Merge branch 'master' of https://github.com/sleuthkit/autopsy into merge_mods

Conflicts:
	Core/javahelp/org/sleuthkit/autopsy/casemodule/docs/new-icon.png
	Core/javahelp/org/sleuthkit/autopsy/casemodule/docs/open-icon.png
This commit is contained in:
adam-m 2012-09-25 13:46:27 -04:00
commit b2780d91cc
8 changed files with 34 additions and 13 deletions

Binary file not shown.

Before

Width:  |  Height:  |  Size: 1.3 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 1.0 KiB

View File

@ -21,16 +21,16 @@
<li>Lookup MD5 hash in database</li> <li>Lookup MD5 hash in database</li>
<li>Detect file type of each file</li> <li>Detect file type of each file</li>
<li>Keyword search each file</li> <li>Keyword search each file</li>
<li>Extract web artifacts (downloads, history, etc.</li> <li>Extract web artifacts (downloads, history, etc.)</li>
</ul> </ul>
<p> <p>
<p>Ingest modules can be created by third-party-developers and can be added independently of Autopsy. </p> <p>Ingest modules can be created by third-party-developers and can be added independently of Autopsy. </p>
<h2>Configuring Ingest Modules</h2> <h2>Configuring Ingest Modules</h2>
There are two places to configure ingest modules. When the Ingest Manager is launched so that you can choose which ingest modules to run, there maybe a small set of configuration changes that the module allows you to set from that interface. Additional configuration is typically available from a separate dialog box that can be opened from either the "Tools" menu or with the "Advanced" button in the Ingest Manager. There are two places to configure ingest modules. When the Ingest Manager is launched, there may be a small set of options the module allows you to edit directly in the Ingest Manager. Additionally, the Ingest Manager may display an "Advanced" button, which will open up a larger configuration menu with more available settings. This advanced configuration menu can often be found in the "Tools" > "Options" menu, along with the advanced settings for numerous other ingest modules.
<h2>Adding Ingest Modules</h2> <h2>Adding Ingest Modules</h2>
Not yet supported. Ingest modules can be added through Autopsy's plugin manager. This is accessible through the "Tools" > "Plugins" menu. Currently, the best way to add an ingest module is by navigating to the module's NBM file after choosing "Add Plugin..." in the "Downloaded" tab of the plugin manager. Autopsy will require a restart after any modules are installed in order to properly load and display them.
</body> </body>
</html> </html>

View File

@ -166,27 +166,27 @@ public class KeywordSearchSettings {
logger.log(Level.INFO, "Detecting default settings."); logger.log(Level.INFO, "Detecting default settings.");
//setting default NSRL //setting default NSRL
if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_NSRL, "SkipKnown")){ if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_NSRL, "SkipKnown")){
logger.log(Level.INFO, "No configuration for NSRL not found, generating default..."); logger.log(Level.INFO, "No configuration for NSRL found, generating default...");
KeywordSearchSettings.setSkipKnown(true); KeywordSearchSettings.setSkipKnown(true);
} }
//setting default Update Frequency //setting default Update Frequency
if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_OPTIONS, "UpdateFrequency")){ if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_OPTIONS, "UpdateFrequency")){
logger.log(Level.INFO, "No configuration for Update Frequency not found, generating default..."); logger.log(Level.INFO, "No configuration for Update Frequency found, generating default...");
KeywordSearchSettings.setUpdateFrequency(UpdateFrequency.AVG); KeywordSearchSettings.setUpdateFrequency(UpdateFrequency.AVG);
} }
//setting default Extract UTF8 //setting default Extract UTF8
if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_OPTIONS, AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString())){ if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_OPTIONS, AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString())){
logger.log(Level.INFO, "No configuration for UTF8 not found, generating default..."); logger.log(Level.INFO, "No configuration for UTF8 found, generating default...");
KeywordSearchSettings.setStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString(), Boolean.TRUE.toString()); KeywordSearchSettings.setStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString(), Boolean.TRUE.toString());
} }
//setting default Extract UTF16 //setting default Extract UTF16
if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_OPTIONS, AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString())){ if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_OPTIONS, AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString())){
logger.log(Level.INFO, "No configuration for UTF16 not found, generating defaults..."); logger.log(Level.INFO, "No configuration for UTF16 found, generating defaults...");
KeywordSearchSettings.setStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString(), Boolean.TRUE.toString()); KeywordSearchSettings.setStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString(), Boolean.TRUE.toString());
} }
//setting default Latin-1 Script //setting default Latin-1 Script
if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_SCRIPTS, SCRIPT.LATIN_1.name())){ if(!ModuleSettings.settingExists(KeywordSearchSettings.PROPERTIES_SCRIPTS, SCRIPT.LATIN_1.name())){
logger.log(Level.INFO, "No configuration for Scripts not found, generating defaults..."); logger.log(Level.INFO, "No configuration for Scripts found, generating defaults...");
ModuleSettings.setConfigSetting(KeywordSearchSettings.PROPERTIES_SCRIPTS, SCRIPT.LATIN_1.name(), Boolean.toString(true)); ModuleSettings.setConfigSetting(KeywordSearchSettings.PROPERTIES_SCRIPTS, SCRIPT.LATIN_1.name(), Boolean.toString(true));
} }
} }

View File

@ -32,7 +32,7 @@ limitations under the License.
<p> <p>
To see keyword search results in real-time while ingest is running, add keyword lists using the To see keyword search results in real-time while ingest is running, add keyword lists using the
<a href="nbdocs:/org/sleuthkit/autopsy/keywordsearch/docs/keywordsearch-configuration.html">Keyword Search Configuration Dialog</a> <a href="nbdocs:/org/sleuthkit/autopsy/keywordsearch/docs/keywordsearch-configuration.html">Keyword Search Configuration Dialog</a>
and select the "Use during triage / ingest" check box. See <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">(Ingest)</a> and select the "Use during ingest" check box. See <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">(Ingest)</a>
for more information on refresh speeds and ingest in general. for more information on refresh speeds and ingest in general.
</p> </p>
<p> <p>

