Merged in develop branch as of March 24, 2014

This commit is contained in:
Richard Cordovano 2014-03-24 12:35:48 -04:00
commit 87bb0211f2
19 changed files with 130 additions and 76 deletions

View File

@ -106,7 +106,7 @@ import org.sleuthkit.datamodel.TskException;
}
// this sleep here prevents the UI from locking up
// due to too frequent updates to the progressMonitor above
Thread.sleep(2 * 1000);
Thread.sleep(500);
}
} catch (InterruptedException ie) {
// nothing to do, thread was interrupted externally

View File

@ -391,12 +391,21 @@ public class DataResultViewerTable extends AbstractDataResultViewer {
// Populate a two-dimensional array with rows of property values for up
// to maxRows children of the node passed in.
private static Object[][] getRowValues(Node node, int maxRows) {
Object[][] rowValues = new Object[Math.min(maxRows, node.getChildren().getNodesCount())][];
int numRows = Math.min(maxRows, node.getChildren().getNodesCount());
Object[][] rowValues = new Object[numRows][];
int rowCount = 0;
for (Node child : node.getChildren().getNodes()) {
if (rowCount >= maxRows) {
break;
}
// BC: I got this once, I think it was because the table
// refreshed while we were in this method
// could be better synchronized. Or it was from
// the lazy nodes updating... Didn't have time
// to fully debug it.
if (rowCount > numRows) {
break;
}
PropertySet[] propertySets = child.getPropertySets();
if (propertySets.length > 0) {
Property[] properties = propertySets[0].getProperties();

View File

@ -442,6 +442,8 @@ import org.sleuthkit.datamodel.TskCoreException;
NotifyDescriptor.ERROR_MESSAGE);
DialogDisplayer.getDefault().notify(d);
logger.log(Level.SEVERE, "Error making thumbnails: " + ex.getMessage());
} // catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex) {
}
}
}.execute();

View File

@ -678,6 +678,8 @@ public class GstVideoPanel extends MediaViewVideoPanel {
logger.log(Level.WARNING, "Error updating video progress: " + ex.getMessage());
infoLabel.setText("Error updating video progress: " + ex.getMessage());
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
}
} //end class progress worker

View File

@ -320,6 +320,8 @@ import org.sleuthkit.datamodel.VolumeSystem;
NbBundle.getMessage(this.getClass(), "ExtractUnallocAction.done.errMsg.title"),
NbBundle.getMessage(this.getClass(), "ExtractUnallocAction.done.errMsg.msg", ex.getMessage()));
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
}
}

View File

@ -176,6 +176,10 @@ public class ViewContextAction extends AbstractAction {
logger.log(Level.WARNING, "Failed to get nodes in selection worker.", ex);
return;
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) {
return;
}
// It is possible the user selected a different Node to be displayed
// in the DataResultViewer while the child Nodes were being generated.

View File

@ -210,6 +210,7 @@ public final class IngestJobLauncher {
moduleNames.add("Extension Mismatch Detector");
break;
case "EWF Verify":
case "E01 Verify":
moduleNames.add("E01 Verifier");
break;
default:

View File

@ -262,6 +262,8 @@ import org.sleuthkit.datamodel.TskData;
MessageNotifyUtil.MessageType.ERROR);
logger.log(Level.SEVERE, "failed to generate reports", ex);
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
}
}
@ -364,6 +366,8 @@ import org.sleuthkit.datamodel.TskData;
MessageNotifyUtil.MessageType.ERROR);
logger.log(Level.SEVERE, "failed to generate reports", ex);
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
}
}
@ -626,6 +630,8 @@ import org.sleuthkit.datamodel.TskData;
MessageNotifyUtil.MessageType.ERROR);
logger.log(Level.SEVERE, "failed to generate reports", ex);
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
}
/**

