mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge develop branch into collaborative branch

Browse Source
This commit is contained in:
Richard Cordovano 2015-07-13 16:43:28 -04:00
commit b4ee3471eb
43 changed files with 399 additions and 239 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
BUILDING.txt
View File

@ -11,9 +11,10 @@ correct C libraries.
STEPS:
1) Get Java Setup
1a) Download and install JDK version 1.8. You can now use 32-bit or 64-bit, but
special work is needed to get The Sleuth Kit to compile as 64-bit. So, 32-bit
is easier, but if you intend to use PostgreSQL, choose 64-bit.
1a) Download and install JDK version 1.8. For the current version of JavaFX
that we use, you'll need 1.8.0_40 or greater. You can now use 32-bit or 64-bit,
but special work is needed to get The Sleuth Kit to compile as 64-bit. So,
32-bit is easier, but if you intend to use PostgreSQL, choose 64-bit.
Autopsy has been used and tested with Oracle JavaSE and the included JavaFX support
(http://www.oracle.com/technetwork/java/javase/downloads/index.html).

2
Core/manifest.mf
View File

@ -2,7 +2,7 @@ Manifest-Version: 1.0
OpenIDE-Module: org.sleuthkit.autopsy.core/10
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/core/Bundle.properties
OpenIDE-Module-Layer: org/sleuthkit/autopsy/core/layer.xml
OpenIDE-Module-Implementation-Version: 13
OpenIDE-Module-Implementation-Version: 14
OpenIDE-Module-Requires: org.openide.windows.WindowManager
AutoUpdate-Show-In-Client: true
AutoUpdate-Essential-Module: true

2
Core/nbproject/project.properties
View File

@ -18,5 +18,5 @@ license.file=../LICENSE-2.0.txt
nbm.homepage=http://www.sleuthkit.org/
nbm.module.author=Brian Carrier
nbm.needs.restart=true
spec.version.base=10.2
spec.version.base=10.3

4
Core/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties
View File

@ -181,3 +181,7 @@ AutopsyOptionsPanel.jCheckBoxEnableProcTimeout.text=
AutopsyOptionsPanel.jFormattedTextFieldProcTimeOutHrs.text=60
AutopsyOptionsPanel.jLabelProcessTimeOutUnits.text=hour(s)
AutopsyOptionsPanel.jLabelSetProcessTimeOut.text=Enable timeout to allow modules to automatically terminate after a set amount of time:
DataContentViewerHex.goToOffsetLabel.text=Jump to Offset
DataContentViewerHex.goToOffsetTextField.text=
DataContentViewerHex.goToOffsetTextField.msgDlg=Invalid Offset: {0}
DataContentViewerHex.setDataView.invalidOffset.negativeOffsetValue=Cannot jump to the resultant offset

0
Core/src/org/sleuthkit/autopsy/corecomponents/Bundle_ja.properties Normal file → Executable file
View File

36
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerHex.form
View File

@ -88,9 +88,13 @@
<Component id="goToPageLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="goToPageTextField" min="-2" pref="79" max="-2" attributes="0"/>
<EmptySpace pref="205" max="32767" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/>
<Component id="goToOffsetLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="goToOffsetTextField" min="-2" pref="79" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
</Group>
<Component id="jScrollPane1" alignment="0" pref="622" max="32767" attributes="0"/>
<Component id="jScrollPane1" alignment="0" max="32767" attributes="0"/>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
@ -108,9 +112,11 @@
<Component id="prevPageButton" alignment="0" min="-2" pref="23" max="-2" attributes="0"/>
<Component id="goToPageLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="goToPageTextField" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="goToOffsetLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="goToOffsetTextField" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="-2" pref="0" max="-2" attributes="0"/>
<Component id="jScrollPane1" pref="388" max="32767" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="jScrollPane1" pref="382" max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
@ -131,6 +137,9 @@
<Property name="font" type="java.awt.Font" editor="org.netbeans.beaninfo.editors.FontEditor">
<Font name="Courier New" size="11" style="0"/>
</Property>
<Property name="cursor" type="java.awt.Cursor" editor="org.netbeans.modules.form.editors2.CursorEditor">
<Color id="Default Cursor"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[700, 20]"/>
</Property>
@ -140,7 +149,7 @@
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_CreateCodeCustom" type="java.lang.String" value="new JTextPane(){&#xd; public boolean getScrollableTracksViewportWidth() {&#xd; return (getSize().width &lt; 400);&#xd; }};"/>
<AuxValue name="JavaCodeGenerator_CreateCodePost" type="java.lang.String" value="this.outputViewPane.setBackground(new java.awt.Color(255, 255, 255)); // to make sure the background color is white"/>
<AuxValue name="JavaCodeGenerator_CreateCodePost" type="java.lang.String" value="this.outputViewPane.setBackground(new java.awt.Color(255, 255, 255)); // to make sure the background color is white&#xd;&#xa;this.outputViewPane.requestFocusInWindow();&#xd;&#xa;this.outputViewPane.setCursor(Cursor.getDefaultCursor());&#xd;&#xa;"/>
</AuxValues>
</Component>
</SubComponents>
@ -278,6 +287,23 @@
</Property>
</Properties>
</Component>
<Component class="javax.swing.JLabel" name="goToOffsetLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/corecomponents/Bundle.properties" key="DataContentViewerHex.goToOffsetLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JTextField" name="goToOffsetTextField">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/corecomponents/Bundle.properties" key="DataContentViewerHex.goToOffsetTextField.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="goToOffsetTextFieldActionPerformed"/>
</Events>
</Component>
</SubComponents>
</Container>
</SubComponents>

