1903-saving of previously used filter fixed

Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java

@@ -42,21 +42,18 @@ import org.sleuthkit.autopsy.modules.interestingitems.IngestSetFilter;
 /**
  * Encapsulates the ingest job settings for a particular execution context.
  * Examples of execution contexts include the add data source wizard and the run
- * ingest modules dialog. Different execution conterxts may have different
+ * ingest modules dialog. Different execution contexts may have different ingest
- * ingest job settings.
+ * job settings.
  */
 public class IngestJobSettings {
 
     private static final String ENABLED_MODULES_KEY = "Enabled_Ingest_Modules"; //NON-NLS
     private static final String DISABLED_MODULES_KEY = "Disabled_Ingest_Modules"; //NON-NLS
     private static final String PARSE_UNALLOC_SPACE_KEY = "Process_Unallocated_Space"; //NON-NLS 
-    private static final String RUN_ON_FILTER_KEY = "Run_Ingest_On";
     private static final String PROCESS_UNALLOC_SPACE_DEFAULT = "true"; //NON-NLS
-    private static final String RUN_ON_FILTER_DEFAULT = IngestSetFilter.ALL_FILES_AND_UNALLOCATED_FILTER;
     private static final String MODULE_SETTINGS_FOLDER = "IngestModuleSettings"; //NON-NLS
     private static final String MODULE_SETTINGS_FOLDER_PATH = Paths.get(PlatformUtil.getUserConfigDirectory(), IngestJobSettings.MODULE_SETTINGS_FOLDER).toAbsolutePath().toString();
     private static final String MODULE_SETTINGS_FILE_EXT = ".settings"; //NON-NLS
-    private String runIngestModulesOnFilter;
     private static final Logger LOGGER = Logger.getLogger(IngestJobSettings.class.getName());
     private final String executionContext;
     private final IngestType ingestType;
@@ -66,22 +63,6 @@ public class IngestJobSettings {
     private boolean processUnallocatedSpace;
     private final List<String> warnings;
 
-    /**
-     * @return the runIngestModulesOnFilter
-     */
-    String getRunIngestModulesOnFilter() {
-        return runIngestModulesOnFilter;
-    }
-
-    /**
-     * @param runIngestModulesOnFilter the runIngestModulesOnFilter to set
-     */
-    void setRunIngestModulesOnFilter(String runIngestModulesOnFilter) {
-        this.runIngestModulesOnFilter = runIngestModulesOnFilter;
-        this.processUnallocatedSpace = (new IngestSetFilter(runIngestModulesOnFilter)).isProcessUnallocatedSpace();
-        this.save();
-    }
-
     /**
      * The type of ingest modules to run.
      */
@@ -114,7 +95,6 @@ public class IngestJobSettings {
         this.ingestType = IngestType.ALL_MODULES;
         this.moduleTemplates = new ArrayList<>();
         this.processUnallocatedSpace = Boolean.parseBoolean(IngestJobSettings.PROCESS_UNALLOC_SPACE_DEFAULT);
-        this.runIngestModulesOnFilter = IngestSetFilter.ALL_FILES_AND_UNALLOCATED_FILTER;
         this.warnings = new ArrayList<>();
         this.createSavedModuleSettingsFolder();
         this.load();
@@ -141,7 +121,6 @@ public class IngestJobSettings {
         this.moduleTemplates = new ArrayList<>();
 
         this.processUnallocatedSpace = Boolean.parseBoolean(IngestJobSettings.PROCESS_UNALLOC_SPACE_DEFAULT);
-        this.runIngestModulesOnFilter = IngestSetFilter.ALL_FILES_AND_UNALLOCATED_FILTER;
         this.warnings = new ArrayList<>();
         this.createSavedModuleSettingsFolder();
         this.load();
@@ -331,14 +310,8 @@ public class IngestJobSettings {
         ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.ENABLED_MODULES_KEY, makeCommaSeparatedValuesList(enabledModuleNames));
         ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.DISABLED_MODULES_KEY, makeCommaSeparatedValuesList(disabledModuleNames));
 
-        // Get the filter setting telling it which files to run modules on. If the setting does
-        // not exist yet, default it to All Files and Unallocated Space filter.
-        if (ModuleSettings.settingExists(this.executionContext, IngestJobSettings.RUN_ON_FILTER_KEY) == false) {
-            ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.RUN_ON_FILTER_KEY, IngestJobSettings.RUN_ON_FILTER_DEFAULT);
-        }
-        this.runIngestModulesOnFilter = ModuleSettings.getConfigSetting(this.executionContext, IngestJobSettings.RUN_ON_FILTER_KEY);
         //set the process unallocated space setting based on the filter chosen.
-        this.processUnallocatedSpace = (new IngestSetFilter(runIngestModulesOnFilter)).isProcessUnallocatedSpace();
+        this.processUnallocatedSpace = (new IngestSetFilter()).isProcessUnallocatedSpace();
 
