mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 02:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

1903-saving of previously used filter fixed

Browse Source
This commit is contained in:
William Schaefer 2016-12-05 15:20:47 -05:00
parent ce5d879d48
commit 97f9064d30
13 changed files with 438 additions and 334 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java
View File

@ -42,21 +42,18 @@ import org.sleuthkit.autopsy.modules.interestingitems.IngestSetFilter;
/** /**
* Encapsulates the ingest job settings for a particular execution context. * Encapsulates the ingest job settings for a particular execution context.
* Examples of execution contexts include the add data source wizard and the run * Examples of execution contexts include the add data source wizard and the run
* ingest modules dialog. Different execution conterxts may have different * ingest modules dialog. Different execution contexts may have different ingest
* ingest job settings. * job settings.
*/ */
public class IngestJobSettings { public class IngestJobSettings {
private static final String ENABLED_MODULES_KEY = "Enabled_Ingest_Modules"; //NON-NLS private static final String ENABLED_MODULES_KEY = "Enabled_Ingest_Modules"; //NON-NLS
private static final String DISABLED_MODULES_KEY = "Disabled_Ingest_Modules"; //NON-NLS private static final String DISABLED_MODULES_KEY = "Disabled_Ingest_Modules"; //NON-NLS
private static final String PARSE_UNALLOC_SPACE_KEY = "Process_Unallocated_Space"; //NON-NLS private static final String PARSE_UNALLOC_SPACE_KEY = "Process_Unallocated_Space"; //NON-NLS
private static final String RUN_ON_FILTER_KEY = "Run_Ingest_On";
private static final String PROCESS_UNALLOC_SPACE_DEFAULT = "true"; //NON-NLS private static final String PROCESS_UNALLOC_SPACE_DEFAULT = "true"; //NON-NLS
private static final String RUN_ON_FILTER_DEFAULT = IngestSetFilter.ALL_FILES_AND_UNALLOCATED_FILTER;
private static final String MODULE_SETTINGS_FOLDER = "IngestModuleSettings"; //NON-NLS private static final String MODULE_SETTINGS_FOLDER = "IngestModuleSettings"; //NON-NLS
private static final String MODULE_SETTINGS_FOLDER_PATH = Paths.get(PlatformUtil.getUserConfigDirectory(), IngestJobSettings.MODULE_SETTINGS_FOLDER).toAbsolutePath().toString(); private static final String MODULE_SETTINGS_FOLDER_PATH = Paths.get(PlatformUtil.getUserConfigDirectory(), IngestJobSettings.MODULE_SETTINGS_FOLDER).toAbsolutePath().toString();
private static final String MODULE_SETTINGS_FILE_EXT = ".settings"; //NON-NLS private static final String MODULE_SETTINGS_FILE_EXT = ".settings"; //NON-NLS
private String runIngestModulesOnFilter;
private static final Logger LOGGER = Logger.getLogger(IngestJobSettings.class.getName()); private static final Logger LOGGER = Logger.getLogger(IngestJobSettings.class.getName());
private final String executionContext; private final String executionContext;
private final IngestType ingestType; private final IngestType ingestType;
@ -66,22 +63,6 @@ public class IngestJobSettings {
private boolean processUnallocatedSpace; private boolean processUnallocatedSpace;
private final List<String> warnings; private final List<String> warnings;
/**
* @return the runIngestModulesOnFilter
*/
String getRunIngestModulesOnFilter() {
return runIngestModulesOnFilter;
}
/**
* @param runIngestModulesOnFilter the runIngestModulesOnFilter to set
*/
void setRunIngestModulesOnFilter(String runIngestModulesOnFilter) {
this.runIngestModulesOnFilter = runIngestModulesOnFilter;
this.processUnallocatedSpace = (new IngestSetFilter(runIngestModulesOnFilter)).isProcessUnallocatedSpace();
this.save();
}
/** /**
* The type of ingest modules to run. * The type of ingest modules to run.
*/ */
@ -114,7 +95,6 @@ public class IngestJobSettings {
this.ingestType = IngestType.ALL_MODULES; this.ingestType = IngestType.ALL_MODULES;
this.moduleTemplates = new ArrayList<>(); this.moduleTemplates = new ArrayList<>();
this.processUnallocatedSpace = Boolean.parseBoolean(IngestJobSettings.PROCESS_UNALLOC_SPACE_DEFAULT); this.processUnallocatedSpace = Boolean.parseBoolean(IngestJobSettings.PROCESS_UNALLOC_SPACE_DEFAULT);
this.runIngestModulesOnFilter = IngestSetFilter.ALL_FILES_AND_UNALLOCATED_FILTER;
this.warnings = new ArrayList<>(); this.warnings = new ArrayList<>();
this.createSavedModuleSettingsFolder(); this.createSavedModuleSettingsFolder();
this.load(); this.load();
@ -141,7 +121,6 @@ public class IngestJobSettings {
this.moduleTemplates = new ArrayList<>(); this.moduleTemplates = new ArrayList<>();
this.processUnallocatedSpace = Boolean.parseBoolean(IngestJobSettings.PROCESS_UNALLOC_SPACE_DEFAULT); this.processUnallocatedSpace = Boolean.parseBoolean(IngestJobSettings.PROCESS_UNALLOC_SPACE_DEFAULT);
this.runIngestModulesOnFilter = IngestSetFilter.ALL_FILES_AND_UNALLOCATED_FILTER;
this.warnings = new ArrayList<>(); this.warnings = new ArrayList<>();
this.createSavedModuleSettingsFolder(); this.createSavedModuleSettingsFolder();
this.load(); this.load();
@ -331,14 +310,8 @@ public class IngestJobSettings {
ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.ENABLED_MODULES_KEY, makeCommaSeparatedValuesList(enabledModuleNames)); ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.ENABLED_MODULES_KEY, makeCommaSeparatedValuesList(enabledModuleNames));
ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.DISABLED_MODULES_KEY, makeCommaSeparatedValuesList(disabledModuleNames)); ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.DISABLED_MODULES_KEY, makeCommaSeparatedValuesList(disabledModuleNames));
// Get the filter setting telling it which files to run modules on. If the setting does
// not exist yet, default it to All Files and Unallocated Space filter.
if (ModuleSettings.settingExists(this.executionContext, IngestJobSettings.RUN_ON_FILTER_KEY) == false) {
ModuleSettings.setConfigSetting(this.executionContext, IngestJobSettings.RUN_ON_FILTER_KEY, IngestJobSettings.RUN_ON_FILTER_DEFAULT);
}
this.runIngestModulesOnFilter = ModuleSettings.getConfigSetting(this.executionContext, IngestJobSettings.RUN_ON_FILTER_KEY);
//set the process unallocated space setting based on the filter chosen. //set the process unallocated space setting based on the filter chosen.
this.processUnallocatedSpace = (new IngestSetFilter(runIngestModulesOnFilter)).isProcessUnallocatedSpace(); this.processUnallocatedSpace = (new IngestSetFilter()).isProcessUnallocatedSpace();
} }
@ -474,6 +447,7 @@ public class IngestJobSettings {
*/ */
String processUnalloc = Boolean.toString(this.processUnallocatedSpace); String processUnalloc = Boolean.toString(this.processUnallocatedSpace);
ModuleSettings.setConfigSetting(this.executionContext, PARSE_UNALLOC_SPACE_KEY, processUnalloc); ModuleSettings.setConfigSetting(this.executionContext, PARSE_UNALLOC_SPACE_KEY, processUnalloc);
} }
/** /**

12
Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettingsPanel.java
View File