149
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerHex.java
View File

@ -28,6 +28,8 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import javax.swing.JMenuItem;
import javax.swing.JOptionPane;
import javax.swing.JTextPane;
import javax.swing.text.BadLocationException;
import javax.swing.text.Utilities;
import org.openide.nodes.Node;
import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
@ -94,6 +96,8 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
return (getSize().width < 400);
}};
this.outputViewPane.setBackground(new java.awt.Color(255, 255, 255)); // to make sure the background color is white
this.outputViewPane.requestFocusInWindow();
this.outputViewPane.setCursor(Cursor.getDefaultCursor());
totalPageLabel = new javax.swing.JLabel();
ofLabel = new javax.swing.JLabel();
currentPageLabel = new javax.swing.JLabel();
@ -103,6 +107,8 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
pageLabel2 = new javax.swing.JLabel();
goToPageTextField = new javax.swing.JTextField();
goToPageLabel = new javax.swing.JLabel();
goToOffsetLabel = new javax.swing.JLabel();
goToOffsetTextField = new javax.swing.JTextField();
copyMenuItem.setText(org.openide.util.NbBundle.getMessage(DataContentViewerHex.class, "DataContentViewerHex.copyMenuItem.text")); // NOI18N
rightClickMenu.add(copyMenuItem);
@ -113,7 +119,8 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
jScrollPane1.setBackground(new java.awt.Color(255, 255, 255));
outputViewPane.setEditable(false);
outputViewPane.setFont(new Font("Courier New", Font.PLAIN, 11)); // NOI18N NON-NLS
outputViewPane.setFont(new java.awt.Font("Courier New", 0, 11)); // NOI18N
outputViewPane.setCursor(new java.awt.Cursor(java.awt.Cursor.DEFAULT_CURSOR));
outputViewPane.setMinimumSize(new java.awt.Dimension(700, 20));
outputViewPane.setPreferredSize(new java.awt.Dimension(700, 400));
jScrollPane1.setViewportView(outputViewPane);
@ -132,28 +139,28 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
pageLabel.setMinimumSize(new java.awt.Dimension(33, 14));
pageLabel.setPreferredSize(new java.awt.Dimension(33, 14));
prevPageButton.setIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_back.png"))); // NOI18N NON-NLS
prevPageButton.setIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_back.png"))); // NOI18N
prevPageButton.setText(org.openide.util.NbBundle.getMessage(DataContentViewerHex.class, "DataContentViewerHex.prevPageButton.text")); // NOI18N
prevPageButton.setBorderPainted(false);
prevPageButton.setContentAreaFilled(false);
prevPageButton.setDisabledIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_back_disabled.png"))); // NOI18N NON-NLS
prevPageButton.setDisabledIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_back_disabled.png"))); // NOI18N
prevPageButton.setMargin(new java.awt.Insets(2, 0, 2, 0));
prevPageButton.setPreferredSize(new java.awt.Dimension(23, 23));
prevPageButton.setRolloverIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_back_hover.png"))); // NOI18N NON-NLS
prevPageButton.setRolloverIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_back_hover.png"))); // NOI18N
prevPageButton.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
prevPageButtonActionPerformed(evt);
}
});
nextPageButton.setIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_forward.png"))); // NOI18N NON-NLS
nextPageButton.setIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_forward.png"))); // NOI18N
nextPageButton.setText(org.openide.util.NbBundle.getMessage(DataContentViewerHex.class, "DataContentViewerHex.nextPageButton.text")); // NOI18N
nextPageButton.setBorderPainted(false);
nextPageButton.setContentAreaFilled(false);
nextPageButton.setDisabledIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_forward_disabled.png"))); // NOI18N NON-NLS
nextPageButton.setDisabledIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_forward_disabled.png"))); // NOI18N
nextPageButton.setMargin(new java.awt.Insets(2, 0, 2, 0));
nextPageButton.setPreferredSize(new java.awt.Dimension(23, 23));
nextPageButton.setRolloverIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_forward_hover.png"))); // NOI18N NON-NLS
nextPageButton.setRolloverIcon(new javax.swing.ImageIcon(getClass().getResource("/org/sleuthkit/autopsy/corecomponents/btn_step_forward_hover.png"))); // NOI18N
nextPageButton.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
nextPageButtonActionPerformed(evt);
@ -174,6 +181,15 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
goToPageLabel.setText(org.openide.util.NbBundle.getMessage(DataContentViewerHex.class, "DataContentViewerHex.goToPageLabel.text")); // NOI18N
goToOffsetLabel.setText(org.openide.util.NbBundle.getMessage(DataContentViewerHex.class, "DataContentViewerHex.goToOffsetLabel.text")); // NOI18N
goToOffsetTextField.setText(org.openide.util.NbBundle.getMessage(DataContentViewerHex.class, "DataContentViewerHex.goToOffsetTextField.text")); // NOI18N
goToOffsetTextField.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
goToOffsetTextFieldActionPerformed(evt);
}
});
javax.swing.GroupLayout hexViewerPanelLayout = new javax.swing.GroupLayout(hexViewerPanel);
hexViewerPanel.setLayout(hexViewerPanelLayout);
hexViewerPanelLayout.setHorizontalGroup(
@ -197,8 +213,12 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
.addComponent(goToPageLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(goToPageTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 79, javax.swing.GroupLayout.PREFERRED_SIZE)
.addContainerGap(205, Short.MAX_VALUE))
.addComponent(jScrollPane1, javax.swing.GroupLayout.DEFAULT_SIZE, 622, Short.MAX_VALUE)
.addGap(18, 18, 18)
.addComponent(goToOffsetLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(goToOffsetTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 79, javax.swing.GroupLayout.PREFERRED_SIZE)
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addComponent(jScrollPane1)
);
hexViewerPanelLayout.setVerticalGroup(
hexViewerPanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@ -213,9 +233,11 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
.addComponent(nextPageButton, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(prevPageButton, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(goToPageLabel)
.addComponent(goToPageTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGap(0, 0, 0)
.addComponent(jScrollPane1, javax.swing.GroupLayout.DEFAULT_SIZE, 388, Short.MAX_VALUE))
.addComponent(goToPageTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
.addComponent(goToOffsetLabel)