     }
 
@@ -474,6 +447,7 @@ public class IngestJobSettings {
          */
         String processUnalloc = Boolean.toString(this.processUnallocatedSpace);
         ModuleSettings.setConfigSetting(this.executionContext, PARSE_UNALLOC_SPACE_KEY, processUnalloc);
+
     }
 
     /**

Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettingsPanel.java

@@ -85,7 +85,7 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel {
 
         initComponents();
         customizeComponents();
-        jComboBox1.setSelectedItem(settings.getRunIngestModulesOnFilter());
+        jComboBox1.setSelectedItem(controller.getIngestSetFilter().getLastSelected());
     }
 
     /**
@@ -114,7 +114,7 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel {
 
         initComponents();
         customizeComponents();
-        jComboBox1.setSelectedItem(settings.getRunIngestModulesOnFilter());
+        jComboBox1.setSelectedItem(controller.getIngestSetFilter().getLastSelected());
     }
 
     /**
@@ -422,12 +422,12 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel {
                 dialog.close();
             });
             dialog.display((IngestModuleGlobalSettingsPanel) controller.getComponent(controller.getLookup()));
+            jComboBox1.setSelectedItem(controller.getIngestSetFilter().getLastSelected());
 
-        } else {
+        } else if (evt.getActionCommand().equals("comboBoxChanged")) {
-            settings.setRunIngestModulesOnFilter(jComboBox1.getSelectedItem().toString());
+            controller.getIngestSetFilter().setLastSelected(jComboBox1.getSelectedItem().toString());
-            settings.save();
         }
-        jComboBox1.setSelectedItem(settings.getRunIngestModulesOnFilter());
+
 
     }//GEN-LAST:event_jComboBox1ActionPerformed
 

Core/src/org/sleuthkit/autopsy/ingest/IngestTasksScheduler.java

@@ -412,10 +412,10 @@ final class IngestTasksScheduler {
             return false;
         }
 
-        if (file.isFile()){  //is this the criteria we want to be using(will unallocated space files show return true?)
+        if (file.isFile()) {  //is this the criteria we want to be using(will unallocated space files show return true?)
             IngestSetFilter ingestSetFilter;
-          ingestSetFilter = new IngestSetFilter(task.getIngestJob().runIngestModulesOnFilter());         
+            ingestSetFilter = new IngestSetFilter();
-            if (!ingestSetFilter.match(file)){
+            if (!ingestSetFilter.match(file)) {
                 return false;
             }
         }
@@ -563,12 +563,12 @@ final class IngestTasksScheduler {
             static final List<Pattern> MEDIUM_PRI_PATHS = new ArrayList<>();
 
             static final List<Pattern> HIGH_PRI_PATHS = new ArrayList<>();
+
             /*
              * prioritize root directory folders based on the assumption that we
              * are looking for user content. Other types of investigations may
              * want different priorities.
              */
-
             static /*
              * prioritize root directory folders based on the assumption that we
              * are looking for user content. Other types of investigations may

Core/src/org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties

@@ -4,7 +4,7 @@ OpenIDE-Module-Short-Description=Interesting Files Identifier ingest module.
 OpenIDE-Module-Name=Interesting Files Identifier
 OptionsCategory_Name_InterestingItemDefinitions=Interesting Files
 OptionsCategory_Keywords_InterestingItemDefinitions=InterestingItemDefinitions
-OptionsCategory_Name_IngestSetFilterDefinitions=File Filter
+OptionsCategory_Name_IngestSetFilterDefinitions=Ingest Set Filter
 OptionsCategory_Keywords_IngestSetFilterDefinitions=IngestSetFilterDefinitions
 InterestingItemsIdentifierIngestModule.moduleName=Interesting Files Identifier
 InterestingItemsIdentifierIngestModule.moduleDescription=Identifies interesting items as defined by interesting item rule sets.
@@ -33,6 +33,8 @@ FilesSetRulePanel.pathSeparatorInfoLabel.text=Use /  as path separator
 FilesIdentifierIngestJobSettingsPanel.border.title=Select interesting files sets to enable during ingest:
 FilesSetRulePanel.jLabel1.text=Type:
 FilesSetRulePanel.jLabel5.text=Enter information about files that you want to find.
+InterestingItemDefsPanel.processUnallocCheckbox.toolTipText=Processes unallocated space, such as deleted files. Produces more complete results, but it may take longer to process on large images.
+InterestingItemDefsPanel.processUnallocCheckbox.text=Process Unallocated Space
 InterestingItemDefsPanel.jLabel6.text=Set Details
 InterestingItemDefsPanel.jLabel8.text=File Size:
 InterestingItemDefsPanel.jLabel7.text=MIME Type:

Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestJobSettingsPanel.java

@@ -26,7 +26,6 @@ import java.util.TreeMap;
 import javax.swing.JTable;
 import javax.swing.table.AbstractTableModel;
 import javax.swing.table.TableColumn;
-import org.openide.util.Exceptions;
 import org.openide.util.NbBundle.Messages;
 import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
 import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
@@ -36,6 +35,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
  * Ingest job settings panel for interesting files identifier ingest modules.
  */
 final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobSettingsPanel implements Observer {
+
     @Messages({
         "FilesIdentifierIngestJobSettingsPanel.updateError=Error updating interesting files sets settings file.",
         "FilesIdentifierIngestJobSettingsPanel.getError=Error getting interesting files sets from settings file."
@@ -83,7 +83,7 @@ final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobS
          */
         List<FilesSetRow> filesSetRows = new ArrayList<>();
         try {
-            this.filesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()));
+            this.filesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()));
         } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
             MessageNotifyUtil.Message.error(Bundle.FilesIdentifierIngestJobSettingsPanel_getError());
             this.filesSetSnapshot = new TreeMap<>();
@@ -138,7 +138,7 @@ final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobS
         List<FilesSetRow> rowModels = new ArrayList<>();
         TreeMap<String, FilesSet> newFilesSetSnapshot;
         try {
-            newFilesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()));
+            newFilesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()));
         } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
             MessageNotifyUtil.Message.error(Bundle.FilesIdentifierIngestJobSettingsPanel_updateError());
             return;

Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java

@@ -83,7 +83,7 @@ final class FilesIdentifierIngestModule implements FileIngestModule {
                 // to disable the interesting files set definition UI during ingest.
                 List<FilesSet> filesSets = new ArrayList<>();
                 try {
-                    for (FilesSet set : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()).values()) {
+                    for (FilesSet set : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()).values()) {
                         if (settings.interestingFilesSetIsEnabled(set.getName())) {
                             filesSets.add(set);
                         }

Core/src/org/sleuthkit/autopsy/modules/interestingitems/IngestSetFilter.java

@@ -20,48 +20,97 @@ package org.sleuthkit.autopsy.modules.interestingitems;
 
 import java.util.Set;
 import org.openide.util.Exceptions;
+import org.sleuthkit.autopsy.coreutils.ModuleSettings;
 import org.sleuthkit.datamodel.AbstractFile;
 import org.sleuthkit.datamodel.TskData;
 
 /**
- *
+ * Allows limiting which files ingest is run on by storing rules and allowing
+ * files to be compared to them.
  *
  */
-public class IngestSetFilter {
+public final class IngestSetFilter {
 
     FilesSet currentRules;
     String rulesKey;
     private boolean processUnallocatedSpace;
     public final static String ALL_FILES_FILTER = "<All Files>";
     public final static String ALL_FILES_AND_UNALLOCATED_FILTER = "<All Files and Unallocated Space>";
-    public final static String NEW_INGEST_FILTER= "<Create New>";
+    public final static String NEW_INGEST_FILTER = "<Create New>";
-
+    private String lastSelected;
-    public static Set<String> getKeys() throws InterestingItemDefsManager.InterestingItemDefsManagerException {
+    private static final String LAST_INGEST_FILTER_FILE = "CurrentIngestFilter";
-        InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance();
+    private static final String LAST_INGEST_FILTER_PROPERTY = "LastIngestFilter";
-        return manager.getInterestingFilesSets(InterestingItemDefsManager.getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME(), "").keySet();
-    }
 
+    /**
+     * Creates an IngestSetFilter for the filter specified by the key.
+     *
+     * @param key - The name of the filter you wish to create.
+     */
     public IngestSetFilter(String key) {
         this.rulesKey = key;
         InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance();
-        if (key.equals(ALL_FILES_FILTER)) {
+        switch (key) {
+            case ALL_FILES_FILTER:
                 currentRules = null;
                 processUnallocatedSpace = false;
-        } else if (key.equals(ALL_FILES_AND_UNALLOCATED_FILTER)) {
+                break;
+            case ALL_FILES_AND_UNALLOCATED_FILTER:
                 currentRules = null;
                 processUnallocatedSpace = true;
-        } else {
+                break;
+            default:
                 try {
-                currentRules = manager.getInterestingFilesSets(InterestingItemDefsManager.getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME(), "").get(key);
+                    currentRules = manager.getInterestingFilesSets(InterestingItemDefsManager.getIngestSetFilterDefsName(), "").get(key);
                     processUnallocatedSpace = currentRules.processesUnallocatedSpace();
                 } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
                     Exceptions.printStackTrace(ex);
                 }
+                break;
         }
     }
 
