mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

removed isSupported from ContentViewer API

Browse Source
This commit is contained in:
Brian Carrier 2014-01-15 23:23:53 -05:00
parent 3f9a296a0f
commit a5de0c23b8
21 changed files with 372 additions and 397 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
API-CHANGES.txt
View File

@ -1,7 +1,6 @@
Changes to make to API when we are ready to make backward incompatible changes: Changes to make to API when we are ready to make backward incompatible changes:
- HTMLReport has special API for more context on columns and special handling in REportGenerator. Change all reports to the new API. - HTMLReport has special API for more context on columns and special handling in REportGenerator. Change all reports to the new API.
- DataContentViewer.isPreferred does not need isSupported to be passed in
- DataContentViewerHex and Strings can have the public setDataView methods removed in favor of the new private ones - DataContentViewerHex and Strings can have the public setDataView methods removed in favor of the new private ones
- Content.getUniquePath() should not thrown TskException. We should deal with it in the method. - Content.getUniquePath() should not thrown TskException. We should deal with it in the method.
- Make the list of events that Case fires off to be part of an enum to group them together (like IngestManager does). - Make the list of events that Case fires off to be part of an enum to group them together (like IngestManager does).

2
Core/src/org/sleuthkit/autopsy/contentviewers/Metadata.java
View File

@ -185,7 +185,7 @@ public class Metadata extends javax.swing.JPanel implements DataContentViewer
} }
@Override @Override
public int isPreferred(Node node, boolean isSupported) { public int isPreferred(Node node) {
return 1; return 1;
} }
} }

7
Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataContentViewer.java
View File

@ -83,16 +83,15 @@ public interface DataContentViewer {
* Checks whether the given viewer is preferred for the Node. * Checks whether the given viewer is preferred for the Node.
* This is a bit subjective, but the idea is that Autopsy wants to display * This is a bit subjective, but the idea is that Autopsy wants to display
* the most relevant tab. The more generic the viewer, the lower * the most relevant tab. The more generic the viewer, the lower
* the return value should be. * the return value should be. This will only be called on viewers that
* support the given node.
* *
* @param node Node to check for preference * @param node Node to check for preference
* @param isSupported true if the viewer is supported by the node, false otherwise
* as determined by a previous check
* @return an int (0-10) higher return means the viewer has higher priority * @return an int (0-10) higher return means the viewer has higher priority
* 0 means not supported * 0 means not supported
* 1 to 2 means the module will display all file types (such as the hex viewer) * 1 to 2 means the module will display all file types (such as the hex viewer)
* 3-10 are prioritized by Content viewer developer. Modules that operate on very * 3-10 are prioritized by Content viewer developer. Modules that operate on very
* few file types should be towards 10. * few file types should be towards 10.
*/ */
public int isPreferred(Node node, boolean isSupported); public int isPreferred(Node node);
} }

6
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentPanel.java
View File

@ -181,7 +181,7 @@ public class DataContentPanel extends javax.swing.JPanel implements DataContent,
jTabbedPane1.setEnabledAt(i, true); jTabbedPane1.setEnabledAt(i, true);
// remember the viewer with the highest preference value // remember the viewer with the highest preference value
int currentPreferred = dcv.isPreferred(selectedNode, true); int currentPreferred = dcv.isPreferred(selectedNode);
if (currentPreferred > maxPreferred) { if (currentPreferred > maxPreferred) {
preferredViewerIndex = i; preferredViewerIndex = i;
maxPreferred = currentPreferred; maxPreferred = currentPreferred;
@ -258,8 +258,8 @@ public class DataContentPanel extends javax.swing.JPanel implements DataContent,
return this.wrapped.isSupported(node); return this.wrapped.isSupported(node);
} }
int isPreferred(Node node, boolean isSupported) { int isPreferred(Node node) {
return this.wrapped.isPreferred(node, isSupported); return this.wrapped.isPreferred(node);
} }
} }

13
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java
View File

@ -326,18 +326,13 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat
} }
@Override @Override
public int isPreferred(Node node, boolean isSupported) { public int isPreferred(Node node) {
BlackboardArtifact artifact = node.getLookup().lookup(BlackboardArtifact.class); BlackboardArtifact artifact = node.getLookup().lookup(BlackboardArtifact.class);
if(isSupported) { if(artifact == null) {
if(artifact == null) { return 3;
return 3;
}
else {
return 5;
}
} }
else { else {
return 0; return 5;
} }
} }