@ -85,7 +85,7 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel {
initComponents(); initComponents();
customizeComponents(); customizeComponents();
jComboBox1.setSelectedItem(settings.getRunIngestModulesOnFilter()); jComboBox1.setSelectedItem(controller.getIngestSetFilter().getLastSelected());
} }
/** /**
@ -114,7 +114,7 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel {
initComponents(); initComponents();
customizeComponents(); customizeComponents();
jComboBox1.setSelectedItem(settings.getRunIngestModulesOnFilter()); jComboBox1.setSelectedItem(controller.getIngestSetFilter().getLastSelected());
} }
/** /**
@ -422,12 +422,12 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel {
dialog.close(); dialog.close();
}); });
dialog.display((IngestModuleGlobalSettingsPanel) controller.getComponent(controller.getLookup())); dialog.display((IngestModuleGlobalSettingsPanel) controller.getComponent(controller.getLookup()));
jComboBox1.setSelectedItem(controller.getIngestSetFilter().getLastSelected());
} else { } else if (evt.getActionCommand().equals("comboBoxChanged")) {
settings.setRunIngestModulesOnFilter(jComboBox1.getSelectedItem().toString()); controller.getIngestSetFilter().setLastSelected(jComboBox1.getSelectedItem().toString());
settings.save();
} }
jComboBox1.setSelectedItem(settings.getRunIngestModulesOnFilter());
}//GEN-LAST:event_jComboBox1ActionPerformed }//GEN-LAST:event_jComboBox1ActionPerformed

16
Core/src/org/sleuthkit/autopsy/ingest/IngestTasksScheduler.java
View File

@ -150,7 +150,7 @@ final class IngestTasksScheduler {
* @param job The job for which the tasks are to be scheduled. * @param job The job for which the tasks are to be scheduled.
* *
* @throws InterruptedException if the calling thread is blocked due to a * @throws InterruptedException if the calling thread is blocked due to a
* full tasks queue and is interrupted. * full tasks queue and is interrupted.
*/ */
synchronized void scheduleIngestTasks(DataSourceIngestJob job) { synchronized void scheduleIngestTasks(DataSourceIngestJob job) {
if (!job.isCancelled()) { if (!job.isCancelled()) {
@ -210,7 +210,7 @@ final class IngestTasksScheduler {
/** /**
* Schedules a file ingest task for an ingest job. * Schedules a file ingest task for an ingest job.
* *
* @param job The job for which the tasks are to be scheduled. * @param job The job for which the tasks are to be scheduled.
* @param file The file to be associated with the task. * @param file The file to be associated with the task.
*/ */
synchronized void scheduleFileIngestTask(DataSourceIngestJob job, AbstractFile file) { synchronized void scheduleFileIngestTask(DataSourceIngestJob job, AbstractFile file) {
@ -412,10 +412,10 @@ final class IngestTasksScheduler {
return false; return false;
} }
if (file.isFile()){ //is this the criteria we want to be using(will unallocated space files show return true?) if (file.isFile()) { //is this the criteria we want to be using(will unallocated space files show return true?)
IngestSetFilter ingestSetFilter; IngestSetFilter ingestSetFilter;
ingestSetFilter = new IngestSetFilter(task.getIngestJob().runIngestModulesOnFilter()); ingestSetFilter = new IngestSetFilter();
if (!ingestSetFilter.match(file)){ if (!ingestSetFilter.match(file)) {
return false; return false;
} }
} }
@ -487,7 +487,7 @@ final class IngestTasksScheduler {
* well. * well.
* *
* @param taskQueue The queue from which to remove the tasks. * @param taskQueue The queue from which to remove the tasks.
* @param jobId The id of the job for which the tasks are to be removed. * @param jobId The id of the job for which the tasks are to be removed.
*/ */
synchronized private void removeTasksForJob(Collection<? extends IngestTask> taskQueue, long jobId) { synchronized private void removeTasksForJob(Collection<? extends IngestTask> taskQueue, long jobId) {
Iterator<? extends IngestTask> iterator = taskQueue.iterator(); Iterator<? extends IngestTask> iterator = taskQueue.iterator();
@ -563,12 +563,12 @@ final class IngestTasksScheduler {
static final List<Pattern> MEDIUM_PRI_PATHS = new ArrayList<>(); static final List<Pattern> MEDIUM_PRI_PATHS = new ArrayList<>();
static final List<Pattern> HIGH_PRI_PATHS = new ArrayList<>(); static final List<Pattern> HIGH_PRI_PATHS = new ArrayList<>();
/* /*
* prioritize root directory folders based on the assumption that we * prioritize root directory folders based on the assumption that we
* are looking for user content. Other types of investigations may * are looking for user content. Other types of investigations may
* want different priorities. * want different priorities.
*/ */
static /* static /*
* prioritize root directory folders based on the assumption that we * prioritize root directory folders based on the assumption that we
* are looking for user content. Other types of investigations may * are looking for user content. Other types of investigations may

4
Core/src/org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties
View File

@ -4,7 +4,7 @@ OpenIDE-Module-Short-Description=Interesting Files Identifier ingest module.
OpenIDE-Module-Name=Interesting Files Identifier OpenIDE-Module-Name=Interesting Files Identifier
OptionsCategory_Name_InterestingItemDefinitions=Interesting Files OptionsCategory_Name_InterestingItemDefinitions=Interesting Files
OptionsCategory_Keywords_InterestingItemDefinitions=InterestingItemDefinitions OptionsCategory_Keywords_InterestingItemDefinitions=InterestingItemDefinitions
OptionsCategory_Name_IngestSetFilterDefinitions=File Filter OptionsCategory_Name_IngestSetFilterDefinitions=Ingest Set Filter
OptionsCategory_Keywords_IngestSetFilterDefinitions=IngestSetFilterDefinitions OptionsCategory_Keywords_IngestSetFilterDefinitions=IngestSetFilterDefinitions
InterestingItemsIdentifierIngestModule.moduleName=Interesting Files Identifier InterestingItemsIdentifierIngestModule.moduleName=Interesting Files Identifier
InterestingItemsIdentifierIngestModule.moduleDescription=Identifies interesting items as defined by interesting item rule sets. InterestingItemsIdentifierIngestModule.moduleDescription=Identifies interesting items as defined by interesting item rule sets.
@ -33,6 +33,8 @@ FilesSetRulePanel.pathSeparatorInfoLabel.text=Use / as path separator
FilesIdentifierIngestJobSettingsPanel.border.title=Select interesting files sets to enable during ingest: FilesIdentifierIngestJobSettingsPanel.border.title=Select interesting files sets to enable during ingest:
FilesSetRulePanel.jLabel1.text=Type: FilesSetRulePanel.jLabel1.text=Type:
FilesSetRulePanel.jLabel5.text=Enter information about files that you want to find. FilesSetRulePanel.jLabel5.text=Enter information about files that you want to find.
InterestingItemDefsPanel.processUnallocCheckbox.toolTipText=Processes unallocated space, such as deleted files. Produces more complete results, but it may take longer to process on large images.
InterestingItemDefsPanel.processUnallocCheckbox.text=Process Unallocated Space
InterestingItemDefsPanel.jLabel6.text=Set Details InterestingItemDefsPanel.jLabel6.text=Set Details
InterestingItemDefsPanel.jLabel8.text=File Size: InterestingItemDefsPanel.jLabel8.text=File Size:
InterestingItemDefsPanel.jLabel7.text=MIME Type: InterestingItemDefsPanel.jLabel7.text=MIME Type:

12
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestJobSettingsPanel.java
View File