View File

@ -153,20 +153,20 @@ class FileExtMismatchXML {
Element rootEl = doc.createElement(ROOT_EL);
doc.appendChild(rootEl);
ArrayList<String> appTypeList = new ArrayList<>(sigTypeToExtMap.keySet());
Collections.sort(appTypeList);
ArrayList<String> mimeTypeList = new ArrayList<>(sigTypeToExtMap.keySet());
Collections.sort(mimeTypeList);
for (String appType : appTypeList) {
for (String mimeType : mimeTypeList) {
Element sigEl = doc.createElement(SIG_EL);
sigEl.setAttribute(SIG_MIMETYPE_ATTR, appType);
sigEl.setAttribute(SIG_MIMETYPE_ATTR, mimeType.toLowerCase());
String[] extArray = sigTypeToExtMap.get(appType);
String[] extArray = sigTypeToExtMap.get(mimeType);
if (extArray != null) {
ArrayList<String> extList = new ArrayList<>(Arrays.asList(extArray));
Collections.sort(extList);
for (String ext : extList) {
Element extEl = doc.createElement(EXT_EL);
extEl.setTextContent(ext);
extEl.setTextContent(ext.toLowerCase());
sigEl.appendChild(extEl);
}
}

View File

@ -69,8 +69,9 @@
<ext>tgz</ext>
</signature>
<signature mimetype="application/x-msoffice">
<ext>automaticDestinations-ms</ext>
<ext>customDestinations-ms</ext>
<ext>automaticdestinations-ms</ext>
<ext>bag</ext>
<ext>customdestinations-ms</ext>
<ext>db</ext>
<ext>db.keep</ext>
<ext>doc</ext>
@ -79,6 +80,7 @@
<ext>dot</ext>
<ext>dotm</ext>
<ext>dotx</ext>
<ext>dpb</ext>
<ext>feed-ms</ext>
<ext>gra</ext>
<ext>msi</ext>
@ -139,6 +141,7 @@
<ext>ppsm</ext>
<ext>pptm</ext>
<ext>pptx</ext>
<ext>vs</ext>
<ext>wmz</ext>
<ext>xlam</ext>
<ext>xlsb</ext>
@ -251,6 +254,7 @@
<signature mimetype="text/plain">
<ext>acro</ext>
<ext>adm</ext>
<ext>admx</ext>
<ext>aff</ext>
<ext>arff</ext>
<ext>ashx</ext>
@ -263,6 +267,7 @@
<ext>c</ext>
<ext>catalog</ext>
<ext>cc</ext>
<ext>cdxml</ext>
<ext>cfg</ext>
<ext>chs</ext>
<ext>cht</ext>
@ -308,6 +313,7 @@
<ext>iem</ext>
<ext>inc</ext>
<ext>inf</ext>
<ext>inf_loc</ext>
<ext>ini</ext>
<ext>ins</ext>
<ext>iqy</ext>
@ -356,7 +362,11 @@
<ext>properties</ext>
<ext>prx</ext>
<ext>ps</ext>
<ext>ps1</ext>
<ext>ps1xml</ext>
<ext>psd1</ext>
<ext>psm</ext>
<ext>psm1</ext>
<ext>psp</ext>
<ext>py</ext>
<ext>pyw</ext>
@ -397,10 +407,12 @@
<ext>winprf_backup</ext>
<ext>wpl</ext>
<ext>wsdl</ext>
<ext>xaml</ext>
<ext>xdc</ext>
<ext>xdr</ext>
<ext>xhtml</ext>
<ext>xml</ext>
<ext>xrm-ms</ext>
<ext>xsd</ext>
<ext>xsl</ext>
<ext>xsml</ext>
@ -421,6 +433,7 @@
<ext>mpv</ext>
</signature>
<signature mimetype="video/quicktime">
<ext>m4a</ext>
<ext>mov</ext>
<ext>mp4</ext>
<ext>qt</ext>

View File

@ -1013,6 +1013,8 @@ public class HashDbManager implements PropertyChangeListener {
"Error creating index: " + ex.getMessage(),
MessageNotifyUtil.MessageType.ERROR);
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
try {
hashDb.propertyChangeSupport.firePropertyChange(HashDb.Event.INDEXING_DONE.toString(), null, hashDb);

View File

@ -711,6 +711,8 @@ class ExtractedContentPanel extends javax.swing.JPanel {
} catch (InterruptedException | ExecutionException ex) {
logger.log(Level.SEVERE, "Error getting marked up text" );
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
if (markup != null) {

