From 83f271dda71d9310c1d2ca7166a62c079cef969e Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Mon, 26 Mar 2012 11:06:11 -0700 Subject: [PATCH 1/4] Fixes to nulls in report column, recent doc display modified, moved progress bar down below buttons in report filter, removed artifact id column from hashset table, report window once again resizable, now a new report gets generated each time, clearing out the old one. Added a non-linked table of contents with number of hits at the top of the html report. Signed-off-by: Alex Ebadirad --- .../autopsy/report/reportFilter.form | 64 +++++++++------ .../autopsy/report/reportFilter.java | 53 ++++++------ .../sleuthkit/autopsy/report/reportHTML.java | 80 ++++++++++++++----- .../autopsy/report/reportPanelAction.java | 2 +- 4 files changed, 129 insertions(+), 70 deletions(-) diff --git a/Report/src/org/sleuthkit/autopsy/report/reportFilter.form b/Report/src/org/sleuthkit/autopsy/report/reportFilter.form index d6a44ab924..8ce061c777 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportFilter.form +++ b/Report/src/org/sleuthkit/autopsy/report/reportFilter.form @@ -16,6 +16,11 @@ + + + + + @@ -32,42 +37,48 @@ - + - + - - - - - - - - + + + + + + + + + + + + + + + + + + + - + - - - - - - + + - - + @@ -80,14 +91,13 @@ - - - - - - + + + + + @@ -152,11 +162,13 @@ + - + + diff --git a/Report/src/org/sleuthkit/autopsy/report/reportFilter.java b/Report/src/org/sleuthkit/autopsy/report/reportFilter.java index 0af6be7cbb..0e5ad341e4 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportFilter.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportFilter.java @@ -57,6 +57,8 @@ public class reportFilter extends javax.swing.JPanel { jButton2.setActionCommand(org.openide.util.NbBundle.getMessage(reportFilter.class, "reportFilter.jButton2.actionCommand")); // NOI18N jButton2.setLabel(org.openide.util.NbBundle.getMessage(reportFilter.class, "reportFilter.jButton2.label")); // NOI18N + setPreferredSize(new java.awt.Dimension(250, 193)); + jCheckBox1.setSelected(true); jCheckBox1.setText(org.openide.util.NbBundle.getMessage(reportFilter.class, "reportFilter.jCheckBox1.text")); // NOI18N jCheckBox1.addActionListener(new java.awt.event.ActionListener() { @@ -89,9 +91,11 @@ public class reportFilter extends javax.swing.JPanel { } }); + progBar.setDoubleBuffered(true); progBar.setEnabled(false); progBar.setName(""); // NOI18N - progBar.setPreferredSize(new java.awt.Dimension(146, 23)); + progBar.setPreferredSize(new java.awt.Dimension(146, 15)); + progBar.setStringPainted(true); cancelButton.setText(org.openide.util.NbBundle.getMessage(reportFilter.class, "reportFilter.cancelButton.text")); // NOI18N cancelButton.setActionCommand(org.openide.util.NbBundle.getMessage(reportFilter.class, "reportFilter.cancelButton.actionCommand")); // NOI18N @@ -107,33 +111,36 @@ public class reportFilter extends javax.swing.JPanel { layout.setHorizontalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createSequentialGroup() - .addGap(38, 38, 38) + .addContainerGap() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createSequentialGroup() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(jCheckBox3) .addGroup(layout.createSequentialGroup() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(jCheckBox2) - .addComponent(jCheckBox1)) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) - .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(jCheckBox5) - .addComponent(jCheckBox4)))) - .addGap(69, 69, 69)) + .addComponent(jCheckBox3) + .addGroup(layout.createSequentialGroup() + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addComponent(jCheckBox2) + .addComponent(jCheckBox1)) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addComponent(jCheckBox5) + .addComponent(jCheckBox4)))) + .addGap(69, 69, 69)) + .addGroup(layout.createSequentialGroup() + .addComponent(jButton1) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) + .addComponent(cancelButton) + .addGap(156, 156, 156))) + .addContainerGap()) .addGroup(layout.createSequentialGroup() - .addComponent(jButton1) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 15, Short.MAX_VALUE) - .addComponent(cancelButton) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) - .addComponent(progBar, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE) - .addGap(42, 42, 42))) - .addContainerGap()) + .addComponent(progBar, javax.swing.GroupLayout.PREFERRED_SIZE, 231, javax.swing.GroupLayout.PREFERRED_SIZE) + .addContainerGap(109, Short.MAX_VALUE)))) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createSequentialGroup() - .addGap(24, 24, 24) + .addContainerGap() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) .addComponent(jCheckBox1) .addComponent(jCheckBox4)) @@ -144,11 +151,11 @@ public class reportFilter extends javax.swing.JPanel { .addGap(18, 18, 18) .addComponent(jCheckBox3) .addGap(18, 18, 18) - .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) - .addComponent(jButton1, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) - .addComponent(cancelButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) - .addComponent(progBar, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)) + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) + .addComponent(jButton1, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) + .addComponent(cancelButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) + .addComponent(progBar, javax.swing.GroupLayout.DEFAULT_SIZE, 17, Short.MAX_VALUE) .addContainerGap()) ); }// //GEN-END:initComponents diff --git a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java index 2019ee0da9..101b0f3a5c 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java @@ -38,6 +38,10 @@ public reportHTML (HashMap> re //This is literally a terrible way to count up all the types of artifacts, and doesn't include any added ones. //Unlike the XML report, which is dynamic, this is formatted and needs to be redone later instead of being hardcoded. + //Also, clearing variables to generate new report. + formatted_Report.setLength(0); + unformatted_header.setLength(0); + formatted_header.setLength(0); int countGen = 0; int countWebBookmark = 0; @@ -128,6 +132,7 @@ public reportHTML (HashMap> re + "table tr th {text-align: left; width: 80px;} " + "table td {width: 100px; font-size: 8px; display: table-cell; padding: 4px 8px;} " + "table tr {text-align: left; width: 60px; background: #f3f3f3;} " + + "tr.alt td{ background-color: #FFFFFF;}" + ""; unformatted_header.append(header); unformatted_header.append(simpleCSS); @@ -140,15 +145,25 @@ public reportHTML (HashMap> re { formatted_Report.append(ingestwarning); } - formatted_Report.append("

