From 7e4159822620e7d0490291dc4f5481811223206a Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Mon, 25 Jan 2021 13:27:13 -0500 Subject: [PATCH] Add more cancellation to RA --- .../autopsy/recentactivity/Chromium.java | 21 +++++--- .../DataSourceUsageAnalyzer.java | 14 +++++- .../autopsy/recentactivity/ExtractEdge.java | 18 +++++-- .../autopsy/recentactivity/ExtractIE.java | 20 ++++++-- .../autopsy/recentactivity/ExtractOs.java | 4 ++ .../recentactivity/ExtractPrefetch.java | 9 +--- .../recentactivity/ExtractRecycleBin.java | 1 - .../recentactivity/ExtractRegistry.java | 48 +++++++++++++------ .../autopsy/recentactivity/ExtractSafari.java | 30 +++++++++--- .../autopsy/recentactivity/ExtractSru.java | 13 ++--- .../recentactivity/ExtractWebAccountType.java | 7 ++- .../recentactivity/ExtractZoneIdentifier.java | 8 ++-- .../autopsy/recentactivity/Firefox.java | 48 ++++++++++++++++--- .../recentactivity/RAImageIngestModule.java | 4 +- .../recentactivity/RecentDocumentsByLnk.java | 13 +++-- 15 files changed, 190 insertions(+), 68 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java index ef91cee067..9fd2acf40f 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chromium.java @@ -32,11 +32,15 @@ import com.google.gson.JsonSyntaxException; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.datamodel.ContentUtils; import java.util.logging.Level; -import java.util.*; import java.io.File; import java.io.FileNotFoundException; import java.io.FileReader; import java.io.IOException; +import java.util.Collection; +import java.util.List; +import java.util.Map; +import java.util.HashMap; +import java.util.ArrayList; import org.apache.commons.io.FilenameUtils; import org.openide.util.NbBundle.Messages; import org.sleuthkit.autopsy.casemodule.Case; @@ -268,7 +272,7 @@ class Chromium extends Extract { dbFile.delete(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -410,7 +414,10 @@ class Chromium extends Extract { this.getName(), bookmarkFile.getName())); } } - postArtifacts(bbartifacts); + + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } bbartifacts.clear(); dbFile.delete(); } @@ -506,7 +513,7 @@ class Chromium extends Extract { dbFile.delete(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -628,7 +635,7 @@ class Chromium extends Extract { dbFile.delete(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -729,7 +736,7 @@ class Chromium extends Extract { dbFile.delete(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -807,7 +814,7 @@ class Chromium extends Extract { dbFile.delete(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java index 44d5f2c70c..c31e429601 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java @@ -66,17 +66,27 @@ class DataSourceUsageAnalyzer extends Extract { this.dataSource = dataSource; try { progressBar.progress(Bundle.Progress_Message_Analyze_Usage()); - createDataSourceUsageArtifacts(); + createDataSourceUsageArtifacts(context); } catch (TskCoreException ex) { logger.log(Level.WARNING, "Failed to check if datasource contained a volume with operating system specific files", ex); } } - private void createDataSourceUsageArtifacts() throws TskCoreException { + private void createDataSourceUsageArtifacts(IngestJobContext context) throws TskCoreException { createOSInfoDataSourceUsageArtifacts(); + + if (context.dataSourceIngestIsCancelled()) { + return; + } + createAndroidMediaCardArtifacts(); + + if (context.dataSourceIngestIsCancelled()) { + return; + } + createDJIDroneDATArtitifacts(); } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java index 133764f427..77939c3b6f 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java @@ -147,6 +147,10 @@ final class ExtractEdge extends Extract { this.addErrorMessage(Bundle.ExtractEdge_process_errMsg_errGettingWebCacheFiles()); LOG.log(Level.SEVERE, "Error fetching 'WebCacheV01.dat' files for Microsoft Edge", ex); //NON-NLS } + + if (context.dataSourceIngestIsCancelled()) { + return; + } try { spartanFiles = fetchSpartanDBFiles(); // For later use with bookmarks @@ -166,6 +170,10 @@ final class ExtractEdge extends Extract { LOG.log(Level.WARNING, "Microsoft Edge files found, unable to parse on Non-Windows system"); //NON-NLS return; } + + if (context.dataSourceIngestIsCancelled()) { + return; + } final