mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-13 08:26:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

address review comments

Browse Source 
Address review comments with added comment and changed description.
This commit is contained in:
Mark McKinnon 2019-09-24 10:10:17 -04:00
parent bbdff3147b
commit ada7493bee
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/Bundle.properties-MERGED
View File

@ -1,7 +1,7 @@
EncryptionDetectionDataSourceIngestModule.artifactComment.bitlocker=Bitlocker encryption detected. EncryptionDetectionDataSourceIngestModule.artifactComment.bitlocker=Bitlocker encryption detected.
EncryptionDetectionDataSourceIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f). EncryptionDetectionDataSourceIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f).
EncryptionDetectionDataSourceIngestModule.processing.message=Checking image for encryption. EncryptionDetectionDataSourceIngestModule.processing.message=Checking image for encryption.
EncryptionDetectionFileIngestModule.artifactComment.location=Location/File Extension determine encrypted file. EncryptionDetectionFileIngestModule.artifactComment.location=High entropy and known location/extension.
EncryptionDetectionFileIngestModule.artifactComment.password=Password protection detected. EncryptionDetectionFileIngestModule.artifactComment.password=Password protection detected.
EncryptionDetectionFileIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f). EncryptionDetectionFileIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f).
EncryptionDetectionFileIngestModule.getDesc.text=Looks for files with the specified minimum entropy. EncryptionDetectionFileIngestModule.getDesc.text=Looks for files with the specified minimum entropy.

7
Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionFileIngestModule.java
View File

@ -77,7 +77,10 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
private static final String MIME_TYPE_PDF = "application/pdf"; private static final String MIME_TYPE_PDF = "application/pdf";
private static final String[] FILE_IGNORE_LIST = {"hiberfile.sys", "pagefile.sys"}; private static final String[] FILE_IGNORE_LIST = {"hiberfile.sys", "pagefile.sys"};
/**
* This maps file locations to file extensions that are known to be encrypted
*/
private static final Map<String, String> knownEncryptedLocationExtensions = createLocationExtensionMap(); private static final Map<String, String> knownEncryptedLocationExtensions = createLocationExtensionMap();
private final IngestServices services = IngestServices.getInstance(); private final IngestServices services = IngestServices.getInstance();
@ -123,7 +126,7 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
@Messages({ @Messages({
"EncryptionDetectionFileIngestModule.artifactComment.password=Password protection detected.", "EncryptionDetectionFileIngestModule.artifactComment.password=Password protection detected.",
"EncryptionDetectionFileIngestModule.artifactComment.location=Location/File Extension determine encrypted file.", "EncryptionDetectionFileIngestModule.artifactComment.location=High entropy and known location/extension.",
"EncryptionDetectionFileIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f)." "EncryptionDetectionFileIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f)."
}) })
@Override @Override