Case Summary

HTML Report Generated by Autopsy 3 on ").append(datetime).append("

    "); + formatted_Report.append("

    Case Summary

    HTML Report Generated by Autopsy 3 on ").append(datetime).append("

      "); formatted_Report.append("
    • # of Images: ").append(imagecount).append("
      • "); formatted_Report.append("
    • FileSystems: ").append(filesystemcount).append("
      • "); formatted_Report.append("
    • # of Files: ").append(totalfiles.toString()).append("
      • "); formatted_Report.append("
    • # of Dirs: ").append(totaldirs.toString()).append("
      • "); - formatted_Report.append("
    • # of Artifacts: ").append(reportsize).append("
      • "); + formatted_Report.append("
    • # of Artifacts: ").append(reportsize).append("
    "); + + formatted_Report.append("
    "); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append("
    SectionCount
    Web Bookmarks").append(countWebBookmark).append("
    Web History").append(countWebHistory).append("
    Web Downloads").append(countWebDownload).append("
    Recent Documents").append(countRecentObjects).append("
    Installed Programs").append(countInstalled).append("
    Keyword Hits").append(countKeyword).append("
    Hash Hits").append(countHash).append("

    "); String tableHeader = ""; StringBuilder nodeGen = new StringBuilder("

    General Information (").append(countGen).append(")

    ").append(tableHeader).append(""); - StringBuilder nodeWebBookmark = new StringBuilder("

    Web Bookmarks (").append(countWebBookmark).append(")

    ").append(tableHeader).append(""); + StringBuilder nodeWebBookmark = new StringBuilder("

    Web Bookmarks (").append(countWebBookmark).append(")

    ").append(tableHeader).append(""); StringBuilder nodeWebCookie = new StringBuilder("

    Web Cookies (").append(countWebCookie).append(")

    ").append(tableHeader).append(""); StringBuilder nodeWebHistory = new StringBuilder("

    Web History (").append(countWebHistory).append(")

    ").append(tableHeader).append(""); StringBuilder nodeWebDownload = new StringBuilder("

    Web Downloads (").append(countWebDownload).append(")

    ").append(tableHeader).append(""); @@ -156,13 +171,24 @@ public reportHTML (HashMap> re StringBuilder nodeTrackPoint = new StringBuilder("

    Track Points (").append(countTrackPoint).append(")