8
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerHex.java
View File

@ -434,12 +434,8 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
} }
@Override @Override
public int isPreferred(Node node, boolean isSupported) { public int isPreferred(Node node) {
if (isSupported) { return 1;
return 1;
} else {
return 0;
}
} }
@Override @Override

31
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerMedia.java
View File

@ -226,25 +226,22 @@ public class DataContentViewerMedia extends javax.swing.JPanel implements DataCo
} }
@Override @Override
public int isPreferred(Node node, boolean isSupported) { public int isPreferred(Node node) {
if (isSupported) { //special case, check if deleted video, then do not make it preferred
//special case, check if deleted video, then do not make it preferred AbstractFile file = node.getLookup().lookup(AbstractFile.class);
AbstractFile file = node.getLookup().lookup(AbstractFile.class); if (file == null) {
if (file == null) {
return 0;
}
String name = file.getName().toLowerCase();
boolean deleted = file.isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM.UNALLOC);
if (containsExt(name, videoExtensions) && deleted) {
return 0;
}
else {
return 7;
}
} else {
return 0; return 0;
} }
String name = file.getName().toLowerCase();
boolean deleted = file.isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM.UNALLOC);
if (containsExt(name, videoExtensions) && deleted) {
return 0;
}
else {
return 7;
}
} }
private static boolean containsExt(String name, String[] exts) { private static boolean containsExt(String name, String[] exts) {

8
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerString.java
View File

@ -484,12 +484,8 @@ public class DataContentViewerString extends javax.swing.JPanel implements DataC
} }
@Override @Override
public int isPreferred(Node node, boolean isSupported) { public int isPreferred(Node node) {
if (node != null && isSupported) { return 1;
return 1;
} else {
return 0;
}
} }
@Override @Override

