diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index a4a009e7ba..e9fddf5d61 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -64,7 +64,6 @@ public class ExtractRegistry extends Extract { private int sysid; private IngestServices services; final public static String MODULE_VERSION = "1.0"; - private ExecUtil execRR; //hide public constructor to prevent from instantiation by ingest module loader @@ -92,8 +91,7 @@ public class ExtractRegistry extends Extract { if (PlatformUtil.isWindowsOS()) { RR_PATH = rrHome + File.separator + "rip.exe"; - } - else { + } else { RR_PATH = "perl " + rrHome + File.separator + "rip.pl"; } } @@ -103,9 +101,8 @@ public class ExtractRegistry extends Extract { return MODULE_VERSION; } - private void getRegistryFiles(Image image, IngestImageWorkerController controller) { - + org.sleuthkit.autopsy.casemodule.services.FileManager fileManager = currentCase.getServices().getFileManager(); List allRegistryFiles = new ArrayList(); try { @@ -113,10 +110,10 @@ public class ExtractRegistry extends Extract { } catch (TskCoreException ex) { logger.log(Level.WARNING, "Error fetching 'ntuser.dat' file."); } - + // try to find each of the listed registry files whose parent directory // is like '%/system32/config%' - String[] regFileNames = new String[] {"system", "software", "security", "sam", "default"}; + String[] regFileNames = new String[]{"system", "software", "security", "sam", "default"}; for (String regFileName : regFileNames) { try { allRegistryFiles.addAll(fileManager.findFiles(image, regFileName, "%/system32/config%")); @@ -124,7 +121,7 @@ public class ExtractRegistry extends Extract { logger.log(Level.WARNING, "Error fetching registry file: " + regFileName); } } - + ExtractUSB extrctr = new ExtractUSB(); int j = 0; for (FsContent regFile : allRegistryFiles) { String regFileName = regFile.getName(); @@ -136,14 +133,13 @@ public class ExtractRegistry extends Extract { } File aRegFile = new File(temps); logger.log(Level.INFO, moduleName + "- Now getting registry information from " + temps); - ExtractUSB extrctr = new ExtractUSB(); String txtPath = executeRegRip(temps, j++); if (txtPath.length() > 0) { - if (parseReg(txtPath, regFile.getId(),extrctr) == false) { + if (parseReg(txtPath, regFile.getId(), extrctr) == false) { continue; } } - + //At this point pasco2 proccessed the index files. //Now fetch the results, parse them and the delete the files. aRegFile.delete(); @@ -160,26 +156,20 @@ public class ExtractRegistry extends Extract { try { if (regFilePath.toLowerCase().contains("system")) { type = "autopsysystem"; - } - else if (regFilePath.toLowerCase().contains("software")) { + } else if (regFilePath.toLowerCase().contains("software")) { type = "autopsysoftware"; - } - else if (regFilePath.toLowerCase().contains("ntuser")) { + } else if (regFilePath.toLowerCase().contains("ntuser")) { type = "autopsy"; - } - else if (regFilePath.toLowerCase().contains("default")) { + } else if (regFilePath.toLowerCase().contains("default")) { type = "1default"; - } - else if (regFilePath.toLowerCase().contains("sam")) { + } else if (regFilePath.toLowerCase().contains("sam")) { type = "1sam"; - } - else if (regFilePath.toLowerCase().contains("security")) { + } else if (regFilePath.toLowerCase().contains("security")) { type = "1security"; - } - else { + } else { type = "1default"; } - + logger.log(Level.INFO, "Writing RegRipper results to: " + txtPath); writer = new FileWriter(txtPath); execRR = new ExecUtil(); @@ -190,8 +180,7 @@ public class ExtractRegistry extends Extract { logger.log(Level.SEVERE, "Unable to RegRipper and process parse some registry files.", ex); } catch (InterruptedException ex) { logger.log(Level.SEVERE, "RegRipper has been interrupted, failed to parse registry.", ex); - } - finally { + } finally { if (writer != null) { try { writer.close(); @@ -200,7 +189,7 @@ public class ExtractRegistry extends Extract { } } } - + return txtPath; } @@ -229,13 +218,13 @@ public class ExtractRegistry extends Extract { Element oroot = doc.getDocumentElement(); NodeList