org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -29,13 +29,12 @@ import java.util.concurrent.atomic.AtomicInteger;
import java.util.concurrent.atomic.AtomicLong;
import org.openide.util.NbBundle;
+import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content;
/**
- * Runs a collection of data sources through a set of ingest modules specified
- * via ingest job settings.
- *
- * This class is thread-safe.
+ * Analyzes one or more data sources using a set of ingest modules specified via
+ * ingest job settings.
*/
public final class IngestJob {
@@ -69,7 +68,7 @@ public final class IngestJob {
private volatile CancellationReason cancellationReason;
/**
- * Constructs an ingest job that runs a collection of data sources through a
+ * Constructs an ingest job that analyzes one or more data sources using a
* set of ingest modules specified via ingest job settings.
*
* @param dataSources The data sources to be ingested.
@@ -88,6 +87,26 @@ public final class IngestJob {
cancellationReason = CancellationReason.NOT_CANCELLED;
}
+ /**
+ * Constructs an ingest job that analyzes one data source using a set of
+ * ingest modules specified via ingest job settings. Either all of the files
+ * in the data source or a given subset of the files will be analyzed.
+ *
+ * @param dataSource The data source to be analyzed
+ * @param files A subset of the files for the data source.
+ * @param settings The ingest job settings.
+ * @param doUI Whether or not this job should use progress bars,
+ * message boxes for errors, etc.
+ */
+ IngestJob(Content dataSource, List files, IngestJobSettings settings, boolean doUI) {
+ this.id = IngestJob.nextId.getAndIncrement();
+ this.dataSourceJobs = new ConcurrentHashMap<>();
+ DataSourceIngestJob dataSourceIngestJob = new DataSourceIngestJob(this, dataSource, files, settings, doUI);
+ this.dataSourceJobs.put(dataSourceIngestJob.getId(), dataSourceIngestJob);
+ incompleteJobsCount = new AtomicInteger(dataSourceJobs.size());
+ cancellationReason = CancellationReason.NOT_CANCELLED;
+ }
+
/**
* Gets the unique identifier assigned to this ingest job.
*
diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java
index 13d67f9e9c..65d0162d6d 100644
--- a/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java
+++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java
@@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
- * Copyright 2011-2018 Basis Technology Corp.
+ * Copyright 2012-2018 Basis Technology Corp.
* Contact: carrier sleuthkit org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -298,7 +298,7 @@ public class IngestManager {
/**
* Queues an ingest job for for one or more data sources.
*
- * @param dataSources The data sources to process.
+ * @param dataSources The data sources to analyze.
* @param settings The settings for the ingest job.
*/
public void queueIngestJob(Collection dataSources, IngestJobSettings settings) {
@@ -312,6 +312,25 @@ public class IngestManager {
}
}
+ /**
+ * Queues an ingest job for for a data source. Either all of the files in
+ * the data source or a given subset of the files will be analyzed.
+ *
+ * @param dataSource The data source to analyze.
+ * @param files A subset of the files for the data source.
+ * @param settings The settings for the ingest job.
+ */
+ public void queueIngestJob(Content dataSource, List files, IngestJobSettings settings) {
+ if (caseIsOpen) {
+ IngestJob job = new IngestJob(dataSource, files, settings, RuntimeProperties.runningWithGUI());
+ if (job.hasIngestPipeline()) {
+ long taskId = nextIngestManagerTaskId.incrementAndGet();
+ Future task = startIngestJobsExecutor.submit(new StartIngestJobTask(taskId, job));
+ startIngestJobFutures.put(taskId, task);
+ }
+ }
+ }
+
/**
* Immdiately starts an ingest job for one or more data sources.
*
@@ -351,7 +370,7 @@ public class IngestManager {
Case openCase;
try {
openCase = Case.getOpenCase();
- } catch (NoCurrentCaseException ex) {
+ } catch (NoCurrentCaseException ex) {
return new IngestJobStartResult(null, new IngestManagerException("Exception while getting open case.", ex), Collections.emptyList()); //NON-NLS
}
if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestTasksScheduler.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestTasksScheduler.java
index a9ad8c7634..b9cee95687 100644
--- a/Core/src/org/sleuthkit/autopsy/ingest/IngestTasksScheduler.java
+++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestTasksScheduler.java
@@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
- * Copyright 2012-2017 Basis Technology Corp.
