From 6fda0ca726f36e0af291135d17130096d80972ca Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 14 Jan 2021 09:02:49 -0500 Subject: [PATCH 1/2] moduleName for aleapp or ileapp --- .../ALeappAnalyzerIngestModule.java | 2 +- .../ILeappAnalyzerIngestModule.java | 2 +- .../leappanalyzers/LeappFileProcessor.java | 24 +++++++++---------- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java index 705468ae15..3e28b3c5ed 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java @@ -97,7 +97,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule { } try { - aLeappFileProcessor = new LeappFileProcessor(XMLFILE); + aLeappFileProcessor = new LeappFileProcessor(XMLFILE, ALeappAnalyzerModuleFactory.getModuleName()); } catch (IOException | IngestModuleException | NoCurrentCaseException ex) { throw new IngestModuleException(Bundle.ALeappAnalyzerIngestModule_error_ileapp_file_processor_init(), ex); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ILeappAnalyzerIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ILeappAnalyzerIngestModule.java index 19cf344942..d334702a64 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ILeappAnalyzerIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ILeappAnalyzerIngestModule.java @@ -97,7 +97,7 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule { } try { - iLeappFileProcessor = new LeappFileProcessor(XMLFILE); + iLeappFileProcessor = new LeappFileProcessor(XMLFILE, ILeappAnalyzerModuleFactory.getModuleName()); } catch (IOException | IngestModuleException | NoCurrentCaseException ex) { throw new IngestModuleException(Bundle.ILeappAnalyzerIngestModule_error_ileapp_file_processor_init(), ex); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java index 3811f21a90..2aab2f3a6b 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java @@ -118,9 +118,8 @@ public final class LeappFileProcessor { } private static final Logger logger = Logger.getLogger(LeappFileProcessor.class.getName()); - private static final String MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName(); - private final String xmlFile; //NON-NLS + private final String moduleName; private final Map tsvFiles; private final Map tsvFileArtifacts; @@ -129,12 +128,13 @@ public final class LeappFileProcessor { Blackboard blkBoard; - public LeappFileProcessor(String xmlFile) throws IOException, IngestModuleException, NoCurrentCaseException { + public LeappFileProcessor(String xmlFile, String moduleName) throws IOException, IngestModuleException, NoCurrentCaseException { this.tsvFiles = new HashMap<>(); this.tsvFileArtifacts = new HashMap<>(); this.tsvFileArtifactComments = new HashMap<>(); this.tsvFileAttributes = new HashMap<>(); this.xmlFile = xmlFile; + this.moduleName = moduleName; blkBoard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard(); @@ -364,7 +364,7 @@ public final class LeappFileProcessor { } if (tsvFileArtifactComments.containsKey(fileName)) { - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, MODULE_NAME, tsvFileArtifactComments.get(fileName))); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, moduleName, tsvFileArtifactComments.get(fileName))); } return bbattributes; @@ -384,28 +384,28 @@ public final class LeappFileProcessor { String columnValue = columnValues[columnNumber]; if (attrType.matches("STRING")) { - bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, columnValue)); + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, columnValue)); } else if (attrType.matches("INTEGER")) { try { - bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Integer.valueOf(columnValue))); + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Integer.valueOf(columnValue))); } catch (NumberFormatException ex) { logger.log(Level.WARNING, String.format("Unable to format %s as an integer.", columnValue), ex); } } else if (attrType.matches("LONG")) { try { - bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Long.valueOf(columnValue))); + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Long.valueOf(columnValue))); } catch (NumberFormatException ex) { logger.log(Level.WARNING, String.format("Unable to format %s as an long.", columnValue), ex); } } else if (attrType.matches("DOUBLE")) { try { - bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Double.valueOf(columnValue))); + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Double.valueOf(columnValue))); } catch (NumberFormatException ex) { logger.log(Level.WARNING, String.format("Unable to format %s as an double.", columnValue), ex); } } else if (attrType.matches("BYTE")) { try { - bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Byte.valueOf(columnValue))); + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Byte.valueOf(columnValue))); } catch (NumberFormatException ex) { logger.log(Level.WARNING, String.format("Unable to format %s as an byte.", columnValue), ex); } @@ -416,7 +416,7 @@ public final class LeappFileProcessor { try { Date newDate = dateFormat.parse(columnValue); dateLong = newDate.getTime() / 1000; - bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, dateLong)); + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, dateLong)); } catch (ParseException ex) { // catching error and displaying date that could not be parsed // we set the timestamp to 0 and continue on processing @@ -424,7 +424,7 @@ public final class LeappFileProcessor { } } else if (attrType.matches("JSON")) { - bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, columnValue)); + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, columnValue)); } else { // Log this and continue on with processing logger.log(Level.WARNING, String.format("Attribute Type %s not defined.", attrType)); //NON-NLS @@ -678,7 +678,7 @@ public final class LeappFileProcessor { } try { - Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifacts(artifacts, MODULE_NAME); + Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifacts(artifacts, moduleName); } catch (Blackboard.BlackboardException ex) { logger.log(Level.SEVERE, Bundle.LeappFileProcessor_postartifacts_error(), ex); //NON-NLS } From 8a6d62083a5bf74e62ed6ecdfdc97568e01ba3d5 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 14 Jan 2021 09:15:22 -0500 Subject: [PATCH 2/2] handle decimals for integer and long value types --- .../autopsy/modules/leappanalyzers/LeappFileProcessor.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java index 2aab2f3a6b..df85f35ef3 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java @@ -387,13 +387,15 @@ public final class LeappFileProcessor { bbattributes.add(new BlackboardAttribute(attributeType, moduleName, columnValue)); } else if (attrType.matches("INTEGER")) { try { - bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Integer.valueOf(columnValue))); + // parse as double to handle values of format like '21.0' and then convert to int + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Double.valueOf(columnValue).intValue())); } catch (NumberFormatException ex) { logger.log(Level.WARNING, String.format("Unable to format %s as an integer.", columnValue), ex); } } else if (attrType.matches("LONG")) { try { - bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Long.valueOf(columnValue))); + // parse as double to handle values of format like '21.0' and then convert to long + bbattributes.add(new BlackboardAttribute(attributeType, moduleName, Double.valueOf(columnValue).longValue())); } catch (NumberFormatException ex) { logger.log(Level.WARNING, String.format("Unable to format %s as an long.", columnValue), ex); }