mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

bug fixes

Browse Source
This commit is contained in:
Greg DiCristofaro 2021-07-20 13:50:03 -04:00
parent c32ab89922
commit 928ef9e33d
3 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pythonExamples/Registry_Example.py
View File

@ -179,20 +179,16 @@ class RegistryExampleIngestModule(DataSourceIngestModule):
artType = skCase.getArtifactType("TSK_REGISTRY_RUN_KEYS") artType = skCase.getArtifactType("TSK_REGISTRY_RUN_KEYS")
try: try:
addArtifactAttributeType(String
attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE
valueType, String
displayName)
attributeIdRunKeyName = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_NAME", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Name") attributeIdRunKeyName = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_NAME", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Name")
except: except:
self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_NAME, May already exist. ") self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_NAME, May already exist. ")
try: try:
attributeIdRunKeyValue = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_VALUE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Value") attributeIdRunKeyValue = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_VALUE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Value")
except: except:
self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_VALUE, May already exist. ") self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_VALUE, May already exist. ")
try: try:
attributeIdRegKeyLoc = skCase.addArtifactAttributeType("TSK_REG_KEY_LOCATION", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Registry Key Location") attributeIdRegKeyLoc = skCase.addArtifactAttributeType("TSK_REG_KEY_LOCATION", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Registry Key Location")
except: except:
self.log(Level.INFO, "Attributes Creation Error, TSK_REG_KEY_LOCATION, May already exist. ") self.log(Level.INFO, "Attributes Creation Error, TSK_REG_KEY_LOCATION, May already exist. ")
attributeIdRunKeyName = skCase.getAttributeType("TSK_REG_RUN_KEY_NAME") attributeIdRunKeyName = skCase.getAttributeType("TSK_REG_RUN_KEY_NAME")

7
pythonExamples/Sept2015ReportTutorial_CSV/CsvReportModule.py
View File

@ -37,6 +37,7 @@
import os import os
import codecs
from java.lang import System from java.lang import System
from java.util.logging import Level from java.util.logging import Level
from org.sleuthkit.datamodel import TskData from org.sleuthkit.datamodel import TskData
@ -72,11 +73,11 @@ class CSVReportModule(GeneralReportModuleAdapter):
# The 'baseReportDir' object being passed in is a string with the directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath(). # The 'baseReportDir' object being passed in is a string with the directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath().
# The 'progressBar' object is of type ReportProgressPanel. # The 'progressBar' object is of type ReportProgressPanel.
# See: http://sleuthkit.org/autopsy/docs/api-docs/latest/classorg_1_1sleuthkit_1_1autopsy_1_1report_1_1_report_progress_panel.html # See: http://sleuthkit.org/autopsy/docs/api-docs/latest/classorg_1_1sleuthkit_1_1autopsy_1_1report_1_1_report_progress_panel.html
def generateReport(self, baseReportDir, progressBar): def generateReport(self, reportSettings, progressBar):
# Open the output file. # Open the output file.
fileName = os.path.join(baseReportDir, self.getRelativeFilePath()) fileName = os.path.join(reportSettings.getReportDirectoryPath(), self.getRelativeFilePath())
report = open(fileName, 'w') report = codecs.open(fileName, "w", "utf-8")
# Query the database for the files (ignore the directories) # Query the database for the files (ignore the directories)
sleuthkitCase = Case.getCurrentCase().getSleuthkitCase() sleuthkitCase = Case.getCurrentCase().getSleuthkitCase()

4
pythonExamples/reportmodule.py
View File

@ -70,7 +70,7 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
# The 'baseReportDir' object being passed in is a string with the directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath(). # The 'baseReportDir' object being passed in is a string with the directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath().
# The 'progressBar' object is of type ReportProgressPanel. # The 'progressBar' object is of type ReportProgressPanel.
# See: http://sleuthkit.org/autopsy/docs/api-docs/latest/classorg_1_1sleuthkit_1_1autopsy_1_1report_1_1_report_progress_panel.html # See: http://sleuthkit.org/autopsy/docs/api-docs/latest/classorg_1_1sleuthkit_1_1autopsy_1_1report_1_1_report_progress_panel.html
def generateReport(self, baseReportDir, progressBar): def generateReport(self, reportSettings, progressBar):
# For an example, we write a file with the number of files created in the past 2 weeks # For an example, we write a file with the number of files created in the past 2 weeks
# Configure progress bar for 2 tasks # Configure progress bar for 2 tasks
@ -95,7 +95,7 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
progressBar.increment() progressBar.increment()
# Write the count to the report file. # Write the count to the report file.
fileName = os.path.join(baseReportDir, self.getRelativeFilePath()) fileName = os.path.join(reportSettings.getReportDirectoryPath(), self.getRelativeFilePath())
report = open(fileName, 'w') report = open(fileName, 'w')
report.write("file count = %d" % fileCount) report.write("file count = %d" % fileCount)
report.close() report.close()