.addComponent(goToOffsetTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(jScrollPane1, javax.swing.GroupLayout.DEFAULT_SIZE, 382, Short.MAX_VALUE))
);
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
@ -241,11 +263,13 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
}// </editor-fold>//GEN-END:initComponents
private void prevPageButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_prevPageButtonActionPerformed
setDataView(currentPage - 1);
setDataViewByPageNumber(currentPage - 1);
goToPageTextField.setText(Integer.toString(currentPage));
}//GEN-LAST:event_prevPageButtonActionPerformed
private void nextPageButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_nextPageButtonActionPerformed
setDataView(currentPage + 1);
setDataViewByPageNumber(currentPage + 1);
goToPageTextField.setText(Integer.toString(currentPage));
}//GEN-LAST:event_nextPageButtonActionPerformed
private void goToPageTextFieldActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_goToPageTextFieldActionPerformed
@ -267,11 +291,59 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
JOptionPane.WARNING_MESSAGE);
return;
}
setDataView(pageNumber);
setDataViewByPageNumber(pageNumber);
}//GEN-LAST:event_goToPageTextFieldActionPerformed
/***
* Calculates the offset relative to the current caret position.
* @param userInput the user provided signed offset value.
* @return returns the resultant offset value relative to the current caret
* position. -1L is returned if the resultant offset cannot be calculated.
*/
private long getOffsetRelativeToCaretPosition(Long userInput) {
String userSelectedLine;
try {
// get the selected line. Extract the current hex offset location.
userSelectedLine = outputViewPane.getText().subSequence(
Utilities.getRowStart(outputViewPane, outputViewPane.getCaretPosition()),
Utilities.getRowEnd(outputViewPane, outputViewPane.getCaretPosition()))
.toString();
// NOTE: This needs to change if the outputFormat of outputViewPane changes.
String hexForUserSelectedLine = userSelectedLine.substring(0, userSelectedLine.indexOf(":"));
return Long.decode(hexForUserSelectedLine) + userInput;
} catch (BadLocationException | StringIndexOutOfBoundsException | NumberFormatException ex) {
// thrown in case the caret location is out of the range of the outputViewPane.
return -1L;
}
}
private void goToOffsetTextFieldActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_goToOffsetTextFieldActionPerformed
long offset;
try {
if (goToOffsetTextField.getText().startsWith("+") || goToOffsetTextField.getText().startsWith("-")) {
offset = getOffsetRelativeToCaretPosition(Long.decode(goToOffsetTextField.getText()));
} else {
offset = Long.decode(goToOffsetTextField.getText());
}
} catch (NumberFormatException ex) {
// notify the user and return
JOptionPane.showMessageDialog(this, NbBundle.getMessage(this.getClass(), "DataContentViewerHex.goToOffsetTextField.msgDlg", goToOffsetTextField.getText()));
return;
}
if (offset >= 0) {
setDataViewByOffset(offset);
} else {
outputViewPane.setText(NbBundle.getMessage(DataContentViewerHex.class, "DataContentViewerHex.setDataView.invalidOffset.negativeOffsetValue"));
}
}//GEN-LAST:event_goToOffsetTextFieldActionPerformed
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JMenuItem copyMenuItem;
private javax.swing.JLabel currentPageLabel;
private javax.swing.JLabel goToOffsetLabel;
private javax.swing.JTextField goToOffsetTextField;
private javax.swing.JLabel goToPageLabel;
private javax.swing.JTextField goToPageTextField;
private javax.swing.JPanel hexViewerPanel;
@ -289,26 +361,41 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
/**
* Sets the DataView (The tabbed panel)
* Sets the DataView (The tabbed panel) by page number
*
* @param page Page to display (1-based counting)
*/
private void setDataView(int page) {
private void setDataViewByPageNumber(int page) {
if (this.dataSource == null) {
return;
}
if (page == 0) {
return;
}
currentPage = page;
long offset = (currentPage - 1) * pageLength;
setDataView(offset);
goToOffsetTextField.setText(Long.toString(offset));
}
/**
* Sets the DataView (The tabbed panel) by offset
*
* @param page Page to display (1-based counting)
*/
private void setDataViewByOffset(long offset) {
if (this.dataSource == null) {
return;
}
currentPage = (int) (offset / pageLength) + 1;
setDataView(offset);
goToPageTextField.setText(Integer.toString(currentPage));
}
private void setDataView(long offset) {
// change the cursor to "waiting cursor" for this operation
this.setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
String errorText = null;
String errorText = null;
int bytesRead = 0;
if (dataSource.getSize() > 0) {
@ -316,7 +403,7 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
bytesRead = dataSource.read(data, offset, pageLength); // read the data
} catch (TskException ex) {
errorText = NbBundle.getMessage(this.getClass(), "DataContentViewerHex.setDataView.errorText", offset,
offset + pageLength);
offset + pageLength);
logger.log(Level.WARNING, "Error while trying to show the hex content.", ex); //NON-NLS
}
}
@ -324,25 +411,22 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
// set the data on the bottom and show it
if (bytesRead <= 0) {
errorText = NbBundle.getMessage(this.getClass(), "DataContentViewerHex.setDataView.errorText", offset,
offset + pageLength);
offset + pageLength);
}
// disable or enable the next button
if ((errorText == null) && (currentPage < totalPages)) {
nextPageButton.setEnabled(true);
}
else {
} else {
nextPageButton.setEnabled(false);
}
if ((errorText == null) && (currentPage > 1)) {
prevPageButton.setEnabled(true);
}
else {
} else {
prevPageButton.setEnabled(false);
}
currentPageLabel.setText(Integer.toString(currentPage));
setComponentsVisibility(true); // shows the components that not needed
@ -350,8 +434,7 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
if (errorText == null) {
int showLength = bytesRead < pageLength ? bytesRead : (int) pageLength;
outputViewPane.setText(DataConversion.byteArrayToHex(data, showLength, offset));
}
else {
} else {
outputViewPane.setText(errorText);
}
@ -379,7 +462,7 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
}
totalPageLabel.setText(Integer.toString(totalPages));
this.setDataView(1);
this.setDataViewByPageNumber(1);
}
@Override
@ -423,6 +506,8 @@ public class DataContentViewerHex extends javax.swing.JPanel implements DataCont
pageLabel2.setVisible(isVisible);
goToPageTextField.setVisible(isVisible);
goToPageLabel.setVisible(isVisible);
goToOffsetTextField.setVisible(isVisible);
goToOffsetLabel.setVisible(isVisible);
}
@Override

