mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-19 11:07:43 +00:00
Combine OS attributes found in the registry.
This commit is contained in:
APriestman
parent
93eb80364a
commit
8ac91c2cb8
@ -59,9 +59,11 @@ import org.sleuthkit.autopsy.ingest.IngestJobContext;
|
||||
import org.sleuthkit.datamodel.*;
|
||||
|
||||
/**
|
||||
* Extracts activity from Internet Explorer browser, as well as recent documents in windows.
|
||||
* Extracts activity from Internet Explorer browser, as well as recent documents
|
||||
* in windows.
|
||||
*/
|
||||
class ExtractIE extends Extract {
|
||||
|
||||
private static final Logger logger = Logger.getLogger(ExtractIE.class.getName());
|
||||
private IngestServices services = IngestServices.getInstance();
|
||||
private String moduleTempResultsDir;
|
||||
@ -354,6 +356,7 @@ class ExtractIE extends Extract {
|
||||
|
||||
/**
|
||||
* Execute pasco on a single file that has been saved to disk.
|
||||
*
|
||||
* @param indexFilePath Path to local index.dat file to analyze
|
||||
* @param outputFileName Name of file to save output to
|
||||
* @return false on error
|
||||
@ -386,7 +389,9 @@ class ExtractIE extends Extract {
|
||||
|
||||
/**
|
||||
* parse Pasco output and create artifacts
|
||||
* @param origFile Original index.dat file that was analyzed to get this output
|
||||
*
|
||||
* @param origFile Original index.dat file that was analyzed to get this
|
||||
* output
|
||||
* @param pascoOutputFileName name of pasco output file
|
||||
*/
|
||||
private void parsePascoOutput(AbstractFile origFile, String pascoOutputFileName) {
|
||||
@ -511,7 +516,7 @@ class ExtractIE extends Extract {
|
||||
"ExtractIE.parentModuleName.noSpace"), user));
|
||||
bbart.addAttributes(bbattributes);
|
||||
|
||||
if( (!user.isEmpty()) && (!reportedUserAccounts.contains(user))){
|
||||
if ((!user.isEmpty()) && (!reportedUserAccounts.contains(user))) {
|
||||
BlackboardArtifact osAttr = origFile.newArtifact(ARTIFACT_TYPE.TSK_OS_ACCOUNT);
|
||||
osAttr.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_USER_NAME.getTypeID(),
|
||||
NbBundle.getMessage(this.getClass(), "ExtractIE.parentModuleName.noSpace"), user));
|
||||
|
||||
@ -43,6 +43,8 @@ import org.sleuthkit.autopsy.recentactivity.UsbDeviceIdMapper.USBInfo;
|
||||
import org.sleuthkit.datamodel.*;
|
||||
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
|
||||
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
|
||||
import org.sleuthkit.datamodel.OSUtility; // TEMP
|
||||
import org.sleuthkit.autopsy.casemodule.Case;
|
||||
import org.w3c.dom.Document;
|
||||
import org.w3c.dom.Element;
|
||||
import org.w3c.dom.Node;
|
||||
@ -51,10 +53,10 @@ import org.xml.sax.InputSource;
|
||||
import org.xml.sax.SAXException;
|
||||
|
||||
/**
|
||||
* Extract windows registry data using regripper.
|
||||
* Runs two versions of regripper. One is the generally available set of plug-ins
|
||||
* and the second is a set that were customized for Autopsy to produce a more structured
|
||||
* output of XML so that we can parse and turn into blackboard artifacts.
|
||||
* Extract windows registry data using regripper. Runs two versions of
|
||||
* regripper. One is the generally available set of plug-ins and the second is a
|
||||
* set that were customized for Autopsy to produce a more structured output of
|
||||
* XML so that we can parse and turn into blackboard artifacts.
