diff --git a/Core/src/org/sleuthkit/autopsy/texttranslation/translators/GoogleTranslator.java b/Core/src/org/sleuthkit/autopsy/texttranslation/translators/GoogleTranslator.java index 38506ef936..318191e713 100644 --- a/Core/src/org/sleuthkit/autopsy/texttranslation/translators/GoogleTranslator.java +++ b/Core/src/org/sleuthkit/autopsy/texttranslation/translators/GoogleTranslator.java @@ -28,6 +28,8 @@ import java.io.FileInputStream; import java.io.FileNotFoundException; import java.io.IOException; import java.io.InputStream; +import java.net.InetAddress; +import java.net.UnknownHostException; import java.util.logging.Level; import java.util.logging.Logger; import org.openide.util.NbBundle.Messages; @@ -56,9 +58,26 @@ public final class GoogleTranslator implements TextTranslator { settingsPanel = new GoogleTranslatorSettingsPanel(settings.getCredentialPath(), settings.getTargetLanguageCode()); loadTranslator(); } - + + private static boolean googleIsReachable() { + String host = "www.google.com"; + InetAddress address; + try { + address = InetAddress.getByName(host); + return address.isReachable(1500); + }catch (UnknownHostException ex) { + return false; + } catch (IOException ex) { + return false; + } + } + @Override public String translate(String string) throws TranslationException { + if (!googleIsReachable()) { + throw new TranslationException("Failure translating using GoogleTranslator: Cannot connect to Google"); + } + if (googleTranslate != null) { try { // Translates some text into English, without specifying the source language. @@ -66,10 +85,10 @@ public final class GoogleTranslator implements TextTranslator { // HTML files were producing lots of white space at the end String substring = string.trim(); - // WE can't currently set parameters, so we are using the default behavior of - // asuming the input is HTML. We need to replace newlines with
for Google to preserve them + // We can't currently set parameters, so we are using the default behavior of + // assuming the input is HTML. We need to replace newlines with
for Google to preserve them substring = substring.replaceAll("(\r\n|\n)", "
"); - + // The API complains if the "Payload" is over 204800 bytes. I'm assuming that // deals with the full request. At some point, we get different errors about too // much text. Officially, Google says they will googleTranslate only 5k chars, @@ -81,7 +100,7 @@ public final class GoogleTranslator implements TextTranslator { Translation translation = googleTranslate.translate(substring); String translatedString = translation.getTranslatedText(); - + // put back the newlines translatedString = translatedString.replaceAll("
", "\n"); return translatedString; @@ -93,7 +112,7 @@ public final class GoogleTranslator implements TextTranslator { throw new TranslationException("Google Translator has not been configured, credentials need to be specified"); } } - + @Messages({"GoogleTranslator.name.text=Google Translate"}) @Override public String getName() { diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java index 52295254c8..0e88900aee 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java @@ -698,7 +698,7 @@ public final class ImageGalleryController { //grab files with supported mime-types + MIMETYPE_CLAUSE //NON-NLS //grab files with image or video mime-types even if we don't officially support them - + " OR mime_type LIKE 'video/%' OR mime_type LIKE 'image/%' )" //NON-NLS + + " OR mime_type LIKE 'video/%' OR mime_type LIKE 'image/%' )" //NON-NLS + " ORDER BY parent_path "; } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java index 1c68d6c49d..a320590822 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2013-2018 Basis Technology Corp. + * Copyright 2013-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/docs/doxygen-user/images/InterestingFiles/bomb_png.png b/docs/doxygen-user/images/InterestingFiles/bomb_png.png new file mode 100644 index 0000000000..016ff5dea5 Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/bomb_png.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/download_archive.png b/docs/doxygen-user/images/InterestingFiles/download_archive.png new file mode 100644 index 0000000000..aa457e929c Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/download_archive.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/ingest.png b/docs/doxygen-user/images/InterestingFiles/ingest.png new file mode 100644 index 0000000000..aadf558768 Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/ingest.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/main.png b/docs/doxygen-user/images/InterestingFiles/main.png new file mode 100644 index 0000000000..67a27cdb7e Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/main.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/new_large_files.png b/docs/doxygen-user/images/InterestingFiles/new_large_files.png new file mode 100644 index 0000000000..a159f5af1f Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/new_large_files.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/new_rule.png b/docs/doxygen-user/images/InterestingFiles/new_rule.png new file mode 100644 index 0000000000..3385a402c0 Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/new_rule.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/new_rule_set.png b/docs/doxygen-user/images/InterestingFiles/new_rule_set.png new file mode 100644 index 0000000000..eb857b4734 Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/new_rule_set.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/private_folder.png b/docs/doxygen-user/images/InterestingFiles/private_folder.png new file mode 100644 index 0000000000..706bbeca57 Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/private_folder.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/results.png b/docs/doxygen-user/images/InterestingFiles/results.png new file mode 100644 index 0000000000..9ce29ceaea Binary files /dev/null and b/docs/doxygen-user/images/InterestingFiles/results.png differ diff --git a/docs/doxygen-user/images/interesting_files_configuration.PNG b/docs/doxygen-user/images/interesting_files_configuration.PNG deleted file mode 100644 index 2c37a4f27b..0000000000 Binary files a/docs/doxygen-user/images/interesting_files_configuration.PNG and /dev/null differ diff --git a/docs/doxygen-user/images/interesting_files_ingest_settings.PNG b/docs/doxygen-user/images/interesting_files_ingest_settings.PNG deleted file mode 100644 index 854a495862..0000000000 Binary files a/docs/doxygen-user/images/interesting_files_ingest_settings.PNG and /dev/null differ diff --git a/docs/doxygen-user/images/interesting_files_results.PNG b/docs/doxygen-user/images/interesting_files_results.PNG deleted file mode 100644 index 26dd994cd9..0000000000 Binary files a/docs/doxygen-user/images/interesting_files_results.PNG and /dev/null differ diff --git a/docs/doxygen-user/interesting_files.dox b/docs/doxygen-user/interesting_files.dox index 