mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

revert registry example

Browse Source
This commit is contained in:
Greg DiCristofaro 2021-07-20 13:54:00 -04:00
parent 928ef9e33d
commit 9ece3e41ed
1 changed files with 16 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
pythonExamples/Registry_Example.py
View File

@ -45,7 +45,7 @@ from java.lang import Class
from java.lang import System from java.lang import System
from java.sql import DriverManager, SQLException from java.sql import DriverManager, SQLException
from java.util.logging import Level from java.util.logging import Level
from java.util import Arrays from java.util import ArrayList
from org.sleuthkit.datamodel import SleuthkitCase from org.sleuthkit.datamodel import SleuthkitCase
from org.sleuthkit.datamodel import AbstractFile from org.sleuthkit.datamodel import AbstractFile
from org.sleuthkit.datamodel import ReadContentInputStream from org.sleuthkit.datamodel import ReadContentInputStream
@ -171,24 +171,23 @@ class RegistryExampleIngestModule(DataSourceIngestModule):
# Setup Artifact and Attributes # Setup Artifact and Attributes
try: try:
skCase.addBlackboardArtifactType("TSK_REGISTRY_RUN_KEYS", "Registry Run Keys", artID = skCase.addArtifactType( "TSK_REGISTRY_RUN_KEYS", "Registry Run Keys")
BlackboardArtifact.Category.DATA_ARTIFACT)
except: except:
self.log(Level.INFO, "Artifacts Creation Error, some artifacts may not exist now. ==> ") self.log(Level.INFO, "Artifacts Creation Error, some artifacts may not exist now. ==> ")
artType = skCase.getArtifactType("TSK_REGISTRY_RUN_KEYS") artId = skCase.getArtifactTypeID("TSK_REGISTRY_RUN_KEYS")
try: try:
attributeIdRunKeyName = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_NAME", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Name") attributeIdRunKeyName = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_NAME", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Name")
except: except:
self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_NAME, May already exist. ") self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_NAME, May already exist. ")
try: try:
attributeIdRunKeyValue = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_VALUE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Value") attributeIdRunKeyValue = skCase.addArtifactAttributeType("TSK_REG_RUN_KEY_VALUE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Run Key Value")
except: except:
self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_VALUE, May already exist. ") self.log(Level.INFO, "Attributes Creation Error, TSK_REG_RUN_KEY_VALUE, May already exist. ")
try: try:
attributeIdRegKeyLoc = skCase.addArtifactAttributeType("TSK_REG_KEY_LOCATION", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Registry Key Location") attributeIdRegKeyLoc = skCase.addArtifactAttributeType("TSK_REG_KEY_LOCATION", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Registry Key Location")
except: except:
self.log(Level.INFO, "Attributes Creation Error, TSK_REG_KEY_LOCATION, May already exist. ") self.log(Level.INFO, "Attributes Creation Error, TSK_REG_KEY_LOCATION, May already exist. ")
attributeIdRunKeyName = skCase.getAttributeType("TSK_REG_RUN_KEY_NAME") attributeIdRunKeyName = skCase.getAttributeType("TSK_REG_RUN_KEY_NAME")
@ -199,15 +198,17 @@ class RegistryExampleIngestModule(DataSourceIngestModule):
# RefistryKeysFound is a list that contains a list with the following records abstractFile, Registry Key Location, Key Name, Key value # RefistryKeysFound is a list that contains a list with the following records abstractFile, Registry Key Location, Key Name, Key value
for registryKey in self.registryKeysFound: for registryKey in self.registryKeysFound:
art = registryKey[0].newDataArtifact(artType, Arrays.asList( attributes = ArrayList()
BlackboardAttribute(attributeIdRegKeyLoc, moduleName, registryKey[1]), art = registryKey[0].newArtifact(artId)
BlackboardAttribute(attributeIdRunKeyName, moduleName, registryKey[2]),
BlackboardAttribute(attributeIdRunKeyValue, moduleName, registryKey[3]) attributes.add(BlackboardAttribute(attributeIdRegKeyLoc, moduleName, registryKey[1]))
)) attributes.add(BlackboardAttribute(attributeIdRunKeyName, moduleName, registryKey[2]))
attributes.add(BlackboardAttribute(attributeIdRunKeyValue, moduleName, registryKey[3]))
art.addAttributes(attributes)
# post the artifact for listeners of artifact events # index the artifact for keyword search
try: try:
skCase.getBlackboard().postArtifact(art, moduleName) blackboard.indexArtifact(art)
except: except:
self._logger.log(Level.WARNING, "Error indexing artifact " + art.getDisplayName()) self._logger.log(Level.WARNING, "Error indexing artifact " + art.getDisplayName())
@ -277,7 +278,7 @@ class RegistryExampleIngestModule(DataSourceIngestModule):
return currentKey return currentKey
except: except:
# Key not found # Key not found
return None return null