mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
Move current package-level descriptions (case, datamodel, corecinterfaces) javadoc format to doxygen.
Need more package-level descriptions for other modules.
This commit is contained in:
adam-m
parent
f8dfacc63a
commit
95b48366fa
9
Case/src/org/sleuthkit/autopsy/casemodule/package.dox
Normal file
9
Case/src/org/sleuthkit/autopsy/casemodule/package.dox
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
/**
|
||||||
|
* \package org.sleuthkit.autopsy.casemodule
|
||||||
|
* A case contains one or more disk images and is the highest-level unit of an investigation. All data in a case will be stored in a single database and configuration file. A case must be open before analysis can occur. You will use a {@link org.sleuthkit.autopsy.casemodule.Case#Case Case} object to get access to the data being analyzed.
|
||||||
|
* Case settings are stored in an XML file. See the {@link org.sleuthkit.autopsy.casemodule.XMLCaseManagement#XMLCaseManagement() XMLCaseManagement} class for more details.
|
||||||
|
* Currently, only one case can be opened at a time. To determine the open case, use the static {@link org.sleuthkit.autopsy.casemodule.Case#getCurrentCase() Case.getCurrentCase()} method. Once you have the object for the currently open case, {@link org.sleuthkit.autopsy.casemodule.Case#getRootObjects() Case.getRootObjects()} will return the top-level Sleuth Kit Content modules. You can then get their children to go down the tree of data types.
|
||||||
|
* To receive an event when cases are opened, closed, or changed, use the {@link org.sleuthkit.autopsy.casemodule.Case#addPropertyChangeListener(PropertyChangeListener) addPropertyChangeListener} method to register your class as a PropertyChangeListener. THis is most commonly required when developing a new {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer#DataExplorer() DataExplorer} module that needs to get data about the currently opened case.
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
<body>
|
|
||||||
<p>A case contains one or more disk images and is the highest-level unit of an investigation. All data in a case will be stored in a single database and configuration file. A case must be open before analysis can occur. You will use a {@link org.sleuthkit.autopsy.casemodule.Case#Case Case} object to get access to the data being analyzed.</p>
|
|
||||||
|
|
||||||
<p>Case settings are stored in an XML file. See the {@link org.sleuthkit.autopsy.casemodule.XMLCaseManagement#XMLCaseManagement() XMLCaseManagement} class for more details.</p>
|
|
||||||
|
|
||||||
<p>Currently, only one case can be opened at a time. To determine the open case, use the static {@link org.sleuthkit.autopsy.casemodule.Case#getCurrentCase() Case.getCurrentCase()} method. Once you have the object for the currently open case, {@link org.sleuthkit.autopsy.casemodule.Case#getRootObjects() Case.getRootObjects()} will return the top-level Sleuth Kit Content modules. You can then get their children to go down the tree of data types. </p>
|
|
||||||
|
|
||||||
<p>To receive an event when cases are opened, closed, or changed, use the {@link org.sleuthkit.autopsy.casemodule.Case#addPropertyChangeListener(PropertyChangeListener) addPropertyChangeListener} method to register your class as a PropertyChangeListener. THis is most commonly required when developing a new {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer#DataExplorer() DataExplorer} module that needs to get data about the currently opened case. </p>
|
|
||||||
</body>
|
|
||||||
|
|
||||||
@ -0,0 +1,84 @@
|
|||||||
|
/**
|
||||||
|
* \package org.sleuthkit.autopsy.corecomponentinterfaces
|
||||||
|
* This package contains the interface classes that define the core components in Autopsy. These components are used in the difference zones of the GUI.
|
||||||
|
* <h2>Autopsy Zones</h2>
|
||||||
|
* There are three major zones in the Autopsy UI. The left hand side has the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer DataExplorer} zone. This area is where you can search for and explore data. It has all of the analysis smarts. An example of a DataExplorer is the directory tree that shows the hierarchy of directories (and hides the files from view).
|
||||||
|
* The DataExplorer area identifies a subset of the data to show the user and passes the data to the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataResult DataResult}s area in the upper right. In the previous example, the contents of a specific folder would be passed to this area and displayed in a table or thumbnail form.</p>
|
||||||
|
* When a file or object is selected in the DataResult, it is passed to the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataContent DataContent} zone in the lower right. This is where file content can be viewed in hex form, strings, etc.
