mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-09 06:39:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added sample data source ingest module and updated docs to refer to it.

Browse Source
This commit is contained in:
Brian Carrier 2013-08-14 23:44:09 -04:00
parent 2407bbee91
commit 72e5ea71b2
2 changed files with 21 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java
View File

@ -77,9 +77,11 @@ public class FileManager implements Closeable {
} }
/** /**
* @param dataSource data source Content (Image, parent-less * Finds a set of files that meets the name criteria.
* VirtualDirectory) where to find files * @param dataSource Root data source to limit search results to (Image,
* @param fileName the name of the file or directory to match * VirtualDirectory, etc.).
* @param fileName Pattern of the name of the file or directory to match (case
* insensitive, used in LIKE SQL statement).
* @return a list of AbstractFile for files/directories whose name matches * @return a list of AbstractFile for files/directories whose name matches
* the given fileName * the given fileName
*/ */
@ -90,11 +92,15 @@ public class FileManager implements Closeable {
return tskCase.findFiles(dataSource, fileName); return tskCase.findFiles(dataSource, fileName);
} }
/** /**
* @param dataSource data source Content (Image, parent-less * Finds a set of files that meets the name criteria.
* VirtualDirectory) where to find files * @param dataSource Root data source to limit search results to (Image,
* @param fileName the name of the file or directory to match * VirtualDirectory, etc.).
* @param dirName the name of a parent directory of fileName * @param fileName Pattern of the name of the file or directory to match (case
* insensitive, used in LIKE SQL statement).
* @param dirName Pattern of the name of the parent directory to use as the root
* of the search (case insensitive, used in LIKE SQL statement).
* @return a list of AbstractFile for files/directories whose name matches * @return a list of AbstractFile for files/directories whose name matches
* fileName and whose parent directory contains dirName. * fileName and whose parent directory contains dirName.
*/ */
@ -106,10 +112,12 @@ public class FileManager implements Closeable {
} }
/** /**
* @param dataSource data source Content (Image, parent-less * Finds a set of files that meets the name criteria.
* VirtualDirectory) where to find files * @param dataSource Root data source to limit search results to (Image,
* @param fileName the name of the file or directory to match * VirtualDirectory, etc.).
* @param parentFile parent file/dir of the file to find * @param fileName Pattern of the name of the file or directory to match (case
* insensitive, used in LIKE SQL statement).
* @param parentFile Object of root/parent directory to restrict search to.
* @return a list of AbstractFile for files/directories whose name matches * @return a list of AbstractFile for files/directories whose name matches
* fileName and that were inside a directory described by parentFsContent. * fileName and that were inside a directory described by parentFsContent.
*/ */

2
docs/doxygen/modIngest.dox
View File

@ -48,6 +48,7 @@ blackboard and with inbox messages to the user.
\section ingest_datasrc Data Source-level Modules \section ingest_datasrc Data Source-level Modules
To make a data source-level module, make a new Java class either manually or using the NetBeans wizards. Edit the class to extend "org.sleuthkit.autopsy.ingest.IngestModuleDataSource". NetBeans will likely complain that you have not implemented the necessary methods and you can use its "hints" to automatically generate stubs for them. Use the documentation for the org.sleuthkit.autopsy.ingest.IngestModuleDataSource class for details on what each needs to do. To make a data source-level module, make a new Java class either manually or using the NetBeans wizards. Edit the class to extend "org.sleuthkit.autopsy.ingest.IngestModuleDataSource". NetBeans will likely complain that you have not implemented the necessary methods and you can use its "hints" to automatically generate stubs for them. Use the documentation for the org.sleuthkit.autopsy.ingest.IngestModuleDataSource class for details on what each needs to do.
You can also refer to org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule as an example module.
Example snippet of an ingest-level module process() method: Example snippet of an ingest-level module process() method:
@ -87,6 +88,7 @@ public void process(Content dataSource, IngestDataSourceWorkerController control
\section ingest_file File-level Modules \section ingest_file File-level Modules
To make a File-level module, make a new Java class either manually or using the NetBeans wizards. Edit the class to extend "org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile". NetBeans will likely complain that you have not implemented the necessary methods and you can use its "hints" to automatically generate stubs for them. Use the method documentation in the org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile class to fill in the details. To make a File-level module, make a new Java class either manually or using the NetBeans wizards. Edit the class to extend "org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile". NetBeans will likely complain that you have not implemented the necessary methods and you can use its "hints" to automatically generate stubs for them. Use the method documentation in the org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile class to fill in the details.
You can also refer to org.sleuthkit.autopsy.examples.SampleFileIngestModule as an example module.
Unlike Data Source-level modules, file-level modules are singletons. Only a single instance is created for all files. Unlike Data Source-level modules, file-level modules are singletons. Only a single instance is created for all files.
The same file-level module instance will be used for files in different images and even different cases if new cases are opened. The same file-level module instance will be used for files in different images and even different cases if new cases are opened.