@ -26,7 +26,6 @@ import java.util.TreeMap;
import javax.swing.JTable; import javax.swing.JTable;
import javax.swing.table.AbstractTableModel; import javax.swing.table.AbstractTableModel;
import javax.swing.table.TableColumn; import javax.swing.table.TableColumn;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings; import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
@ -36,6 +35,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
* Ingest job settings panel for interesting files identifier ingest modules. * Ingest job settings panel for interesting files identifier ingest modules.
*/ */
final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobSettingsPanel implements Observer { final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobSettingsPanel implements Observer {
@Messages({ @Messages({
"FilesIdentifierIngestJobSettingsPanel.updateError=Error updating interesting files sets settings file.", "FilesIdentifierIngestJobSettingsPanel.updateError=Error updating interesting files sets settings file.",
"FilesIdentifierIngestJobSettingsPanel.getError=Error getting interesting files sets from settings file." "FilesIdentifierIngestJobSettingsPanel.getError=Error getting interesting files sets from settings file."
@ -53,7 +53,7 @@ final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobS
* constructor. * constructor.
* *
* @return An instance of the ingest job settings panel interesting files * @return An instance of the ingest job settings panel interesting files
* identifier ingest modules. * identifier ingest modules.
*/ */
static FilesIdentifierIngestJobSettingsPanel makePanel(FilesIdentifierIngestJobSettings settings) { static FilesIdentifierIngestJobSettingsPanel makePanel(FilesIdentifierIngestJobSettings settings) {
FilesIdentifierIngestJobSettingsPanel panel = new FilesIdentifierIngestJobSettingsPanel(settings); FilesIdentifierIngestJobSettingsPanel panel = new FilesIdentifierIngestJobSettingsPanel(settings);
@ -83,7 +83,7 @@ final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobS
*/ */
List<FilesSetRow> filesSetRows = new ArrayList<>(); List<FilesSetRow> filesSetRows = new ArrayList<>();
try { try {
this.filesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME())); this.filesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()));
} catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) { } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
MessageNotifyUtil.Message.error(Bundle.FilesIdentifierIngestJobSettingsPanel_getError()); MessageNotifyUtil.Message.error(Bundle.FilesIdentifierIngestJobSettingsPanel_getError());
this.filesSetSnapshot = new TreeMap<>(); this.filesSetSnapshot = new TreeMap<>();
@ -138,7 +138,7 @@ final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobS
List<FilesSetRow> rowModels = new ArrayList<>(); List<FilesSetRow> rowModels = new ArrayList<>();
TreeMap<String, FilesSet> newFilesSetSnapshot; TreeMap<String, FilesSet> newFilesSetSnapshot;
try { try {
newFilesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME())); newFilesSetSnapshot = new TreeMap<>(InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()));
} catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) { } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
MessageNotifyUtil.Message.error(Bundle.FilesIdentifierIngestJobSettingsPanel_updateError()); MessageNotifyUtil.Message.error(Bundle.FilesIdentifierIngestJobSettingsPanel_updateError());
return; return;
@ -172,7 +172,7 @@ final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobS
* job. * job.
* *
* @param filesSetRows A collection of row objects that bundles an * @param filesSetRows A collection of row objects that bundles an
* interesting files set with an enabled flag * interesting files set with an enabled flag
*/ */
FilesSetsTableModel(List<FilesSetRow> filesSetRows) { FilesSetsTableModel(List<FilesSetRow> filesSetRows) {
this.filesSetRows = filesSetRows; this.filesSetRows = filesSetRows;
@ -182,7 +182,7 @@ final class FilesIdentifierIngestJobSettingsPanel extends IngestModuleIngestJobS
* Refreshes the table with a new set of rows. * Refreshes the table with a new set of rows.
* *
* @param filesSetRows A collection of row objects that bundles an * @param filesSetRows A collection of row objects that bundles an
* interesting files set with an enabled flag * interesting files set with an enabled flag
*/ */
void resetTableData(List<FilesSetRow> filesSetRows) { void resetTableData(List<FilesSetRow> filesSetRows) {
this.filesSetRows = filesSetRows; this.filesSetRows = filesSetRows;

2
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java
View File

@ -83,7 +83,7 @@ final class FilesIdentifierIngestModule implements FileIngestModule {
// to disable the interesting files set definition UI during ingest. // to disable the interesting files set definition UI during ingest.
List<FilesSet> filesSets = new ArrayList<>(); List<FilesSet> filesSets = new ArrayList<>();
try { try {
for (FilesSet set : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()).values()) { for (FilesSet set : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()).values()) {
if (settings.interestingFilesSetIsEnabled(set.getName())) { if (settings.interestingFilesSetIsEnabled(set.getName())) {
filesSets.add(set); filesSets.add(set);
} }

132
Core/src/org/sleuthkit/autopsy/modules/interestingitems/IngestSetFilter.java
View File

@ -20,48 +20,97 @@ package org.sleuthkit.autopsy.modules.interestingitems;
import java.util.Set; import java.util.Set;
import org.openide.util.Exceptions; import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.coreutils.ModuleSettings;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData; import org.sleuthkit.datamodel.TskData;
/** /**
* * Allows limiting which files ingest is run on by storing rules and allowing
* files to be compared to them.
* *
*/ */
public class IngestSetFilter { public final class IngestSetFilter {
FilesSet currentRules; FilesSet currentRules;
String rulesKey; String rulesKey;
private boolean processUnallocatedSpace; private boolean processUnallocatedSpace;
public final static String ALL_FILES_FILTER = "<All Files>"; public final static String ALL_FILES_FILTER = "<All Files>";
public final static String ALL_FILES_AND_UNALLOCATED_FILTER = "<All Files and Unallocated Space>"; public final static String ALL_FILES_AND_UNALLOCATED_FILTER = "<All Files and Unallocated Space>";
public final static String NEW_INGEST_FILTER= "<Create New>"; public final static String NEW_INGEST_FILTER = "<Create New>";
private String lastSelected;
public static Set<String> getKeys() throws InterestingItemDefsManager.InterestingItemDefsManagerException { private static final String LAST_INGEST_FILTER_FILE = "CurrentIngestFilter";
InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance(); private static final String LAST_INGEST_FILTER_PROPERTY = "LastIngestFilter";
return manager.getInterestingFilesSets(InterestingItemDefsManager.getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME(), "").keySet();
}
/**
* Creates an IngestSetFilter for the filter specified by the key.
*
* @param key - The name of the filter you wish to create.
*/
public IngestSetFilter(String key) { public IngestSetFilter(String key) {
this.rulesKey = key; this.rulesKey = key;
InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance(); InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance();
if (key.equals(ALL_FILES_FILTER)) { switch (key) {
currentRules = null; case ALL_FILES_FILTER:
processUnallocatedSpace = false; currentRules = null;
} else if (key.equals(ALL_FILES_AND_UNALLOCATED_FILTER)) { processUnallocatedSpace = false;
currentRules = null; break;
processUnallocatedSpace = true; case ALL_FILES_AND_UNALLOCATED_FILTER:
} else { currentRules = null;
try { processUnallocatedSpace = true;
currentRules = manager.getInterestingFilesSets(InterestingItemDefsManager.getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME(), "").get(key); break;
processUnallocatedSpace = currentRules.processesUnallocatedSpace(); default:
} catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) { try {
Exceptions.printStackTrace(ex); currentRules = manager.getInterestingFilesSets(InterestingItemDefsManager.getIngestSetFilterDefsName(), "").get(key);
} processUnallocatedSpace = currentRules.processesUnallocatedSpace();
} catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
Exceptions.printStackTrace(ex);
}
break;
} }
} }
/** /**
* No argument constructor for IngestSetFilter, creates a filter using the
* same filter that was selected previously.
*/
public IngestSetFilter() {
InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance();
this.rulesKey = getLastSelected();
switch (rulesKey) {
case ALL_FILES_FILTER:
currentRules = null;
processUnallocatedSpace = false;
break;
case ALL_FILES_AND_UNALLOCATED_FILTER:
currentRules = null;
processUnallocatedSpace = true;
break;
default:
try {
currentRules = manager.getInterestingFilesSets(InterestingItemDefsManager.getIngestSetFilterDefsName(), "").get(rulesKey);
processUnallocatedSpace = currentRules.processesUnallocatedSpace();
} catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
Exceptions.printStackTrace(ex);
}
break;
}
}
/**
* Get the set of available Ingest Set Filters.
* *
* @return - the set of filter names
* @throws
* org.sleuthkit.autopsy.modules.interestingitems.InterestingItemDefsManager.InterestingItemDefsManagerException
*/
public static Set<String> getKeys() throws InterestingItemDefsManager.InterestingItemDefsManagerException {
InterestingItemDefsManager manager = InterestingItemDefsManager.getInstance();
return manager.getInterestingFilesSets(InterestingItemDefsManager.getIngestSetFilterDefsName(), "").keySet();
}
/**
* Returns access to the Rules currently being used by the Ingest Set Filter
* *
* @return - the active file filter set from the InterestingItemsDefsManager * @return - the active file filter set from the InterestingItemsDefsManager
*/ */
@ -78,11 +127,10 @@ public class IngestSetFilter {
*/ */
public boolean match(AbstractFile file) { public boolean match(AbstractFile file) {
boolean fileMatches = false; boolean fileMatches = false;
if (isProcessUnallocatedSpace() == false && file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)){ if (isProcessUnallocatedSpace() == false && file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) {
fileMatches = false; fileMatches = false;
} } else if (rulesKey.equals(ALL_FILES_FILTER) || rulesKey.equals(ALL_FILES_AND_UNALLOCATED_FILTER)) {
else if (rulesKey.equals(ALL_FILES_FILTER) || rulesKey.equals(ALL_FILES_AND_UNALLOCATED_FILTER) ) { fileMatches = true;
fileMatches = true;
} else if (currentRules.fileIsMemberOf(file) != null) { } else if (currentRules.fileIsMemberOf(file) != null) {
fileMatches = true; fileMatches = true;
} }
@ -90,7 +138,39 @@ public class IngestSetFilter {
} }
/** /**
* @return the processUnallocatedSpace * Get the name of the Ingest Set Filter which was last used, so that when
* running on the same set of files you will not have to reselect that set.
*
* @return lastSelected - the string which represents the Ingest Set Filter
* which was last used.
*/
public String getLastSelected() {
if (lastSelected == null) {
if (ModuleSettings.configExists(LAST_INGEST_FILTER_FILE)) {
lastSelected = ModuleSettings.getConfigSetting(LAST_INGEST_FILTER_FILE, LAST_INGEST_FILTER_PROPERTY);
} else {
lastSelected = ALL_FILES_AND_UNALLOCATED_FILTER;
}
}
return lastSelected;
}
/**
* Saves the last selected IngestSetFilter, to a file so that it can be
* loaded later.
*
* @return True if value was saved successfully, false if it was not.
*/
public void setLastSelected(String lastSelectedFilter) {
lastSelected = lastSelectedFilter;
ModuleSettings.setConfigSetting(LAST_INGEST_FILTER_FILE, LAST_INGEST_FILTER_PROPERTY, lastSelected);
}
/**
* Get whether or not unallocated space should be processed as a boolean.
*
* @return the processUnallocatedSpace true if unallocated space should be
* processed false if unallocated space should not be processed
*/ */
public boolean isProcessUnallocatedSpace() { public boolean isProcessUnallocatedSpace() {
return processUnallocatedSpace; return processUnallocatedSpace;