|
||||||
|
* <h2>Data Flow</h2>
|
||||||
|
* <h3>Creating Nodes in DataExplorer</h3>
|
||||||
|
* Data flows between the areas inside of a NetBeans node. The DataExplorer modules create the NetBeans nodes. They query the SQLite database or do whatever they want to identify the set of files that are of interest. They create the NetBeans nodes based on Sleuthkit data model objects. See the org.sleuthkit.autopsy.datamodel package for more details on this.
|
||||||
|
* <h3>Getting Nodes to DataResult</h3>
|
||||||
|
* Each DataExplorer TopComponent is responsible for creating its own DataResult TopComponent to display its results. It can choose to re-use the same TopComponent for multiple searches (as DirectoryTree does) or it can choose to make a new one each time (as FileSearch does). The setNode() method on the DataResult object is used to set the root node to display. A dummy root node must be created as the parent if a parent does not already exist.
|
||||||
|
* The DataExplorer is responsible for setting the double-click and right-click actions associated with the node. The default single click action is to pass data to DataContent. To override this, you must create a new DataResultViewer instance that overrides the propertyChange() method. The DataExplorer adds actions to wrapping the node in a FilterNode variant. The FilterNode then defines the actions for the node by overriding the getPreferredAction() and getActions() methods. As an example, org.sleuthkit.autopsy.directorytree.DataResultFilterNode and org.sleuthkit.autopsy.directorytree.DataResultFilterChildren wraps the nodes that are passed over by the DirectoryTree DataExplorer.
|
||||||
|
* DataResult can send data back to its DataExplorer by making a custom action that looks up it's instance (DataExplorer.getInstance()).
|
||||||
|
* <h3>Getting Nodes to DataContent </h3>
|
||||||
|
* A default DataContent viewer is created when a case is opened. To display the contents of a node, it must be passed to a DataContent instance. The default single-click behavior of the DataResultViewers is to lookup the default DataContent TopComponent and pass the selected node to it. See {@link org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer#propertyChange(PropertyChangeEvent) AbstractDataResultViewer.propertyChange()} for details.
|
||||||
|
* <h2>Creating new Functionality</h2>
|
||||||
|
* <h3>Creating a DataExplorer</h3>
|
||||||
|
* <ol>
|
||||||
|
* <li>Create a module from within NetBeans. It must be dependent on these modules:
|
||||||
|
* <ul>
|
||||||
|
* <li>Case
|
||||||
|
* <li>CoreComponentInterfaces
|
||||||
|
* <li>CoreComponents
|
||||||
|
* <li>DataModel
|
||||||
|
* <li>DialogsAPI (if pop-ups and such are going to be used)
|
||||||
|
* <li>Explorer & Property Sheet API
|
||||||
|
* <li>Lookup
|
||||||
|
* <li>Nodes API
|
||||||
|
* <li>Setting API
|
||||||
|
* <li>UI Utilities API
|
||||||
|
* <li>Utilities API
|
||||||
|
* <li>Window System API
|
||||||
|
* </ul>
|
||||||
|
* <li> Create a class that implements {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer DataExplorer}. We have been making the TopComponent class be the one that implements DataExplorer. Register this class as a DataExplorer service provider by specifying "@ServiceProvider(service=DataExplorer.class)" in the class or using layer.xml.
|
||||||
|
* <li>Implement the methods required by the DataExplorer interface.
|
||||||
|
* <li>Register the class to receive property change events from the org.sleuthkit.autopsy.Case module by using its addPropertyChangeListener() method.
|
||||||
|
* <li>Access case data using the org.sleuthkit.autopsy.Case module.
|
||||||
|
* <li>Create Nodes for the data objects using the techniques outlined in the previous section.
|
||||||
|
* <li>Wrap the nodes in FilterNodes to define actions as outlined in the previous section.
|
||||||
|
* <li>Send results to DataResults using the techniques outlined in the previous section.
|
||||||
|
* </ol>
|
||||||
|
* <h3>Creating a DataResultViewer</h3>
|
||||||
|
* <p>DataResultTopComponent is the high-level window in the DataResult area. Each instance of this loads up all instances of DataResultViewers that have been registered with the system. Example viewers include the table and thumbnail views. If you want to make your own type of viewer, follow the steps below. Note that the table and thumbnail viewers come with Autopsy by default and can be used by all DataExplorers.