9
Core/src/org/sleuthkit/autopsy/datamodel/DeletedContent.java
View File

@ -112,6 +112,7 @@ public class DeletedContent implements AutopsyVisitableItem {
private static final String NAME = NbBundle.getMessage(DeletedContent.class,
"DeletedContent.deletedContentsNode.name");
private SleuthkitCase skCase;
DeletedContentsNode(SleuthkitCase skCase) {
super(Children.create(new DeletedContentsChildren(skCase), true), Lookups.singleton(NAME));
@ -152,7 +153,8 @@ public class DeletedContent implements AutopsyVisitableItem {
private SleuthkitCase skCase;
private Observable notifier;
private static boolean maxFilesDialogShown = false;
// true if we have already told user that not all files will be shown
private static boolean maxFilesDialogShown = false;
public DeletedContentsChildren(SleuthkitCase skCase) {
this.skCase = skCase;
@ -362,9 +364,8 @@ public class DeletedContent implements AutopsyVisitableItem {
protected boolean createKeys(List<AbstractFile> list) {
List<AbstractFile> queryList = runFsQuery();
if (queryList.size() == MAX_OBJECTS) {
queryList.remove(queryList.size() - 1);
// only show the dialog once
queryList.remove(queryList.size() - 1);
// only show the dialog once - not each time we refresh
if (maxFilesDialogShown == false) {
maxFilesDialogShown = true;
SwingUtilities.invokeLater(new Runnable() {

4
Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/Bundle.properties
View File