|
||||
*/
|
||||
class ExtractRegistry extends Extract {
|
||||
|
||||
@ -97,10 +99,9 @@ class ExtractRegistry extends Extract {
|
||||
rrFullFound = true;
|
||||
}
|
||||
|
||||
if(rrFullRoot != null){
|
||||
if (rrFullRoot != null) {
|
||||
rrFullHome = rrFullRoot.getAbsolutePath();
|
||||
}
|
||||
else{
|
||||
} else {
|
||||
rrFullHome = "";
|
||||
}
|
||||
logger.log(Level.INFO, "RegRipper Full home: {0}", rrFullHome); //NON-NLS
|
||||
@ -122,18 +123,16 @@ class ExtractRegistry extends Extract {
|
||||
// find the user-specific ntuser-dat files
|
||||
try {
|
||||
allRegistryFiles.addAll(fileManager.findFiles(dataSource, "ntuser.dat")); //NON-NLS
|
||||
}
|
||||
catch (TskCoreException ex) {
|
||||
} catch (TskCoreException ex) {
|
||||
logger.log(Level.WARNING, "Error fetching 'ntuser.dat' file."); //NON-NLS
|
||||
}
|
||||
|
||||
// find the system hives'
|
||||
String[] regFileNames = new String[] {"system", "software", "security", "sam"}; //NON-NLS
|
||||
String[] regFileNames = new String[]{"system", "software", "security", "sam"}; //NON-NLS
|
||||
for (String regFileName : regFileNames) {
|
||||
try {
|
||||
allRegistryFiles.addAll(fileManager.findFiles(dataSource, regFileName, "/system32/config")); //NON-NLS
|
||||
}
|
||||
catch (TskCoreException ex) {
|
||||
} catch (TskCoreException ex) {
|
||||
String msg = NbBundle.getMessage(this.getClass(),
|
||||
"ExtractRegistry.findRegFiles.errMsg.errReadingFile", regFileName);
|
||||
logger.log(Level.WARNING, msg);
|
||||
@ -144,7 +143,8 @@ class ExtractRegistry extends Extract {
|
||||
}
|
||||
|
||||
/**
|
||||
* Identifies registry files in the database by mtimeItem, runs regripper on them, and parses the output.
|
||||
* Identifies registry files in the database by mtimeItem, runs regripper on
|
||||
* them, and parses the output.
|
||||
*/
|
||||
private void analyzeRegistryFiles() {
|
||||
List<AbstractFile> allRegistryFiles = findRegistryFiles();
|
||||
@ -179,10 +179,9 @@ class ExtractRegistry extends Extract {
|
||||
|
||||
try {
|
||||
if (logFile != null) {
|
||||
logFile.write(Integer.toString(j-1) + "\t" + regFile.getUniquePath() + "\n");
|
||||
logFile.write(Integer.toString(j - 1) + "\t" + regFile.getUniquePath() + "\n");
|
||||
}
|
||||
}
|
||||
catch (TskCoreException | IOException ex) {
|
||||
} catch (TskCoreException | IOException ex) {
|
||||
logger.log(Level.SEVERE, null, ex);
|
||||
}
|
||||
|
||||
@ -204,9 +203,8 @@ class ExtractRegistry extends Extract {
|
||||
// create a report for the full output
|
||||
if (regOutputFiles.fullPlugins.isEmpty() == false) {
|
||||
try {
|
||||
currentCase.addReport(regOutputFiles.fullPlugins, NbBundle.getMessage(this.getClass(),"ExtractRegistry.parentModuleName.noSpace"), "RegRipper " + regFile.getUniquePath() );
|
||||
}
|
||||
catch (TskCoreException e) {
|
||||
currentCase.addReport(regOutputFiles.fullPlugins, NbBundle.getMessage(this.getClass(), "ExtractRegistry.parentModuleName.noSpace"), "RegRipper " + regFile.getUniquePath());
|
||||
} catch (TskCoreException e) {
|
||||
this.addErrorMessage("Error adding regripper output as Autopsy report: " + e.getLocalizedMessage());
|
||||
}
|
||||
}
|
||||
@ -225,14 +223,17 @@ class ExtractRegistry extends Extract {
|
||||
}
|
||||
|
||||
private class RegOutputFiles {
|
||||
|
||||
public String autopsyPlugins = "";
|
||||
public String fullPlugins = "";
|
||||
}
|
||||
|
||||
/**
|
||||
* Execute regripper on the given registry.
|
||||
*
|
||||
* @param regFilePath Path to local copy of registry
|
||||
* @param outFilePathBase Path to location to save output file to. Base mtimeItem that will be extended on
|
||||
* @param outFilePathBase Path to location to save output file to. Base
|
||||
* mtimeItem that will be extended on
|
||||
*/
|
||||
private RegOutputFiles ripRegistryFile(String regFilePath, String outFilePathBase) {
|
||||
String autopsyType = ""; // Type argument for rr for autopsy-specific modules
|
||||
@ -243,22 +244,17 @@ class ExtractRegistry extends Extract {
|
||||
if (regFilePath.toLowerCase().contains("system")) { //NON-NLS
|
||||
autopsyType = "autopsysystem"; //NON-NLS
|
||||
fullType = "system"; //NON-NLS
|
||||
}
|
||||
else if (regFilePath.toLowerCase().contains("software")) { //NON-NLS
|
||||
} else if (regFilePath.toLowerCase().contains("software")) { //NON-NLS
|
||||
autopsyType = "autopsysoftware"; //NON-NLS
|
||||
fullType = "software"; //NON-NLS
|
||||
}
|
||||
else if (regFilePath.toLowerCase().contains("ntuser")) { //NON-NLS
|
||||
} else if (regFilePath.toLowerCase().contains("ntuser")) { //NON-NLS
|
||||
autopsyType = "autopsyntuser"; //NON-NLS
|
||||
fullType = "ntuser"; //NON-NLS
|
||||
}
|
||||
else if (regFilePath.toLowerCase().contains("sam")) { //NON-NLS
|
||||
} else if (regFilePath.toLowerCase().contains("sam")) { //NON-NLS
|
||||
fullType = "sam"; //NON-NLS
|
||||
}
|
||||
else if (regFilePath.toLowerCase().contains("security")) { //NON-NLS
|
||||
} else if (regFilePath.toLowerCase().contains("security")) { //NON-NLS
|
||||
fullType = "security"; //NON-NLS
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
return regOutputFiles;
|
||||
}
|
||||
|
||||
@ -308,7 +304,8 @@ class ExtractRegistry extends Extract {
|
||||
/**
|
||||
*
|
||||
* @param regFilePath Path to the output file produced by RegRipper.
|
||||
* @param regFile File object for registry that we are parsing (to make blackboard artifacts with)
|
||||
* @param regFile File object for registry that we are parsing (to make
|
||||
* blackboard artifacts with)
|
||||
* @return
|
||||
*/
|
||||
private boolean parseAutopsyPluginOutput(String regFilePath, AbstractFile regFile) {
|
||||
@ -369,7 +366,7 @@ class ExtractRegistry extends Extract {
|
||||
String winver = "";
|
||||
|
||||
// If all artifact nodes should really go under one Blackboard artifact, need to process it differently
|
||||
if(dataType.equals("WinVersion")){
|
||||
if (dataType.equals("WinVersion")) {
|
||||
|
||||
String version = "";
|
||||
String systemRoot = "";
|
||||
@ -387,26 +384,20 @@ class ExtractRegistry extends Extract {
|
||||
String value = artnode.getTextContent().trim();
|
||||
String name = artnode.getAttribute("name");
|
||||
|
||||
if(name.equals("ProductName")){ // NON_NLS
|
||||
if (name.equals("ProductName")) { // NON_NLS
|
||||
version = value;
|
||||
}
|
||||
else if(name.equals("CSDVersion")){ // NON_NLS
|
||||
} else if (name.equals("CSDVersion")) { // NON_NLS
|
||||
// This is dependant on the fact that ProductName shows up first in the module output
|
||||
version = version + " " + value;
|
||||
}
|
||||
else if(name.equals("SystemRoot")){
|
||||
} else if (name.equals("SystemRoot")) {
|
||||
systemRoot = value;
|
||||
}
|
||||
else if(name.equals("ProductId")){
|
||||
} else if (name.equals("ProductId")) {
|
||||
productId = value;
|
||||
}
|
||||
else if(name.equals("RegisteredOwner")){
|
||||
} else if (name.equals("RegisteredOwner")) {
|
||||
regOwner = value;
|
||||
}
|
||||
else if(name.equals("RegisteredOrganization")){
|
||||
} else if (name.equals("RegisteredOrganization")) {
|
||||
regOrg = value;
|
||||
}
|
||||
else if(name.equals("InstallDate")){
|
||||
} else if (name.equals("InstallDate")) {
|
||||
try {
|
||||
Long epochtime = new SimpleDateFormat("EEE MMM d HH:mm:ss yyyy").parse(value).getTime();
|
||||
installtime = epochtime;
|
||||
@ -422,20 +413,27 @@ class ExtractRegistry extends Extract {
|
||||
try {
|
||||
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), parentModuleName, version));
|
||||
if(installtime != null){
|
||||
if (installtime != null) {
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), parentModuleName, installtime));
|
||||
}
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(), parentModuleName, systemRoot));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PRODUCT_ID.getTypeID(), parentModuleName, productId));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_OWNER.getTypeID(), parentModuleName, regOwner));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_ORGANIZATION.getTypeID(), parentModuleName, regOrg));
|
||||
|
||||
// Check if there is already an OS_INFO artifact for this file, and add to that if possible.
|
||||
ArrayList<BlackboardArtifact> results = tempDb.getBlackboardArtifacts(ARTIFACT_TYPE.TSK_OS_INFO, regFile.getId());
|
||||
if (results.isEmpty()) {
|
||||
BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_OS_INFO);
|
||||
bbart.addAttributes(bbattributes);
|
||||
} else {
|
||||
results.get(0).addAttributes(bbattributes);
|
||||
}
|
||||
|
||||
} catch (TskCoreException ex) {
|
||||
logger.log(Level.SEVERE, "Error adding installed program artifact to blackboard."); //NON-NLS
|
||||
}
|
||||
}
|
||||
else if(dataType.equals("Profiler")){ // NON-NLS
|
||||
} else if (dataType.equals("Profiler")) { // NON-NLS
|
||||
|
||||
String os = "";
|
||||
String procArch = "";
|
||||
@ -451,16 +449,13 @@ class ExtractRegistry extends Extract {
|
||||
String value = artnode.getTextContent().trim();
|
||||
String name = artnode.getAttribute("name");
|
||||
|
||||
if(name.equals("OS")){ // NON-NLS
|
||||
if (name.equals("OS")) { // NON-NLS
|
||||
os = value;
|
||||
}
|
||||
else if(name.equals("PROCESSOR_ARCHITECTURE")){ // NON-NLS
|
||||
} else if (name.equals("PROCESSOR_ARCHITECTURE")) { // NON-NLS
|
||||
procArch = value;
|
||||
}
|
||||
else if(name.equals("PROCESSOR_IDENTIFIER")){ //NON-NLS
|
||||
} else if (name.equals("PROCESSOR_IDENTIFIER")) { //NON-NLS
|
||||
procId = value;
|
||||
}
|
||||
else if(name.equals("TEMP")){
|
||||
} else if (name.equals("TEMP")) {
|
||||
tempDir = value;
|
||||
}
|
||||
}
|
||||
@ -472,13 +467,19 @@ class ExtractRegistry extends Extract {
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE.getTypeID(), parentModuleName, procArch));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROCESSOR_NAME.getTypeID(), parentModuleName, procId));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TEMP_DIR.getTypeID(), parentModuleName, tempDir));
|
||||
|
||||
// Check if there is already an OS_INFO artifact for this file and add to that if possible
|
||||
ArrayList<BlackboardArtifact> results = tempDb.getBlackboardArtifacts(ARTIFACT_TYPE.TSK_OS_INFO, regFile.getId());
|
||||
if (results.isEmpty()) {
|
||||
BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_OS_INFO);
|
||||
bbart.addAttributes(bbattributes);
|
||||
} else {
|
||||
results.get(0).addAttributes(bbattributes);
|
||||
}
|
||||
} catch (TskCoreException ex) {
|
||||
logger.log(Level.SEVERE, "Error adding os info artifact to blackboard."); //NON-NLS
|
||||
}
|
||||
}
|
||||
else if(dataType.equals("CompName")){ // NON-NLS
|
||||
} else if (dataType.equals("CompName")) { // NON-NLS
|
||||
|
||||
String compName = "";
|
||||
String domain = "";
|
||||
@ -492,10 +493,9 @@ class ExtractRegistry extends Extract {
|
||||
String value = artnode.getTextContent().trim();
|
||||
String name = artnode.getAttribute("name");
|
||||
|
||||
if(name.equals("ComputerName")){ // NON-NLS
|
||||
if (name.equals("ComputerName")) { // NON-NLS
|
||||
compName = value;
|
||||
}
|
||||
else if(name.equals("Domain")){ // NON-NLS
|
||||
} else if (name.equals("Domain")) { // NON-NLS
|
||||
domain = value;
|
||||
}
|
||||
}
|
||||
@ -505,13 +505,19 @@ class ExtractRegistry extends Extract {
|
||||
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), parentModuleName, compName));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DOMAIN.getTypeID(), parentModuleName, domain));
|
||||
|
||||
// Check if there is already an OS_INFO artifact for this file and add to that if possible
|
||||
ArrayList<BlackboardArtifact> results = tempDb.getBlackboardArtifacts(ARTIFACT_TYPE.TSK_OS_INFO, regFile.getId());
|
||||
if (results.isEmpty()) {
|
||||
BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_OS_INFO);
|
||||
bbart.addAttributes(bbattributes);
|
||||
} else {
|
||||
results.get(0).addAttributes(bbattributes);
|
||||
}
|
||||
} catch (TskCoreException ex) {
|
||||
logger.log(Level.SEVERE, "Error adding os info artifact to blackboard."); //NON-NLS
|
||||
}
|
||||
}
|
||||
else{
|
||||
} else {
|
||||
for (int j = 0; j < myartlist.getLength(); j++) {
|
||||
Node artchild = myartlist.item(j);
|
||||
// If it has attributes, then it is an Element (based off API)
|
||||
@ -569,7 +575,7 @@ class ExtractRegistry extends Extract {
|
||||
|
||||
try {
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), parentModuleName, value));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(),parentModuleName, itemMtime));
|
||||
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), parentModuleName, itemMtime));
|
||||
BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_INSTALLED_PROG);
|
||||
bbart.addAttributes(bbattributes);
|
||||
} catch (TskCoreException ex) {
|
||||
@ -629,14 +635,13 @@ class ExtractRegistry extends Extract {
|
||||
break;
|
||||
|
||||
case "NtuserNetwork": // NON-NLS
|
||||
try{
|
||||
try {
|
||||
String localPath = artnode.getAttribute("localPath");
|
||||
String remoteName = value;
|
||||
|
||||
BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED);
|
||||
bbart.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(),
|
||||
BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_REMOTE_DRIVE);
|
||||
bbart.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LOCAL_PATH.getTypeID(),
|
||||
parentModuleName, localPath));
|
||||
bbart.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(),
|
||||
bbart.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REMOTE_PATH.getTypeID(),
|
||||
parentModuleName, remoteName));
|
||||
|
||||
} catch (TskCoreException ex) {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user