View File

@ -1001,6 +1001,8 @@ public final class KeywordSearchIngestModule extends IngestModuleAdapter impleme
logger.log(Level.SEVERE, "Error performing keyword search: " + e.getMessage());
services.postMessage(IngestMessage.createErrorMessage(++messageID, KeywordSearchModuleFactory.getModuleName(), "Error performing keyword search", e.getMessage()));
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
}
/**

View File

@ -610,6 +610,8 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValueQuery> {
} catch (InterruptedException | ExecutionException ex) {
logger.log(Level.SEVERE, "Error querying ", ex);
}
// catch and ignore if we were cancelled
catch (java.util.concurrent.CancellationException ex ) { }
}
private static synchronized void registerWriter(ResultWriter writer) {

View File

@ -9,6 +9,7 @@
# http://msdn.microsoft.com/en-us/library/ms954376.aspx
#
# Change History:
# 20120523 - updated to include 64-bit systems
# 20100116 - Minor updates
# 20090413 - Extract DisplayVersion info
# 20090128 - Added references
@ -23,12 +24,12 @@ my %config = (hive => "Software",
hasShortDescr => 1,
hasDescr => 0,
hasRefs => 0,
version => 20100116);
version => 20120523);
sub getConfig{return %config}
sub getShortDescr {
return "Gets contents of Uninstall key from Software hive";
return "Gets contents of Uninstall keys (64- & 32-bit) from Software hive";
}
sub getDescr{}
sub getRefs {}
@ -44,49 +45,55 @@ sub pluginmain {
my $reg = Parse::Win32Registry->new($hive);
my $root_key = $reg->get_root_key;
my $key_path = 'Microsoft\\Windows\\CurrentVersion\\Uninstall';
my $key;
if ($key = $root_key->get_subkey($key_path)) {
#::rptMsg("Uninstall");
#::rptMsg($key_path);
#::rptMsg("");
::rptMsg("<uninstall>");
::rptMsg("<mtime>".gmtime($key->get_timestamp())."</mtime>");
::rptMsg("<artifacts>");
my %uninst;
my @subkeys = $key->get_list_of_subkeys();
if (scalar(@subkeys) > 0) {
foreach my $s (@subkeys) {
my $lastwrite = $s->get_timestamp();
my $display;
eval {
$display = $s->get_value("DisplayName")->get_data();
};
$display = $s->get_name() if ($display eq "");
my $ver;
eval {
$ver = $s->get_value("DisplayVersion")->get_data();
};
$display .= " v\.".$ver unless ($@);
push(@{$uninst{$lastwrite}},$display);
}
foreach my $t (reverse sort {$a <=> $b} keys %uninst) {
#::rptMsg("<item mtime=\"". gmtime($t)."\">");
foreach my $item (@{$uninst{$t}}) {
::rptMsg("<item mtime=\"". gmtime($t)."\">" .$item."</item>");
}
#::rptMsg("");
}
}
else {
#::rptMsg($key_path." has no subkeys.");
}
}
else {
#::rptMsg($key_path." not found.");
}
my @keys = ('Microsoft\\Windows\\CurrentVersion\\Uninstall',
'Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall');
::rptMsg("<uninstall>");
::rptMsg("<artifacts>");
foreach my $key_path (@keys) {
my $key;
if ($key = $root_key->get_subkey($key_path)) {
#::rptMsg("Uninstall");
#::rptMsg($key_path);
#::rptMsg("");
#::rptMsg("<mtime>".gmtime($key->get_timestamp())."</mtime>");
my %uninst;
my @subkeys = $key->get_list_of_subkeys();
if (scalar(@subkeys) > 0) {
foreach my $s (@subkeys) {
my $lastwrite = $s->get_timestamp();
my $display;
eval {
$display = $s->get_value("DisplayName")->get_data();
};
$display = $s->get_name() if ($display eq "");
my $ver;
eval {
$ver = $s->get_value("DisplayVersion")->get_data();
};
$display .= " v\.".$ver unless ($@);
push(@{$uninst{$lastwrite}},$display);
}
foreach my $t (reverse sort {$a <=> $b} keys %uninst) {
#::rptMsg("<item mtime=\"". gmtime($t)."\">");
foreach my $item (@{$uninst{$t}}) {
::rptMsg("<item mtime=\"". gmtime($t)."\">" .$item."</item>");
}
#::rptMsg("");
}
}
else {
#::rptMsg($key_path." has no subkeys.");
}
}
else {
#::rptMsg($key_path." not found.");
}
}
::rptMsg("</artifacts></uninstall>");
}
1;