@ -17,9 +17,9 @@ EmbeddedFileExtractorIngestModule.ArchiveExtractor.init.errInitModule.msg=Error
EmbeddedFileExtractorIngestModule.ArchiveExtractor.init.errInitModule.details=Error initializing output dir\: {0}\: {1}
EmbeddedFileExtractorIngestModule.ArchiveExtractor.init.errCantInitLib=Could not initialize 7-ZIP library\: {0}
EmbeddedFileExtractorIngestModule.ArchiveExtractor.isZipBombCheck.warnMsg=Possible ZIP bomb detected in archive\: {0}, item\: {1}
EmbeddedFileExtractorIngestModule.ArchiveExtractor.isZipBombCheck.warnDetails=The archive item compression ratio is {0}, skipping processing of this archive item.
EmbeddedFileExtractorIngestModule.ArchiveExtractor.isZipBombCheck.warnDetails=Compression ratio is {0}, skipping item in {1}.
EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.warnMsg.zipBomb=Possible ZIP bomb detected\: {0}
EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.warnDetails.zipBomb=The archive is {0} levels deep, skipping processing of this archive and its contents
EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.warnDetails.zipBomb=The archive is {0} levels deep, skipping processing of {1}
EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.unknownPath.msg=Unknown item path in archive\: {0}, will use\: {1}
EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.notEnoughDiskSpace.msg=Not enough disk space to unpack archive item\: {0}, {1}
EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.notEnoughDiskSpace.details=The archive item is too large to unpack, skipping unpacking this item.

58
Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/Bundle_ja.properties
View File