+ * Copyright 2012-2018 Basis Technology Corp.
* Contact: carrier sleuthkit org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -143,15 +143,14 @@ final class IngestTasksScheduler {
}
/**
- * Schedules a data source ingest task and file ingest tasks for an ingest
- * job.
+ * Schedules a data source level ingest task and file level ingest tasks for
+ * an ingest job. Either all of the files in the data source or a given
+ * subset of the files will be scheduled.
*
- * @param job The job for which the tasks are to be scheduled.
- *
- * @throws InterruptedException if the calling thread is blocked due to a
- * full tasks queue and is interrupted.
+ * @param job The data source ingest job.
+ * @param files A subset of the files for the data source.
*/
- synchronized void scheduleIngestTasks(DataSourceIngestJob job) {
+ synchronized void scheduleIngestTasks(DataSourceIngestJob job, List files) {
if (!job.isCancelled()) {
// Scheduling of both a data source ingest task and file ingest tasks
// for a job must be an atomic operation. Otherwise, the data source
@@ -159,14 +158,14 @@ final class IngestTasksScheduler {
// resulting in a potential false positive when another thread checks
// whether or not all the tasks for the job are completed.
this.scheduleDataSourceIngestTask(job);
- this.scheduleFileIngestTasks(job);
+ this.scheduleFileIngestTasks(job, files);
}
}
/**
- * Schedules a data source ingest task for an ingest job.
+ * Schedules a data source level ingest task for a data source ingest job.
*
- * @param job The job for which the tasks are to be scheduled.
+ * @param job The data source ingest job.
*/
synchronized void scheduleDataSourceIngestTask(DataSourceIngestJob job) {
if (!job.isCancelled()) {
@@ -186,16 +185,22 @@ final class IngestTasksScheduler {
}
/**
- * Schedules file ingest tasks for an ingest job.
+ * Schedules file level ingest tasks for a data source ingest job. Either
+ * all of the files in the data source or a given subset of the files will
+ * be scheduled.
*
- * @param job The job for which the tasks are to be scheduled.
+ * @param job The data source ingest job.
+ * @param files A subset of the files for the data source.
*/
- synchronized void scheduleFileIngestTasks(DataSourceIngestJob job) {
+ synchronized void scheduleFileIngestTasks(DataSourceIngestJob job, List files) {
if (!job.isCancelled()) {
- // Get the top level files for the data source associated with this job
- // and add them to the root directories priority queue.
- List topLevelFiles = getTopLevelFiles(job.getDataSource());
- for (AbstractFile firstLevelFile : topLevelFiles) {
+ List candidateFiles = new ArrayList<>();
+ if (files.isEmpty()) {
+ getTopLevelFiles(job.getDataSource(), candidateFiles);
+ } else {
+ candidateFiles.addAll(files);
+ }
+ for (AbstractFile firstLevelFile : candidateFiles) {
FileIngestTask task = new FileIngestTask(job, firstLevelFile);
if (IngestTasksScheduler.shouldEnqueueFileTask(task)) {
this.tasksInProgress.add(task);
@@ -207,12 +212,14 @@ final class IngestTasksScheduler {
}
/**
- * Schedules a file ingest task for an ingest job.
+ * Schedules a file ingest task for a data source ingest job. The task that
+ * is created is added directly to the pending file tasks queues, i.e., it
+ * is "fast tracked."
*
- * @param job The job for which the tasks are to be scheduled.
- * @param file The file to be associated with the task.
+ * @param job The data source ingest job.
+ * @param file A file.
*/
- synchronized void scheduleFileIngestTask(DataSourceIngestJob job, AbstractFile file) {
+ synchronized void scheduleFastTrackedFileIngestTask(DataSourceIngestJob job, AbstractFile file) {
if (!job.isCancelled()) {
FileIngestTask task = new FileIngestTask(job, file);
if (IngestTasksScheduler.shouldEnqueueFileTask(task)) {
@@ -279,12 +286,10 @@ final class IngestTasksScheduler {
* files and virtual directories for a data source. Used to create file
* tasks to put into the root directories queue.