19
Core/src/org/sleuthkit/autopsy/modules/interestingitems/IngestSetFilterDefsOptionsPanelController.java
View File

@ -30,20 +30,22 @@ import org.openide.util.Lookup;
@OptionsPanelController.TopLevelRegistration( @OptionsPanelController.TopLevelRegistration(
categoryName = "#OptionsCategory_Name_IngestSetFilterDefinitions", categoryName = "#OptionsCategory_Name_IngestSetFilterDefinitions",
iconBase = "org/sleuthkit/autopsy/images/interesting_item_32x32.png", iconBase = "org/sleuthkit/autopsy/images/ingest_set_filter32x32.png",
keywords = "#OptionsCategory_Keywords_IngestSetFilterDefinitions", keywords = "#OptionsCategory_Keywords_IngestSetFilterDefinitions",
keywordsCategory = "IngestSetFilterDefinitions", keywordsCategory = "IngestSetFilterDefinitions",
position = 7 position = 7
) )
/** /**
* Class for creating an InterestingItemDefsPanel which will be used for configuring the IngestSetFilter. * Class for creating an InterestingItemDefsPanel which will be used for
* configuring the IngestSetFilter.
*/ */
public final class IngestSetFilterDefsOptionsPanelController extends OptionsPanelController { public final class IngestSetFilterDefsOptionsPanelController extends OptionsPanelController {
private InterestingItemDefsPanel panel; private InterestingItemDefsPanel panel;
private final PropertyChangeSupport pcs = new PropertyChangeSupport(this); private final PropertyChangeSupport pcs = new PropertyChangeSupport(this);
private boolean changed; private boolean changed;
private final IngestSetFilter filter = new IngestSetFilter();
/** /**
* Component should load its data here. * Component should load its data here.
@ -74,6 +76,10 @@ public final class IngestSetFilterDefsOptionsPanelController extends OptionsPane
return nameList.toArray(returnArray); return nameList.toArray(returnArray);
} }
public IngestSetFilter getIngestSetFilter() {
return filter;
}
/** /**
* This method is called when both the Ok and Apply buttons are pressed. It * This method is called when both the Ok and Apply buttons are pressed. It
* applies to any of the panels that have been opened in the process of * applies to any of the panels that have been opened in the process of
@ -138,9 +144,16 @@ public final class IngestSetFilterDefsOptionsPanelController extends OptionsPane
pcs.removePropertyChangeListener(l); pcs.removePropertyChangeListener(l);
} }
/**
* Creates an interestingItemsDefPanel that will be labeled to indicate it
* is for Ingest Set Filter settings
*
* @return an InterestingItemDefsPanel which has text and fields modified to
* indicate it is for Ingest Set Filtering.
*/
private InterestingItemDefsPanel getPanel() { private InterestingItemDefsPanel getPanel() {
if (panel == null) { if (panel == null) {
panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME(), ""); panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getIngestSetFilterDefsName(), "");
panel.addPropertyChangeListener(new PropertyChangeListener() { panel.addPropertyChangeListener(new PropertyChangeListener() {
@Override @Override
public void propertyChange(PropertyChangeEvent evt) { public void propertyChange(PropertyChangeEvent evt) {