62
Core/src/org/sleuthkit/autopsy/corecomponents/docs/corecomponents-toc.xml
View File

@ -1,31 +1,31 @@
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE toc PUBLIC "-//Sun Microsystems Inc.//DTD JavaHelp TOC Version 2.0//EN" "http://java.sun.com/products/javahelp/toc_2_0.dtd"> <!DOCTYPE toc PUBLIC "-//Sun Microsystems Inc.//DTD JavaHelp TOC Version 2.0//EN" "http://java.sun.com/products/javahelp/toc_2_0.dtd">
<toc version="2.0"> <toc version="2.0">
<tocitem text="Data Explorers"> <tocitem text="Data Explorers">
<tocitem text="About Data Explorers" target="org.sleuthkit.autopsy.corecomponents.dataexplorer-about"/> <tocitem text="About Data Explorers" target="org.sleuthkit.autopsy.corecomponents.dataexplorer-about"/>
<tocitem text="Directory Tree"> <tocitem text="Directory Tree">
<tocitem text="About Directory Tree" target="org.sleuthkit.autopsy.directorytree.about"/> <tocitem text="About Directory Tree" target="org.sleuthkit.autopsy.directorytree.about"/>
<tocitem text="Image Details Window" target="org.sleuthkit.autopsy.directorytree.image-details"/> <tocitem text="Image Details Window" target="org.sleuthkit.autopsy.directorytree.image-details"/>
<tocitem text="Volume Details Window" target="org.sleuthkit.autopsy.directorytree.volume-details"/> <tocitem text="Volume Details Window" target="org.sleuthkit.autopsy.directorytree.volume-details"/>
<tocitem text="Extracting Unallocated Space" target="org.sleuthkit.autopsy.directorytree.unallocated-space"/> <tocitem text="Extracting Unallocated Space" target="org.sleuthkit.autopsy.directorytree.unallocated-space"/>
</tocitem> </tocitem>
<tocitem text="File Search"> <tocitem text="File Search">
<tocitem text="About File Search" target="org.sleuthkit.autopsy.filesearch.about"/> <tocitem text="About File Search" target="org.sleuthkit.autopsy.filesearch.about"/>
<tocitem text="How to Open File Search" target="org.sleuthkit.autopsy.filesearch.open-filesearch"/> <tocitem text="How to Open File Search" target="org.sleuthkit.autopsy.filesearch.open-filesearch"/>
<tocitem text="How to Use File Search" target="org.sleuthkit.autopsy.filesearch.how-to-use-filesearch"/> <tocitem text="How to Use File Search" target="org.sleuthkit.autopsy.filesearch.how-to-use-filesearch"/>
</tocitem> </tocitem>
</tocitem> </tocitem>
<tocitem text="Result Viewers"> <tocitem text="Result Viewers">
<tocitem text="About Result Viewers" target="org.sleuthkit.autopsy.corecomponents.dataresult-about"/> <tocitem text="About Result Viewers" target="org.sleuthkit.autopsy.corecomponents.dataresult-about"/>
<tocitem text="Table Results Viewer" target="org.sleuthkit.autopsy.corecomponents.table-results-viewer"/> <tocitem text="Table Results Viewer" target="org.sleuthkit.autopsy.corecomponents.table-results-viewer"/>
<tocitem text="Thumbnail Result Viewer" target="org.sleuthkit.autopsy.corecomponents.thumbnail-results-viewer"/> <tocitem text="Thumbnail Result Viewer" target="org.sleuthkit.autopsy.corecomponents.thumbnail-results-viewer"/>
</tocitem> </tocitem>
<tocitem text="Content Viewers"> <tocitem text="Content Viewers">
<tocitem text="About Content Viewers" target="org.sleuthkit.autopsy.corecomponents.datacontent-about"/> <tocitem text="About Content Viewers" target="org.sleuthkit.autopsy.corecomponents.datacontent-about"/>
<tocitem text="Hex Content Viewer" target="org.sleuthkit.autopsy.corecomponents.hex-content-viewer"/> <tocitem text="Hex Content Viewer" target="org.sleuthkit.autopsy.corecomponents.hex-content-viewer"/>
<tocitem text="String Content Viewer" target="org.sleuthkit.autopsy.corecomponents.string-content-viewer"/> <tocitem text="String Content Viewer" target="org.sleuthkit.autopsy.corecomponents.string-content-viewer"/>
<tocitem text="Text Content Viewer" target="org.sleuthkit.autopsy.corecomponents.text-content-viewer"/> <tocitem text="Text Content Viewer" target="org.sleuthkit.autopsy.corecomponents.text-content-viewer"/>
<tocitem text="Media Content Viewer" target="org.sleuthkit.autopsy.corecomponents.picture-content-viewer"/> <tocitem text="Media Content Viewer" target="org.sleuthkit.autopsy.corecomponents.picture-content-viewer"/>
</tocitem> </tocitem>
</toc> </toc>