*
- * @param dataSource The data source.
- *
- * @return A list of top level files.
+ * @param dataSource The data source.
+ * @param topLevelFiles The top level files are added to this list.
*/
- private static List getTopLevelFiles(Content dataSource) {
- List topLevelFiles = new ArrayList<>();
+ private static void getTopLevelFiles(Content dataSource, List topLevelFiles) {
Collection rootObjects = dataSource.accept(new GetRootDirectoryVisitor());
if (rootObjects.isEmpty() && dataSource instanceof AbstractFile) {
// The data source is itself a file to be processed.
@@ -312,7 +317,6 @@ final class IngestTasksScheduler {
}
}
}
- return topLevelFiles;
}
/**
@@ -405,7 +409,7 @@ final class IngestTasksScheduler {
return false;
}
- /**
+ /*
* Check if the file is a member of the file ingest filter that is being
* applied to the current run of ingest, checks if unallocated space
* should be processed inside call to fileIsMemberOf
@@ -414,8 +418,8 @@ final class IngestTasksScheduler {
return false;
}
-// Skip the task if the file is one of a select group of special, large
-// NTFS or FAT file system files.
+ // Skip the task if the file is one of a select group of special, large
+ // NTFS or FAT file system files.
if (file instanceof org.sleuthkit.datamodel.File) {
final org.sleuthkit.datamodel.File f = (org.sleuthkit.datamodel.File) file;
diff --git a/Core/src/org/sleuthkit/autopsy/ingest/runIngestModuleWizard/RunIngestModulesAction.java b/Core/src/org/sleuthkit/autopsy/ingest/runIngestModuleWizard/RunIngestModulesAction.java
index 09a4f12894..64a60c1f24 100644
--- a/Core/src/org/sleuthkit/autopsy/ingest/runIngestModuleWizard/RunIngestModulesAction.java
+++ b/Core/src/org/sleuthkit/autopsy/ingest/runIngestModuleWizard/RunIngestModulesAction.java
@@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
- * Copyright 2011-2018 Basis Technology Corp.
+ * Copyright 2017-2018 Basis Technology Corp.
* Contact: carrier sleuthkit org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -23,6 +23,7 @@ import java.awt.event.ActionEvent;
import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.List;
+import java.util.logging.Level;
import javax.swing.AbstractAction;
import javax.swing.Action;
import javax.swing.JOptionPane;
@@ -31,26 +32,33 @@ import org.openide.DialogDisplayer;
import org.openide.WizardDescriptor;
import org.openide.util.NbBundle.Messages;
import org.openide.windows.WindowManager;
+import org.sleuthkit.autopsy.coreutils.Logger;
+import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
+import org.sleuthkit.autopsy.datamodel.SpecialDirectoryNode;
import org.sleuthkit.autopsy.ingest.IngestJobSettings;
import org.sleuthkit.autopsy.ingest.IngestManager;
+import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content;
-import org.sleuthkit.datamodel.Directory;
+import org.sleuthkit.datamodel.TskCoreException;
/**
- * This class is used to add the action to the run ingest modules menu item.
- * When the data source is pressed, it should open the wizard for ingest
- * modules.
+ * An action that invokes the Run Ingest Modules wizard for one or more data
+ * sources or for the children of a file.
*/
public final class RunIngestModulesAction extends AbstractAction {
@Messages("RunIngestModulesAction.name=Run Ingest Modules")
private static final long serialVersionUID = 1L;
+ private static final Logger logger = Logger.getLogger(SpecialDirectoryNode.class.getName());
/*
* Note that the execution context is the name of the dialog that used to be
* used instead of this wizard and is retained for backwards compatibility.
*/
private static final String EXECUTION_CONTEXT = "org.sleuthkit.autopsy.ingest.RunIngestModulesDialog";
+ private final List dataSources = new ArrayList<>();
+ private final IngestJobSettings.IngestType ingestType;
+ private final AbstractFile parentFile;
/**
* Display any warnings that the ingestJobSettings have.