49
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsManager.java
View File

@ -52,9 +52,9 @@ final class InterestingItemDefsManager extends Observable {
private static final List<String> ILLEGAL_FILE_NAME_CHARS = Collections.unmodifiableList(new ArrayList<>(Arrays.asList("\\", "/", ":", "*", "?", "\"", "<", ">"))); private static final List<String> ILLEGAL_FILE_NAME_CHARS = Collections.unmodifiableList(new ArrayList<>(Arrays.asList("\\", "/", ":", "*", "?", "\"", "<", ">")));
private static final List<String> ILLEGAL_FILE_PATH_CHARS = Collections.unmodifiableList(new ArrayList<>(Arrays.asList("\\", ":", "*", "?", "\"", "<", ">"))); private static final List<String> ILLEGAL_FILE_PATH_CHARS = Collections.unmodifiableList(new ArrayList<>(Arrays.asList("\\", ":", "*", "?", "\"", "<", ">")));
private static final String LEGACY_FILES_SET_DEFS_FILE_NAME = "InterestingFilesSetDefs.xml"; //NON-NLS private static final String LEGACY_FILES_SET_DEFS_FILE_NAME = "InterestingFilesSetDefs.xml"; //NON-NLS
private static final String INTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME = "InterestingFileSets.settings"; private static final String INTERESTING_FILES_SET_DEFS_NAME = "InterestingFileSets.settings";
private static final String FILE_FILTER_SET_DEFS_SERIALIZATION_NAME = "FileFilterSets.settings"; private static final String INGEST_SET_FILTER_DEFS_NAME = "IngestSetFilterDefs.settings";
private static final String INTERESTING_FILES_SET_DEFS_SERIALIZATION_PATH = PlatformUtil.getUserConfigDirectory() + File.separator; private static final String INTERESTING_FILES_SET_DEFS_PATH = PlatformUtil.getUserConfigDirectory() + File.separator;
private static final String LEGACY_FILE_SET_DEFS_PATH = PlatformUtil.getUserConfigDirectory() + File.separator; private static final String LEGACY_FILE_SET_DEFS_PATH = PlatformUtil.getUserConfigDirectory() + File.separator;
private static InterestingItemDefsManager instance; private static InterestingItemDefsManager instance;
@ -90,29 +90,29 @@ final class InterestingItemDefsManager extends Observable {
/** /**
* @return the LEGACY_FILES_SET_DEFS_FILE_NAME * @return the LEGACY_FILES_SET_DEFS_FILE_NAME
*/ */
static String getLEGACY_FILES_SET_DEFS_FILE_NAME() { static String getLegacyFilesSetDefsFileName() {
return LEGACY_FILES_SET_DEFS_FILE_NAME; return LEGACY_FILES_SET_DEFS_FILE_NAME;
} }
/** /**
* @return the INTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME * @return the INTERESTING_FILES_SET_DEFS_NAME
*/ */
static String getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME() { static String getInterestingFilesSetDefsSerializationName() {
return INTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME; return INTERESTING_FILES_SET_DEFS_NAME;
} }
/** /**
* @return the FILE_FILTER_SET_DEFS_SERIALIZATION_NAME * @return the INGEST_SET_FILTER_DEFS_NAME
*/ */
static String getFILE_FILTER_SET_DEFS_SERIALIZATION_NAME() { static String getIngestSetFilterDefsName() {
return FILE_FILTER_SET_DEFS_SERIALIZATION_NAME; return INGEST_SET_FILTER_DEFS_NAME;
} }
/** /**
* Gets a copy of the current interesting files set definitions. * Gets a copy of the current interesting files set definitions.
* *
* @return A map of interesting files set names to interesting file sets, * @return A map of interesting files set names to interesting file sets,
* possibly empty. * possibly empty.
*/ */
synchronized Map<String, FilesSet> getInterestingFilesSets(String serialFileName, String legacyFilePath) throws InterestingItemDefsManagerException { synchronized Map<String, FilesSet> getInterestingFilesSets(String serialFileName, String legacyFilePath) throws InterestingItemDefsManagerException {
return FilesSetXML.readDefinitionsFile(serialFileName, LEGACY_FILE_SET_DEFS_PATH); return FilesSetXML.readDefinitionsFile(serialFileName, LEGACY_FILE_SET_DEFS_PATH);
@ -123,10 +123,10 @@ final class InterestingItemDefsManager extends Observable {
* previous definitions. * previous definitions.
* *
* @param filesSets A mapping of interesting files set names to files sets, * @param filesSets A mapping of interesting files set names to files sets,
* used to enforce unique files set names. * used to enforce unique files set names.
*/ */
synchronized void setInterestingFilesSets(Map<String, FilesSet> filesSets, String serialFileName) throws InterestingItemDefsManagerException { synchronized void setInterestingFilesSets(Map<String, FilesSet> filesSets, String serialFileName) throws InterestingItemDefsManagerException {
FilesSetXML.writeDefinitionsFile(INTERESTING_FILES_SET_DEFS_SERIALIZATION_PATH+serialFileName, filesSets); FilesSetXML.writeDefinitionsFile(INTERESTING_FILES_SET_DEFS_PATH + serialFileName, filesSets);
this.setChanged(); this.setChanged();
this.notifyObservers(); this.notifyObservers();
} }
@ -179,8 +179,8 @@ final class InterestingItemDefsManager extends Observable {
return filesSets; return filesSets;
} }
// Check if the legacy xml file exists. // Check if the legacy xml file exists.
if(!legacyFileName.isEmpty()){ if (!legacyFileName.isEmpty()) {
File defsFile = new File(LEGACY_FILE_SET_DEFS_PATH+legacyFileName); File defsFile = new File(LEGACY_FILE_SET_DEFS_PATH + legacyFileName);
if (!defsFile.exists()) { if (!defsFile.exists()) {
return filesSets; return filesSets;
} }
@ -218,12 +218,13 @@ final class InterestingItemDefsManager extends Observable {
* Reads the definitions from the serialization file * Reads the definitions from the serialization file
* *
* @return the map representing settings saved to serialization file, * @return the map representing settings saved to serialization file,
* empty set if the file does not exist. * empty set if the file does not exist.
* *
* @throws InterestingItemDefsManagerException if file could not be read * @throws InterestingItemDefsManagerException if file could not be read
*/ */
private static Map<String, FilesSet> readSerializedDefinitions(String serialFileName) throws InterestingItemDefsManagerException { private static Map<String, FilesSet> readSerializedDefinitions(String serialFileName) throws InterestingItemDefsManagerException {
String filePath = INTERESTING_FILES_SET_DEFS_SERIALIZATION_PATH + serialFileName; String filePath;
filePath = INTERESTING_FILES_SET_DEFS_PATH + serialFileName;
System.out.println(filePath); System.out.println(filePath);
File fileSetFile = new File(filePath); File fileSetFile = new File(filePath);
if (fileSetFile.exists()) { if (fileSetFile.exists()) {
@ -236,16 +237,16 @@ final class InterestingItemDefsManager extends Observable {
throw new InterestingItemDefsManagerException(String.format("Failed to read settings from %s", filePath), ex); throw new InterestingItemDefsManagerException(String.format("Failed to read settings from %s", filePath), ex);
} }
} else { } else {
return new HashMap<String, FilesSet>(); return new HashMap<>();
} }
} }
/** /**
* Reads in an interesting files set. * Reads in an interesting files set.
* *
* @param setElem An interesting files set XML element * @param setElem An interesting files set XML element
* @param filesSets A collection to which the set is to be added. * @param filesSets A collection to which the set is to be added.
* @param filePath The source file, used for error reporting. * @param filePath The source file, used for error reporting.
*/ */
private static void readFilesSet(Element setElem, Map<String, FilesSet> filesSets, String filePath) { private static void readFilesSet(Element setElem, Map<String, FilesSet> filesSets, String filePath) {
// The file set must have a unique name. // The file set must have a unique name.
@ -319,10 +320,10 @@ final class InterestingItemDefsManager extends Observable {
* Construct an interesting files set file name rule from the data in an * Construct an interesting files set file name rule from the data in an
* XML element. * XML element.
* *
* @param elem The file name rule XML element. * @param elem The file name rule XML element.
* *
* @return A file name rule, or null if there is an error (the error is * @return A file name rule, or null if there is an error (the error is
* logged). * logged).
*/ */
private static FilesSet.Rule readFileNameRule(Element elem) { private static FilesSet.Rule readFileNameRule(Element elem) {
String ruleName = FilesSetXML.readRuleName(elem); String ruleName = FilesSetXML.readRuleName(elem);
@ -380,7 +381,7 @@ final class InterestingItemDefsManager extends Observable {
* @param elem The file name extension rule XML element. * @param elem The file name extension rule XML element.
* *
* @return A file name extension rule, or null if there is an error (the * @return A file name extension rule, or null if there is an error (the
* error is logged). * error is logged).
*/ */
private static FilesSet.Rule readFileExtensionRule(Element elem) { private static FilesSet.Rule readFileExtensionRule(Element elem) {
String ruleName = FilesSetXML.readRuleName(elem); String ruleName = FilesSetXML.readRuleName(elem);
@ -473,7 +474,7 @@ final class InterestingItemDefsManager extends Observable {
* @param ruleElement The XML element. * @param ruleElement The XML element.
* *
* @return The meta-type condition, or null if there is an error * @return The meta-type condition, or null if there is an error
* (logged). * (logged).
*/ */
private static FilesSet.Rule.MetaTypeCondition readMetaTypeCondition(Element ruleElement) { private static FilesSet.Rule.MetaTypeCondition readMetaTypeCondition(Element ruleElement) {
FilesSet.Rule.MetaTypeCondition condition = null; FilesSet.Rule.MetaTypeCondition condition = null;

2
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsOptionsPanelController.java
View File

@ -115,7 +115,7 @@ public final class InterestingItemDefsOptionsPanelController extends OptionsPane
private InterestingItemDefsPanel getPanel() { private InterestingItemDefsPanel getPanel() {
if (panel == null) { if (panel == null) {
panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()); panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName());
panel.addPropertyChangeListener(new PropertyChangeListener() { panel.addPropertyChangeListener(new PropertyChangeListener() {
@Override @Override
public void propertyChange(PropertyChangeEvent evt) { public void propertyChange(PropertyChangeEvent evt) {