98
Core/src/org/sleuthkit/autopsy/corecomponents/docs/datacontent-about.html
View File

@ -1,50 +1,50 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>About Content Viewers</title> <title>About Content Viewers</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Content Viewers</h2> <h2>Content Viewers</h2>
<p> <p>
The Content Viewer area is in the lower right area of the interface. The Content Viewer area is in the lower right area of the interface.
This area is used to view a specific file in a variety of formats. This area is used to view a specific file in a variety of formats.
There are different tabs for different viewers. There are different tabs for different viewers.
Not all tabs support all file types, so only some of them will be enabled. Not all tabs support all file types, so only some of them will be enabled.
To display data in this area, a file must be selected from the To display data in this area, a file must be selected from the
<a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataresult-about.html">Result Viewer</a> window. <a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataresult-about.html">Result Viewer</a> window.
</p> </p>
<p> <p>
The Content Viewer area is part of a plug-in framework. The Content Viewer area is part of a plug-in framework.
You can install modules that will add more viewer types. You can install modules that will add more viewer types.
This section describes the viewers that come by default with Autopsy. This section describes the viewers that come by default with Autopsy.
</p> </p>
<p>Here's an example of a "Content Viewer" window:</p> <p>Here's an example of a "Content Viewer" window:</p>
<img src="ContentViewer_example.png" alt="Example of Content Viewer Window" /> <img src="ContentViewer_example.png" alt="Example of Content Viewer Window" />
<h2>Default Viewers</h2> <h2>Default Viewers</h2>
<p> Currently, there are 5 main tabs on "Content Viewer" window:</p> <p> Currently, there are 5 main tabs on "Content Viewer" window:</p>
<ul> <ul>
<li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/result-viewer.html">Result Viewer</a></li> <li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/result-viewer.html">Result Viewer</a></li>
<li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/hex-content-viewer.html">Hex Content Viewer</a></li> <li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/hex-content-viewer.html">Hex Content Viewer</a></li>
<li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/string-content-viewer.html">String Content Viewer</a></li> <li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/string-content-viewer.html">String Content Viewer</a></li>
<li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/picture-content-viewer.html">Media Viewer</a></li> <li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/picture-content-viewer.html">Media Viewer</a></li>
<li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/text-content-viewer.html">Text Viewer</a></li> <li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/text-content-viewer.html">Text Viewer</a></li>
</ul> </ul>
</body> </body>
</html> </html>
<!-- <!--
Tip: to create a link which will open in an external web browser, try: Tip: to create a link which will open in an external web browser, try:
<object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer"> <object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer">
<param name="content" value="http://www.netbeans.org/"> <param name="content" value="http://www.netbeans.org/">
<param name="text" value="<html><u>http://www.netbeans.org/</u></html>"> <param name="text" value="<html><u>http://www.netbeans.org/</u></html>">
<param name="textFontSize" value="medium"> <param name="textFontSize" value="medium">
<param name="textColor" value="blue"> <param name="textColor" value="blue">
</object> </object>
To create a link to a help set from another module, you need to know the code name base and path, e.g.: To create a link to a help set from another module, you need to know the code name base and path, e.g.:
<a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a> <a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a>
(This link will behave sanely if that module is disabled or missing.) (This link will behave sanely if that module is disabled or missing.)
!--> !-->

92
Core/src/org/sleuthkit/autopsy/corecomponents/docs/dataexplorer-about.html
View File

@ -1,47 +1,47 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Data Explorers</title> <title>Data Explorers</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>About the Data Explorer</h2> <h2>About the Data Explorer</h2>
<p> <p>
The Data Explorer view in Autopsy is the <a href="nbdocs:/org/sleuthkit/autopsy/directorytree/docs/directorytree-about.html">directory tree</a> The Data Explorer view in Autopsy is the <a href="nbdocs:/org/sleuthkit/autopsy/directorytree/docs/directorytree-about.html">directory tree</a>
node structure seen on the left hand side. node structure seen on the left hand side.
</p> </p>
<p>The data explorer contains the following data:</p> <p>The data explorer contains the following data:</p>
<ul> <ul>
<li>Image file-system with its directory structure that can be navigated,</li> <li>Image file-system with its directory structure that can be navigated,</li>
<li>Saved results of image and file analysis, such as results produced by the ingest process,</li> <li>Saved results of image and file analysis, such as results produced by the ingest process,</li>
<li>Built-in views and filters on the file-system and saved results.</li> <li>Built-in views and filters on the file-system and saved results.</li>
</ul> </ul>
<p>The data explorer provides different methods for finding relevant data, such as:</p> <p>The data explorer provides different methods for finding relevant data, such as:</p>
<ul> <ul>
<li>All files of a specific type</li> <li>All files of a specific type</li>
<li>Different extracted content types (web bookmarks, web history, installed programs, devices, etc.)</li> <li>Different extracted content types (web bookmarks, web history, installed programs, devices, etc.)</li>
<li>Hash database hits</li> <li>Hash database hits</li>
<li>Keyword hits</li> <li>Keyword hits</li>
<li>File bookmarks</li> <li>File bookmarks</li>
</ul> </ul>
<p> <p>
The Data Explorer will publish all relevant data to the <a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataresult-about.html">Result Viewer</a> The Data Explorer will publish all relevant data to the <a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataresult-about.html">Result Viewer</a>
when specific nodes are clicked. In general, if you are looking for an 'analysis technique', then this is where you should look. when specific nodes are clicked. In general, if you are looking for an 'analysis technique', then this is where you should look.
</p> </p>
</body> </body>
</html> </html>
<!-- <!--
Tip: to create a link which will open in an external web browser, try: Tip: to create a link which will open in an external web browser, try:
<object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer"> <object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer">
<param name="content" value="http://www.netbeans.org/"> <param name="content" value="http://www.netbeans.org/">
<param name="text" value="<html><u>http://www.netbeans.org/</u></html>"> <param name="text" value="<html><u>http://www.netbeans.org/</u></html>">
<param name="textFontSize" value="medium"> <param name="textFontSize" value="medium">
<param name="textColor" value="blue"> <param name="textColor" value="blue">
</object> </object>
To create a link to a help set from another module, you need to know the code name base and path, e.g.: To create a link to a help set from another module, you need to know the code name base and path, e.g.:
<a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a> <a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a>
(This link will behave sanely if that module is disabled or missing.) (This link will behave sanely if that module is disabled or missing.)
!--> !-->