|
||||||
|
* <ol>
|
||||||
|
* <li>Create a module from within NetBeans. It must be dependent on these modules:
|
||||||
|
* <ul>
|
||||||
|
* <li>Case
|
||||||
|
* <li>CoreComponentInterfaces
|
||||||
|
* <li>CoreComponents
|
||||||
|
* <li>DataModel
|
||||||
|
* <li>DialogsAPI (if pop-ups and such are going to be used)
|
||||||
|
* <li>Explorer & Property Sheet API
|
||||||
|
* <li>Lookup
|
||||||
|
* <li>Nodes API
|
||||||
|
* <li>Setting API
|
||||||
|
* <li>UI Utilities API
|
||||||
|
* <li>Utilities API
|
||||||
|
* <li>Window System API
|
||||||
|
* </ul>
|
||||||
|
* <li>Make a class that extends {@link org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer#AbstractDataResultViewer() AbstractDataResultViewer} and is registered as a service provider for the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer DataResultViewer} class by specifying "@ServiceProvider(service = DataResultViewer.class)" or by using layer.xml. This class will extend JPanel. </li>
|
||||||
|
* <li>See the previous sections on default actions.</li>
|
||||||
|
* </ol>
|
||||||
|
* <h3>Creating a DataContentViewer</h3>
|
||||||
|
* DataContentTopComponent is the high-level window in the DataContent area. Each instance of this loads up all instances of DataContentViewers that have been registered with the system. Example viewers include the strings and hexdump views. If you want to make your own type of viewer, follow the steps below. Note that the strings, hexdump, and image viewers come with Autopsy by default and can be used by all DataExplorers and DataResults. You only need to make a new DataContentViewer if these viewers do not satisfy your needs.
|
||||||
|
* <ol>
|
||||||
|
* <li>Create a module from within NetBeans. It must be dependent on these modules:
|
||||||
|
* <ul>
|
||||||
|
* <li>Case
|
||||||
|
* <li>CoreComponentInterfaces
|
||||||
|
* <li>CoreComponents
|
||||||
|
* <li>DataModel
|
||||||
|
* <li>DialogsAPI (if pop-ups and such are going to be used)
|
||||||
|
* <li>Explorer & Property Sheet API
|
||||||
|
* <li>Lookup
|
||||||
|
* <li>Nodes API
|
||||||
|
* <li>Setting API
|
||||||
|
* <li>UI Utilities API
|
||||||
|
* <li>Utilities API
|
||||||
|
* <li>Window System API
|
||||||
|
* </ul>
|
||||||
|
* <li>Make a class that implements {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer DataContentViewer} and is registered as a service provider for DataContentViewer.class by specifying "@ServiceProvider(service = DataContentViewer.class)" or by using layer.xml. This class must extend JPanel. </li>
|
||||||
|
* </ol>
|
||||||
|
*/
|
||||||
@ -1,106 +0,0 @@
|
|||||||
<body>
|
|
||||||
<p>This package contains the interface classes that define the core components in Autopsy. These components are used in the difference zones of the GUI.</p>
|
|
||||||
|
|
||||||
<h2>Autopsy Zones</h2>
|
|
||||||
|
|
||||||
<p>There are three major zones in the Autopsy UI. The left hand side has the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer DataExplorer} zone. This area is where you can search for and explore data. It has all of the analysis smarts. An example of a DataExplorer is the directory tree that shows the hierarchy of directories (and hides the files from view).</p>
|
|
||||||
|
|
||||||
<p>The DataExplorer area identifies a subset of the data to show the user and passes the data to the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataResult DataResult}s area in the upper right. In the previous example, the contents of a specific folder would be passed to this area and displayed in a table or thumbnail form.</p>
|
|
||||||
|
|
||||||
<p>When a file or object is selected in the DataResult, it is passed to the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataContent DataContent} zone in the lower right. This is where file content can be viewed in hex form, strings, etc. </p>
|
|
||||||
|
|
||||||
|
|
||||||
<h2>Data Flow</h2>
|
|
||||||
<h3>Creating Nodes in DataExplorer</h3>
|
|
||||||
|
|
||||||
<p>Data flows between the areas inside of a NetBeans node. The DataExplorer modules create the NetBeans nodes. They query the SQLite database or do whatever they want to identify the set of files that are of interest. They create the NetBeans nodes based on Sleuthkit data model objects. See the org.sleuthkit.autopsy.datamodel package for more details on this. </p>
|
|
||||||
|
|
||||||
<h3>Getting Nodes to DataResult</h3>
|
|
||||||
|
|
||||||
<p>Each DataExplorer TopComponent is responsible for creating its own DataResult TopComponent to display its results. It can choose to re-use the same TopComponent for multiple searches (as DirectoryTree does) or it can choose to make a new one each time (as FileSearch does). The setNode() method on the DataResult object is used to set the root node to display. A dummy root node must be created as the parent if a parent does not already exist. </p>
|
|
||||||
|
|
||||||
<p>The DataExplorer is responsible for setting the double-click and right-click actions associated with the node. The default single click action is to pass data to DataContent. To override this, you must create a new DataResultViewer instance that overrides the propertyChange() method. The DataExplorer adds actions to wrapping the node in a FilterNode variant. The FilterNode then defines the actions for the node by overriding the getPreferredAction() and getActions() methods. As an example, org.sleuthkit.autopsy.directorytree.DataResultFilterNode and org.sleuthkit.autopsy.directorytree.DataResultFilterChildren wraps the nodes that are passed over by the DirectoryTree DataExplorer.</p>
|
|
||||||
|
|
||||||
DataResult can send data back to its DataExplorer by making a custom action that looks up it's instance (DataExplorer.getInstance()).