     /**
+     * No argument constructor for IngestSetFilter, creates a filter using the
+     * same filter that was selected previously.
+     */
+    public IngestSetFilter() {
+        InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance();
+        this.rulesKey = getLastSelected();
+        switch (rulesKey) {
+            case ALL_FILES_FILTER:
+                currentRules = null;
+                processUnallocatedSpace = false;
+                break;
+            case ALL_FILES_AND_UNALLOCATED_FILTER:
+                currentRules = null;
+                processUnallocatedSpace = true;
+                break;
+            default:
+                try {
+                    currentRules = manager.getInterestingFilesSets(InterestingItemDefsManager.getIngestSetFilterDefsName(), "").get(rulesKey);
+                    processUnallocatedSpace = currentRules.processesUnallocatedSpace();
+                } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
+                    Exceptions.printStackTrace(ex);
+                }
+                break;
+        }
+
+    }
+
+    /**
+     * Get the set of available Ingest Set Filters.
      *
+     * @return - the set of filter names
+     * @throws
+     * org.sleuthkit.autopsy.modules.interestingitems.InterestingItemDefsManager.InterestingItemDefsManagerException
+     */
+    public static Set<String> getKeys() throws InterestingItemDefsManager.InterestingItemDefsManagerException {
+        InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance();
+        return manager.getInterestingFilesSets(InterestingItemDefsManager.getIngestSetFilterDefsName(), "").keySet();
+    }
+
+    /**
+     * Returns access to the Rules currently being used by the Ingest Set Filter
      *
      * @return - the active file filter set from the InterestingItemsDefsManager
      */
@@ -78,10 +127,9 @@ public class IngestSetFilter {
      */
     public boolean match(AbstractFile file) {
         boolean fileMatches = false;
-        if (isProcessUnallocatedSpace() == false && file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)){
+        if (isProcessUnallocatedSpace() == false && file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) {
             fileMatches = false;
-        }
+        } else if (rulesKey.equals(ALL_FILES_FILTER) || rulesKey.equals(ALL_FILES_AND_UNALLOCATED_FILTER)) {
-        else if (rulesKey.equals(ALL_FILES_FILTER) || rulesKey.equals(ALL_FILES_AND_UNALLOCATED_FILTER) ) {
             fileMatches = true;
         } else if (currentRules.fileIsMemberOf(file) != null) {
             fileMatches = true;
@@ -90,7 +138,39 @@ public class IngestSetFilter {
     }
 
     /**
-     * @return the processUnallocatedSpace
+     * Get the name of the Ingest Set Filter which was last used, so that when
+     * running on the same set of files you will not have to reselect that set.
+     *
+     * @return lastSelected - the string which represents the Ingest Set Filter
+     * which was last used.
+     */
+    public String getLastSelected() {
+        if (lastSelected == null) {
+            if (ModuleSettings.configExists(LAST_INGEST_FILTER_FILE)) {
+                lastSelected = ModuleSettings.getConfigSetting(LAST_INGEST_FILTER_FILE, LAST_INGEST_FILTER_PROPERTY);
+            } else {
+                lastSelected = ALL_FILES_AND_UNALLOCATED_FILTER;
+            }
+        }
+        return lastSelected;
+    }
+
+    /**
+     * Saves the last selected IngestSetFilter, to a file so that it can be
+     * loaded later.
+     *
+     * @return True if value was saved successfully, false if it was not.
+     */
+    public void setLastSelected(String lastSelectedFilter) {
+        lastSelected = lastSelectedFilter;
+        ModuleSettings.setConfigSetting(LAST_INGEST_FILTER_FILE, LAST_INGEST_FILTER_PROPERTY, lastSelected);
+    }
+
+    /**
+     * Get whether or not unallocated space should be processed as a boolean.
+     *
+     * @return the processUnallocatedSpace true if unallocated space should be
+     * processed false if unallocated space should not be processed
      */
     public boolean isProcessUnallocatedSpace() {
         return processUnallocatedSpace;

Core/src/org/sleuthkit/autopsy/modules/interestingitems/IngestSetFilterDefsOptionsPanelController.java

@@ -30,20 +30,22 @@ import org.openide.util.Lookup;
 
 @OptionsPanelController.TopLevelRegistration(
         categoryName = "#OptionsCategory_Name_IngestSetFilterDefinitions",
-        iconBase = "org/sleuthkit/autopsy/images/interesting_item_32x32.png",
+        iconBase = "org/sleuthkit/autopsy/images/ingest_set_filter32x32.png",
         keywords = "#OptionsCategory_Keywords_IngestSetFilterDefinitions",
         keywordsCategory = "IngestSetFilterDefinitions",
         position = 7
 )
 
 /**
- * Class for creating an InterestingItemDefsPanel which will be used for configuring the IngestSetFilter.  
+ * Class for creating an InterestingItemDefsPanel which will be used for
+ * configuring the IngestSetFilter.
  */
 public final class IngestSetFilterDefsOptionsPanelController extends OptionsPanelController {
 
     private InterestingItemDefsPanel panel;
     private final PropertyChangeSupport pcs = new PropertyChangeSupport(this);
     private boolean changed;
+    private final IngestSetFilter filter = new IngestSetFilter();
 
     /**
      * Component should load its data here.
@@ -74,6 +76,10 @@ public final class IngestSetFilterDefsOptionsPanelController extends OptionsPane
         return nameList.toArray(returnArray);
     }
 
+    public IngestSetFilter getIngestSetFilter() {
+        return filter;
+    }
+
     /**
      * This method is called when both the Ok and Apply buttons are pressed. It
      * applies to any of the panels that have been opened in the process of
@@ -138,9 +144,16 @@ public final class IngestSetFilterDefsOptionsPanelController extends OptionsPane
         pcs.removePropertyChangeListener(l);
     }
 