90
Core/src/org/sleuthkit/autopsy/corecomponents/docs/dataresult-about.html
View File

@ -1,45 +1,45 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Result Viewers</title> <title>Result Viewers</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Result Viewers</h2> <h2>Result Viewers</h2>
<p> <p>
The Result Viewer windows are in the upper right area of the interface and display the results from selecting something in the The Result Viewer windows are in the upper right area of the interface and display the results from selecting something in the
<a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataexplorer-about.html">Data Explorer Tree</a> area. <a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataexplorer-about.html">Data Explorer Tree</a> area.
You will have the option to display the results in a variety of formats. You will have the option to display the results in a variety of formats.
</p> </p>
<p>Currently, there are 2 main tabs in the Result Viewer window:</p> <p>Currently, there are 2 main tabs in the Result Viewer window:</p>
<ul> <ul>
<li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/table-results-viewer.html">Table Results Viewer</a></li> <li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/table-results-viewer.html">Table Results Viewer</a></li>
<li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/thumbnail-results-viewer.html">Thumbnail Results Viewer</a></li> <li><a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/thumbnail-results-viewer.html">Thumbnail Results Viewer</a></li>
</ul> </ul>
<h2>Right Click Functions</h2> <h2>Right Click Functions</h2>
<p> <p>
Viewers in Result Viewers have certain right-click functions built-in into them that can be accessed when a node a certain type is selected (a file, directory or a result). Viewers in Result Viewers have certain right-click functions built-in into them that can be accessed when a node a certain type is selected (a file, directory or a result).
</p> </p>
<p>Here are some examples that you may see:</p> <p>Here are some examples that you may see:</p>
<ul> <ul>
<li><strong>Open File in External Viewer</strong>: <li><strong>Open File in External Viewer</strong>:
Opens the selected file in an "external" application as defined by the local OS. Opens the selected file in an "external" application as defined by the local OS.
For example, HTML files may be opened by IE or Firefox, depending on what the local system is configured to use.</li> For example, HTML files may be opened by IE or Firefox, depending on what the local system is configured to use.</li>
<li><strong>View in New Window:</strong> <li><strong>View in New Window:</strong>
Opens the content in a new internal Content Viewer (instead of in the default location in the lower right).</li> Opens the content in a new internal Content Viewer (instead of in the default location in the lower right).</li>
<li><strong>Extract:</strong> <li><strong>Extract:</strong>
Make a local copy of the file or directory for further analysis.</li> Make a local copy of the file or directory for further analysis.</li>
<li><strong>Search for files with the same MD5 Hash:</strong> <li><strong>Search for files with the same MD5 Hash:</strong>
Searches the entire file-system for any files with the same MD5 Hash as the one selected.</li> Searches the entire file-system for any files with the same MD5 Hash as the one selected.</li>
</ul> </ul>
<h2>Example</h2> <h2>Example</h2>
<p>Below is an example of a "Result Viewer" window:</p> <p>Below is an example of a "Result Viewer" window:</p>
<img src="ResultViewer_example.png" alt="Example of Result Viewer Window" /> <img src="ResultViewer_example.png" alt="Example of Result Viewer Window" />
</body> </body>
</html> </html>