    ").append(tableHeader).append("    "); StringBuilder nodeInstalled = new StringBuilder("

    Installed Programs (").append(countInstalled).append(")

    ").append(tableHeader).append(""); StringBuilder nodeKeyword = new StringBuilder("

    Keyword Search Hits (").append(countKeyword).append(")

    "); - StringBuilder nodeHash = new StringBuilder("

    Hashset Hits (").append(countHash).append(")

    ").append(tableHeader).append(""); - + StringBuilder nodeHash = new StringBuilder("

    Hashset Hits (").append(countHash).append(")

    ").append(tableHeader).append(""); + int alt = 0; + String altRow = ""; for (Entry> entry : report.entrySet()) { if(reportFilter.cancel == true){ break; } int cc = 0; + + if(alt > 0) + { + altRow = " class=\"alt\""; + alt = 0; + } + else{ + altRow=""; + alt++; + } StringBuilder artifact = new StringBuilder(""); Long objId = entry.getKey().getObjectID(); //Content file = skCase.getContentById(objId); @@ -172,15 +198,27 @@ public reportHTML (HashMap> re TreeMap attributes = new TreeMap(); - // Get all the attributes, line them up to be added. + // Get all the attributes, line them up to be added. Place empty string placeholders for each attribute type + int n; + for(n=1;n<=35;n++) + { + attributes.put(n, ""); + + } for (BlackboardAttribute tempatt : entry.getValue()) { if(reportFilter.cancel == true){ break; } - + String value = ""; int type = tempatt.getAttributeTypeID(); - String value = tempatt.getValueString(); + if(tempatt.getValueString() == null || tempatt.getValueString() == "null"){ + + } + else + { + value = tempatt.getValueString(); + } value = reportUtils.insertPeriodically(value, "
    ", 30); attributes.put(type, value); cc++; @@ -193,14 +231,14 @@ public reportHTML (HashMap> re nodeGen.append(artifact); } if(entry.getKey().getArtifactTypeID() == 2){ - artifact.append("    "); + artifact.append(""); artifact.append(""); artifact.append(""); artifact.append(""); nodeWebBookmark.append(artifact); } if(entry.getKey().getArtifactTypeID() == 3){ - artifact.append(""); + artifact.append(""); artifact.append(""); artifact.append(""); artifact.append(""); @@ -209,8 +247,8 @@ public reportHTML (HashMap> re nodeWebCookie.append(artifact); } if(entry.getKey().getArtifactTypeID() == 4){ - artifact.append(""); - artifact.append(""); + artifact.append(""); + artifact.append(""); artifact.append(""); artifact.append(""); artifact.append(""); @@ -218,29 +256,30 @@ public reportHTML (HashMap> re nodeWebHistory.append(artifact); } if(entry.getKey().getArtifactTypeID() == 5){ - artifact.append(""); + artifact.append(""); artifact.append(""); - artifact.append(""); + artifact.append(""); artifact.append(""); artifact.append(""); nodeWebDownload.append(artifact); } if(entry.getKey().getArtifactTypeID() == 6){ - artifact.append(""); + //artifact.append(""); + artifact.append(""); artifact.append(""); artifact.append(""); nodeRecentObjects.append(artifact); } if(entry.getKey().getArtifactTypeID() == 7){ - artifact.append(""); artifact.append(""); artifact.append(""); nodeTrackPoint.append(artifact); } if(entry.getKey().getArtifactTypeID() == 8){ - artifact.append(""); artifact.append(""); artifact.append(""); @@ -254,8 +293,8 @@ public reportHTML (HashMap> re // nodeKeyword.append(artifact); } if(entry.getKey().getArtifactTypeID() == 10){ - artifact.append(""); + // artifact.append(""); artifact.append(""); //artifact.append(""); artifact.append(""); @@ -268,6 +307,7 @@ public reportHTML (HashMap> re //Add them back in order //formatted_Report.append(nodeGen); // formatted_Report.append("
    AttributeValue
    URLTitleProgram
    URLTitleProgram
    URLDateNameValueProgram
    URLDateReferrerTitleProgram
    FileSourceTimeProgram