|
|
||||||
|
|
||||||
<h3>Getting Nodes to DataContent </h3>
|
|
||||||
<p> A default DataContent viewer is created when a case is opened. To display the contents of a node, it must be passed to a DataContent instance. The default single-click behavior of the DataResultViewers is to lookup the default DataContent TopComponent and pass the selected node to it. See {@link org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer#propertyChange(PropertyChangeEvent) AbstractDataResultViewer.propertyChange()} for details. </p>
|
|
||||||
|
|
||||||
<h2>Creating new Functionality</h2>
|
|
||||||
|
|
||||||
<h3>Creating a DataExplorer</h3>
|
|
||||||
<ol>
|
|
||||||
<li>Create a module from within NetBeans. It must be dependent on these modules:
|
|
||||||
<ul>
|
|
||||||
<li>Case
|
|
||||||
<li>CoreComponentInterfaces
|
|
||||||
<li>CoreComponents
|
|
||||||
<li>DataModel
|
|
||||||
<li>DialogsAPI (if pop-ups and such are going to be used)
|
|
||||||
<li>Explorer & Property Sheet API
|
|
||||||
<li>Lookup
|
|
||||||
<li>Nodes API
|
|
||||||
<li>Setting API
|
|
||||||
<li>UI Utilities API
|
|
||||||
<li>Utilities API
|
|
||||||
<li>Window System API
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<li> Create a class that implements {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer DataExplorer}. We have been making the TopComponent class be the one that implements DataExplorer. Register this class as a DataExplorer service provider by specifying "@ServiceProvider(service=DataExplorer.class)" in the class or using layer.xml.
|
|
||||||
<li>Implement the methods required by the DataExplorer interface.
|
|
||||||
<li>Register the class to receive property change events from the org.sleuthkit.autopsy.Case module by using its addPropertyChangeListener() method.
|
|
||||||
<li>Access case data using the org.sleuthkit.autopsy.Case module.
|
|
||||||
<li>Create Nodes for the data objects using the techniques outlined in the previous section.
|
|
||||||
<li>Wrap the nodes in FilterNodes to define actions as outlined in the previous section.
|
|
||||||
<li>Send results to DataResults using the techniques outlined in the previous section.