View File

@ -77,7 +77,7 @@ class Firefox extends Extract {
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> historyFiles;
try {
historyFiles = fileManager.findFiles(dataSource, "%places.sqlite%", "Firefox");
historyFiles = fileManager.findFiles(dataSource, "places.sqlite", "Firefox");
} catch (TskCoreException ex) {
String msg = NbBundle.getMessage(this.getClass(), "Firefox.getHistory.errMsg.errFetchingFiles");
logger.log(Level.WARNING, msg);

View File

@ -1,8 +1,8 @@
OpenIDE-Module-Name=ewfVerify
EwfVerifyIngestModule.moduleName.text=EWF Verifier
EwfVerifyIngestModule.moduleName.text=E01 Verifier
EwfVerifyIngestModule.moduleDesc.text=Validates the integrity of E01 files.
EwfVerifyIngestModule.process.errProcImg=Error processing {0}
EwfVerifyIngestModule.process.skipNonEwf=Skipping non-ewf image {0}
EwfVerifyIngestModule.process.skipNonEwf=Skipping non-E01 image {0}
EwfVerifyIngestModule.process.noStoredHash=Image {0} does not have stored hash.
EwfVerifyIngestModule.process.startingImg=Starting {0}
EwfVerifyIngestModule.process.errGetSizeOfImg=Error getting size of {0}. Image will not be processed.
@ -10,7 +10,7 @@ EwfVerifyIngestModule.process.errReadImgAtChunk=Error reading {0} at chunk {1}
EwfVerifyIngestModule.init.exception.failGetMd5=Failed to get MD5 algorithm
EwfVerifyIngestModule.complete.verified=\ verified
EwfVerifyIngestModule.complete.notVerified=\ not verified
EwfVerifyIngestModule.complete.verifResultsHead=<p>EWF Verification Results for {0}</p>
EwfVerifyIngestModule.complete.verifResultsHead=<p>E01 Verification Results for {0}</p>
EwfVerifyIngestModule.complete.resultLi=<li>Result\:{0}</li>
EwfVerifyIngestModule.complete.calcHashLi=<li>Calculated hash\: {0}</li>
EwfVerifyIngestModule.complete.storedHashLi=<li>Stored hash\: {0}</li>

View File

@ -1,16 +1,16 @@
OpenIDE-Module-Name=EWF\u30D9\u30EA\u30D5\u30A1\u30A4
EwfVerifyIngestModule.process.errProcImg={0}\u306E\u51E6\u7406\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F
EwfVerifyIngestModule.moduleName.text=EWF\u30D9\u30EA\u30D5\u30A1\u30A4
EwfVerifyIngestModule.moduleDesc.text=E01\u30D5\u30A1\u30A4\u30EB\u306E\u6574\u5408\u6027\u3092\u8A8D\u8A3C\u3057\u307E\u3059\u3002
EwfVerifyIngestModule.process.skipNonEwf=EWF\u30A4\u30E1\u30FC\u30B8\u3067\u306F\u306A\u3044{0}\u3092\u30B9\u30AD\u30C3\u30D7\u3057\u3066\u3044\u307E\u3059
EwfVerifyIngestModule.process.noStoredHash=\u30A4\u30E1\u30FC\u30B8{0}\u306F\u30CF\u30C3\u30B7\u30E5\u304C\u683C\u7D0D\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002
EwfVerifyIngestModule.process.startingImg={0}\u3092\u958B\u59CB\u4E2D
EwfVerifyIngestModule.process.errGetSizeOfImg={0}\u306E\u30B5\u30A4\u30BA\u306E\u53D6\u5F97\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F\u3002\u30A4\u30E1\u30FC\u30B8\u306F\u51E6\u7406\u3055\u308C\u307E\u305B\u3093\u3002
EwfVerifyIngestModule.process.errReadImgAtChunk={0}\u306E\u30C1\u30E3\u30F3\u30AF{1}\u306E\u8AAD\u307F\u53D6\u308A\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F
EwfVerifyIngestModule.init.exception.failGetMd5=MD5\u30A2\u30EB\u30B4\u30EA\u30BA\u30E0\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F
EwfVerifyIngestModule.complete.verified=\u8A8D\u8A3C\u3055\u308C\u307E\u3057\u305F
EwfVerifyIngestModule.complete.notVerified=\u8A8D\u8A3C\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F
EwfVerifyIngestModule.complete.verifResultsHead=<p>{0}\u306EEWF\u8A8D\u8A3C\u7D50\u679C</p>
EwfVerifyIngestModule.complete.resultLi=<li>\u7D50\u679C\uFF1A{0}</li>
EwfVerifyIngestModule.complete.calcHashLi=<li>\u8A08\u7B97\u3055\u308C\u305F\u30CF\u30C3\u30B7\u30E5\uFF1A{0}</li>
EwfVerifyIngestModule.complete.storedHashLi=<li>\u683C\u7D0D\u3055\u308C\u305F\u30CF\u30C3\u30B7\u30E5\uFF1A{0}</li>
OpenIDE-Module-Name=EWF\u30d9\u30ea\u30d5\u30a1\u30a4
EwfVerifyIngestModule.process.errProcImg={0}\u306e\u51e6\u7406\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f
EwfVerifyIngestModule.moduleName.text=E01\u30d9\u30ea\u30d5\u30a1\u30a4
EwfVerifyIngestModule.moduleDesc.text=E01\u30d5\u30a1\u30a4\u30eb\u306e\u6574\u5408\u6027\u3092\u8a8d\u8a3c\u3057\u307e\u3059\u3002
EwfVerifyIngestModule.process.skipNonEwf=E01\u30a4\u30e1\u30fc\u30b8\u3067\u306f\u306a\u3044{0}\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u3066\u3044\u307e\u3059
EwfVerifyIngestModule.process.noStoredHash=\u30a4\u30e1\u30fc\u30b8{0}\u306f\u30cf\u30c3\u30b7\u30e5\u304c\u683c\u7d0d\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u3002
EwfVerifyIngestModule.process.startingImg={0}\u3092\u958b\u59cb\u4e2d
EwfVerifyIngestModule.process.errGetSizeOfImg={0}\u306e\u30b5\u30a4\u30ba\u306e\u53d6\u5f97\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u30a4\u30e1\u30fc\u30b8\u306f\u51e6\u7406\u3055\u308c\u307e\u305b\u3093\u3002
EwfVerifyIngestModule.process.errReadImgAtChunk={0}\u306e\u30c1\u30e3\u30f3\u30af{1}\u306e\u8aad\u307f\u53d6\u308a\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f
EwfVerifyIngestModule.init.exception.failGetMd5=MD5\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306e\u53d6\u5f97\u306b\u5931\u6557\u3057\u307e\u3057\u305f
EwfVerifyIngestModule.complete.verified=\u8a8d\u8a3c\u3055\u308c\u307e\u3057\u305f
EwfVerifyIngestModule.complete.notVerified=\u8a8d\u8a3c\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f
EwfVerifyIngestModule.complete.verifResultsHead=<p>{0}\u306eE01\u8a8d\u8a3c\u7d50\u679c</p>
EwfVerifyIngestModule.complete.resultLi=<li>\u7d50\u679c\uff1a{0}</li>
EwfVerifyIngestModule.complete.calcHashLi=<li>\u8a08\u7b97\u3055\u308c\u305f\u30cf\u30c3\u30b7\u30e5\uff1a{0}</li>
EwfVerifyIngestModule.complete.storedHashLi=<li>\u683c\u7d0d\u3055\u308c\u305f\u30cf\u30c3\u30b7\u30e5\uff1a{0}</li>

View File

@ -117,7 +117,7 @@ public class EwfVerifyIngestModule extends IngestModuleAdapter implements DataSo
return ProcessResult.ERROR;
}
logger.log(Level.INFO, "Starting ewf verification of {0}", img.getName());
logger.log(Level.INFO, "Starting hash verification of {0}", img.getName());
services.postMessage(IngestMessage.createMessage(++messageId, MessageType.INFO, EwfVerifierModuleFactory.getModuleName(),
NbBundle.getMessage(this.getClass(),
"EwfVerifyIngestModule.process.startingImg",