@ -1,31 +1,31 @@
OpenIDE-Module-Display-Category=\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u30E2\u30B8\u30E5\u30FC\u30EB
OpenIDE-Module-Display-Category=\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u30e2\u30b8\u30e5\u30fc\u30eb
OpenIDE-Module-Long-Description=\
7Zip\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u30E2\u30B8\u30E5\u30FC\u30EB\n\n7Zip\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u30E2\u30B8\u30E5\u30FC\u30EB\u306F\u30A2\u30FC\u30AB\u30A4\u30D6\u30D5\u30A1\u30A4\u30EB\u3092\u51E6\u7406\u3057\u307E\u3059\uFF08zip\u30847zip\u30A8\u30AF\u30B9\u30C8\u30E9\u30AF\u30BF\u30FC\u306B\u30B5\u30DD\u30FC\u30C8\u3055\u308C\u3066\u3044\u308B\u305D\u306E\u4ED6\u306E\u30A2\u30FC\u30AB\u30A4\u30D6\u30BF\u30A4\u30D7\u306A\u3069\uFF09\u3002\n\
\u30A2\u30FC\u30AB\u30A4\u30D6\u306E\u30B3\u30F3\u30C6\u30F3\u30C4\u306F\u62BD\u51FA\u3055\u308C\u3001\u6D3E\u751F\u30D5\u30A1\u30A4\u30EB\u306F\u8A2D\u5B9A\u3055\u308C\u305F\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u30E2\u30B8\u30E5\u30FC\u30EB\u306B\u51E6\u7406\u3055\u308C\u308B\u305F\u3081\u3001\u73FE\u5728\u306E\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u306B\u8FFD\u52A0\u3055\u308C\u307E\u3059\u3002\n\
\u3082\u3057\u6D3E\u751F\u30D5\u30A1\u30A4\u30EB\u304C\u30A2\u30FC\u30AB\u30A4\u30D6\u30D5\u30A1\u30A4\u30EB\u3067\u3042\u308C\u3070\u30017Zip\u30A8\u30AF\u30B9\u30C8\u30E9\u30AF\u30BF\u30FC\u306B\u3088\u308A\u3001\u518D\u5EA6\u51E6\u7406\u3055\u308C\u307E\u3059 - \u30A8\u30AF\u30B9\u30C8\u30E9\u30AF\u30BF\u30FC\u306F\u30A2\u30FC\u30AB\u30A4\u30D6\u30D5\u30A1\u30A4\u30EB\u3092N-\u30EC\u30D9\u30EB\u306E\u6DF1\u3055\u3067\u51E6\u7406\u3057\u307E\u3059\u3002\n\n\
\u62BD\u51FA\u3055\u308C\u305F\u30D5\u30A1\u30A4\u30EB\u306F\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30C4\u30EA\u30FC\u3067\u30CA\u30D3\u30B2\u30FC\u30C8\u3067\u304D\u307E\u3059\u3002\n\n\
\u3053\u306E\u30E2\u30B8\u30E5\u30FC\u30EB\u306FWindows\u3001Linux\u3001Mac\u306E\u30AA\u30DA\u30EC\u30FC\u30C6\u30A3\u30F3\u30B0\u30B7\u30B9\u30C6\u30E0\u74B0\u5883\u3092\u30B5\u30DD\u30FC\u30C8\u3057\u3066\u3044\u307E\u3059\u3002
7Zip\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u30e2\u30b8\u30e5\u30fc\u30eb\n\n7Zip\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u30a2\u30fc\u30ab\u30a4\u30d6\u30d5\u30a1\u30a4\u30eb\u3092\u51e6\u7406\u3057\u307e\u3059\uff08zip\u30847zip\u30a8\u30af\u30b9\u30c8\u30e9\u30af\u30bf\u30fc\u306b\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u305d\u306e\u4ed6\u306e\u30a2\u30fc\u30ab\u30a4\u30d6\u30bf\u30a4\u30d7\u306a\u3069\uff09\u3002\n\
\u30a2\u30fc\u30ab\u30a4\u30d6\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u306f\u62bd\u51fa\u3055\u308c\u3001\u6d3e\u751f\u30d5\u30a1\u30a4\u30eb\u306f\u8a2d\u5b9a\u3055\u308c\u305f\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u30e2\u30b8\u30e5\u30fc\u30eb\u306b\u51e6\u7406\u3055\u308c\u308b\u305f\u3081\u3001\u73fe\u5728\u306e\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u306b\u8ffd\u52a0\u3055\u308c\u307e\u3059\u3002\n\
\u3082\u3057\u6d3e\u751f\u30d5\u30a1\u30a4\u30eb\u304c\u30a2\u30fc\u30ab\u30a4\u30d6\u30d5\u30a1\u30a4\u30eb\u3067\u3042\u308c\u3070\u30017Zip\u30a8\u30af\u30b9\u30c8\u30e9\u30af\u30bf\u30fc\u306b\u3088\u308a\u3001\u518d\u5ea6\u51e6\u7406\u3055\u308c\u307e\u3059 - \u30a8\u30af\u30b9\u30c8\u30e9\u30af\u30bf\u30fc\u306f\u30a2\u30fc\u30ab\u30a4\u30d6\u30d5\u30a1\u30a4\u30eb\u3092N-\u30ec\u30d9\u30eb\u306e\u6df1\u3055\u3067\u51e6\u7406\u3057\u307e\u3059\u3002\n\n\
\u62bd\u51fa\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c4\u30ea\u30fc\u3067\u30ca\u30d3\u30b2\u30fc\u30c8\u3067\u304d\u307e\u3059\u3002\n\n\
\u3053\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306fWindows\u3001Linux\u3001Mac\u306e\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u74b0\u5883\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002
OpenIDE-Module-Name=7Zip
OpenIDE-Module-Short-Description=7Zip\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u30E2\u30B8\u30E5\u30FC\u30EB
SevenZipContentReadStream.seek.exception.invalidOrigin=\u7121\u52B9\u306A\u30B7\u30FC\u30AF\u30AA\u30EA\u30B8\u30F3\uFF1A {0}
