diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java index e82215a7de..705468ae15 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java @@ -318,7 +318,8 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule { "\"" + aLeappExecutable + "\"", //NON-NLS "-t", aLeappFileSystemType, //NON-NLS "-i", sourceFilePath, //NON-NLS - "-o", moduleOutputPath.toString() + "-o", moduleOutputPath.toString(), + "-w" ); processBuilder.redirectError(moduleOutputPath.resolve("aLeapp_err.txt").toFile()); //NON-NLS processBuilder.redirectOutput(moduleOutputPath.resolve("aLeapp_out.txt").toFile()); //NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java index 584ea06ba9..9f7418f8f9 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java @@ -30,7 +30,9 @@ import java.text.ParseException; import java.text.SimpleDateFormat; import java.util.List; import java.util.ArrayList; +import java.util.Arrays; import java.util.Collection; +import java.util.Collections; import java.util.Date; import java.util.HashMap; import static java.util.Locale.US; @@ -239,7 +241,6 @@ public final class LeappFileProcessor { Collection bbattributes = processReadLine(line, columnNumberToProcess, fileName); if (artifactType == null) { logger.log(Level.SEVERE, "Error trying to process Leapp output files in directory . "); //NON-NLS - } if (!bbattributes.isEmpty() && !blkBoard.artifactExists(dataSource, BlackboardArtifact.ARTIFACT_TYPE.fromID(artifactType.getTypeID()), bbattributes)) { BlackboardArtifact bbartifact = createArtifactWithAttributes(artifactType.getTypeID(), dataSource, bbattributes); @@ -264,7 +265,17 @@ public final class LeappFileProcessor { * @return */ private Collection processReadLine(String line, Map columnNumberToProcess, String fileName) throws IngestModuleException { - String[] columnValues = line.split("\\t"); + + String[] columnValues; + + // Check to see if the 2 values are equal, they may not be equal if there is no corresponding data in the line. + // If this happens then adding an empty value(s) for each columnValue where data does not exist + Integer maxColumnNumber = Collections.max(columnNumberToProcess.keySet()); + if (maxColumnNumber > line.split("\\t").length) { + columnValues = Arrays.copyOf(line.split("\\t"), maxColumnNumber + 1); + } else { + columnValues = line.split("\\t"); + } Collection bbattributes = new ArrayList(); diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml index b11fbd3714..6a573e0abb 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml +++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml @@ -225,7 +225,7 @@ - + @@ -233,7 +233,7 @@ - + @@ -294,8 +294,8 @@ - - + + diff --git a/docs/doxygen-user/aleapp.dox b/docs/doxygen-user/aleapp.dox new file mode 100644 index 0000000000..d62a6edc6d --- /dev/null +++ b/docs/doxygen-user/aleapp.dox @@ -0,0 +1,20 @@ +/*! \page aleapp_page Android Analyzer (aLEAPP) + +[TOC] + +\section aleapp_overview Overview + +The Android Analyzer ingest module runs aLEAPP (https://github.com/abrignoni/aLEAPP) and converts the results into results that can be viewed in Autopsy. + +\section aleapp_config Using the Module + +Select the checkbox in the Ingest Modules settings screen to enable the Android Analzyer (ALEAPP) module. The module will run on .tar/.zip files found in a \ref ds_log "logical files data source" or a \ref ds_img disk image. + +\section aleapp_results Seeing Results + +Results from the Android Analyzer module will appear in the \ref tree_viewer_page under Results->Extracted Content. + +\image html aleapp_main.jpg + + +*/ diff --git a/docs/doxygen-user/images/aleapp_main.jpg b/docs/doxygen-user/images/aleapp_main.jpg new file mode 100644 index 0000000000..82d8d2c778 Binary files /dev/null and b/docs/doxygen-user/images/aleapp_main.jpg differ diff --git a/thirdparty/aLeapp/aleapp.exe b/thirdparty/aLeapp/aleapp.exe index 7ed46c4689..52fab109ea 100644 Binary files a/thirdparty/aLeapp/aleapp.exe and b/thirdparty/aLeapp/aleapp.exe differ