40
Core/src/org/sleuthkit/autopsy/corecomponents/docs/hex-content-viewer.html
View File

@ -1,21 +1,21 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Hex Content Viewer</title> <title>Hex Content Viewer</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Hex Content Viewer</h2> <h2>Hex Content Viewer</h2>
<p> <p>
Hex Content Viewer shows you the raw and exact contents of a file. Hex Content Viewer shows you the raw and exact contents of a file.
In this Hex Content Viewer, the data of the file is represented as hexadecimal values grouped in 2 groups of 8 bytes, In this Hex Content Viewer, the data of the file is represented as hexadecimal values grouped in 2 groups of 8 bytes,
followed by one group of 16 ASCII characters which are derived from each pair of hex values (each byte). followed by one group of 16 ASCII characters which are derived from each pair of hex values (each byte).
Non-printable ASCII characters and characters that would take more than one character space are typically represented by a dot (".") in the following ASCII field. Non-printable ASCII characters and characters that would take more than one character space are typically represented by a dot (".") in the following ASCII field.
</p> </p>
<h2>Example</h2> <h2>Example</h2>
<p>Below is an example of "Hex Content Viewer" window:</p> <p>Below is an example of "Hex Content Viewer" window:</p>
<img src="Hex_Content_Viewer.png" alt="Example of Hex Content Viewer Tab" /> <img src="Hex_Content_Viewer.png" alt="Example of Hex Content Viewer Tab" />
</body> </body>
</html> </html>

40
Core/src/org/sleuthkit/autopsy/corecomponents/docs/picture-content-viewer.html
View File

@ -1,20 +1,20 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Media Content Viewer</title> <title>Media Content Viewer</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Media Content Viewer</h2> <h2>Media Content Viewer</h2>
<p> <p>
The Media Content Viewer will show a picture or video file. The Media Content Viewer will show a picture or video file.
Video files can be played and paused. Video files can be played and paused.
The size of the picture or video will be reduced to fit into the screen. The size of the picture or video will be reduced to fit into the screen.
If you want more complex analysis of the media, then you must export the file. If you want more complex analysis of the media, then you must export the file.
</p> </p>
<p>If you select an non-picture file or an unsupported picture format on the "Result Viewers", this tab will be disabled.</p> <p>If you select an non-picture file or an unsupported picture format on the "Result Viewers", this tab will be disabled.</p>
<p>Here's one of the example of the "Media Content Viewer":</p> <p>Here's one of the example of the "Media Content Viewer":</p>
<img src="Picture_Content_Viewer.png" alt="Example of Picture Content Viewer Tab" /> <img src="Picture_Content_Viewer.png" alt="Example of Picture Content Viewer Tab" />
</body> </body>
</html> </html>

54
Core/src/org/sleuthkit/autopsy/corecomponents/docs/result-viewer.html
View File

@ -1,28 +1,28 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Result Content Viewer</title> <title>Result Content Viewer</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Result Content Viewer</h2> <h2>Result Content Viewer</h2>
<p>Result Content Viewer shows the artifacts (saved results) associated with the item selected in the Result Viewer.</p> <p>Result Content Viewer shows the artifacts (saved results) associated with the item selected in the Result Viewer.</p>
<h2>Example</h2> <h2>Example</h2>
<p>Below is an example of "Result Content Viewer" window:</p> <p>Below is an example of "Result Content Viewer" window:</p>
<img src="Result_Viewer.png" alt="Example of Result Content Viewer Tab" /> <img src="Result_Viewer.png" alt="Example of Result Content Viewer Tab" />
</body> </body>
</html> </html>
<!-- <!--
Tip: to create a link which will open in an external web browser, try: Tip: to create a link which will open in an external web browser, try:
<object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer"> <object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer">
<param name="content" value="http://www.netbeans.org/"> <param name="content" value="http://www.netbeans.org/">
<param name="text" value="<html><u>http://www.netbeans.org/</u></html>"> <param name="text" value="<html><u>http://www.netbeans.org/</u></html>">
<param name="textFontSize" value="medium"> <param name="textFontSize" value="medium">
<param name="textColor" value="blue"> <param name="textColor" value="blue">
</object> </object>
To create a link to a help set from another module, you need to know the code name base and path, e.g.: To create a link to a help set from another module, you need to know the code name base and path, e.g.:
<a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a> <a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a>
(This link will behave sanely if that module is disabled or missing.) (This link will behave sanely if that module is disabled or missing.)
!--> !-->

46
Core/src/org/sleuthkit/autopsy/corecomponents/docs/string-content-viewer.html
View File

@ -1,23 +1,23 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>String Content Viewer</title> <title>String Content Viewer</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>String Content Viewer</h2> <h2>String Content Viewer</h2>
<p> <p>
Strings Content Viewer scans (potentially binary) data of the file / folder and searches it for data that could be text. Strings Content Viewer scans (potentially binary) data of the file / folder and searches it for data that could be text.
When appropriate data is found, the String Content Viewer shows data strings extracted from binary, decoded, and interpreted as UTF8/16 for the selected script/language. When appropriate data is found, the String Content Viewer shows data strings extracted from binary, decoded, and interpreted as UTF8/16 for the selected script/language.
</p> </p>
<p> <p>
Note that this is different from the Text Content Viewer, which displays the text for a file that is stored in the keyword search index. Note that this is different from the Text Content Viewer, which displays the text for a file that is stored in the keyword search index.
The results may be the same or they could be different, depending how the data were interpreted by the indexer. The results may be the same or they could be different, depending how the data were interpreted by the indexer.
</p> </p>
<h2>Example</h2> <h2>Example</h2>
<p>Below is an example of "String Content Viewer" window:</p> <p>Below is an example of "String Content Viewer" window:</p>
<img src="String_Content_Viewer.png" alt="Example of String Content Viewer Tab" /> <img src="String_Content_Viewer.png" alt="Example of String Content Viewer Tab" />
</body> </body>
</html> </html>

46
Core/src/org/sleuthkit/autopsy/corecomponents/docs/table-results-viewer.html
View File

@ -1,24 +1,24 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Table Results (Directory Listing) Viewer</title> <title>Table Results (Directory Listing) Viewer</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Table Results Viewer</h2> <h2>Table Results Viewer</h2>
<p> <p>
Table Results Viewer (Directory Listing) displays the data catalog as a table with some details (properties) of each file. Table Results Viewer (Directory Listing) displays the data catalog as a table with some details (properties) of each file.
The properties that it shows are: name, time (modified, changed, accessed, and created), size, flags (directory and meta), mode, user ID, group ID, metadata address, attribute address, and type (directory and meta). The properties that it shows are: name, time (modified, changed, accessed, and created), size, flags (directory and meta), mode, user ID, group ID, metadata address, attribute address, and type (directory and meta).
Click the Table Viewer tab to select this view. Click the Table Viewer tab to select this view.
</p> </p>
<p> <p>
The Results Viewer can be also activated for saved results and it can show a high level results grouped, The Results Viewer can be also activated for saved results and it can show a high level results grouped,
or a results at a file level, depending on which node on the Directory Tree is selected to populate the Table Results Viewer. or a results at a file level, depending on which node on the Directory Tree is selected to populate the Table Results Viewer.
</p> </p>
<h2>Example</h2> <h2>Example</h2>
<p>Below is an example of a "Table Results Viewer" window:</p> <p>Below is an example of a "Table Results Viewer" window:</p>
<img src="Table_Results_Viewer.png" alt="Example of Table Result Viewers Tab" /> <img src="Table_Results_Viewer.png" alt="Example of Table Result Viewers Tab" />
</body> </body>
</html> </html>