String esedumper = getPathForESEDumper(); if (esedumper == null) { @@ -353,7 +361,7 @@ final class ExtractEdge extends Extract { fileScanner.close(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -399,7 +407,7 @@ final class ExtractEdge extends Extract { fileScanner.close(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -455,7 +463,7 @@ final class ExtractEdge extends Extract { fileScanner.close(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -517,7 +525,9 @@ final class ExtractEdge extends Extract { fileScanner.close(); } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java index d128c09dc7..50568a2b2e 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java @@ -97,9 +97,17 @@ class ExtractIE extends Extract { progressBar.progress(Bundle.Progress_Message_IE_Bookmarks()); this.getBookmark(); + + if (context.dataSourceIngestIsCancelled()) { + return; + } progressBar.progress(Bundle.Progress_Message_IE_Cookies()); this.getCookie(); + + if (context.dataSourceIngestIsCancelled()) { + return; + } progressBar.progress(Bundle.Progress_Message_IE_History()); this.getHistory(); @@ -166,7 +174,9 @@ class ExtractIE extends Extract { } } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } private String getURLFromIEBookmarkFile(AbstractFile fav) { @@ -276,7 +286,9 @@ class ExtractIE extends Extract { } } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /** @@ -376,7 +388,9 @@ class ExtractIE extends Extract { } } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /** diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractOs.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractOs.java index 753031021b..bf6e9f5f4d 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractOs.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractOs.java @@ -71,6 +71,10 @@ class ExtractOs extends Extract { try { progressBar.progress(Bundle.ExtractOS_progressMessage()); for (OS_TYPE value : OS_TYPE.values()) { + if (context.dataSourceIngestIsCancelled()) { + return; + } + checkForOSFiles(value); } } catch (TskCoreException ex) { diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractPrefetch.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractPrefetch.java index 5803aa119c..0c140fed4f 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractPrefetch.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractPrefetch.java @@ -36,7 +36,6 @@ import java.util.logging.Level; import org.openide.modules.InstalledFileLocator; import org.openide.util.NbBundle.Messages; import org.sleuthkit.autopsy.casemodule.Case; -import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.services.FileManager; import org.sleuthkit.autopsy.coreutils.ExecUtil; import org.sleuthkit.autopsy.coreutils.Logger; @@ -306,12 +305,8 @@ final class ExtractPrefetch extends Extract { logger.log(Level.SEVERE, "Error while trying to read into a sqlite db.", ex);//NON-NLS } - if (!blkBrdArtList.isEmpty()) { - try { - blackboard.postArtifacts(blkBrdArtList, MODULE_NAME); - } catch (Blackboard.BlackboardException ex) { - logger.log(Level.SEVERE, "Error Posting Artifact.", ex);//NON-NLS - } + if (!blkBrdArtList.isEmpty() && !context.dataSourceIngestIsCancelled()) { + postArtifacts(blkBrdArtList); } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java index 175a47044e..e5b443fc1b 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java @@ -58,7 +58,6 @@ import org.sleuthkit.datamodel.FsContent; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskData; -import org.sleuthkit.datamodel.TskDataException; /** * This module is based on the RecycleBin python module from Mark McKinnon. diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 38552dfd2e..e230bfda5a 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -292,6 +292,10 @@ class ExtractRegistry extends Extract { } for (AbstractFile regFile : allRegistryFiles) { + if (context.dataSourceIngestIsCancelled()) { + return; + } + String regFileName = regFile.getName(); long regFileId = regFile.getId(); String regFileNameLocal = RAImageIngestModule.getRATempPath(currentCase, "reg") + File.separator + regFileName; @@ -339,6 +343,10 @@ class ExtractRegistry extends Extract { NbBundle.getMessage(this.getClass(), "ExtractRegistry.analyzeRegFiles.failedParsingResults", this.getName(), regFileName)); } + + if (context.dataSourceIngestIsCancelled()) { + return; + } // create a report for the full output if (!regOutputFiles.fullPlugins.isEmpty()) { @@ -360,6 +368,11 @@ class ExtractRegistry extends Extract { NbBundle.getMessage(this.getClass(), "ExtractRegistry.analyzeRegFiles.failedParsingResults", this.getName(), regFileName)); } + + if (context.dataSourceIngestIsCancelled()) { + return; + } + try { Report report = currentCase.addReport(regOutputFiles.fullPlugins, NbBundle.getMessage(this.getClass(), "ExtractRegistry.parentModuleName.noSpace"), @@ -948,8 +961,10 @@ class ExtractRegistry extends Extract { } } catch (IOException ex) { } - - postArtifacts(newArtifacts); + + if (!context.dataSourceIngestIsCancelled()) { + postArtifacts(newArtifacts); + } } return false; } @@ -1031,7 +1046,8 @@ class ExtractRegistry extends Extract { } } } - if (!bbartifacts.isEmpty()) { + + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1144,7 +1160,9 @@ class ExtractRegistry extends Extract { } catch (TskCoreException ex) { logger.log(Level.WARNING, "Error updating TSK_OS_ACCOUNT artifacts to include newly parsed data.", ex); //NON-NLS } finally { - postArtifacts(newArtifacts); + if (!context.dataSourceIngestIsCancelled()) { + postArtifacts(newArtifacts); + } } return false; } @@ -1448,8 +1466,8 @@ class ExtractRegistry extends Extract { } line = reader.readLine(); } - if (!bbartifacts.isEmpty()) { - postArtifacts(bbartifacts); + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); } } @@ -1517,7 +1535,7 @@ class ExtractRegistry extends Extract { line = line.trim(); } } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1568,7 +1586,7 @@ class ExtractRegistry extends Extract { line = line.trim(); } } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty()&& !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1616,7 +1634,7 @@ class ExtractRegistry extends Extract { line = line.trim(); } } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1665,7 +1683,7 @@ class ExtractRegistry extends Extract { line = line.trim(); } } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1706,7 +1724,7 @@ class ExtractRegistry extends Extract { line = line.trim(); } } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1755,7 +1773,7 @@ class ExtractRegistry extends Extract { line = reader.readLine(); line = line.trim(); } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1818,7 +1836,7 @@ class ExtractRegistry extends Extract { line = line.trim(); } } - if (!bbartifacts.isEmpty()) { + if (!bbartifacts.isEmpty() && !context.dataSourceIngestIsCancelled()) { postArtifacts(bbartifacts); } } @@ -1950,7 +1968,9 @@ class ExtractRegistry extends Extract { artifacts.add(artifact); } } finally { - postArtifacts(artifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(artifacts); + } } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSafari.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSafari.java index c11e4fde22..5e1194d78b 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSafari.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSafari.java @@ -46,7 +46,6 @@ import org.sleuthkit.autopsy.datamodel.ContentUtils; import org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress; import org.sleuthkit.autopsy.ingest.IngestJobContext; import org.sleuthkit.autopsy.ingest.IngestServices; -import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.autopsy.recentactivity.BinaryCookieReader.Cookie; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; @@ -124,6 +123,10 @@ final class ExtractSafari extends Extract { this.addErrorMessage(Bundle.ExtractSafari_Error_Getting_History()); LOG.log(Level.SEVERE, "Exception thrown while processing history file.", ex); //NON-NLS } + + if (context.dataSourceIngestIsCancelled()) { + return; + } progressBar.progress(Bundle.Progress_Message_Safari_Bookmarks()); try { @@ -133,6 +136,10 @@ final class ExtractSafari extends Extract { LOG.log(Level.SEVERE, "Exception thrown while parsing Safari Bookmarks file.", ex); //NON-NLS } + if (context.dataSourceIngestIsCancelled()) { + return; + } + progressBar.progress(Bundle.Progress_Message_Safari_Downloads()); try { processDownloadsPList(dataSource, context); @@ -140,6 +147,10 @@ final class ExtractSafari extends Extract { this.addErrorMessage(Bundle.ExtractSafari_Error_Parsing_Bookmark()); LOG.log(Level.SEVERE, "Exception thrown while parsing Safari Download.plist file.", ex); //NON-NLS } + + if (context.dataSourceIngestIsCancelled()) { + return; + } progressBar.progress(Bundle.Progress_Message_Safari_Cookies()); try { @@ -292,7 +303,9 @@ final class ExtractSafari extends Extract { } try { - postArtifacts(getHistoryArtifacts(historyFile, tempHistoryFile.toPath(), context)); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(getHistoryArtifacts(historyFile, tempHistoryFile.toPath(), context)); + } } finally { tempHistoryFile.delete(); } @@ -319,7 +332,9 @@ final class ExtractSafari extends Extract { File tempFile = createTemporaryFile(context, file); try { - postArtifacts(getBookmarkArtifacts(file, tempFile, context)); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(getBookmarkArtifacts(file, tempFile, context)); + } } finally { tempFile.delete(); } @@ -347,8 +362,9 @@ final class ExtractSafari extends Extract { File tempFile = createTemporaryFile(context, file); try { - postArtifacts(getDownloadArtifacts(dataSource, file, tempFile)); - + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(getDownloadArtifacts(dataSource, file, tempFile)); + } } finally { if (tempFile != null) { tempFile.delete(); @@ -376,7 +392,9 @@ final class ExtractSafari extends Extract { try { tempFile = createTemporaryFile(context, file); - postArtifacts(getCookieArtifacts(file, tempFile, context)); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(getCookieArtifacts(file, tempFile, context)); + } } finally { if (tempFile != null) { diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSru.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSru.java index b8dd027278..310d5f8c62 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSru.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractSru.java @@ -386,10 +386,8 @@ final class ExtractSru extends Extract { logger.log(Level.SEVERE, "Error while trying to read into a sqlite db.", ex);//NON-NLS } - try { - blackboard.postArtifacts(bba, MODULE_NAME); - } catch (Blackboard.BlackboardException ex) { - logger.log(Level.SEVERE, "Error Posting Artifact.", ex);//NON-NLS + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bba); } } @@ -445,11 +443,10 @@ final class ExtractSru extends Extract { logger.log(Level.SEVERE, "Error while trying to read into a sqlite db.", ex);//NON-NLS } - try { - blackboard.postArtifacts(bba, MODULE_NAME); - } catch (Blackboard.BlackboardException ex) { - logger.log(Level.SEVERE, "Error Posting Artifact.", ex);//NON-NLS + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bba); } + } /** diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractWebAccountType.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractWebAccountType.java index 658f7e9d8c..54e50e9f01 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractWebAccountType.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractWebAccountType.java @@ -272,6 +272,7 @@ class ExtractWebAccountType extends Extract { } try { + List artifactList = new ArrayList<>(); for (RoleKey key : roles.keySet()) { if (context.dataSourceIngestIsCancelled()) { return; @@ -297,7 +298,11 @@ class ExtractWebAccountType extends Extract { NbBundle.getMessage(this.getClass(), "ExtractWebAccountType.parentModuleName"), role.getUrl())); - postArtifact(createArtifactWithAttributes(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_ACCOUNT_TYPE, file, bbattributes)); + artifactList.add(createArtifactWithAttributes(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_ACCOUNT_TYPE, file, bbattributes)); + } + + if (!context.dataSourceIngestIsCancelled()) { + postArtifacts(artifactList); } } catch (TskCoreException ex) { logger.log(Level.SEVERE, "Error creating web accounts", ex); diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java index 367c68e3c4..aaedc654b1 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractZoneIdentifier.java @@ -108,9 +108,11 @@ final class ExtractZoneIdentifier extends Extract { LOG.log(Level.WARNING, message, ex); } } - - postArtifacts(associatedObjectArtifacts); - postArtifacts(downloadArtifacts); + + if (!context.dataSourceIngestIsCancelled()) { + postArtifacts(associatedObjectArtifacts); + postArtifacts(downloadArtifacts); + } } /** diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java index e0bf5c10b8..ba1cba3394 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java @@ -112,18 +112,38 @@ class Firefox extends Extract { progressBar.progress(Bundle.Progress_Message_Firefox_History()); this.getHistory(); + if (context.dataSourceIngestIsCancelled()) { + return; + } + progressBar.progress(Bundle.Progress_Message_Firefox_Bookmarks()); this.getBookmark(); + if (context.dataSourceIngestIsCancelled()) { + return; + } + progressBar.progress(Bundle.Progress_Message_Firefox_Downloads()); this.getDownload(); + if (context.dataSourceIngestIsCancelled()) { + return; + } + progressBar.progress(Bundle.Progress_Message_Firefox_Cookies()); this.getCookie(); + if (context.dataSourceIngestIsCancelled()) { + return; + } + progressBar.progress(Bundle.Progress_Message_Firefox_FormHistory()); this.getFormsHistory(); + if (context.dataSourceIngestIsCancelled()) { + return; + } + progressBar.progress(Bundle.Progress_Message_Firefox_AutoFill()); this.getAutofillProfiles(); } @@ -225,7 +245,9 @@ class Firefox extends Extract { dbFile.delete(); } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /** @@ -319,7 +341,9 @@ class Firefox extends Extract { dbFile.delete(); } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /** @@ -346,6 +370,10 @@ class Firefox extends Extract { Collection bbartifacts = new ArrayList<>(); int j = 0; for (AbstractFile cookiesFile : cookiesFiles) { + if (context.dataSourceIngestIsCancelled()) { + return; + } + if (cookiesFile.getSize() == 0) { continue; } @@ -429,7 +457,9 @@ class Firefox extends Extract { dbFile.delete(); } - postArtifacts(bbartifacts); + if (!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /** @@ -576,7 +606,9 @@ class Firefox extends Extract { break; } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /** @@ -714,7 +746,9 @@ class Firefox extends Extract { break; } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /** @@ -832,7 +866,9 @@ class Firefox extends Extract { dbFile.delete(); } - postArtifacts(bbartifacts); + if(!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java index 4f6e477ed3..54474ab677 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java @@ -48,9 +48,9 @@ public final class RAImageIngestModule implements DataSourceIngestModule { private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName()); private final List extractors = new ArrayList<>(); private final List browserExtractors = new ArrayList<>(); - private IngestServices services = IngestServices.getInstance(); + private final IngestServices services = IngestServices.getInstance(); private IngestJobContext context; - private StringBuilder subCompleted = new StringBuilder(); + private final StringBuilder subCompleted = new StringBuilder(); RAImageIngestModule() { } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RecentDocumentsByLnk.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RecentDocumentsByLnk.java index 7b65b0c824..32341727cb 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RecentDocumentsByLnk.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RecentDocumentsByLnk.java @@ -41,9 +41,12 @@ import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; import org.sleuthkit.datamodel.Content; -import org.sleuthkit.datamodel.*; +import org.sleuthkit.datamodel.TskCoreException; +import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.ReadContentInputStream; import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT; import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT; +import org.sleuthkit.datamodel.TskData; /** * Recent documents class that will extract recent documents in the form of .lnk @@ -79,7 +82,7 @@ class RecentDocumentsByLnk extends Extract { this.getName())); return; } - + if (recentFiles.isEmpty()) { logger.log(Level.INFO, "Didn't find any recent files."); //NON-NLS return; @@ -132,8 +135,10 @@ class RecentDocumentsByLnk extends Extract { } } } - - postArtifacts(bbartifacts); + + if (!context.dataSourceIngestIsCancelled()) { + postArtifacts(bbartifacts); + } } /**