@@ -67,12 +75,10 @@ public final class RunIngestModulesAction extends AbstractAction {
JOptionPane.showMessageDialog(WindowManager.getDefault().getMainWindow(), warningMessage.toString());
}
}
- private final List dataSources = new ArrayList<>();
- private final IngestJobSettings.IngestType ingestType;
/**
- * Creates an action which will make a run ingest modules wizard when it is
- * performed.
+ * Constructs an action that invokes the Run Ingest Modules wizard for one
+ * or more data sources.
*
* @param dataSources - the data sources you want to run ingest on
*/
@@ -91,17 +97,25 @@ public final class RunIngestModulesAction extends AbstractAction {
this.putValue(Action.NAME, Bundle.RunIngestModulesAction_name());
this.dataSources.addAll(dataSources);
this.ingestType = IngestJobSettings.IngestType.ALL_MODULES;
+ this.parentFile = null;
}
/**
- * Creates an action which will make a run ingest modules wizard when it is
- * performed.
+ * Constructs an action that invokes the Run Ingest Modules wizard for the
+ * children of a file.
*
- * @param dir - the directory you want to run ingest on
+ * @param file The file.
*/
- public RunIngestModulesAction(Directory dir) {
+ public RunIngestModulesAction(AbstractFile parentFile) {
this.putValue(Action.NAME, Bundle.RunIngestModulesAction_name());
- this.dataSources.add(dir);
+ this.parentFile = parentFile;
this.ingestType = IngestJobSettings.IngestType.FILES_ONLY;
+ try {
+ this.setEnabled(parentFile.hasChildren());
+ } catch (TskCoreException ex) {
+ this.setEnabled(false);
+ logger.log(Level.SEVERE, String.format("Failed to get children count for parent file %s (objId=%d), RunIngestModulesAction disabled", parentFile.getName(), parentFile.getId()), ex);
+ MessageNotifyUtil.Message.error(Bundle.RunIngestModulesAction_actionPerformed_errorMessage());
+ }
}
@@ -110,6 +124,9 @@ public final class RunIngestModulesAction extends AbstractAction {
*
* @param e the action event
*/
+ @Messages({
+ "RunIngestModulesAction.actionPerformed.errorMessage=Error querying the case database for the selected item."
+ })
@Override
public void actionPerformed(ActionEvent e) {
/**
@@ -129,7 +146,26 @@ public final class RunIngestModulesAction extends AbstractAction {
if (DialogDisplayer.getDefault().notify(wiz) == WizardDescriptor.FINISH_OPTION) {
IngestJobSettings ingestJobSettings = wizard.getIngestJobSettings();
showWarnings(ingestJobSettings);
- IngestManager.getInstance().queueIngestJob(this.dataSources, ingestJobSettings);
+ if (this.parentFile == null) {
+ IngestManager.getInstance().queueIngestJob(this.dataSources, ingestJobSettings);
+ } else {
+ try {
+ Content dataSource = parentFile.getDataSource();
+ List children = parentFile.getChildren();
+ List files = new ArrayList<>();
+ for (Content child : children) {
+ if (child instanceof AbstractFile) {
+ files.add((AbstractFile) child);
+ }
+ }
+ if (!files.isEmpty()) {
+ IngestManager.getInstance().queueIngestJob(dataSource, files, ingestJobSettings);
+ }
+ } catch (TskCoreException ex) {
+ logger.log(Level.SEVERE, String.format("Failed to get data source or children for parent file %s (objId=%d), action failed", parentFile.getName(), parentFile.getId()), ex);
+ MessageNotifyUtil.Message.error(Bundle.RunIngestModulesAction_actionPerformed_errorMessage());
+ }
+ }
}
}
diff --git a/Core/src/org/sleuthkit/autopsy/keywordsearchservice/KeywordSearchService.java b/Core/src/org/sleuthkit/autopsy/keywordsearchservice/KeywordSearchService.java
index e3b36499f0..1a9e947b76 100644
--- a/Core/src/org/sleuthkit/autopsy/keywordsearchservice/KeywordSearchService.java
+++ b/Core/src/org/sleuthkit/autopsy/keywordsearchservice/KeywordSearchService.java
@@ -26,6 +26,8 @@ import org.sleuthkit.datamodel.TskCoreException;
/**
* An interface for implementations of a keyword search service.