SevenZipContentReadStream.read.exception.errReadStream=\u30B3\u30F3\u30C6\u30F3\u30C4\u30B9\u30C8\u30EA\u30FC\u30E0\u306E\u8AAD\u307F\u53D6\u308A\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F\u3002
SevenZipIngestModule.moduleName=\u30A2\u30FC\u30AB\u30A4\u30D6\u30A8\u30AF\u30B9\u30C8\u30E9\u30AF\u30BF\u30FC
SevenZipIngestModule.moduleDesc.text=\u30A2\u30FC\u30AB\u30A4\u30D6\u30D5\u30A1\u30A4\u30EB(zip, rar, arj, 7z, gzip, bzip2, tar)\u3092\u62BD\u51FA\u3057\u3001\u73FE\u5728\u306E\u30A4\u30F3\u30B8\u30A7\u30B9\u30C8\u306B\u30EA\u30B9\u30B1\u3057\u3001\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30C4\u30EA\u30FC\u306B\u65B0\u898F\u30D5\u30A1\u30A4\u30EB\u3092\u6295\u5165\u3057\u307E\u3059\u3002
SevenZipIngestModule.encryptionFileLevel=\u30D5\u30A1\u30A4\u30EB\u30EC\u30D9\u30EB\u6697\u53F7\u5316
SevenZipIngestModule.encryptionFull=\u5168\u4F53\u6697\u53F7\u5316
SevenZipIngestModule.init.errInitModule.msg={0}\u306E\u521D\u671F\u5316\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F
SevenZipIngestModule.init.errInitModule.details=\u30A2\u30A6\u30C8\u30D7\u30C3\u30C8\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\: {0}\: {1}\u306E\u521D\u671F\u5316\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F
SevenZipIngestModule.init.errCantInitLib=7-Zip\u30E9\u30A4\u30D6\u30E9\u30EA\: {0}\u3092\u521D\u671F\u5316\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F
SevenZipIngestModule.isZipBombCheck.warnMsg=Zip\u7206\u5F3E\u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u3082\u306E\u304C\u30A2\u30FC\u30AB\u30A4\u30D6\: {0}, item\: {1}\u306B\u691C\u51FA\u3055\u308C\u307E\u3057\u305F
SevenZipIngestModule.isZipBombCheck.warnDetails=\u30A2\u30FC\u30AB\u30A4\u30D6\u30A2\u30A4\u30C6\u30E0\u306E\u5727\u7E2E\u7387\u306F{0}\u3001\u3053\u306E\u30A2\u30FC\u30AB\u30A4\u30D6\u30A2\u30A4\u30C6\u30E0\u306E\u51E6\u7406\u3092\u30B9\u30AD\u30C3\u30D7\u3057\u307E\u3059\u3002
SevenZipIngestModule.unpack.warnMsg.zipBomb=Zip\u7206\u5F3E\u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u3082\u306E\u304C\u691C\u51FA\u3055\u308C\u307E\u3057\u305F\uFF1A {0}
SevenZipIngestModule.unpack.warnDetails.zipBomb=\u30A2\u30FC\u30AB\u30A4\u30D6\u306F {0}\u30EC\u30D9\u30EB\u306E\u6DF1\u3055\u3067\u3059\u3001\u3053\u306E\u30A2\u30FC\u30AB\u30A4\u30D6\u3068\u305D\u306E\u30B3\u30F3\u30C6\u30F3\u30C4\u306E\u51E6\u7406\u3092\u30B9\u30AD\u30C3\u30D7\u3057\u307E\u3059
SevenZipIngestModule.unpack.unknownPath.msg=\u30A2\u30FC\u30AB\u30A4\u30D6\: {0}\u306B\u4E0D\u660E\u306E\u30A2\u30A4\u30C6\u30E0\u30D1\u30B9\u304C\u5B58\u5728\u3057\u307E\u3059\u3001{1}\u3092\u4F7F\u7528\u3057\u307E\u3059
SevenZipIngestModule.unpack.notEnoughDiskSpace.msg=\u30A2\u30FC\u30AB\u30A4\u30D6\u30A2\u30A4\u30C6\u30E0\: {0}, {1}\u3092\u89E3\u51CD\u3059\u308B\u306E\u306B\u5341\u5206\u306A\u30C7\u30A3\u30B9\u30AF\u30B9\u30DA\u30FC\u30B9\u304C\u3042\u308A\u307E\u305B\u3093
SevenZipIngestModule.unpack.notEnoughDiskSpace.details=\u30A2\u30FC\u30AB\u30A4\u30D6\u30A2\u30A4\u30C6\u30E0\u306F\u89E3\u51CD\u3059\u308B\u306E\u306B\u5927\u304D\u3059\u304E\u307E\u3059\u3001\u3053\u306E\u30A2\u30A4\u30C6\u30E0\u306E\u89E3\u51CD\u3092\u30B9\u30AD\u30C3\u30D7\u3057\u307E\u3059\u3002
SevenZipIngestModule.unpack.errUnpacking.msg={0}\u89E3\u51CD\u30A8\u30E9\u30FC
SevenZipIngestModule.unpack.errUnpacking.details={0}. {1}\u306E\u89E3\u51CD\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F
SevenZipIngestModule.unpack.encrFileDetected.msg=\u30A2\u30FC\u30AB\u30A4\u30D6\u306B\u6697\u53F7\u5316\u30D5\u30A1\u30A4\u30EB\u304C\u691C\u51FA\u3055\u308C\u307E\u3057\u305F\u3002
SevenZipIngestModule.unpack.encrFileDetected.details=\u30A2\u30FC\u30AB\u30A4\u30D6\: {0}\u306E\u4E00\u90E8\u306E\u30D5\u30A1\u30A4\u30EB\u304C\u6697\u53F7\u5316\u3055\u308C\u3066\u3044\u307E\u3059\u3002{1}\u30A8\u30AF\u30B9\u30C8\u30E9\u30AF\u30BF\u30FC\u306F\u3053\u306E\u30A2\u30FC\u30AB\u30A4\u30D6\u304B\u3089\u5168\u3066\u306E\u30D5\u30A1\u30A4\u30EB\u306F\u62BD\u51FA\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\u3002
SevenZipIngestModule.UnpackStream.write.exception.msg=\u89E3\u51CD\u3057\u305F\u30D5\u30A1\u30A4\u30EB\u306E\u4E0B\u8A18\u3078\u306E\u66F8\u304D\u8FBC\u307F\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F\: {0}