    Artifact IDNameSizeAttributeValue
    Artifact IDNameSizeAttributeValue
    Artifact IDNameSizeHashset Name
    NameSizeHashset Name
    ").append(attributes.get(1)).append("").append(attributes.get(1)).append("").append(attributes.get(3)).append("").append(attributes.get(4)).append("
    ").append(attributes.get(1)).append("").append(attributes.get(1)).append("").append(attributes.get(2)).append("").append(attributes.get(3)).append("").append(attributes.get(6)).append("
    ").append(attributes.get(1)).append("").append(attributes.get(2)).append("").append(attributes.get(1)).append("").append(attributes.get(33)).append("").append(attributes.get(32)).append("").append(attributes.get(3)).append("").append(attributes.get(4)).append("
    ").append(attributes.get(8)).append("").append(attributes.get(8)).append("").append(attributes.get(1)).append("").append(attributes.get(2)).append("").append(attributes.get(33)).append("").append(attributes.get(4)).append("
    ").append(objId.toString()); - artifact.append("").append(file.getName().toString()).append("
    ").append(objId.toString()); + artifact.append("").append(attributes.get(6)).append("").append(attributes.get(5)).append("").append(filesize.toString()).append("
    ").append(objId.toString()); + artifact.append("").append(objId.toString()); artifact.append("").append(file.getName().toString()).append("").append(filesize.toString()).append("
    ").append(objId.toString()); + artifact.append("").append(objId.toString()); artifact.append("").append(file.getName().toString()).append("").append(filesize.toString()).append("
    ").append(objId.toString()); - artifact.append("").append(file.getName().toString()).append("
    ").append(objId.toString()); + artifact.append("").append(file.getName().toString()).append("").append(filesize.toString()).append("").append(attributes.get(31)).append("").append(attributes.get(30)).append("
    "); + formatted_Report.append(nodeWebBookmark); formatted_Report.append(""); formatted_Report.append(nodeWebCookie); diff --git a/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java b/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java index 4528aff206..023c29d263 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java @@ -97,7 +97,7 @@ public class reportPanelAction { // add the panel to the popup window popUpWindow.add(panel); - popUpWindow.setResizable(false); + popUpWindow.setResizable(true); popUpWindow.pack(); // set the location of the popUp Window on the center of the screen Dimension screenDimension = Toolkit.getDefaultToolkit().getScreenSize(); From 52fcef0014201d1d33cff304f70fd504fd216509 Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Mon, 26 Mar 2012 12:04:33 -0700 Subject: [PATCH 2/4] Installed programs now available w/ version of windows Signed-off-by: Alex Ebadirad --- .../release/rr/plugins/autopsyuninstall.pl | 4 +- .../release/rr/plugins/autopsywinver.pl | 2 +- .../recentactivity/ExtractRegistry.java | 46 +++++++++++++++++-- .../sleuthkit/autopsy/report/reportHTML.java | 7 ++- 4 files changed, 47 insertions(+), 12 deletions(-) diff --git a/RecentActivity/release/rr/plugins/autopsyuninstall.pl b/RecentActivity/release/rr/plugins/autopsyuninstall.pl index 1cff08cf14..30fc0dcd74 100644 --- a/RecentActivity/release/rr/plugins/autopsyuninstall.pl +++ b/RecentActivity/release/rr/plugins/autopsyuninstall.pl @@ -73,9 +73,9 @@ sub pluginmain { push(@{$uninst{$lastwrite}},$display); } foreach my $t (reverse sort {$a <=> $b} keys %uninst) { - ::rptMsg(""); + #::rptMsg(""); foreach my $item (@{$uninst{$t}}) { - ::rptMsg($item.""); + ::rptMsg("" .