+    /**
+     * Creates an interestingItemsDefPanel that will be labeled to indicate it
+     * is for Ingest Set Filter settings
+     *
+     * @return an InterestingItemDefsPanel which has text and fields modified to
+     * indicate it is for Ingest Set Filtering.
+     */
     private InterestingItemDefsPanel getPanel() {
         if (panel == null) {
-            panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME(), "");
+            panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getIngestSetFilterDefsName(), "");
             panel.addPropertyChangeListener(new PropertyChangeListener() {
                 @Override
                 public void propertyChange(PropertyChangeEvent evt) {

Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsManager.java

@@ -52,9 +52,9 @@ final class InterestingItemDefsManager extends Observable {
     private static final List<String> ILLEGAL_FILE_NAME_CHARS = Collections.unmodifiableList(new ArrayList<>(Arrays.asList("\\", "/", ":", "*", "?", "\"", "<", ">")));
     private static final List<String> ILLEGAL_FILE_PATH_CHARS = Collections.unmodifiableList(new ArrayList<>(Arrays.asList("\\", ":", "*", "?", "\"", "<", ">")));
     private static final String LEGACY_FILES_SET_DEFS_FILE_NAME = "InterestingFilesSetDefs.xml"; //NON-NLS
-    private static final String INTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME = "InterestingFileSets.settings";
+    private static final String INTERESTING_FILES_SET_DEFS_NAME = "InterestingFileSets.settings";
-    private static final String FILE_FILTER_SET_DEFS_SERIALIZATION_NAME = "FileFilterSets.settings";
+    private static final String INGEST_SET_FILTER_DEFS_NAME = "IngestSetFilterDefs.settings";
-    private static final String INTERESTING_FILES_SET_DEFS_SERIALIZATION_PATH = PlatformUtil.getUserConfigDirectory() + File.separator;
+    private static final String INTERESTING_FILES_SET_DEFS_PATH = PlatformUtil.getUserConfigDirectory() + File.separator;
     private static final String LEGACY_FILE_SET_DEFS_PATH = PlatformUtil.getUserConfigDirectory() + File.separator;
     private static InterestingItemDefsManager instance;
 
@@ -90,22 +90,22 @@ final class InterestingItemDefsManager extends Observable {
     /**
      * @return the LEGACY_FILES_SET_DEFS_FILE_NAME
      */
-    static String getLEGACY_FILES_SET_DEFS_FILE_NAME() {
+    static String getLegacyFilesSetDefsFileName() {
         return LEGACY_FILES_SET_DEFS_FILE_NAME;
     }
 
     /**
-     * @return the INTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME
+     * @return the INTERESTING_FILES_SET_DEFS_NAME
      */
-    static String getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME() {
+    static String getInterestingFilesSetDefsSerializationName() {
-        return INTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME;
+        return INTERESTING_FILES_SET_DEFS_NAME;
     }
 
     /**
-     * @return the FILE_FILTER_SET_DEFS_SERIALIZATION_NAME
+     * @return the INGEST_SET_FILTER_DEFS_NAME
      */
-    static String getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME() {
+    static String getIngestSetFilterDefsName() {
-        return FILE_FILTER_SET_DEFS_SERIALIZATION_NAME;
+        return INGEST_SET_FILTER_DEFS_NAME;
     }
 
     /**
@@ -126,7 +126,7 @@ final class InterestingItemDefsManager extends Observable {
      * used to enforce unique files set names.
      */
     synchronized void setInterestingFilesSets(Map<String, FilesSet> filesSets, String serialFileName) throws InterestingItemDefsManagerException {
-        FilesSetXML.writeDefinitionsFile(INTERESTING_FILES_SET_DEFS_SERIALIZATION_PATH+serialFileName, filesSets);
+        FilesSetXML.writeDefinitionsFile(INTERESTING_FILES_SET_DEFS_PATH + serialFileName, filesSets);
         this.setChanged();
         this.notifyObservers();
     }
@@ -179,8 +179,8 @@ final class InterestingItemDefsManager extends Observable {
                 return filesSets;
             }
             // Check if the legacy xml file exists.
-            if(!legacyFileName.isEmpty()){
+            if (!legacyFileName.isEmpty()) {
-                File defsFile = new File(LEGACY_FILE_SET_DEFS_PATH+legacyFileName);
+                File defsFile = new File(LEGACY_FILE_SET_DEFS_PATH + legacyFileName);
                 if (!defsFile.exists()) {
                     return filesSets;
                 }
@@ -223,7 +223,8 @@ final class InterestingItemDefsManager extends Observable {
          * @throws InterestingItemDefsManagerException if file could not be read
          */
         private static Map<String, FilesSet> readSerializedDefinitions(String serialFileName) throws InterestingItemDefsManagerException {
-            String filePath = INTERESTING_FILES_SET_DEFS_SERIALIZATION_PATH + serialFileName;
+            String filePath;
+            filePath = INTERESTING_FILES_SET_DEFS_PATH + serialFileName;
             System.out.println(filePath);
             File fileSetFile = new File(filePath);
             if (fileSetFile.exists()) {
@@ -236,7 +237,7 @@ final class InterestingItemDefsManager extends Observable {
                     throw new InterestingItemDefsManagerException(String.format("Failed to read settings from %s", filePath), ex);
                 }
             } else {
-                return new HashMap<String, FilesSet>();
+                return new HashMap<>();
             }
         }
 

Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsOptionsPanelController.java

@@ -115,7 +115,7 @@ public final class InterestingItemDefsOptionsPanelController extends OptionsPane
 
     private InterestingItemDefsPanel getPanel() {
         if (panel == null) {
-            panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME());
+            panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName());
             panel.addPropertyChangeListener(new PropertyChangeListener() {
                 @Override
                 public void propertyChange(PropertyChangeEvent evt) {

Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.form

@@ -61,18 +61,20 @@
 
           <Layout>
             <DimensionLayout dim="0">
-              <Group type="103" groupAlignment="0" attributes="0">
-                  <Group type="102" attributes="0">
               <Group type="103" groupAlignment="0" attributes="0">
                   <Group type="102" attributes="0">
                       <EmptySpace min="360" pref="360" max="-2" attributes="0"/>
                       <Group type="103" groupAlignment="0" attributes="0">
                           <Component id="rulesListLabel" alignment="0" min="-2" max="-2" attributes="0"/>
                           <Component id="jLabel5" alignment="0" min="-2" max="-2" attributes="0"/>
-                                  <Component id="ignoreKnownFilesCheckbox" alignment="0" min="-2" max="-2" attributes="0"/>
                           <Component id="jLabel6" alignment="0" min="-2" max="-2" attributes="0"/>
+                          <Group type="102" alignment="0" attributes="0">
+                              <Component id="ignoreKnownFilesCheckbox" min="-2" max="-2" attributes="0"/>
+                              <EmptySpace max="-2" attributes="0"/>
+                              <Component id="processUnallocCheckbox" min="-2" pref="158" max="-2" attributes="0"/>
                           </Group>
-                              <EmptySpace min="0" pref="0" max="32767" attributes="0"/>
+                      </Group>
+                      <EmptySpace max="32767" attributes="0"/>
                   </Group>
                   <Group type="102" alignment="0" attributes="0">
                       <EmptySpace min="-2" max="-2" attributes="0"/>
@@ -141,7 +143,7 @@
                           <Group type="102" attributes="0">
                               <Group type="103" groupAlignment="0" attributes="0">
                                   <Component id="setDescScrollPanel" alignment="0" max="32767" attributes="0"/>
-                                          <Component id="rulesListScrollPane" alignment="0" max="32767" attributes="0"/>
+                                  <Component id="rulesListScrollPane" alignment="0" pref="342" max="32767" attributes="0"/>
                               </Group>
                               <EmptySpace min="7" pref="7" max="-2" attributes="0"/>
                           </Group>
@@ -180,9 +182,7 @@
                               <EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
                           </Group>
                       </Group>
-                          </Group>
+                      <EmptySpace min="-2" pref="85" max="-2" attributes="0"/>
-                      </Group>
-                      <EmptySpace min="-2" pref="23" max="-2" attributes="0"/>
                   </Group>
               </Group>
             </DimensionLayout>
@@ -214,7 +214,10 @@
                                       <EmptySpace min="-2" max="-2" attributes="0"/>
                                       <Component id="setDescScrollPanel" min="-2" pref="42" max="-2" attributes="0"/>
                                       <EmptySpace min="-2" max="-2" attributes="0"/>
-                                      <Component id="ignoreKnownFilesCheckbox" min="-2" max="-2" attributes="0"/>
+                                      <Group type="103" groupAlignment="3" attributes="0">
+                                          <Component id="ignoreKnownFilesCheckbox" alignment="3" min="-2" max="-2" attributes="0"/>
+                                          <Component id="processUnallocCheckbox" alignment="3" min="-2" pref="23" max="-2" attributes="0"/>
+                                      </Group>
                                       <EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/>
                                       <Component id="rulesListLabel" min="-2" max="-2" attributes="0"/>
                                       <EmptySpace min="-2" max="-2" attributes="0"/>
@@ -839,6 +842,19 @@
                 <AuxValue name="JavaCodeGenerator_TypeParameters" type="java.lang.String" value="&lt;String&gt;"/>
               </AuxValues>
             </Component>
+            <Component class="javax.swing.JCheckBox" name="processUnallocCheckbox">
+              <Properties>
+                <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+                  <ResourceString bundle="org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties" key="InterestingItemDefsPanel.processUnallocCheckbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+                </Property>
+                <Property name="toolTipText" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+                  <ResourceString bundle="org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties" key="InterestingItemDefsPanel.processUnallocCheckbox.toolTipText" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+                </Property>
+              </Properties>
+              <Events>
+                <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="processUnallocCheckboxActionPerformed"/>
+              </Events>
+            </Component>
           </SubComponents>
         </Container>
       </SubComponents>

Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.java

@@ -90,29 +90,27 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
         this.rulesList.addListSelectionListener(new InterestingItemDefsPanel.RulesListSelectionListener());
         this.settingsFileName = settingsName;
 