+ * You can find the implementations by using Lookup, such as:
+ * Lookup.getDefault().lookup(KeywordSearchService.class)
*
* TODO (AUT-2158: This interface should not extend Closeable.
*/
diff --git a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverIngestModuleFactory.java b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverIngestModuleFactory.java
index 47658b55e0..aae845164c 100644
--- a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverIngestModuleFactory.java
+++ b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverIngestModuleFactory.java
@@ -25,6 +25,7 @@ import org.sleuthkit.autopsy.ingest.IngestModuleFactory;
import org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter;
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings;
import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel;
+import org.sleuthkit.autopsy.ingest.NoIngestModuleIngestJobSettings;
/**
* A factory for creating instances of file ingest modules that carve
@@ -81,7 +82,17 @@ public class PhotoRecCarverIngestModuleFactory extends IngestModuleFactoryAdapte
@Override
public IngestModuleIngestJobSettingsPanel getIngestJobSettingsPanel(IngestModuleIngestJobSettings settings) {
- return new PhotoRecCarverIngestJobSettingsPanel((PhotoRecCarverIngestJobSettings) settings);
+ if (settings instanceof PhotoRecCarverIngestJobSettings) {
+ return new PhotoRecCarverIngestJobSettingsPanel((PhotoRecCarverIngestJobSettings) settings);
+ }
+ /*
+ * Compatibility check for older versions.
+ */
+ if (settings instanceof NoIngestModuleIngestJobSettings) {
+ return new PhotoRecCarverIngestJobSettingsPanel(new PhotoRecCarverIngestJobSettings());
+ }
+
+ throw new IllegalArgumentException("Expected settings argument to be an instance of PhotoRecCarverIngestJobSettings");
}
}
diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/testutils/IngestJobRunner.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/testutils/IngestJobRunner.java
index 5597ce8500..f3587ab29a 100755
--- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/testutils/IngestJobRunner.java
+++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/testutils/IngestJobRunner.java
@@ -33,7 +33,7 @@ import org.sleuthkit.datamodel.Content;
/**
* A utility that runs an ingest job, blocking until the job is completed.
*/
-public final class IngestRunner {
+public final class IngestJobRunner {
/**
* Runs an ingest job, blocking until the job is completed.
@@ -70,7 +70,7 @@ public final class IngestRunner {
/**
* IngestRunner instances cannot be instatiated.
*/
- private IngestRunner() {
+ private IngestJobRunner() {
}
/**
diff --git a/docs/doxygen-user/images/case-properties-history-tab.PNG b/docs/doxygen-user/images/case-properties-history-tab.PNG
index fc0a4da441..0a5d8f25b7 100644
Binary files a/docs/doxygen-user/images/case-properties-history-tab.PNG and b/docs/doxygen-user/images/case-properties-history-tab.PNG differ
diff --git a/docs/doxygen-user/images/live_triage_case.png b/docs/doxygen-user/images/live_triage_case.png
new file mode 100644
index 0000000000..fee49485f5
Binary files /dev/null and b/docs/doxygen-user/images/live_triage_case.png differ
diff --git a/docs/doxygen-user/images/live_triage_dialog.png b/docs/doxygen-user/images/live_triage_dialog.png
new file mode 100644
index 0000000000..4768ec8245
Binary files /dev/null and b/docs/doxygen-user/images/live_triage_dialog.png differ
diff --git a/docs/doxygen-user/images/live_triage_ds.png b/docs/doxygen-user/images/live_triage_ds.png
new file mode 100644
index 0000000000..f21a50aa82
Binary files /dev/null and b/docs/doxygen-user/images/live_triage_ds.png differ
diff --git a/docs/doxygen-user/images/live_triage_script.png b/docs/doxygen-user/images/live_triage_script.png
new file mode 100644
index 0000000000..2bdf7f12ae
Binary files /dev/null and b/docs/doxygen-user/images/live_triage_script.png differ
diff --git a/docs/doxygen-user/images/multi_user_case_select.png b/docs/doxygen-user/images/multi_user_case_select.png
index f87baa555a..c4ca377fc6 100644
Binary files a/docs/doxygen-user/images/multi_user_case_select.png and b/docs/doxygen-user/images/multi_user_case_select.png differ
diff --git a/docs/doxygen-user/live_triage.dox b/docs/doxygen-user/live_triage.dox
new file mode 100644
index 0000000000..d85b54a20a
--- /dev/null
+++ b/docs/doxygen-user/live_triage.dox
@@ -0,0 +1,33 @@
+/*! \page live_triage_page Live Triage
+
+\section live_triage_overview Overview
+
+The Live Triage feature allows you to load Autopsy onto a removable drive to run on target systems while making minimal changes to that target system. This will currently only work on Windows systems.
+
+\section live_triage_create_drive Creating a live triage drive
+
+To create a live triage drive, go to Tools->Make Live Triage Drive to bring up the main dialog.
+
+\image html live_triage_dialog.png
+
+Select the drive you want to use - any type of USB storage device will work. For best results use the fastest drive available. Once the process is complete the root folder will contain an Autopsy folder and a RunFromUSB.bat file.
+
+\section live_triage_usage Running Autopsy from the live triage drive
+
+Insert the drive into the target machine and browse to it in Windows Explorer. Right click on RunFromUSB.bat and select "Run as administrator". This is necessary to analyze the local drives.
+
+\image html live_triage_script.png
+
+Running the script will generate a few more directories on the USB drive. The configData directory stores all the data used by Autopsy - primarily configuration files and temporary files. You can make changes to the Autopsy settings and they will persist between runs. The cases directory is created as a recommended place to save your case data. You will need to browse to it when creating a case in Autopsy.
+
+Once Autopsy is running, proceed to create a case as normal, making sure to save it on the USB drive.
+
+\image html live_triage_case.png
+
+Then choose the Local Disk data source and select the desired drive.
+
+\image html live_triage_ds.png
+
+See the \ref ds_local page for more information on local disk data sources.
+
+*/
\ No newline at end of file
diff --git a/docs/doxygen-user/main.dox b/docs/doxygen-user/main.dox
index e4a1e2b3a9..a72256c7f6 100644
--- a/docs/doxygen-user/main.dox
+++ b/docs/doxygen-user/main.dox
@@ -60,6 +60,7 @@ The following topics are available here:
- \subpage windows_authentication
- \subpage multiuser_sec_page
- \subpage multiuser_page
+- \subpage live_triage_page
- \subpage advanced_page
If the topic you need is not listed, refer to the Autopsy Wiki or join the SleuthKit User List at SourceForge.
diff --git a/docs/doxygen/modReport.dox b/docs/doxygen/modReport.dox
index 1e28a5a78d..6199ce7560 100644
--- a/docs/doxygen/modReport.dox
+++ b/docs/doxygen/modReport.dox
@@ -75,6 +75,19 @@ Typically a general report module should interact with both the Blackboard API i
You should call org.sleuthkit.autopsy.casemodule.Case.addReport() with the path to your report so that it is shown in the Autopsy tree. You can specify a specific file or folder and the user can then view it later.
+\subsection report_create_module_indexing Indexing Reports
+
+After you have called org.sleuthkit.autopsy.casemodule.Case.addReport() and created a report, you can pass it to org.sleuthkit.autopsy.keywordsearchservice.KeywordSearchService.index() so that it is indexed and can then be found by a user. This is most commonly used when an Ingest Module runs a 3rd party tool and the output of that tool is added back into Autopsy as a report. Here is some example code:
+
+\code{.java}
+KeywordSearchService searchService = Lookup.getDefault().lookup(KeywordSearchService.class);
+if (null == searchService) {
+ logger.log(Level.WARNING, "Keyword search service not found. Report will not be indexed");
+} else {
+ searchService.index(report);
+}
+\endcode
+
\subsection report_create_module_layer Installing your Report Module
Report modules developed using Java must be registered in a layer.xml file. This file allows Autopsy to find the report module.
diff --git a/ruleset.xml b/ruleset.xml
index ba1bfa6374..f1b0b509af 100644
--- a/ruleset.xml
+++ b/ruleset.xml
@@ -56,9 +56,10 @@
-
+
-
+
+