$item.""); } #::rptMsg(""); } diff --git a/RecentActivity/release/rr/plugins/autopsywinver.pl b/RecentActivity/release/rr/plugins/autopsywinver.pl index a13795b6b6..73cb5a3017 100644 --- a/RecentActivity/release/rr/plugins/autopsywinver.pl +++ b/RecentActivity/release/rr/plugins/autopsywinver.pl @@ -104,6 +104,6 @@ sub pluginmain { #::rptMsg($key_path." not found."); #::logMsg($key_path." not found."); } - ::rptMsg(""); + ::rptMsg(""); } 1; \ No newline at end of file diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 179d40a7f1..7d5569d0b6 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -153,7 +153,7 @@ public void getregistryfiles(List image, IngestImageWorkerController con } if(regFilePath.toLowerCase().contains("software")) { - type = "1software"; + type = "autopsysoftware"; } if(regFilePath.toLowerCase().contains("ntuser")) { @@ -196,6 +196,7 @@ public void getregistryfiles(List image, IngestImageWorkerController con File regfile = new File(regRecord); BufferedReader input = new BufferedReader(new InputStreamReader(new FileInputStream(regfile))); + regfile.delete(); String regString = new Scanner(input).useDelimiter("\\Z").next(); String startdoc = ""; String result = regString.replaceAll("----------------------------------------",""); @@ -219,6 +220,8 @@ public void getregistryfiles(List image, IngestImageWorkerController con Element artroot = tempnode.getChild("artifacts"); List artlist = artroot.getChildren(); + String winver = ""; + String installdate = ""; if(artlist.isEmpty()){ } else{ @@ -229,19 +232,52 @@ public void getregistryfiles(List image, IngestImageWorkerController con String name = artnode.getAttributeValue("name"); String value = artnode.getTextTrim(); Collection bbattributes = new ArrayList(); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(), "RecentActivity", context, time)); + + if("recentdocs".equals(context)){ + + BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(), "RecentActivity", context, time)); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", context, name)); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_VALUE.getTypeID(), "RecentActivity", context, value)); - if("recentdocs".equals(context)){ - BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT); bbart.addAttributes(bbattributes); } else if("runMRU".equals(context)){ BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(), "RecentActivity", context, time)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", context, name)); + + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_VALUE.getTypeID(), "RecentActivity", context, value)); + bbart.addAttributes(bbattributes); + } + else if("uninstall".equals(context)){ + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(), "RecentActivity", context, time)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), "RecentActivity", context, value)); + + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), "RecentActivity", context, name)); + BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_INSTALLED_PROG); bbart.addAttributes(bbattributes); - } + else if("WinVersion".equals(context)){ + + if(name.contains("ProductName")) + { + winver = value; + } + if(name.contains("CSDVersion")){ + winver = winver + " " + value; + } + if(name.contains("InstallDate")) + { + installdate = value; + + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), "RecentActivity", context, winver)); + + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), "RecentActivity", context, installdate)); + BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_INSTALLED_PROG); + bbart.addAttributes(bbattributes); + } + } else { diff --git a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java index 101b0f3a5c..c73c902edf 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java @@ -169,7 +169,7 @@ public reportHTML (HashMap> re StringBuilder nodeWebDownload = new StringBuilder("