|
|
||||||
</ol>
|
|
||||||
|
|
||||||
<h3>Creating a DataResultViewer</h3>
|
|
||||||
<p>DataResultTopComponent is the high-level window in the DataResult area. Each instance of this loads up all instances of DataResultViewers that have been registered with the system. Example viewers include the table and thumbnail views. If you want to make your own type of viewer, follow the steps below. Note that the table and thumbnail viewers come with Autopsy by default and can be used by all DataExplorers. </p>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>Create a module from within NetBeans. It must be dependent on these modules:
|
|
||||||
<ul>
|
|
||||||
<li>Case
|
|
||||||
<li>CoreComponentInterfaces
|
|
||||||
<li>CoreComponents
|
|
||||||
<li>DataModel
|
|
||||||
<li>DialogsAPI (if pop-ups and such are going to be used)
|
|
||||||
<li>Explorer & Property Sheet API
|
|
||||||
<li>Lookup
|
|
||||||
<li>Nodes API
|
|
||||||
<li>Setting API
|
|
||||||
<li>UI Utilities API
|
|
||||||
<li>Utilities API
|
|
||||||
<li>Window System API
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<li>Make a class that extends {@link org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer#AbstractDataResultViewer() AbstractDataResultViewer} and is registered as a service provider for the {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer DataResultViewer} class by specifying "@ServiceProvider(service = DataResultViewer.class)" or by using layer.xml. This class will extend JPanel. </li>
|
|
||||||
|
|
||||||
<li>See the previous sections on default actions.</li>
|
|
||||||
</ol>
|
|
||||||
|
|
||||||
<h3>Creating a DataContentViewer</h3>
|
|
||||||
<p>DataContentTopComponent is the high-level window in the DataContent area. Each instance of this loads up all instances of DataContentViewers that have been registered with the system. Example viewers include the strings and hexdump views. If you want to make your own type of viewer, follow the steps below. Note that the strings, hexdump, and image viewers come with Autopsy by default and can be used by all DataExplorers and DataResults. You only need to make a new DataContentViewer if these viewers do not satisfy your needs.</p>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>Create a module from within NetBeans. It must be dependent on these modules:
|
|
||||||
<ul>
|
|
||||||
<li>Case
|
|
||||||
<li>CoreComponentInterfaces
|
|
||||||
<li>CoreComponents
|
|
||||||
<li>DataModel
|
|
||||||
<li>DialogsAPI (if pop-ups and such are going to be used)
|
|
||||||
<li>Explorer & Property Sheet API
|
|
||||||
<li>Lookup
|
|
||||||
<li>Nodes API
|
|
||||||
<li>Setting API
|
|
||||||
<li>UI Utilities API
|
|
||||||
<li>Utilities API
|
|
||||||
<li>Window System API
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<li>Make a class that implements {@link org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer DataContentViewer} and is registered as a service provider for DataContentViewer.class by specifying "@ServiceProvider(service = DataContentViewer.class)" or by using layer.xml. This class must extend JPanel. </li>
|
|
||||||
</ol>
|
|
||||||
|
|
||||||
</body>
|
|
||||||
@ -1,12 +1,9 @@
|
|||||||
<body>
|
/**
|
||||||
<h2>Overview</h2>
|
* \package org.sleuthkit.autopsy.datamodel
|
||||||
<p>Autopsy 3 uses NetBeans Nodes to pass data around. The Sleuth Kit comes with Java datamodel classes in org.sleuthkit.datamodel and it contains classes for files, directories, file systems, volumes, and other data types that can be found in a disk image. These classes are not NetBeans specific. </p>
|
* <h2>Overview</h2>
|
||||||
|
* Autopsy 3 uses NetBeans Nodes to pass data around. The Sleuth Kit comes with Java datamodel classes in org.sleuthkit.datamodel and it contains classes for files, directories, file systems, volumes, and other data types that can be found in a disk image. These classes are not NetBeans specific.
|
||||||
<p>This package, org.sleuthkit.autopsy.datamodel, contains classes that are NetBeans-specific and map to classes in the Sleuth Kit datamodel. For example org.sleuthkit.autopsy.datamodel.DirectoryNode is the Node class for the org.sleuthkit.datamodel.Directory class.</p>
|
* This package, org.sleuthkit.autopsy.datamodel, contains classes that are NetBeans-specific and map to classes in the Sleuth Kit datamodel. For example org.sleuthkit.autopsy.datamodel.DirectoryNode is the Node class for the org.sleuthkit.datamodel.Directory class.
|
||||||
|
* The underlying sleuthkit.datamodel Content objects are passed around Autopsy by being included in a Node's lookup.
|
||||||
<p>The underlying sleuthkit.datamodel Content objects are passed around Autopsy by being included in a Node's lookup.</p>
|
* <h2>Creating Nodes</h2>
|
||||||
|
* You should only have to create the root node in a hierarchy. To do so, use the RootContentChildren class and pass in the list of TSK datamodel objects that you need to encapsulate. After that, the children will automatically be created as nodes when they are requested. ContentChildren deals with this.
|
||||||
<h2>Creating Nodes</h2>
|
*/
|
||||||
<p>You should only have to create the root node in a hierarchy. To do so, use the RootContentChildren class and pass in the list of TSK datamodel objects that you need to encapsulate. After that, the children will automatically be created as nodes when they are requested. ContentChildren deals with this.</p>
|
|
||||||
|
|
||||||
</body>
|
|
||||||
Loading…
x
Reference in New Issue
Block a user