-        if (legacySettingsName.equals("")){  //Hide the mimetype settings when this is displaying FileSet rules instead of interesting item rules
+        if (legacySettingsName.equals("")) {  //Hide the mimetype settings when this is displaying FileSet rules instead of interesting item rules
             this.mimeTypeComboBox.setVisible(false);
             this.jLabel7.setVisible(false);
             this.ruleDialogTitle = "IngestFileFilter.title";
-        }
+        } else {
-        else {
             this.ruleDialogTitle = "FilesSetPanel.title";
         }
 
     }
 
-    Set<String> getKeys(){
+    Set<String> getKeys() {
         load();
         return filesSets.keySet();
     }
 
     @NbBundle.Messages({"InterestingItemDefsPanel.Title=Global Interesting Items Settings",
-                        "IngestFilterItemDefsPanel.Title=Global Ingest Filter Settings" })
+        "IngestFilterItemDefsPanel.Title=Global Ingest Filter Settings"})
     private void customInit() {
-        if (settingsLegacyFileName.equals("")){
+        if (settingsLegacyFileName.equals("")) {
             setName(Bundle.IngestFilterItemDefsPanel_Title());
-        }
+        } else {
-        else {
             setName(Bundle.InterestingItemDefsPanel_Title());
         }
         Set<String> fileTypesCollated = new HashSet<>();
@@ -205,6 +203,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
         this.setsListModel.clear();
         this.setDescriptionTextArea.setText("");
         this.ignoreKnownFilesCheckbox.setSelected(true);
+        this.processUnallocCheckbox.setSelected(true);
         this.newSetButton.setEnabled(true);
         this.editSetButton.setEnabled(false);
         this.deleteSetButton.setEnabled(false);
@@ -252,7 +251,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
                 // selected files set.
                 InterestingItemDefsPanel.this.setDescriptionTextArea.setText(selectedSet.getDescription());
                 InterestingItemDefsPanel.this.ignoreKnownFilesCheckbox.setSelected(selectedSet.ignoresKnownFiles());
-
+                InterestingItemDefsPanel.this.processUnallocCheckbox.setSelected(selectedSet.processesUnallocatedSpace());
                 // Enable the new, edit and delete set buttons.
                 InterestingItemDefsPanel.this.newSetButton.setEnabled(true);
                 InterestingItemDefsPanel.this.editSetButton.setEnabled(true);
@@ -357,8 +356,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
      * respond to user interactions with the dialog.
      *
      * @param selectedSet The currently selected files set, may be null to
-     *                    indicate a new interesting files set definition is to
+     * indicate a new interesting files set definition is to be created.
-     *                    be created.
      */
     private void doFileSetsDialog(FilesSet selectedSet) {
         // Create a files set defintion panle.
@@ -453,18 +451,20 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
         }
     }
     
+
     /**
      * Adds an interesting files set definition to the collection of definitions
      * owned by this panel. If there is a definition with the same name, it will
      * be replaced, so this is an add/edit operation.
      *
-     * @param oldSet            A set to replace, null if the new set is not a
+     * @param oldSet A set to replace, null if the new set is not a replacement.
-     *                          replacement.
      * @param name The name of the files set.
      * @param description The description of the files set.
      * @param ignoresKnownFiles Whether or not the files set ignores known
      * files.
      * @param rules The set membership rules for the set.
+     * @param processesUnallocatedSpace Whether or not this set of rules processes 
+     * unallocated space
      */
     void replaceFilesSet(FilesSet oldSet, String name, String description, boolean ignoresKnownFiles, Map<String, FilesSet.Rule> rules, boolean processesUnallocatedSpace) {
         if (oldSet != null) {
@@ -496,6 +496,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
      * WARNING: Do NOT modify this code. The content of this method is always
      * regenerated by the Form Editor.
      */
+    
     @SuppressWarnings("unchecked")
     // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
     private void initComponents() {
@@ -543,6 +544,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
         equalitySignComboBox = new javax.swing.JComboBox<String>();
         fileSizeSpinner = new javax.swing.JSpinner();
         fileSizeUnitComboBox = new javax.swing.JComboBox<String>();
+        processUnallocCheckbox = new javax.swing.JCheckBox();
 
         setFont(getFont().deriveFont(getFont().getStyle() & ~java.awt.Font.BOLD, 11));
 
@@ -750,20 +752,30 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
         fileSizeUnitComboBox.setModel(new javax.swing.DefaultComboBoxModel<String>(new String[] { Bundle.InterestingItemDefsPanel_bytes(), Bundle.InterestingItemDefsPanel_kiloBytes(), Bundle.InterestingItemDefsPanel_megaBytes(), Bundle.InterestingItemDefsPanel_gigaBytes() }));
         fileSizeUnitComboBox.setEnabled(false);
 
