From b7796a15c7008ca51e0bd7af74d3f06fb9952a3d Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Tue, 28 Sep 2021 11:58:09 -0400 Subject: [PATCH 1/2] fixed RA instance issue --- .../recentactivity/ExtractRegistry.java | 26 +++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index f51bcbd0f4..72ab38a41c 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -61,6 +61,7 @@ import java.util.AbstractMap; import java.util.ArrayList; import java.util.List; import java.util.Collection; +import java.util.Collections; import java.util.Date; import java.util.HashMap; import java.util.Map; @@ -1105,6 +1106,7 @@ class ExtractRegistry extends Extract { String sid = optional.get(); Map userInfo = userInfoMap.remove(sid); if(userInfo != null) { + addAccountInstance(accountMgr, osAccount, (DataSource)dataSource); updateOsAccount(osAccount, userInfo, groupMap.get(sid), regAbstractFile); } } @@ -1999,9 +2001,10 @@ class ExtractRegistry extends Extract { accountMgr.newOsAccountInstance(osAccount, (DataSource)dataSource, OsAccountInstance.OsAccountInstanceType.LAUNCHED); } else { osAccount = optional.get(); - if (userName != null && !userName.isEmpty()) { + addAccountInstance(accountMgr, osAccount, (DataSource)dataSource); + if (userName != null && !userName.isEmpty()) { OsAccountUpdateResult updateResult= accountMgr.updateCoreWindowsOsAccountAttributes(osAccount, null, userName, domainName.isEmpty() ? null : domainName, host); - osAccount = updateResult.getUpdatedAccount().orElse(osAccount); + osAccount = updateResult.getUpdatedAccount().orElse(osAccount); } } @@ -2269,4 +2272,23 @@ class ExtractRegistry extends Extract { private OsAccountAttribute createOsAccountAttribute(BlackboardAttribute.ATTRIBUTE_TYPE type, Integer value, OsAccount osAccount, Host host, AbstractFile file) { return osAccount.new OsAccountAttribute(new BlackboardAttribute.Type(type), value, osAccount, host, file); } + + /** + * Adds an account instance for the given data source if one does not already + * exist. + * + * @param accountMgr + * @param osAccount + * @param dataSource + * @throws TskCoreException + */ + private void addAccountInstance(OsAccountManager accountMgr, OsAccount osAccount, DataSource dataSource) throws TskCoreException { + List acctInstances = accountMgr.getOsAccountInstances(Collections.singletonList(osAccount.getId())); + for(OsAccountInstance instance: acctInstances) { + if(instance.getDataSource().getId() == dataSource.getId()) { + return; + } + } + accountMgr.newOsAccountInstance(osAccount, dataSource, OsAccountInstance.OsAccountInstanceType.LAUNCHED); + } } From 0e89366339966024e25df79b6e221c563ae32091 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Tue, 28 Sep 2021 15:24:41 -0400 Subject: [PATCH 2/2] Simplfied addAccountInstance method on ExtractRegisty --- .../sleuthkit/autopsy/recentactivity/ExtractRegistry.java | 6 ------ 1 file changed, 6 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 72ab38a41c..ba2b68ca9f 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -2283,12 +2283,6 @@ class ExtractRegistry extends Extract { * @throws TskCoreException */ private void addAccountInstance(OsAccountManager accountMgr, OsAccount osAccount, DataSource dataSource) throws TskCoreException { - List acctInstances = accountMgr.getOsAccountInstances(Collections.singletonList(osAccount.getId())); - for(OsAccountInstance instance: acctInstances) { - if(instance.getDataSource().getId() == dataSource.getId()) { - return; - } - } accountMgr.newOsAccountInstance(osAccount, dataSource, OsAccountInstance.OsAccountInstanceType.LAUNCHED); } }