diff --git a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbIngestModule.java index 2416001856..5c36db124e 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbIngestModule.java @@ -27,7 +27,9 @@ import java.util.concurrent.atomic.AtomicLong; import java.util.logging.Level; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.services.Blackboard; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.autopsy.ingest.IngestMessage; import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; @@ -59,6 +61,7 @@ public class HashDbIngestModule implements FileIngestModule { private long jobId; private static final HashMap totalsForIngestJobs = new HashMap<>(); private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter(); + private Blackboard blackboard; private static class IngestJobTotals { @@ -135,6 +138,8 @@ public class HashDbIngestModule implements FileIngestModule { @Override public ProcessResult process(AbstractFile file) { + blackboard = Case.getCurrentCase().getServices().getBlackboard(); + // Skip unallocated space files. if (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) { return ProcessResult.OK; @@ -292,6 +297,15 @@ public class HashDbIngestModule implements FileIngestModule { badFile.addAttribute(att3); BlackboardAttribute att4 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID(), MODULE_NAME, comment); badFile.addAttribute(att4); + + try { + // index the artifact for keyword search + blackboard.indexArtifact(badFile); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.error.msg", badFile.getDisplayName()), ex); //NON-NLS + MessageNotifyUtil.Notify.error( + NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.exception.msg"), badFile.getDisplayName()); + } if (showInboxMessage) { StringBuilder detailsSb = new StringBuilder(); diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java index b219ee6e02..514546a9ab 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java @@ -25,8 +25,11 @@ import java.sql.SQLException; import java.sql.Statement; import java.util.List; import java.util.logging.Level; +import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.services.Blackboard; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.autopsy.datamodel.ContentUtils; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; @@ -44,8 +47,10 @@ class CallLogAnalyzer { private java.io.File jFile = null; private String moduleName = iOSModuleFactory.getModuleName(); private static final Logger logger = Logger.getLogger(CallLogAnalyzer.class.getName()); + private Blackboard blackboard; public void findCallLogs() { + blackboard = Case.getCurrentCase().getServices().getBlackboard(); List absFiles; try { SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase(); @@ -119,6 +124,14 @@ class CallLogAnalyzer { bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID(), moduleName, type)); bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), moduleName, name)); + try { + // index the artifact for keyword search + blackboard.indexArtifact(bba); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.error.msg", bba.getDisplayName()), ex); //NON-NLS + MessageNotifyUtil.Notify.error( + NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.exception.msg"), bba.getDisplayName()); + } } } catch (Exception e) { logger.log(Level.SEVERE, "Error parsing Call logs to the Blackboard", e); //NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java index 0ba1125ef3..b9ea843aec 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java @@ -30,8 +30,11 @@ import java.sql.SQLException; import java.sql.Statement; import java.util.List; import java.util.logging.Level; +import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.services.Blackboard; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; @@ -50,9 +53,11 @@ class ContactAnalyzer { private java.io.File jFile = null; private String moduleName = iOSModuleFactory.getModuleName(); private static final Logger logger = Logger.getLogger(ContactAnalyzer.class.getName()); + private Blackboard blackboard; public void findContacts() { + blackboard = Case.getCurrentCase().getServices().getBlackboard(); List absFiles; try { SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase(); @@ -140,6 +145,15 @@ class ContactAnalyzer { bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL.getTypeID(), moduleName, data1)); } oldName = name; + + try { + // index the artifact for keyword search + blackboard.indexArtifact(bba); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.error.msg", bba.getDisplayName()), ex); //NON-NLS + MessageNotifyUtil.Notify.error( + NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.exception.msg"), bba.getDisplayName()); + } } } catch (Exception e) { diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java index a6090bc7e4..ca32e43450 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java @@ -25,8 +25,11 @@ import java.sql.SQLException; import java.sql.Statement; import java.util.List; import java.util.logging.Level; +import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.services.Blackboard; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.autopsy.datamodel.ContentUtils; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; @@ -45,8 +48,10 @@ class TextMessageAnalyzer { List absFiles; private String moduleName = iOSModuleFactory.getModuleName(); private static final Logger logger = Logger.getLogger(TextMessageAnalyzer.class.getName()); + private Blackboard blackboard; void findTexts() { + blackboard = Case.getCurrentCase().getServices().getBlackboard(); try { SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase(); absFiles = skCase.findAllFilesWhere("name ='mmssms.db'"); //NON-NLS //get exact file name @@ -122,6 +127,15 @@ class TextMessageAnalyzer { bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT.getTypeID(), moduleName, subject)); bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT.getTypeID(), moduleName, body)); bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE.getTypeID(), moduleName, "SMS Message")); + + try { + // index the artifact for keyword search + blackboard.indexArtifact(bba); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.error.msg", bba.getDisplayName()), ex); //NON-NLS + MessageNotifyUtil.Notify.error( + NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.exception.msg"), bba.getDisplayName()); + } } } catch (Exception e) {