250
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.form
View File

@ -63,126 +63,126 @@
<DimensionLayout dim="0"> <DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0"> <Group type="102" attributes="0">
<EmptySpace min="360" pref="360" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0"> <Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0"> <Component id="rulesListLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<EmptySpace min="360" pref="360" max="-2" attributes="0"/> <Component id="jLabel5" alignment="0" min="-2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0"> <Component id="jLabel6" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="rulesListLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jLabel5" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="ignoreKnownFilesCheckbox" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jLabel6" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0"> <Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" max="-2" attributes="0"/> <Component id="ignoreKnownFilesCheckbox" min="-2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0"> <EmptySpace max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0"> <Component id="processUnallocCheckbox" min="-2" pref="158" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="setsListLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="setsListScrollPane" alignment="0" min="-2" pref="314" max="-2" attributes="0"/>
<Component id="jScrollPane2" alignment="0" min="-2" pref="314" max="-2" attributes="0"/>
</Group>
<EmptySpace type="separate" min="-2" max="-2" attributes="0"/>
<Component id="separator" min="-2" pref="6" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Component id="newSetButton" min="-2" pref="93" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="editSetButton" min="-2" pref="89" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="deleteSetButton" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
<EmptySpace min="-2" pref="12" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="20" pref="20" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel3" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jLabel2" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="-2" pref="6" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="1" attributes="0">
<Component id="jLabel4" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
</Group>
</Group>
<Group type="103" groupAlignment="1" attributes="0">
<Component id="rulePathConditionTextField" alignment="0" max="32767" attributes="0"/>
<Component id="fileNameTextField" max="32767" attributes="0"/>
</Group>
</Group>
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel7" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jLabel8" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="-2" pref="6" max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="equalitySignComboBox" min="-2" pref="38" max="-2" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="fileSizeSpinner" max="32767" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="fileSizeUnitComboBox" min="-2" pref="83" max="-2" attributes="0"/>
<EmptySpace min="8" pref="8" max="-2" attributes="0"/>
</Group>
<Component id="mimeTypeComboBox" alignment="0" max="32767" attributes="0"/>
</Group>
</Group>
</Group>
</Group>
<Group type="102" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="setDescScrollPanel" alignment="0" max="32767" attributes="0"/>
<Component id="rulesListScrollPane" alignment="0" max="32767" attributes="0"/>
</Group>
<EmptySpace min="7" pref="7" max="-2" attributes="0"/>
</Group>
<Group type="102" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel1" alignment="0" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="92" max="-2" attributes="0"/>
<Component id="filesRadioButton" min="-2" pref="47" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="dirsRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="bothRadioButton" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Component id="newRuleButton" min="-2" max="-2" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/>
<Component id="editRuleButton" min="-2" max="-2" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/>
<Component id="deleteRuleButton" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="96" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="fileNameRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
<Component id="fileNameExtensionRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="fileNameRegexCheckbox" min="-2" max="-2" attributes="0"/>
</Group>
<Component id="rulePathConditionRegexCheckBox" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
</Group>
<EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
</Group>
</Group>
</Group> </Group>
</Group> </Group>
<EmptySpace min="-2" pref="23" max="-2" attributes="0"/> <EmptySpace max="32767" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="setsListLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="setsListScrollPane" alignment="0" min="-2" pref="314" max="-2" attributes="0"/>
<Component id="jScrollPane2" alignment="0" min="-2" pref="314" max="-2" attributes="0"/>
</Group>
<EmptySpace type="separate" min="-2" max="-2" attributes="0"/>
<Component id="separator" min="-2" pref="6" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Component id="newSetButton" min="-2" pref="93" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="editSetButton" min="-2" pref="89" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="deleteSetButton" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
<EmptySpace min="-2" pref="12" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="20" pref="20" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel3" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jLabel2" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="-2" pref="6" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="1" attributes="0">
<Component id="jLabel4" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
</Group>
</Group>
<Group type="103" groupAlignment="1" attributes="0">
<Component id="rulePathConditionTextField" alignment="0" max="32767" attributes="0"/>
<Component id="fileNameTextField" max="32767" attributes="0"/>
</Group>
</Group>
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel7" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jLabel8" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="-2" pref="6" max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="equalitySignComboBox" min="-2" pref="38" max="-2" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="fileSizeSpinner" max="32767" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="fileSizeUnitComboBox" min="-2" pref="83" max="-2" attributes="0"/>
<EmptySpace min="8" pref="8" max="-2" attributes="0"/>
</Group>
<Component id="mimeTypeComboBox" alignment="0" max="32767" attributes="0"/>
</Group>
</Group>
</Group>
</Group>
<Group type="102" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="setDescScrollPanel" alignment="0" max="32767" attributes="0"/>
<Component id="rulesListScrollPane" alignment="0" pref="342" max="32767" attributes="0"/>
</Group>
<EmptySpace min="7" pref="7" max="-2" attributes="0"/>
</Group>
<Group type="102" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel1" alignment="0" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="92" max="-2" attributes="0"/>
<Component id="filesRadioButton" min="-2" pref="47" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="dirsRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="bothRadioButton" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Component id="newRuleButton" min="-2" max="-2" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/>
<Component id="editRuleButton" min="-2" max="-2" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/>
<Component id="deleteRuleButton" min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="96" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="fileNameRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
<Component id="fileNameExtensionRadioButton" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="fileNameRegexCheckbox" min="-2" max="-2" attributes="0"/>
</Group>
<Component id="rulePathConditionRegexCheckBox" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
</Group>
<EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
</Group>
</Group>
<EmptySpace min="-2" pref="85" max="-2" attributes="0"/>
</Group> </Group>
</Group> </Group>
</DimensionLayout> </DimensionLayout>
@ -214,7 +214,10 @@
<EmptySpace min="-2" max="-2" attributes="0"/> <EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="setDescScrollPanel" min="-2" pref="42" max="-2" attributes="0"/> <Component id="setDescScrollPanel" min="-2" pref="42" max="-2" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/> <EmptySpace min="-2" max="-2" attributes="0"/>
<Component id="ignoreKnownFilesCheckbox" min="-2" max="-2" attributes="0"/> <Group type="103" groupAlignment="3" attributes="0">
<Component id="ignoreKnownFilesCheckbox" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="processUnallocCheckbox" alignment="3" min="-2" pref="23" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/> <EmptySpace type="unrelated" min="-2" max="-2" attributes="0"/>
<Component id="rulesListLabel" min="-2" max="-2" attributes="0"/> <Component id="rulesListLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/> <EmptySpace min="-2" max="-2" attributes="0"/>
@ -839,6 +842,19 @@
<AuxValue name="JavaCodeGenerator_TypeParameters" type="java.lang.String" value="&lt;String&gt;"/> <AuxValue name="JavaCodeGenerator_TypeParameters" type="java.lang.String" value="&lt;String&gt;"/>
</AuxValues> </AuxValues>
</Component> </Component>
<Component class="javax.swing.JCheckBox" name="processUnallocCheckbox">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties" key="InterestingItemDefsPanel.processUnallocCheckbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
<Property name="toolTipText" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/modules/interestingitems/Bundle.properties" key="InterestingItemDefsPanel.processUnallocCheckbox.toolTipText" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="processUnallocCheckboxActionPerformed"/>
</Events>
</Component>
</SubComponents> </SubComponents>
</Container> </Container>
</SubComponents> </SubComponents>