    Web Downloads (").append(countWebDownload).append(")

    ").append(tableHeader).append("FileSourceTimeProgram"); StringBuilder nodeRecentObjects = new StringBuilder("

    Recent Documents (").append(countRecentObjects).append(")

    ").append(tableHeader).append("NamePathSize"); StringBuilder nodeTrackPoint = new StringBuilder("

    Track Points (").append(countTrackPoint).append(")

    ").append(tableHeader).append("Artifact IDNameSizeAttributeValue"); - StringBuilder nodeInstalled = new StringBuilder("

    Installed Programs (").append(countInstalled).append(")

    ").append(tableHeader).append("Artifact IDNameSizeAttributeValue"); + StringBuilder nodeInstalled = new StringBuilder("

    Installed Programs (").append(countInstalled).append(")

    ").append(tableHeader).append("Program NameInstall Date/Time"); StringBuilder nodeKeyword = new StringBuilder("

    Keyword Search Hits (").append(countKeyword).append(")

    "); StringBuilder nodeHash = new StringBuilder("

    Hashset Hits (").append(countHash).append(")

    ").append(tableHeader).append("NameSizeHashset Name"); int alt = 0; @@ -279,9 +279,8 @@ public reportHTML (HashMap> re nodeTrackPoint.append(artifact); } if(entry.getKey().getArtifactTypeID() == 8){ - artifact.append("").append(objId.toString()); - artifact.append("").append(file.getName().toString()).append(""); - artifact.append("").append(filesize.toString()).append(""); + artifact.append("").append(attributes.get(4)).append(""); + artifact.append("").append(attributes.get(2)).append(""); artifact.append(""); nodeInstalled.append(artifact); } From f469c03967484ea1363624823e330574d1c6bbb0 Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Mon, 26 Mar 2012 12:27:04 -0700 Subject: [PATCH 3/4] Addition of installed prog to reporting section. Signed-off-by: Alex Ebadirad --- .../org/sleuthkit/autopsy/report/report.java | 21 ++++++++++++ .../sleuthkit/autopsy/report/reportHTML.java | 32 +++++++++---------- .../autopsy/report/reportInterface.java | 1 + .../autopsy/report/reportPanelAction.java | 2 +- 4 files changed, 39 insertions(+), 17 deletions(-) diff --git a/Report/src/org/sleuthkit/autopsy/report/report.java b/Report/src/org/sleuthkit/autopsy/report/report.java index ae8c5a2a57..e87d4e60ee 100644 --- a/Report/src/org/sleuthkit/autopsy/report/report.java +++ b/Report/src/org/sleuthkit/autopsy/report/report.java @@ -196,6 +196,27 @@ public HashMap> getHashHit() { return reportMap; } +@Override +public HashMap> getInstalledProg() { + HashMap> reportMap = new HashMap(); + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tempDb = currentCase.getSleuthkitCase(); + try + { + ArrayList bbart = tempDb.getBlackboardArtifacts(8); + for (BlackboardArtifact artifact : bbart) + { + ArrayList attributes = artifact.getAttributes(); + reportMap.put(artifact, attributes); + } + } + catch (Exception e) + { + Logger.getLogger(report.class.getName()).log(Level.INFO, "Exception occurred", e); + } + + return reportMap; +} @Override public String getGroupedKeywordHit() { diff --git a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java index c73c902edf..539948563d 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportHTML.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportHTML.java @@ -145,7 +145,7 @@ public reportHTML (HashMap> re { formatted_Report.append(ingestwarning); } - formatted_Report.append("

    Case Summary

    HTML Report Generated by Autopsy 3 on ").append(datetime).append("

      "); + formatted_Report.append("

      Case Summary

      HTML Report Generated by Autopsy 3 on ").append(datetime).append("

        "); formatted_Report.append("
      • # of Images: ").append(imagecount).append("
        • "); formatted_Report.append("
      • FileSystems: ").append(filesystemcount).append("
        • "); formatted_Report.append("
      • # of Files: ").append(totalfiles.toString()).append("
        • "); @@ -153,25 +153,25 @@ public reportHTML (HashMap> re formatted_Report.append("
      • # of Artifacts: ").append(reportsize).append("
      "); formatted_Report.append("
      "); - formatted_Report.append(""); - formatted_Report.append(""); - formatted_Report.append(""); - formatted_Report.append(""); - formatted_Report.append(""); - formatted_Report.append(""); - formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); + formatted_Report.append(""); formatted_Report.append("
      SectionCount
      Web Bookmarks").append(countWebBookmark).append("
      Web History").append(countWebHistory).append("
      Web Downloads").append(countWebDownload).append("
      Recent Documents").append(countRecentObjects).append("
      Installed Programs").append(countInstalled).append("
      Keyword Hits").append(countKeyword).append("
      Hash Hits").append(countHash).append("
      Web Bookmarks").append(countWebBookmark).append("
      Web History").append(countWebHistory).append("
      Web Downloads").append(countWebDownload).append("
      Recent Documents").append(countRecentObjects).append("
      Installed Programs").append(countInstalled).append("
      Keyword Hits").append(countKeyword).append("
      Hash Hits").append(countHash).append("

      "); String tableHeader = ""; StringBuilder nodeGen = new StringBuilder("

      General Information (").append(countGen).append(")

      ").append(tableHeader).append(""); StringBuilder nodeWebBookmark = new StringBuilder("

      Web Bookmarks (").append(countWebBookmark).append(")

      ").append(tableHeader).append(""); - StringBuilder nodeWebCookie = new StringBuilder("

      Web Cookies (").append(countWebCookie).append(")

      ").append(tableHeader).append(""); - StringBuilder nodeWebHistory = new StringBuilder("

      Web History (").append(countWebHistory).append(")

      ").append(tableHeader).append(""); - StringBuilder nodeWebDownload = new StringBuilder("

      Web Downloads (").append(countWebDownload).append(")

      ").append(tableHeader).append(""); - StringBuilder nodeRecentObjects = new StringBuilder("

      Recent Documents (").append(countRecentObjects).append(")

      ").append(tableHeader).append(""); - StringBuilder nodeTrackPoint = new StringBuilder("

      Track Points (").append(countTrackPoint).append(")

      ").append(tableHeader).append(""); - StringBuilder nodeInstalled = new StringBuilder("

