self.context = None
|
||||
|
||||
def startUp(self, context):
|
||||
# Used to verify if the GUI checkbox event been recorded or not.
|
||||
logger = Logger.getLogger("SampleJythonFileIngestModule")
|
||||
if self.local_settings.getFlag():
|
||||
logger.info("flag is set")
|
||||
else:
|
||||
logger.info("flag is not set")
|
||||
|
||||
self.context = context
|
||||
|
||||
def process(self, dataSource, progressBar):
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Configure progress bar for 2 tasks
|
||||
progressBar.switchToDeterminate(2)
|
||||
|
||||
autopsyCase = Case.getCurrentCase()
|
||||
sleuthkitCase = autopsyCase.getSleuthkitCase()
|
||||
services = Services(sleuthkitCase)
|
||||
fileManager = services.getFileManager()
|
||||
|
||||
# Get count of files with "test" in name.
|
||||
fileCount = 0;
|
||||
files = fileManager.findFiles(dataSource, "%test%")
|
||||
for file in files:
|
||||
fileCount += 1
|
||||
progressBar.progress(1)
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Get files by creation time.
|
||||
currentTime = System.currentTimeMillis() / 1000
|
||||
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
|
||||
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
|
||||
for otherFile in otherFiles:
|
||||
fileCount += 1
|
||||
progressBar.progress(1);
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
# Post a message to the ingest messages in box.
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
|
||||
"Sample Jython Data Source Ingest Module", "Found %d files" % fileCount)
|
||||
IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
|
||||
class SampleJythonFileIngestModule(FileIngestModule):
|
||||
'''
|
||||
File-level ingest module. One gets created per thread. Looks at the
|
||||
attributes of the passed in file. if you don't need a file-level module,
|
||||
delete this class.
|
||||
'''
|
||||
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
|
||||
def startUp(self, context):
|
||||
# Used to verify if the GUI checkbox event been recorded or not.
|
||||
logger = Logger.getLogger("SampleJythonFileIngestModule")
|
||||
if self.local_settings.getFlag():
|
||||
logger.info("flag is set")
|
||||
else:
|
||||
logger.info("flag is not set")
|
||||
pass
|
||||
|
||||
def process(self, file):
|
||||
# If the file has a txt extension, post an artifact to the blackboard.
|
||||
if file.getName().find("test") != -1:
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(),
|
||||
"Sample Jython File Ingest Module", "Text Files")
|
||||
art.addAttribute(att)
|
||||
|
||||
# Read the contents of the file.
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
len = inputStream.read(buffer)
|
||||
while (len != -1):
|
||||
totLen = totLen + len
|
||||
len = inputStream.read(buffer)
|
||||
|
||||
# Send the size of the file to the ingest messages in box.
|
||||
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule",
|
||||
msgText)
|
||||
ingestServices = IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
def shutDown(self):
|
||||
pass
|
||||
|
||||
|
||||
class SampleIngestModuleSettings(IngestModuleIngestJobSettings):
|
||||
serialVersionUID = 1L
|
||||
|
||||
def __init__(self):
|
||||
self.flag = False
|
||||
|
||||
def getVersionNumber(self):
|
||||
return serialVersionUID
|
||||
|
||||
def getFlag(self):
|
||||
return self.flag
|
||||
|
||||
def setFlag(self, flag):
|
||||
self.flag = flag
|
||||
|
||||
|
||||
class SampleIngestModuleSettingsPanel(IngestModuleIngestJobSettingsPanel):
|
||||
# self.settings instance variable not used. Rather, self.local_settings is used.
|
||||
# https://wiki.python.org/jython/UserGuide#javabean-properties
|
||||
# Jython Introspector generates a property - 'settings' on the basis
|
||||
# of getSettings() defined in this class. Since only getter function
|
||||
# is present, it creates a read-only 'settings' property. This auto-
|
||||
# generated read-only property overshadows the instance-variable -
|
||||
# 'settings'
|
||||
|
||||
def checkBoxEvent(self, event):
|
||||
if self.checkbox.isSelected():
|
||||
self.local_settings.setFlag(True)
|
||||
else:
|
||||
self.local_settings.setFlag(False)
|
||||
|
||||
def initComponents(self):
|
||||
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
|
||||
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
|
||||
self.add(self.checkbox)
|
||||
|
||||
def customizeComponents(self):
|
||||
self.checkbox.setSelected(self.local_settings.getFlag())
|
||||
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
self.initComponents()
|
||||
self.customizeComponents()
|
||||
|
||||
def getSettings(self):
|
||||
return self.local_settings
|
||||
Loading…
x
Reference in New Issue
Block a user