211
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.java
View File

@ -90,29 +90,27 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
this.rulesList.addListSelectionListener(new InterestingItemDefsPanel.RulesListSelectionListener()); this.rulesList.addListSelectionListener(new InterestingItemDefsPanel.RulesListSelectionListener());
this.settingsFileName = settingsName; this.settingsFileName = settingsName;
if (legacySettingsName.equals("")){ //Hide the mimetype settings when this is displaying FileSet rules instead of interesting item rules if (legacySettingsName.equals("")) { //Hide the mimetype settings when this is displaying FileSet rules instead of interesting item rules
this.mimeTypeComboBox.setVisible(false); this.mimeTypeComboBox.setVisible(false);
this.jLabel7.setVisible(false); this.jLabel7.setVisible(false);
this.ruleDialogTitle = "IngestFileFilter.title"; this.ruleDialogTitle = "IngestFileFilter.title";
} } else {
else {
this.ruleDialogTitle = "FilesSetPanel.title"; this.ruleDialogTitle = "FilesSetPanel.title";
} }
} }
Set<String> getKeys(){ Set<String> getKeys() {
load(); load();
return filesSets.keySet(); return filesSets.keySet();
} }
@NbBundle.Messages({"InterestingItemDefsPanel.Title=Global Interesting Items Settings", @NbBundle.Messages({"InterestingItemDefsPanel.Title=Global Interesting Items Settings",
"IngestFilterItemDefsPanel.Title=Global Ingest Filter Settings" }) "IngestFilterItemDefsPanel.Title=Global Ingest Filter Settings"})
private void customInit() { private void customInit() {
if (settingsLegacyFileName.equals("")){ if (settingsLegacyFileName.equals("")) {
setName(Bundle.IngestFilterItemDefsPanel_Title()); setName(Bundle.IngestFilterItemDefsPanel_Title());
} } else {
else {
setName(Bundle.InterestingItemDefsPanel_Title()); setName(Bundle.InterestingItemDefsPanel_Title());
} }
Set<String> fileTypesCollated = new HashSet<>(); Set<String> fileTypesCollated = new HashSet<>();
@ -205,6 +203,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
this.setsListModel.clear(); this.setsListModel.clear();
this.setDescriptionTextArea.setText(""); this.setDescriptionTextArea.setText("");
this.ignoreKnownFilesCheckbox.setSelected(true); this.ignoreKnownFilesCheckbox.setSelected(true);
this.processUnallocCheckbox.setSelected(true);
this.newSetButton.setEnabled(true); this.newSetButton.setEnabled(true);
this.editSetButton.setEnabled(false); this.editSetButton.setEnabled(false);
this.deleteSetButton.setEnabled(false); this.deleteSetButton.setEnabled(false);
@ -252,7 +251,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
// selected files set. // selected files set.
InterestingItemDefsPanel.this.setDescriptionTextArea.setText(selectedSet.getDescription()); InterestingItemDefsPanel.this.setDescriptionTextArea.setText(selectedSet.getDescription());
InterestingItemDefsPanel.this.ignoreKnownFilesCheckbox.setSelected(selectedSet.ignoresKnownFiles()); InterestingItemDefsPanel.this.ignoreKnownFilesCheckbox.setSelected(selectedSet.ignoresKnownFiles());
InterestingItemDefsPanel.this.processUnallocCheckbox.setSelected(selectedSet.processesUnallocatedSpace());
// Enable the new, edit and delete set buttons. // Enable the new, edit and delete set buttons.
InterestingItemDefsPanel.this.newSetButton.setEnabled(true); InterestingItemDefsPanel.this.newSetButton.setEnabled(true);
InterestingItemDefsPanel.this.editSetButton.setEnabled(true); InterestingItemDefsPanel.this.editSetButton.setEnabled(true);
@ -357,8 +356,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
* respond to user interactions with the dialog. * respond to user interactions with the dialog.
* *
* @param selectedSet The currently selected files set, may be null to * @param selectedSet The currently selected files set, may be null to
* indicate a new interesting files set definition is to * indicate a new interesting files set definition is to be created.
* be created.
*/ */
private void doFileSetsDialog(FilesSet selectedSet) { private void doFileSetsDialog(FilesSet selectedSet) {
// Create a files set defintion panle. // Create a files set defintion panle.
@ -405,7 +403,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
* dialog box and respond to user interactions with the dialog. * dialog box and respond to user interactions with the dialog.
* *
* @param selectedRule The currently selected rule, may be null to indicate * @param selectedRule The currently selected rule, may be null to indicate
* a new rule definition is to be created. * a new rule definition is to be created.
*/ */
private void doFilesSetRuleDialog(FilesSet.Rule selectedRule) { private void doFilesSetRuleDialog(FilesSet.Rule selectedRule) {
// Create a files set rule panel. // Create a files set rule panel.
@ -453,18 +451,20 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
} }
} }
/** /**
* Adds an interesting files set definition to the collection of definitions * Adds an interesting files set definition to the collection of definitions
* owned by this panel. If there is a definition with the same name, it will * owned by this panel. If there is a definition with the same name, it will
* be replaced, so this is an add/edit operation. * be replaced, so this is an add/edit operation.
* *
* @param oldSet A set to replace, null if the new set is not a * @param oldSet A set to replace, null if the new set is not a replacement.
* replacement. * @param name The name of the files set.
* @param name The name of the files set. * @param description The description of the files set.
* @param description The description of the files set.
* @param ignoresKnownFiles Whether or not the files set ignores known * @param ignoresKnownFiles Whether or not the files set ignores known
* files. * files.
* @param rules The set membership rules for the set. * @param rules The set membership rules for the set.
* @param processesUnallocatedSpace Whether or not this set of rules processes
* unallocated space
*/ */
void replaceFilesSet(FilesSet oldSet, String name, String description, boolean ignoresKnownFiles, Map<String, FilesSet.Rule> rules, boolean processesUnallocatedSpace) { void replaceFilesSet(FilesSet oldSet, String name, String description, boolean ignoresKnownFiles, Map<String, FilesSet.Rule> rules, boolean processesUnallocatedSpace) {
if (oldSet != null) { if (oldSet != null) {
@ -496,6 +496,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
* WARNING: Do NOT modify this code. The content of this method is always * WARNING: Do NOT modify this code. The content of this method is always
* regenerated by the Form Editor. * regenerated by the Form Editor.
*/ */
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
private void initComponents() { private void initComponents() {
@ -543,6 +544,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
equalitySignComboBox = new javax.swing.JComboBox<String>(); equalitySignComboBox = new javax.swing.JComboBox<String>();
fileSizeSpinner = new javax.swing.JSpinner(); fileSizeSpinner = new javax.swing.JSpinner();
fileSizeUnitComboBox = new javax.swing.JComboBox<String>(); fileSizeUnitComboBox = new javax.swing.JComboBox<String>();
processUnallocCheckbox = new javax.swing.JCheckBox();
setFont(getFont().deriveFont(getFont().getStyle() & ~java.awt.Font.BOLD, 11)); setFont(getFont().deriveFont(getFont().getStyle() & ~java.awt.Font.BOLD, 11));
@ -750,101 +752,111 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
fileSizeUnitComboBox.setModel(new javax.swing.DefaultComboBoxModel<String>(new String[] { Bundle.InterestingItemDefsPanel_bytes(), Bundle.InterestingItemDefsPanel_kiloBytes(), Bundle.InterestingItemDefsPanel_megaBytes(), Bundle.InterestingItemDefsPanel_gigaBytes() })); fileSizeUnitComboBox.setModel(new javax.swing.DefaultComboBoxModel<String>(new String[] { Bundle.InterestingItemDefsPanel_bytes(), Bundle.InterestingItemDefsPanel_kiloBytes(), Bundle.InterestingItemDefsPanel_megaBytes(), Bundle.InterestingItemDefsPanel_gigaBytes() }));
fileSizeUnitComboBox.setEnabled(false); fileSizeUnitComboBox.setEnabled(false);
org.openide.awt.Mnemonics.setLocalizedText(processUnallocCheckbox, org.openide.util.NbBundle.getMessage(InterestingItemDefsPanel.class, "InterestingItemDefsPanel.processUnallocCheckbox.text")); // NOI18N
processUnallocCheckbox.setToolTipText(org.openide.util.NbBundle.getMessage(InterestingItemDefsPanel.class, "InterestingItemDefsPanel.processUnallocCheckbox.toolTipText")); // NOI18N
processUnallocCheckbox.setEnabled(false);
processUnallocCheckbox.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
processUnallocCheckboxActionPerformed(evt);
}
});
javax.swing.GroupLayout jPanel1Layout = new javax.swing.GroupLayout(jPanel1); javax.swing.GroupLayout jPanel1Layout = new javax.swing.GroupLayout(jPanel1);
jPanel1.setLayout(jPanel1Layout); jPanel1.setLayout(jPanel1Layout);
jPanel1Layout.setHorizontalGroup( jPanel1Layout.setHorizontalGroup(
jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createSequentialGroup()
.addGap(360, 360, 360)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(rulesListLabel)
.addComponent(jLabel5)
.addComponent(jLabel6)
.addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(ignoreKnownFilesCheckbox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(processUnallocCheckbox, javax.swing.GroupLayout.PREFERRED_SIZE, 158, javax.swing.GroupLayout.PREFERRED_SIZE)))
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addGroup(jPanel1Layout.createSequentialGroup()
.addContainerGap()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createSequentialGroup()
.addGap(360, 360, 360)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(rulesListLabel) .addComponent(setsListLabel)
.addComponent(jLabel5) .addComponent(setsListScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 314, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(ignoreKnownFilesCheckbox) .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 314, javax.swing.GroupLayout.PREFERRED_SIZE))
.addComponent(jLabel6)) .addGap(18, 18, 18)
.addGap(0, 0, Short.MAX_VALUE)) .addComponent(separator, javax.swing.GroupLayout.PREFERRED_SIZE, 6, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createSequentialGroup()
.addContainerGap() .addComponent(newSetButton, javax.swing.GroupLayout.PREFERRED_SIZE, 93, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(editSetButton, javax.swing.GroupLayout.PREFERRED_SIZE, 89, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(deleteSetButton)))
.addGap(12, 12, 12)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup()
.addGap(20, 20, 20)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createSequentialGroup()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(setsListLabel)
.addComponent(setsListScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 314, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 314, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGap(18, 18, 18)
.addComponent(separator, javax.swing.GroupLayout.PREFERRED_SIZE, 6, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(newSetButton, javax.swing.GroupLayout.PREFERRED_SIZE, 93, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(editSetButton, javax.swing.GroupLayout.PREFERRED_SIZE, 89, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(deleteSetButton)))
.addGap(12, 12, 12)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup()
.addGap(20, 20, 20)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createSequentialGroup()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup() .addComponent(jLabel3)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addComponent(jLabel2))
.addComponent(jLabel3) .addGap(6, 6, 6))
.addComponent(jLabel2)) .addGroup(javax.swing.GroupLayout.Alignment.TRAILING, jPanel1Layout.createSequentialGroup()
.addGap(6, 6, 6)) .addComponent(jLabel4)
.addGroup(javax.swing.GroupLayout.Alignment.TRAILING, jPanel1Layout.createSequentialGroup() .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)))
.addComponent(jLabel4) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED))) .addComponent(rulePathConditionTextField, javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING) .addComponent(fileNameTextField)))
.addComponent(rulePathConditionTextField, javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(fileNameTextField)))
.addGroup(jPanel1Layout.createSequentialGroup()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(jLabel7)
.addComponent(jLabel8))
.addGap(6, 6, 6)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, jPanel1Layout.createSequentialGroup()
.addComponent(equalitySignComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, 38, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(fileSizeSpinner, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(fileSizeUnitComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, 83, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGap(8, 8, 8))
.addComponent(mimeTypeComboBox, javax.swing.GroupLayout.Alignment.LEADING, 0, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)))))
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createSequentialGroup()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(setDescScrollPanel) .addComponent(jLabel7)
.addComponent(rulesListScrollPane)) .addComponent(jLabel8))
.addGap(7, 7, 7)) .addGap(6, 6, 6)
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(javax.swing.GroupLayout.Alignment.LEADING, jPanel1Layout.createSequentialGroup()
.addComponent(jLabel1) .addComponent(equalitySignComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, 38, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGroup(jPanel1Layout.createSequentialGroup()
.addGap(92, 92, 92)
.addComponent(filesRadioButton, javax.swing.GroupLayout.PREFERRED_SIZE, 47, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(dirsRadioButton)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(bothRadioButton)) .addComponent(fileSizeSpinner, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(fileSizeUnitComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, 83, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGap(8, 8, 8))
.addComponent(mimeTypeComboBox, javax.swing.GroupLayout.Alignment.LEADING, 0, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)))))
.addGroup(jPanel1Layout.createSequentialGroup()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(setDescScrollPanel)
.addComponent(rulesListScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 342, Short.MAX_VALUE))
.addGap(7, 7, 7))
.addGroup(jPanel1Layout.createSequentialGroup()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(jLabel1)
.addGroup(jPanel1Layout.createSequentialGroup()
.addGap(92, 92, 92)
.addComponent(filesRadioButton, javax.swing.GroupLayout.PREFERRED_SIZE, 47, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(dirsRadioButton)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(bothRadioButton))
.addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(newRuleButton)
.addGap(18, 18, 18)
.addComponent(editRuleButton)
.addGap(18, 18, 18)
.addComponent(deleteRuleButton))
.addGroup(jPanel1Layout.createSequentialGroup()
.addGap(96, 96, 96)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup() .addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(newRuleButton) .addComponent(fileNameRadioButton)
.addGap(18, 18, 18) .addGap(4, 4, 4)
.addComponent(editRuleButton) .addComponent(fileNameExtensionRadioButton)
.addGap(18, 18, 18) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(deleteRuleButton)) .addComponent(fileNameRegexCheckbox))
.addGroup(jPanel1Layout.createSequentialGroup() .addComponent(rulePathConditionRegexCheckBox))))
.addGap(96, 96, 96) .addGap(4, 4, 4)))
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGap(85, 85, 85))
.addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(fileNameRadioButton)
.addGap(4, 4, 4)
.addComponent(fileNameExtensionRadioButton)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(fileNameRegexCheckbox))
.addComponent(rulePathConditionRegexCheckBox))))
.addGap(4, 4, 4)))))
.addGap(23, 23, 23))
); );
jPanel1Layout.setVerticalGroup( jPanel1Layout.setVerticalGroup(
jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@ -872,7 +884,9 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(setDescScrollPanel, javax.swing.GroupLayout.PREFERRED_SIZE, 42, javax.swing.GroupLayout.PREFERRED_SIZE) .addComponent(setDescScrollPanel, javax.swing.GroupLayout.PREFERRED_SIZE, 42, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(ignoreKnownFilesCheckbox) .addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(ignoreKnownFilesCheckbox)
.addComponent(processUnallocCheckbox, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(rulesListLabel) .addComponent(rulesListLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
@ -1000,6 +1014,10 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
// TODO add your handling code here: // TODO add your handling code here:
}//GEN-LAST:event_fileNameTextFieldActionPerformed }//GEN-LAST:event_fileNameTextFieldActionPerformed
private void processUnallocCheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_processUnallocCheckboxActionPerformed
// TODO add your handling code here:
}//GEN-LAST:event_processUnallocCheckboxActionPerformed
// Variables declaration - do not modify//GEN-BEGIN:variables // Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JRadioButton bothRadioButton; private javax.swing.JRadioButton bothRadioButton;
private javax.swing.JButton deleteRuleButton; private javax.swing.JButton deleteRuleButton;
@ -1032,6 +1050,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
private javax.swing.JComboBox<String> mimeTypeComboBox; private javax.swing.JComboBox<String> mimeTypeComboBox;
private javax.swing.JButton newRuleButton; private javax.swing.JButton newRuleButton;
private javax.swing.JButton newSetButton; private javax.swing.JButton newSetButton;
private javax.swing.JCheckBox processUnallocCheckbox;
private javax.swing.JCheckBox rulePathConditionRegexCheckBox; private javax.swing.JCheckBox rulePathConditionRegexCheckBox;
private javax.swing.JTextField rulePathConditionTextField; private javax.swing.JTextField rulePathConditionTextField;
private javax.swing.JList<FilesSet.Rule> rulesList; private javax.swing.JList<FilesSet.Rule> rulesList;