      Installed Programs (").append(countInstalled).append(")

      ").append(tableHeader).append(""); - StringBuilder nodeKeyword = new StringBuilder("

      Keyword Search Hits (").append(countKeyword).append(")

      "); - StringBuilder nodeHash = new StringBuilder("

      Hashset Hits (").append(countHash).append(")

      ").append(tableHeader).append(""); + StringBuilder nodeWebCookie = new StringBuilder("

      Web Cookies (").append(countWebCookie).append(")

      ").append(tableHeader).append(""); + StringBuilder nodeWebHistory = new StringBuilder("

      Web History (").append(countWebHistory).append(")

      ").append(tableHeader).append(""); + StringBuilder nodeWebDownload = new StringBuilder("

      Web Downloads (").append(countWebDownload).append(")

      ").append(tableHeader).append(""); + StringBuilder nodeRecentObjects = new StringBuilder("

      Recent Documents (").append(countRecentObjects).append(")

      ").append(tableHeader).append(""); + StringBuilder nodeTrackPoint = new StringBuilder("

      Track Points (").append(countTrackPoint).append(")

      ").append(tableHeader).append(""); + StringBuilder nodeInstalled = new StringBuilder("

      Installed Programs (").append(countInstalled).append(")

      ").append(tableHeader).append(""); + StringBuilder nodeKeyword = new StringBuilder("

      Keyword Search Hits (").append(countKeyword).append(")

      "); + StringBuilder nodeHash = new StringBuilder("

      Hashset Hit (").append(countHash).append(")

      ").append(tableHeader).append(""); int alt = 0; String altRow = ""; for (Entry> entry : report.entrySet()) { diff --git a/Report/src/org/sleuthkit/autopsy/report/reportInterface.java b/Report/src/org/sleuthkit/autopsy/report/reportInterface.java index ba8f3ef6f1..61ab8b8dfe 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportInterface.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportInterface.java @@ -22,5 +22,6 @@ public interface reportInterface{ public HashMap> getRecentObject(); public HashMap> getHashHit(); public HashMap> getKeywordHit(); + public HashMap> getInstalledProg(); public String getGroupedKeywordHit(); } diff --git a/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java b/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java index 023c29d263..1f3a42ef69 100644 --- a/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java +++ b/Report/src/org/sleuthkit/autopsy/report/reportPanelAction.java @@ -42,7 +42,7 @@ public class reportPanelAction { if(reportlist.contains(5)){Results.putAll(bbreport.getWebDownload());} if(reportlist.contains(6)){Results.putAll(bbreport.getRecentObject());} // if(reportlist.contains(7)){Results.putAll(bbreport.getGenInfo());} - // if(reportlist.contains(7)){Results.putAll(bbreport.getGenInfo());} + if(reportlist.contains(8)){Results.putAll(bbreport.getInstalledProg());} if(reportlist.contains(9)){Results.putAll(bbreport.getKeywordHit());} if(reportlist.contains(10)){Results.putAll(bbreport.getHashHit());} SwingUtilities.invokeLater(new Runnable() { From 138edf1d2c0125dee5103e0090a48a34816a15a9 Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Mon, 26 Mar 2012 12:37:17 -0700 Subject: [PATCH 4/4] Fixed possible delete before buffer has read in full file in registryextract Signed-off-by: Alex Ebadirad --- .../org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 7d5569d0b6..737b2cff7c 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -196,8 +196,8 @@ public void getregistryfiles(List image, IngestImageWorkerController con File regfile = new File(regRecord); BufferedReader input = new BufferedReader(new InputStreamReader(new FileInputStream(regfile))); - regfile.delete(); String regString = new Scanner(input).useDelimiter("\\Z").next(); + regfile.delete(); String startdoc = ""; String result = regString.replaceAll("----------------------------------------",""); String enddoc = "";
      AttributeValue
      URLTitleProgram
      URLDateNameValueProgram
      URLDateReferrerTitleProgram
      FileSourceTimeProgram
      NamePathSize
      Artifact IDNameSizeAttributeValue
      Program NameInstall Date/Time
      NameSizeHashset Name
      URLDateNameValueProgram
      URLDateReferrerTitleProgram
      FileSourceTimeProgram
      NamePathSize
      Artifact IDNameSizeAttributeValue
      Program NameInstall Date/Time
      NameSizeHashset Name