View File

@ -25,10 +25,15 @@ limitations under the License.
<body> <body>
<h2>Keyword Search Configuration Dialog</h2> <h2>Keyword Search Configuration Dialog</h2>
<p> <p>
The keyword search configuration dialog is used to add, remove, and modify keyword search lists. The keyword search configuration dialog has three tabs, each with it's own purpose:<br/>
<ul>
<li>The Lists tab is used to add, remove, and modify keyword search lists.</li>
<li>The String Extraction tab is used to enable language scripts and extraction type.</li>
<li>The General tab is used to configure the ingest timings and display information.</li>
</ul>
</p> </p>
<p> <p>
To begin, select the 'New List' button and choose a name for the new Keyword List. To create a list, select the 'New List' button and choose a name for the new Keyword List.
Once the list has been created, keywords can be added to it. Regular expressions are supported using Once the list has been created, keywords can be added to it. Regular expressions are supported using
<a href="http://docs.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html">Java Regex Syntax</a>. <a href="http://docs.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html">Java Regex Syntax</a>.
Lists can be added to the keyword search ingest process; searches will happen at regular intervals as content is added to the index. Lists can be added to the keyword search ingest process; searches will happen at regular intervals as content is added to the index.
@ -44,6 +49,11 @@ limitations under the License.
The hash database ingest service can be configured to use the NIST NSRL hash database of known files. The hash database ingest service can be configured to use the NIST NSRL hash database of known files.
The keyword search configuration dialog contains an option to skip keyword indexing and search on files found in the NSRL. The keyword search configuration dialog contains an option to skip keyword indexing and search on files found in the NSRL.
</p> </p>
<img src="keywordsearch-configuration.png" alt="Keyword Search Configuration Dialog" /> <strong>Lists tab:</strong><br>
<img src="keywordsearch-configuration.png" alt="Keyword Search Configuration Dialog" /><br><br>
<strong>String Extraction tab:</strong><br>
<img src="keywordsearch-string.png" alt="Keyword Search Configuration Dialog String Extraction" /><br><br>
<strong>General tab:</strong><br>
<img src="keywordsearch-general.png" alt="Keyword Search Configuration Dialog General" /><br><br>
</body> </body>
</html> </html>

Binary file not shown.

Before

Width:  |  Height:  |  Size: 52 KiB

After

Width:  |  Height:  |  Size: 68 KiB

View File

@ -4,13 +4,22 @@
\section mod_dev_setup Basic Setup \section mod_dev_setup Basic Setup
\subsection mod_dev_setup_java The Java Enviroment
Currently, to develop modules for Autopsy, you must be using Java 1.6.
If you have the Autopsy source code open in NetBeans, you can verify the Autopsy project is running with Java 1.6 by right clicking the project, choosing Properties, and checking that under Libraries the Java Platform is JDK 1.6 and under Sources the Source Level is 1.6.
\subsection mod_dev_setup_autopsy Autopsy as a Development Enviroment
To setup a module development environment for Autopsy, you must have either: To setup a module development environment for Autopsy, you must have either:
\li Autopsy installed on your machine \li Autopsy installed on your machine
\li The Autopsy source code, downloaded from GitHub \li The Autopsy source code, downloaded from GitHub
If you have Autopsy installed on your machine and would like to use that as your development environment, proceed to \ref mod_dev_module. Note that older versions of Autopsy may not have the latest features available for module development. If you have Autopsy installed on your machine and would like to use that as your development environment, proceed to \ref mod_dev_module. Note that older versions of Autopsy may not have the latest features available for module development.
To use the latest Autopsy source code as your development environment, first follow BUILDING.TXT to properly build and setup Autopsy in NetBeans. To use the latest Autopsy source code as your development environment, first follow BUILDING.TXT to properly build and setup Autopsy in NetBeans. Make sure you are using Java 1.6.
Once Autopsy has been successfully built, right click on the Autopsy project in NetBeans and select Package as > ZIP Distribution. Then extract the ZIP file to any directory of your choosing. Once Autopsy has been successfully built, right click on the Autopsy project in NetBeans and select Package as > ZIP Distribution. Then extract the ZIP file to any directory of your choosing.
@ -30,6 +39,8 @@ Autopsy has now been added as a "NetBeans Platform", meaning the development env
Click Next, and fill out the rest of the module-creation wizard. Press Finish when complete, and the module will be added as a standalone project in NetBeans. Click Next, and fill out the rest of the module-creation wizard. Press Finish when complete, and the module will be added as a standalone project in NetBeans.
After the module is created, it is important to verify the new project is using Java 1.6. Any other version of Java may have unforeseen consequences. To check the version of Java, right click on the module in the Projects window and go to Properties. Make sure that under the Libraries category the Java Platform is JDK 1.6, and under Sources the Source Level is 1.6.
See \ref mod_ingest_page for instructions on programming ingest modules for Autopsy. See \ref mod_ingest_page for instructions on programming ingest modules for Autopsy.
Or read <a href="http://bits.netbeans.org/dev/javadoc/org-openide-modules/org/openide/modules/doc-files/api.html">this guide from NetBeans.org</a> for general module development tips. Or read <a href="http://bits.netbeans.org/dev/javadoc/org-openide-modules/org/openide/modules/doc-files/api.html">this guide from NetBeans.org</a> for general module development tips.