67041193ba..080b1072af 100644 --- a/docs/doxygen-user/interesting_files.dox +++ b/docs/doxygen-user/interesting_files.dox @@ -1,81 +1,114 @@ /*! \page interesting_files_identifier_page Interesting Files Identifier Module -What Does It Do -======== +\section interesting_files_overview Overview -The Interesting Files module allows you to search for files or directories in a data source and generate alerts when they are found. You configure rules for the files that you want to find. +The Interesting Files module allows you to automatically flag files and directories that match a set of rules. This can be useful if you always need to check whether files with a given name or path are in the data source, or if you are always interested in files with a certain type. -Use this to be notified when certain things are found. There are examples below that generate alerts when VMWare images are found or when iPhone backup files are found. This module is useful for file types that will frequently have a consistent name and that may not be part of the standard checklist that you look for, or if you simply want to automate your checklist. +This module allows you to make sets of rules that will be run against each file as it is processed. If a file matches any of the rules, you will see an entry for it in the \ref tree_viewer_page. You can share your rules with other users, and import sets made by others into your copy of Autopsy. -Configuration -======= +\section interesting_files_terminology Terminology -Add rules using "Tools", "Options", "Interesting Files". + -All rules need to be part of a set. Select "New set" on the left side panel to create a new set. Sets need to have the following defined: +\section interesting_files_config Configuration -- Set Name (required) -- Set Description (optional) +To create and edit your rule sets, go to "Tools", "Options" and then select the "Interesting Files" tab. The area on the left side will show you a list of all the rule sets that are currently available. Selecting a rule set will display its description and information about each of its rules on the right side of the panel. -Sets can be renamed, edited, copied, and imported and exported from the left side panel. +\image html InterestingFiles/main.png -Rules specify what to look for in a data source. Each rule specifies: -- Type: If the rule should be applied to only files, only directories, or both files and directories. -- Name Pattern: String to match the file name against. Note that you can enter multiple extensions in a comma-separated list. -- Name Pattern Type: Should the pattern be matched against the full file type or just the extension. -- Path Pattern: A substring of the parent path that must be matched. This allows you to restrict generic names to a specific structure (such as an application name). A substring match is performed. -- Rule Name: Additional details that are displayed in the UI when that rule is matched. This allows you to determine which rule in the set matched. +The buttons on the bottom of the left side of the panel control the rule sets. -\image html interesting_files_configuration.PNG + +Selecting a rule set will display its description, whether it ignores known files, and the rules contained in the set. Selecting a rule will display the conditions for that rule in the "Rule Details" section. -VMWare Example --------- -This set of rules is to detect VMWare Player or vmdk files. This would help to make sure you look into the virtual machines for additional evidence. +The buttons under the list of rules allow you to create new rules and edit or delete existing rules. Selecting "New Rule" will bring up a new window to create the rule. -NOTE: This is not extensive and is simply a minimal example: +\image html InterestingFiles/new_rule.png +The top line allows you to choose whether you want to match only files, only directories, or both. If you select directories or both, some of the condition types will be unavailable since they only apply to files. -- Set Name: VMWare -- Rule 1: - - Type: Files - - Full Name: vmplayer.exe - - Name: Program EXE -- Rule 2: - - Type: Files - - Extension: vmdk - - Name: VMDK File +Each rule must have at least one condition. To create conditions, check the box to the left of the condition you want to enable. The following is a description of each condition, with some full examples after. -iPhone Backups Example -------------- -This set of rules is to detect a folder for iPhone Backups. These are typically in a folder such as "%AppData%\Roaming\Apple Computer\MobileSync\Backup" on Windows. Here is a rule that you could use for that. + +Finally you can optionally enter a name for the rule. This will be displayed in the UI for each match. -Ingest Settings ------- +\subsection interesting_files_examples Examples +Here are a few examples of rules being created. -When running the ingest modules, the user can choose which interesting file rules to enable . -
-\image html interesting_files_ingest_settings.PNG +This is a rule that matches any file with "bomb" in the name that also has an "image/png" MIME type. -Seeing Results ------- -The results show up in the tree under "Results", "Interesting Items". +\image html InterestingFiles/bomb_png.png -\image html interesting_files_results.PNG +This is a rule that matches folders named "Private". + +\image html InterestingFiles/private_folder.png + +This rule is looking for archives in the user download directory. It requires "Users" and "Downloads" in the file's path, and an extension of .zip, .rar, or .7z. + +\image html InterestingFiles/download_archive.png + +This is a rule that matches files with size at least 50MB that have been modified in the last week. + +\image html InterestingFiles/new_large_files.png + +\section interesting_files_running Running the Module + +At runtime, you can select which rule sets you would like to run on your data source. + +\image html InterestingFiles/ingest.png + +\section interesting_files_results Viewing Results + +Files that match any of the rules in the enabled rule sets will be shown in the Results section of the \ref tree_viewer_page under "Interesting Items" and then the name of the rule set that matched. Note that other modules besides Interesting Files put results in this section of the tree, so there may be more than just what matched your rule sets. Selecting the "Interesting Files" node under one of your rule sets will display all matching files in the \ref result_viewer_page. + +\image html InterestingFiles/results.png + +You can see which rule matched in the "Category" column. You can export some or all of the files for further analysis. To do this, first use the standard Windows file +selection methods to highlight the files you want to export in the \ref result_viewer_page : + +Once you have your desired files selected, right click and select “Extract Files” to save copies of them. */