+        org.openide.awt.Mnemonics.setLocalizedText(processUnallocCheckbox, org.openide.util.NbBundle.getMessage(InterestingItemDefsPanel.class, "InterestingItemDefsPanel.processUnallocCheckbox.text")); // NOI18N
+        processUnallocCheckbox.setToolTipText(org.openide.util.NbBundle.getMessage(InterestingItemDefsPanel.class, "InterestingItemDefsPanel.processUnallocCheckbox.toolTipText")); // NOI18N
+	processUnallocCheckbox.setEnabled(false);
+        processUnallocCheckbox.addActionListener(new java.awt.event.ActionListener() {
+            public void actionPerformed(java.awt.event.ActionEvent evt) {
+                processUnallocCheckboxActionPerformed(evt);
+            }
+        });
+
         javax.swing.GroupLayout jPanel1Layout = new javax.swing.GroupLayout(jPanel1);
         jPanel1.setLayout(jPanel1Layout);
         jPanel1Layout.setHorizontalGroup(
             jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
-            .addGroup(jPanel1Layout.createSequentialGroup()
-                .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
             .addGroup(jPanel1Layout.createSequentialGroup()
                 .addGap(360, 360, 360)
                 .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
                     .addComponent(rulesListLabel)
                     .addComponent(jLabel5)
+                    .addComponent(jLabel6)
+                    .addGroup(jPanel1Layout.createSequentialGroup()
                         .addComponent(ignoreKnownFilesCheckbox)
-                            .addComponent(jLabel6))
+                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
-                        .addGap(0, 0, Short.MAX_VALUE))
+                        .addComponent(processUnallocCheckbox, javax.swing.GroupLayout.PREFERRED_SIZE, 158, javax.swing.GroupLayout.PREFERRED_SIZE)))
+                .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
             .addGroup(jPanel1Layout.createSequentialGroup()
                 .addContainerGap()
                 .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@@ -815,7 +827,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
                     .addGroup(jPanel1Layout.createSequentialGroup()
                         .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
                             .addComponent(setDescScrollPanel)
-                                    .addComponent(rulesListScrollPane))
+                            .addComponent(rulesListScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 342, Short.MAX_VALUE))
                         .addGap(7, 7, 7))
                     .addGroup(jPanel1Layout.createSequentialGroup()
                         .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@@ -843,8 +855,8 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
                                         .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
                                         .addComponent(fileNameRegexCheckbox))
                                     .addComponent(rulePathConditionRegexCheckBox))))
-                                .addGap(4, 4, 4)))))
+                        .addGap(4, 4, 4)))
-                .addGap(23, 23, 23))
+                .addGap(85, 85, 85))
         );
         jPanel1Layout.setVerticalGroup(
             jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@@ -872,7 +884,9 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
                                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                                 .addComponent(setDescScrollPanel, javax.swing.GroupLayout.PREFERRED_SIZE, 42, javax.swing.GroupLayout.PREFERRED_SIZE)
                                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
+                                .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
                                     .addComponent(ignoreKnownFilesCheckbox)
+                                    .addComponent(processUnallocCheckbox, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE))
                                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
                                 .addComponent(rulesListLabel)
                                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
@@ -1000,6 +1014,10 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
         // TODO add your handling code here:
     }//GEN-LAST:event_fileNameTextFieldActionPerformed
 
+    private void processUnallocCheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_processUnallocCheckboxActionPerformed
+        // TODO add your handling code here:
+    }//GEN-LAST:event_processUnallocCheckboxActionPerformed
+
     // Variables declaration - do not modify//GEN-BEGIN:variables
     private javax.swing.JRadioButton bothRadioButton;
     private javax.swing.JButton deleteRuleButton;
@@ -1032,6 +1050,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
     private javax.swing.JComboBox<String> mimeTypeComboBox;
     private javax.swing.JButton newRuleButton;
     private javax.swing.JButton newSetButton;
+    private javax.swing.JCheckBox processUnallocCheckbox;
     private javax.swing.JCheckBox rulePathConditionRegexCheckBox;
     private javax.swing.JTextField rulePathConditionTextField;
     private javax.swing.JList<FilesSet.Rule> rulesList;

Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemsIngestModuleFactory.java

@@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.modules.interestingitems;
 
 import java.util.ArrayList;
 import java.util.List;
-import org.openide.util.Exceptions;
 import org.openide.util.NbBundle;
 import org.openide.util.NbBundle.Messages;
 import org.openide.util.lookup.ServiceProvider;
@@ -70,7 +69,7 @@ final public class InterestingItemsIngestModuleFactory extends IngestModuleFacto
 
     @Override
     public IngestModuleGlobalSettingsPanel getGlobalSettingsPanel() {
-        InterestingItemDefsPanel panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME());
+        InterestingItemDefsPanel panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName());
         panel.load();
         return panel;
     }
@@ -84,7 +83,7 @@ final public class InterestingItemsIngestModuleFactory extends IngestModuleFacto
         // Doing so also keeps the serialization simple.
         List<String> enabledFilesSetNames = new ArrayList<>();
         try {
-            for (String name : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()).keySet()) {
+            for (String name : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()).keySet()) {
                 enabledFilesSetNames.add(name);
             }
         } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {