diff --git a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java index 9aaa375eba..31006d7e93 100755 --- a/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java +++ b/Core/src/org/sleuthkit/autopsy/discovery/search/DomainSearchCacheLoader.java @@ -63,7 +63,7 @@ class DomainSearchCacheLoader extends CacheLoader searchAttributes = new ArrayList<>(); + Set searchAttributes = new HashSet<>(); searchAttributes.add(key.getGroupAttributeType()); searchAttributes.addAll(key.getFileSortingMethod().getRequiredAttributes()); for (AttributeType attr : searchAttributes) { @@ -304,7 +304,7 @@ class DomainSearchCacheLoader extends CacheLoader { return compareStrings(first.getDomain().toLowerCase(), second.getDomain().toLowerCase()); }; } - + /** * Sorts domains by page view count. - * + * * This comparator sorts results in descending order (largest -> smallest). */ private static Comparator getPageViewComparator() { return (Result domain1, Result domain2) -> { - if (domain1.getType() != SearchData.Type.DOMAIN || - domain2.getType() != SearchData.Type.DOMAIN) { + if (domain1.getType() != SearchData.Type.DOMAIN + || domain2.getType() != SearchData.Type.DOMAIN) { return 0; } ResultDomain first = (ResultDomain) domain1; ResultDomain second = (ResultDomain) domain2; - + long firstPageViews = first.getTotalPageViews(); long secondPageViews = second.getTotalPageViews(); return Long.compare(secondPageViews, firstPageViews); }; } - + /** - * Sorts result domains by last activity date time. The results will be in + * Sorts result domains by last activity date time. The results will be in * descending order. */ private static Comparator getLastActivityDateTimeComparator() { return (Result domain1, Result domain2) -> { - if (domain1.getType() != SearchData.Type.DOMAIN || - domain2.getType() != SearchData.Type.DOMAIN) { + if (domain1.getType() != SearchData.Type.DOMAIN + || domain2.getType() != SearchData.Type.DOMAIN) { return 0; } ResultDomain first = (ResultDomain) domain1; ResultDomain second = (ResultDomain) domain2; - + long firstActivityEnd = first.getActivityEnd(); long secondActivityEnd = second.getActivityEnd(); return Long.compare(secondActivityEnd, firstActivityEnd); }; } - + /** - * Sorts result domains by most file downloads. The results will be in + * Sorts result domains by most file downloads. The results will be in * descending order. */ private static Comparator getWebDownloadsComparator() { return (Result domain1, Result domain2) -> { - if (domain1.getType() != SearchData.Type.DOMAIN || - domain2.getType() != SearchData.Type.DOMAIN) { + if (domain1.getType() != SearchData.Type.DOMAIN + || domain2.getType() != SearchData.Type.DOMAIN) { return 0; } ResultDomain first = (ResultDomain) domain1; ResultDomain second = (ResultDomain) domain2; - + long firstFilesDownloaded = first.getFilesDownloaded(); long secondFilesDownloaded = second.getFilesDownloaded(); return Long.compare(secondFilesDownloaded, firstFilesDownloaded); @@ -388,10 +388,10 @@ public class ResultsSorter implements Comparator { Bundle.FileSorter_SortingMethod_keywordlist_displayName()), // Sort alphabetically by list of keyword list names found BY_FULL_PATH(new ArrayList<>(), Bundle.FileSorter_SortingMethod_fullPath_displayName()), // Sort alphabetically by path - BY_DOMAIN_NAME(new ArrayList<>(),Bundle.FileSorter_SortingMethod_domain_displayName()), - BY_PAGE_VIEWS(new ArrayList<>(), Bundle.FileSorter_SortingMethod_pageViews_displayName()), - BY_DOWNLOADS(new ArrayList<>(), Bundle.FileSorter_SortingMethod_downloads_displayName()), - BY_LAST_ACTIVITY(new ArrayList<>(), Bundle.FileSorter_SortingMethod_activity_displayName()); + BY_DOMAIN_NAME(Arrays.asList(new DiscoveryAttributes.DomainCategoryAttribute()), Bundle.FileSorter_SortingMethod_domain_displayName()), + BY_PAGE_VIEWS(Arrays.asList(new DiscoveryAttributes.DomainCategoryAttribute()), Bundle.FileSorter_SortingMethod_pageViews_displayName()), + BY_DOWNLOADS(Arrays.asList(new DiscoveryAttributes.DomainCategoryAttribute()), Bundle.FileSorter_SortingMethod_downloads_displayName()), + BY_LAST_ACTIVITY(Arrays.asList(new DiscoveryAttributes.DomainCategoryAttribute()), Bundle.FileSorter_SortingMethod_activity_displayName()); private final String displayName; private final List requiredAttributes; diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java index df85f35ef3..f1910a6153 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java @@ -287,10 +287,10 @@ public final class LeappFileProcessor { TskCoreException { if (LeappFile == null || !LeappFile.exists() || fileName == null) { - logger.log(Level.SEVERE, String.format("Leap file: %s is null or does not exist", LeappFile == null ? LeappFile.toString() : "")); + logger.log(Level.WARNING, String.format("Leap file: %s is null or does not exist", LeappFile == null ? LeappFile.toString() : "")); return; } else if (attrList == null || artifactType == null || dataSource == null) { - logger.log(Level.SEVERE, String.format("attribute list, artifact type or dataSource not provided for %s", LeappFile == null ? LeappFile.toString() : "")); + logger.log(Level.WARNING, String.format("attribute list, artifact type or dataSource not provided for %s", LeappFile == null ? LeappFile.toString() : "")); return; } @@ -330,16 +330,18 @@ public final class LeappFileProcessor { if (MapUtils.isEmpty(columnNumberToProcess)) { return Collections.emptyList(); } else if (line == null) { - logger.log(Level.SEVERE, "Line is null. Returning empty list for attributes."); + logger.log(Level.WARNING, "Line is null. Returning empty list for attributes."); return Collections.emptyList(); } String[] columnValues; // Check to see if the 2 values are equal, they may not be equal if there is no corresponding data in the line. + // or if the size of the line to split is not equal to the column numbers we are looking to process. This + // can happen when the last value of the tsv line has no data in it. // If this happens then adding an empty value(s) for each columnValue where data does not exist Integer maxColumnNumber = Collections.max(columnNumberToProcess.keySet()); - if (maxColumnNumber > line.split("\\t").length) { + if ((maxColumnNumber > line.split("\\t").length) || (columnNumberToProcess.size() > line.split("\\t").length)) { columnValues = Arrays.copyOf(line.split("\\t"), maxColumnNumber + 1); } else { columnValues = line.split("\\t"); @@ -351,15 +353,17 @@ public final class LeappFileProcessor { Integer columnNumber = columnToProcess.getKey(); String attributeName = columnToProcess.getValue(); - try { - BlackboardAttribute.Type attributeType = Case.getCurrentCase().getSleuthkitCase().getAttributeType(attributeName.toUpperCase()); - if (attributeType == null) { - continue; + if (columnValues[columnNumber] != null) { + try { + BlackboardAttribute.Type attributeType = Case.getCurrentCase().getSleuthkitCase().getAttributeType(attributeName.toUpperCase()); + if (attributeType == null) { + continue; + } + String attrType = attributeType.getValueType().getLabel().toUpperCase(); + checkAttributeType(bbattributes, attrType, columnValues, columnNumber, attributeType, fileName); + } catch (TskCoreException ex) { + throw new IngestModuleException(String.format("Error getting Attribute type for Attribute Name %s", attributeName), ex); //NON-NLS } - String attrType = attributeType.getValueType().getLabel().toUpperCase(); - checkAttributeType(bbattributes, attrType, columnValues, columnNumber, attributeType, fileName); - } catch (TskCoreException ex) { - throw new IngestModuleException(String.format("Error getting Attribute type for Attribute Name %s", attributeName), ex); //NON-NLS } } @@ -375,7 +379,7 @@ public final class LeappFileProcessor { String fileName) { if (columnValues == null || columnNumber < 0 || columnNumber > columnValues.length || columnValues[columnNumber] == null) { - logger.log(Level.SEVERE, String.format("Unable to determine column value at index %d in columnValues: %s", + logger.log(Level.WARNING, String.format("Unable to determine column value at index %d in columnValues: %s", columnNumber, columnValues == null ? "" : "[" + String.join(", ", columnValues) + "]")); return; @@ -469,7 +473,7 @@ public final class LeappFileProcessor { .mapToObj((idx) -> String.format("'%s'", attrList.get(idx).getColumnName() == null ? "" : attrList.get(idx).getColumnName())) .collect(Collectors.joining(", ")); - logger.log(Level.SEVERE, String.format("Columns size expected not found in file %s based on xml from %s. Column Keys Missing = [%s]; Header Line = '%s'.", + logger.log(Level.WARNING, String.format("Columns size expected not found in file %s based on xml from %s. Column Keys Missing = [%s]; Header Line = '%s'.", this.xmlFile == null ? "" : this.xmlFile, fileName, missingColumns, @@ -540,7 +544,7 @@ public final class LeappFileProcessor { } catch (TskCoreException ex) { logger.log(Level.SEVERE, String.format("There was an issue that arose while trying to fetch artifact type for %s.", artifactName), ex); } - + if (foundArtifactType == null) { logger.log(Level.SEVERE, String.format("No known artifact mapping found for [artifact: %s, %s]", artifactName, getXmlFileIdentifier(parentName))); diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml index 6a573e0abb..1ed5bdef1b 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml @@ -31,8 +31,8 @@ - - + + @@ -40,9 +40,9 @@ - + - + @@ -56,17 +56,17 @@ - - - - - + + + + + - + @@ -108,11 +108,11 @@ - - - - - + + + + + @@ -153,17 +153,17 @@ - - - - - + + + + + - + @@ -197,11 +197,11 @@ - - - - - + + + + + @@ -224,6 +224,79 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -233,10 +306,11 @@ - - + + - + + @@ -256,12 +330,12 @@ - + - + - + diff --git a/thirdparty/aLeapp/aleapp.exe b/thirdparty/aLeapp/aleapp.exe index 52fab109ea..179d7b6331 100644 Binary files a/thirdparty/aLeapp/aleapp.exe and b/thirdparty/aLeapp/aleapp.exe differ