mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-14 17:06:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7307 from sleuthkit/release-4.19.2

Browse Source 
Merge release 4.19.2 branch into develop branch
This commit is contained in:
Richard Cordovano 2021-09-29 14:59:15 -04:00 committed by GitHub
commit 902f9e5eb7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java
View File

@ -751,6 +751,7 @@ class ExtractRegistry extends Extract {
try{ try{
sid = userMap.getKey(); sid = userMap.getKey();
String userName = userMap.getValue(); String userName = userMap.getValue();
// Accounts in the SAM are all local accounts
createOrUpdateOsAccount(regFile, sid, userName, null, null, OsAccountRealm.RealmScope.LOCAL); createOrUpdateOsAccount(regFile, sid, userName, null, null, OsAccountRealm.RealmScope.LOCAL);
} catch(TskCoreException | TskDataException | NotUserSIDException ex) { } catch(TskCoreException | TskDataException | NotUserSIDException ex) {
logger.log(Level.WARNING, String.format("Failed to update Domain for existing OsAccount: %s, sid: %s", regFile.getId(), sid), ex); logger.log(Level.WARNING, String.format("Failed to update Domain for existing OsAccount: %s, sid: %s", regFile.getId(), sid), ex);
@ -864,6 +865,9 @@ class ExtractRegistry extends Extract {
String sid = artnode.getAttribute("sid"); //NON-NLS String sid = artnode.getAttribute("sid"); //NON-NLS
String username = artnode.getAttribute("username"); //NON-NLS String username = artnode.getAttribute("username"); //NON-NLS
String domName = domainName; String domName = domainName;
// accounts in profileList can be either domain or local
// Assume domain unless the SID was seen before in the SAM (which is only local).
OsAccountRealm.RealmScope scope = OsAccountRealm.RealmScope.DOMAIN; OsAccountRealm.RealmScope scope = OsAccountRealm.RealmScope.DOMAIN;
if(knownMachineSID(sid)) { if(knownMachineSID(sid)) {
domName = null; domName = null;
@ -1713,7 +1717,8 @@ class ExtractRegistry extends Extract {
} }
/** /**
* Create a map of userids to usernames from the OS Accounts. * Create a map of userids to usernames for all OS Accounts associated with the current
* host in OsAccountManager.
* *
* @param dataSource * @param dataSource
* *
@ -1726,6 +1731,7 @@ class ExtractRegistry extends Extract {
for(OsAccount account: tskCase.getOsAccountManager().getOsAccounts(((DataSource)dataSource).getHost())) { for(OsAccount account: tskCase.getOsAccountManager().getOsAccounts(((DataSource)dataSource).getHost())) {
Optional<String> userName = account.getLoginName(); Optional<String> userName = account.getLoginName();
// @@@ BC: Seems like this should be calling account.getAddr() to get the SID.
map.put(account.getName(), userName.isPresent() ? userName.get() : ""); map.put(account.getName(), userName.isPresent() ? userName.get() : "");
} }
@ -1741,6 +1747,8 @@ class ExtractRegistry extends Extract {
* @return The Machine SID * @return The Machine SID
*/ */
private String getMachineSID(String osAccountSID) { private String getMachineSID(String osAccountSID) {
// @@@ We should add checks about mininum number of dashes.
// and we should really call this stripRelativeIdentifierFromSID().
int index = osAccountSID.lastIndexOf("-"); int index = osAccountSID.lastIndexOf("-");
return osAccountSID.substring(0, index); return osAccountSID.substring(0, index);
} }
@ -1748,12 +1756,13 @@ class ExtractRegistry extends Extract {
private final List<String> machineSIDs = new ArrayList<>(); private final List<String> machineSIDs = new ArrayList<>();
/** /**
* Returns true if the machine part of the SID was seen prior * Returns true if the machine part of the SID was seen prior
* to ExtractRegistry running. * to ExtractRegistry running.
* *
* @param osAccountSID * @param osAccountSID
* *
* @return * @return
*/ */
// @@@ BC: This is probably more accurately called 'knownDomainIdSID'
private boolean knownMachineSID(String osAccountSID) { private boolean knownMachineSID(String osAccountSID) {
if (machineSIDs.isEmpty()) { if (machineSIDs.isEmpty()) {
Map<String, String> userMap = getUserNameMap(); Map<String, String> userMap = getUserNameMap();
@ -1771,7 +1780,7 @@ class ExtractRegistry extends Extract {
/** /**
* Returns a mapping of user sids to user names. * Returns a mapping of user sids to user names.
* *
* @return username man or empty list if none where found. * @return SID to username map. Will be empty if none where found.
*/ */
private Map<String, String> getUserNameMap() { private Map<String, String> getUserNameMap() {
if(userNameMap == null) { if(userNameMap == null) {