children = oroot.getChildNodes(); int len = children.getLength(); - for(int i=0; i 0) { + if (timenodes.getLength() > 0) { Element timenode = (Element) timenodes.item(0); String etime = timenode.getTextContent(); try { @@ -249,7 +238,7 @@ public class ExtractRegistry extends Extract { } NodeList artroots = tempnode.getElementsByTagName("artifacts"); - if(artroots.getLength() == 0) { + if (artroots.getLength() == 0) { // If there isn't an artifact node, skip this entry continue; } @@ -257,10 +246,10 @@ public class ExtractRegistry extends Extract { NodeList myartlist = artroot.getChildNodes(); String winver = ""; String installdate = ""; - for(int j=0; jpipelineContext, Image image, IngestImageWorkerController controller) { + public void process(PipelineContext pipelineContext, Image image, IngestImageWorkerController controller) { this.getRegistryFiles(image, controller); } @@ -421,7 +412,7 @@ public class ExtractRegistry extends Extract { execRR.stop(); execRR = null; } - + } @Override @@ -434,7 +425,6 @@ public class ExtractRegistry extends Extract { return "Extracts activity from the Windows registry utilizing RegRipper."; } - @Override public boolean hasBackgroundJobsRunning() { return false; diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractUSB.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractUSB.java index f9363cec19..0c78eec299 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractUSB.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractUSB.java @@ -22,12 +22,15 @@ */ package org.sleuthkit.autopsy.recentactivity; +import java.io.File; import java.io.FileInputStream; import java.io.FileNotFoundException; +import java.io.IOException; import java.util.HashMap; import java.util.Scanner; import java.util.logging.Level; import java.util.logging.Logger; +import org.sleuthkit.autopsy.coreutils.PlatformUtil; public class ExtractUSB { private HashMap devices; @@ -41,11 +44,11 @@ public class ExtractUSB { } else { pID = mID + dtokens[3]; } - //if (!devices.containsKey(pID)) { - // return new String[]{"No such Device", null}; - //} else { - return devices.get(pID); - //} + if (!devices.containsKey(pID)) { + return new USB_Info("No such Device", null); + } else { + return devices.get(pID); + } } public ExtractUSB() { @@ -54,12 +57,15 @@ public class ExtractUSB { } catch (FileNotFoundException ex) { Logger.getLogger(ExtractUSB.class.getName()).log(Level.SEVERE, null, ex); devices = null; + } catch (IOException ex) { + Logger.getLogger(ExtractUSB.class.getName()).log(Level.SEVERE, null, ex); } } - private void Devices() throws FileNotFoundException { + private void Devices() throws FileNotFoundException, IOException { devices = new HashMap(); - try (Scanner dat = new Scanner(new FileInputStream(new java.io.File("src" + java.io.File.separator + "org" + java.io.File.separator + "sleuthkit" + java.io.File.separator + "autopsy" + java.io.File.separator + "recentactivity" + java.io.File.separator + "USB_DATA.txt")))) { + PlatformUtil.extractResourceToUserConfigDir(this.getClass(), "USB_DATA.txt"); + try (Scanner dat = new Scanner(new FileInputStream(new java.io.File(PlatformUtil.getUserConfigDirectory() + File.separator + "USB_DATA.txt")))) { String line = dat.nextLine(); while (dat.hasNext()) { String dvc = ""; @@ -69,23 +75,22 @@ public class ExtractUSB { for (int n = 1; n < tokens.length; n++) { dvc += tokens[n] + " "; } + String pID = vID + "0000"; + USB_Info info = new USB_Info(dvc, null); + devices.put(pID, info); line = dat.nextLine(); if (line.startsWith("\t")) { while (dat.hasNext() && line.startsWith("\t")) { tokens = line.split("[\\t\\s]+"); - String pID = vID + tokens[1]; + pID = vID + tokens[1]; String device = ""; line = dat.nextLine(); for (int n = 2; n < tokens.length; n++) { device += tokens[n] + " "; } - USB_Info info = new USB_Info(dvc, device); + info = new USB_Info(dvc, device); devices.put(pID, info); } - } else { - String pID = vID + "0000"; - USB_Info info = new USB_Info(dvc, null); - devices.put(pID, info); } } else { line = dat.nextLine();