60
Core/src/org/sleuthkit/autopsy/corecomponents/docs/text-content-viewer.html
View File

@ -1,30 +1,30 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Text View</title> <title>Text View</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Text View</h2> <h2>Text View</h2>
<p> <p>
Text Content Viewer uses the keyword search index that may have been populated during Text Content Viewer uses the keyword search index that may have been populated during
<a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">Image Ingest</a>. <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">Image Ingest</a>.
If a file has text stored in the index, then this tab will be enabled and it will be displayed to the user if a file or a result associated with a file is selected. If a file has text stored in the index, then this tab will be enabled and it will be displayed to the user if a file or a result associated with a file is selected.
</p> </p>
<p> <p>
This tab may have more text on it than the "String View", which relies on searching the file for text-looking data. This tab may have more text on it than the "String View", which relies on searching the file for text-looking data.
Some files, like PDF, will not have text-looking data at the byte-level, but the keyword indexing process knows how to interpret a PDF file and produce text. Some files, like PDF, will not have text-looking data at the byte-level, but the keyword indexing process knows how to interpret a PDF file and produce text.
For the files the indexer knows about, there may be the METADATA section at the end of the displayed extracted text. For the files the indexer knows about, there may be the METADATA section at the end of the displayed extracted text.
If an indexed document contains any metadata (such as creation date, author, etc), it will be displayed there. If an indexed document contains any metadata (such as creation date, author, etc), it will be displayed there.
Note that, unlike the "String View", the Text View does not have its built-in settings for the script/language to use for extracted strings. Note that, unlike the "String View", the Text View does not have its built-in settings for the script/language to use for extracted strings.
This is because the script/language is used at indexing time, and that setting is associated with the Keyword Search indexer, not the viewer. This is because the script/language is used at indexing time, and that setting is associated with the Keyword Search indexer, not the viewer.
</p> </p>
<p> <p>
If this tab is not enabled, then either the file has no text or you did not enable Keyword Search as an ingest module. If this tab is not enabled, then either the file has no text or you did not enable Keyword Search as an ingest module.
Note that this viewer is also used to display highlighted keyword hits when operated in the "Search Matches" mode, Note that this viewer is also used to display highlighted keyword hits when operated in the "Search Matches" mode,
selected on the right-hand side of the viewer's toolbar. selected on the right-hand side of the viewer's toolbar.
</p> </p>
<img src="textview.png" alt="Text View" /> <img src="textview.png" alt="Text View" />
</body> </body>
</html> </html>

42
Core/src/org/sleuthkit/autopsy/corecomponents/docs/thumbnail-results-viewer.html
View File

@ -1,22 +1,22 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Thumbnail Results Viewer</title> <title>Thumbnail Results Viewer</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Thumbnail Results Viewer</h2> <h2>Thumbnail Results Viewer</h2>
<p> <p>
Thumbnail Results Viewer displays the data catalog as a table of thumbnail images in adjustable sizes. Thumbnail Results Viewer displays the data catalog as a table of thumbnail images in adjustable sizes.
This viewer only supports picture file(s) (Currently, only supports JPG, GIF, and PNG formats). This viewer only supports picture file(s) (Currently, only supports JPG, GIF, and PNG formats).
Click the Thumbnail tab to select this view. Click the Thumbnail tab to select this view.
Note that for a large number of images in a directory selected in the Data Explorer, or for a View selected that contains Note that for a large number of images in a directory selected in the Data Explorer, or for a View selected that contains
a large number of images, it might take a while to populate this view for the first time before the images are cached. a large number of images, it might take a while to populate this view for the first time before the images are cached.
</p> </p>
<h2>Example</h2> <h2>Example</h2>
<p>Below is an example of "Thumbnail Results Viewer" window:</p> <p>Below is an example of "Thumbnail Results Viewer" window:</p>
<img src="Thumbnail_Results_Viewer.png" alt="Example of Thumbnail Results Viewer Tab" /> <img src="Thumbnail_Results_Viewer.png" alt="Example of Thumbnail Results Viewer Tab" />
</body> </body>
</html> </html>

5
Core/src/org/sleuthkit/autopsy/examples/SampleContentViewer.java
View File

@ -166,10 +166,7 @@ public class SampleContentViewer extends javax.swing.JPanel implements DataConte
} }
@Override @Override
public int isPreferred(Node node, boolean isSupported) { public int isPreferred(Node node) {
if (isSupported == false) {
return 0;
}
// we return 1 since this module will operate on nearly all files // we return 1 since this module will operate on nearly all files
return 1; return 1;
} }

18
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/ExtractedContentViewer.java
View File

@ -311,19 +311,15 @@ public class ExtractedContentViewer implements DataContentViewer {
} }
@Override @Override
public int isPreferred(Node node, public int isPreferred(Node node) {
boolean isSupported) {
BlackboardArtifact art = node.getLookup().lookup(BlackboardArtifact.class); BlackboardArtifact art = node.getLookup().lookup(BlackboardArtifact.class);
if (isSupported) {
if (art == null) { if (art == null) {
return 4; return 4;
} else if (art.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) { } else if (art.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
return 6; return 6;
} else {
return 4;
}
} else { } else {
return 0; return 4;
} }
} }