5
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemsIngestModuleFactory.java
View File

@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.modules.interestingitems;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.openide.util.NbBundle.Messages; import org.openide.util.NbBundle.Messages;
import org.openide.util.lookup.ServiceProvider; import org.openide.util.lookup.ServiceProvider;
@ -70,7 +69,7 @@ final public class InterestingItemsIngestModuleFactory extends IngestModuleFacto
@Override @Override
public IngestModuleGlobalSettingsPanel getGlobalSettingsPanel() { public IngestModuleGlobalSettingsPanel getGlobalSettingsPanel() {
InterestingItemDefsPanel panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()); InterestingItemDefsPanel panel = new InterestingItemDefsPanel(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName());
panel.load(); panel.load();
return panel; return panel;
} }
@ -84,7 +83,7 @@ final public class InterestingItemsIngestModuleFactory extends IngestModuleFacto
// Doing so also keeps the serialization simple. // Doing so also keeps the serialization simple.
List<String> enabledFilesSetNames = new ArrayList<>(); List<String> enabledFilesSetNames = new ArrayList<>();
try { try {
for (String name : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getINTERESTING_FILES_SET_DEFS_SERIALIZATION_NAME(), InterestingItemDefsManager.getLEGACY_FILES_SET_DEFS_FILE_NAME()).keySet()) { for (String name : InterestingItemDefsManager.getInstance().getInterestingFilesSets(InterestingItemDefsManager.getInterestingFilesSetDefsSerializationName(), InterestingItemDefsManager.getLegacyFilesSetDefsFileName()).keySet()) {
enabledFilesSetNames.add(name); enabledFilesSetNames.add(name);
} }
} catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) { } catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {