Merge branch 'timeline-event-mgr-2' of github.com:sleuthkit/autopsy into timeline-event-mgr-2

This commit is contained in:
Brian Carrier 2019-07-16 10:35:10 -04:00
commit aa4cd9223e
7 changed files with 17 additions and 37 deletions

View File

@ -1,5 +1,5 @@
CannotRunFileTypeDetection=Cannot run file type detection. CannotRunFileTypeDetection=Cannot run file type detection.
ExifParserFileIngestModule.indexError.message=Failed to index EXIF Metadata artifact for keyword search. ExifParserFileIngestModule.indexError.message=Failed to post EXIF Metadata artifact(s).
OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Long-Description=\ OpenIDE-Module-Long-Description=\
Exif metadata ingest module. \n\n\ Exif metadata ingest module. \n\n\

Binary file not shown.

After

Width:  |  Height:  |  Size: 697 B

View File

@ -91,7 +91,11 @@ final public class EventTypeUtils {
imageFileName = "raw_access_logs.png"; imageFileName = "raw_access_logs.png";
} else if (typeID == TimelineEventType.USER_CREATED.getTypeID()) { } else if (typeID == TimelineEventType.USER_CREATED.getTypeID()) {
imageFileName = "hand_point.png"; imageFileName = "hand_point.png";
} else { } else if (typeID == EventType.WEB_FORM_AUTOFILL.getTypeID()) {
imageFileName = "artifact-icon.png";
} else if (typeID == EventType.WEB_FORM_ADDRESSES.getTypeID()) {
imageFileName = "artifact-icon.png";
}else {
imageFileName = "timeline_marker.png"; imageFileName = "timeline_marker.png";
} }

View File

@ -1,7 +1,6 @@
cannotBuildXmlParser=Unable to build XML parser: cannotBuildXmlParser=Unable to build XML parser:
cannotLoadSEUQA=Unable to load Search Engine URL Query Analyzer settings file, SEUQAMappings.xml: cannotLoadSEUQA=Unable to load Search Engine URL Query Analyzer settings file, SEUQAMappings.xml:
cannotParseXml=Unable to parse XML file: cannotParseXml=Unable to parse XML file:
Chrome.getBookmark.errMsg.errAnalyzeFile={0}: Error while trying to analyze file: {1}
ChromeCacheExtractor.moduleName=ChromeCacheExtractor ChromeCacheExtractor.moduleName=ChromeCacheExtractor
# {0} - module name # {0} - module name
# {1} - row number # {1} - row number
@ -65,7 +64,7 @@ ExtractZone_progress_Msg=Extracting :Zone.Identifer files
ExtractZone_Restricted=Restricted Sites Zone ExtractZone_Restricted=Restricted Sites Zone
ExtractZone_Trusted=Trusted Sites Zone ExtractZone_Trusted=Trusted Sites Zone
OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Long-Description=Recent Activity ingest module.\n\nThe module extracts useful information about the recent user activity on the disk image being ingested, such as:\n\n- Recently open documents,\n- Web activity (sites visited, stored cookies, book marked sites, search engine queries, file downloads),\n- Recently attached devices,\n- Installed programs.\n\nThe module currently supports Windows only disk images.\nThe plugin is also fully functional when deployed on Windows version of Autopsy. OpenIDE-Module-Long-Description=Recent Activity ingest module.\n\n\The module extracts useful information about the recent user activity on the disk image being ingested, such as:\n\n- Recently open documents,\n- Web activity (sites visited, stored cookies, book marked sites, search engine queries, file downloads),\n- Recently attached devices,\n- Installed programs.\n\nThe module currently supports Windows only disk images.\nThe plugin is also fully functional when deployed on Windows version of Autopsy.
OpenIDE-Module-Name=RecentActivity OpenIDE-Module-Name=RecentActivity
OpenIDE-Module-Short-Description=Recent Activity finder ingest module OpenIDE-Module-Short-Description=Recent Activity finder ingest module
Chrome.moduleName=Chrome Chrome.moduleName=Chrome

View File

@ -364,8 +364,6 @@ class Chrome extends Extract {
RecentActivityExtracterModuleFactory.getModuleName(), domain)); RecentActivityExtracterModuleFactory.getModuleName(), domain));
bbart.addAttributes(bbattributes); bbart.addAttributes(bbattributes);
// index the artifact for keyword search
postArtifact(bbart);
bbartifacts.add(bbart); bbartifacts.add(bbart);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error while trying to insert Chrome bookmark artifact{0}", ex); //NON-NLS logger.log(Level.SEVERE, "Error while trying to insert Chrome bookmark artifact{0}", ex); //NON-NLS
@ -374,6 +372,7 @@ class Chrome extends Extract {
this.getName(), bookmarkFile.getName())); this.getName(), bookmarkFile.getName()));
} }
} }
postArtifacts(bbartifacts);
dbFile.delete(); dbFile.delete();
} }
} }

View File

@ -818,12 +818,9 @@ class ExtractRegistry extends Extract {
break; break;
} }
} // for } // for
if (!usbBBartifacts.isEmpty()) {
IngestServices.getInstance().fireModuleDataEvent(new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED, usbBBartifacts)); postArtifacts(usbBBartifacts);
} postArtifacts(wifiBBartifacts);
if (!wifiBBartifacts.isEmpty()) {
IngestServices.getInstance().fireModuleDataEvent(new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_WIFI_NETWORK, wifiBBartifacts));
}
return true; return true;
} catch (FileNotFoundException ex) { } catch (FileNotFoundException ex) {
logger.log(Level.SEVERE, "Error finding the registry file.", ex); //NON-NLS logger.log(Level.SEVERE, "Error finding the registry file.", ex); //NON-NLS

View File

@ -291,12 +291,7 @@ final class ExtractSafari extends Extract {
} }
try { try {
Collection<BlackboardArtifact> bbartifacts = getHistoryArtifacts(historyFile, tempHistoryFile.toPath(), context); postArtifacts(getHistoryArtifacts(historyFile, tempHistoryFile.toPath(), context));
if (!bbartifacts.isEmpty()) {
services.fireModuleDataEvent(new ModuleDataEvent(
RecentActivityExtracterModuleFactory.getModuleName(),
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY, bbartifacts));
}
} finally { } finally {
tempHistoryFile.delete(); tempHistoryFile.delete();
} }
@ -323,12 +318,7 @@ final class ExtractSafari extends Extract {
File tempFile = createTemporaryFile(context, file); File tempFile = createTemporaryFile(context, file);
try { try {
Collection<BlackboardArtifact> bbartifacts = getBookmarkArtifacts(file, tempFile, context); postArtifacts(getBookmarkArtifacts(file, tempFile, context));
if (!bbartifacts.isEmpty()) {
services.fireModuleDataEvent(new ModuleDataEvent(
RecentActivityExtracterModuleFactory.getModuleName(),
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK, bbartifacts));
}
} finally { } finally {
tempFile.delete(); tempFile.delete();
} }
@ -356,12 +346,8 @@ final class ExtractSafari extends Extract {
File tempFile = createTemporaryFile(context, file); File tempFile = createTemporaryFile(context, file);
try { try {
Collection<BlackboardArtifact> bbartifacts = getDownloadArtifacts(dataSource, file, tempFile); postArtifacts(getDownloadArtifacts(dataSource, file, tempFile));
if (!bbartifacts.isEmpty()) {
services.fireModuleDataEvent(new ModuleDataEvent(
RecentActivityExtracterModuleFactory.getModuleName(),
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD, bbartifacts));
}
} finally { } finally {
if (tempFile != null) { if (tempFile != null) {
tempFile.delete(); tempFile.delete();
@ -389,13 +375,8 @@ final class ExtractSafari extends Extract {
try { try {
tempFile = createTemporaryFile(context, file); tempFile = createTemporaryFile(context, file);
Collection<BlackboardArtifact> bbartifacts = getCookieArtifacts(file, tempFile, context); postArtifacts(getCookieArtifacts(file, tempFile, context));
if (!bbartifacts.isEmpty()) {
services.fireModuleDataEvent(new ModuleDataEvent(
RecentActivityExtracterModuleFactory.getModuleName(),
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE, bbartifacts));
}
} finally { } finally {
if (tempFile != null) { if (tempFile != null) {
tempFile.delete(); tempFile.delete();