SevenZipIngestModule.UnpackedTree.exception.msg=\u6D3E\u751F\u30D5\u30A1\u30A4\u30EB\u3092\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\:{0}\u306B\u8FFD\u52A0\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F
OpenIDE-Module-Short-Description=7Zip\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u30e2\u30b8\u30e5\u30fc\u30eb
SevenZipContentReadStream.seek.exception.invalidOrigin=\u7121\u52b9\u306a\u30b7\u30fc\u30af\u30aa\u30ea\u30b8\u30f3\uff1a {0}
SevenZipContentReadStream.read.exception.errReadStream=\u30b3\u30f3\u30c6\u30f3\u30c4\u30b9\u30c8\u30ea\u30fc\u30e0\u306e\u8aad\u307f\u53d6\u308a\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002
SevenZipIngestModule.moduleName=\u30a2\u30fc\u30ab\u30a4\u30d6\u30a8\u30af\u30b9\u30c8\u30e9\u30af\u30bf\u30fc
SevenZipIngestModule.moduleDesc.text=\u30a2\u30fc\u30ab\u30a4\u30d6\u30d5\u30a1\u30a4\u30eb(zip, rar, arj, 7z, gzip, bzip2, tar)\u3092\u62bd\u51fa\u3057\u3001\u73fe\u5728\u306e\u30a4\u30f3\u30b8\u30a7\u30b9\u30c8\u306b\u30ea\u30b9\u30b1\u3057\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c4\u30ea\u30fc\u306b\u65b0\u898f\u30d5\u30a1\u30a4\u30eb\u3092\u6295\u5165\u3057\u307e\u3059\u3002
SevenZipIngestModule.encryptionFileLevel=\u30d5\u30a1\u30a4\u30eb\u30ec\u30d9\u30eb\u6697\u53f7\u5316
SevenZipIngestModule.encryptionFull=\u5168\u4f53\u6697\u53f7\u5316
SevenZipIngestModule.init.errInitModule.msg={0}\u306e\u521d\u671f\u5316\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f
SevenZipIngestModule.init.errInitModule.details=\u30a2\u30a6\u30c8\u30d7\u30c3\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\: {0}\: {1}\u306e\u521d\u671f\u5316\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f
SevenZipIngestModule.init.errCantInitLib=7-Zip\u30e9\u30a4\u30d6\u30e9\u30ea\: {0}\u3092\u521d\u671f\u5316\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f
SevenZipIngestModule.isZipBombCheck.warnMsg=Zip\u7206\u5f3e\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3082\u306e\u304c\u30a2\u30fc\u30ab\u30a4\u30d6\: {0}, item\: {1}\u306b\u691c\u51fa\u3055\u308c\u307e\u3057\u305f
SevenZipIngestModule.isZipBombCheck.warnDetails=\u30a2\u30fc\u30ab\u30a4\u30d6\u30a2\u30a4\u30c6\u30e0\u306e\u5727\u7e2e\u7387\u306f{0}\u3001\u3053\u306e\u30a2\u30fc\u30ab\u30a4\u30d6\u30a2\u30a4\u30c6\u30e0\u306e\u51e6\u7406\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u307e\u3059\u3002{1}
SevenZipIngestModule.unpack.warnMsg.zipBomb=Zip\u7206\u5f3e\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3082\u306e\u304c\u691c\u51fa\u3055\u308c\u307e\u3057\u305f\uff1a {0}
SevenZipIngestModule.unpack.warnDetails.zipBomb=\u30a2\u30fc\u30ab\u30a4\u30d6\u306f {0}\u30ec\u30d9\u30eb\u306e\u6df1\u3055\u3067\u3059\u3001\u3053\u306e\u30a2\u30fc\u30ab\u30a4\u30d6\u3068\u305d\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u51e6\u7406\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u307e\u3059 {1}
SevenZipIngestModule.unpack.unknownPath.msg=\u30a2\u30fc\u30ab\u30a4\u30d6\: {0}\u306b\u4e0d\u660e\u306e\u30a2\u30a4\u30c6\u30e0\u30d1\u30b9\u304c\u5b58\u5728\u3057\u307e\u3059\u3001{1}\u3092\u4f7f\u7528\u3057\u307e\u3059
SevenZipIngestModule.unpack.notEnoughDiskSpace.msg=\u30a2\u30fc\u30ab\u30a4\u30d6\u30a2\u30a4\u30c6\u30e0\: {0}, {1}\u3092\u89e3\u51cd\u3059\u308b\u306e\u306b\u5341\u5206\u306a\u30c7\u30a3\u30b9\u30af\u30b9\u30da\u30fc\u30b9\u304c\u3042\u308a\u307e\u305b\u3093
SevenZipIngestModule.unpack.notEnoughDiskSpace.details=\u30a2\u30fc\u30ab\u30a4\u30d6\u30a2\u30a4\u30c6\u30e0\u306f\u89e3\u51cd\u3059\u308b\u306e\u306b\u5927\u304d\u3059\u304e\u307e\u3059\u3001\u3053\u306e\u30a2\u30a4\u30c6\u30e0\u306e\u89e3\u51cd\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u307e\u3059\u3002
SevenZipIngestModule.unpack.errUnpacking.msg={0}\u89e3\u51cd\u30a8\u30e9\u30fc
SevenZipIngestModule.unpack.errUnpacking.details={0}. {1}\u306e\u89e3\u51cd\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f
SevenZipIngestModule.unpack.encrFileDetected.msg=\u30a2\u30fc\u30ab\u30a4\u30d6\u306b\u6697\u53f7\u5316\u30d5\u30a1\u30a4\u30eb\u304c\u691c\u51fa\u3055\u308c\u307e\u3057\u305f\u3002
SevenZipIngestModule.unpack.encrFileDetected.details=\u30a2\u30fc\u30ab\u30a4\u30d6\: {0}\u306e\u4e00\u90e8\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u6697\u53f7\u5316\u3055\u308c\u3066\u3044\u307e\u3059\u3002{1}\u30a8\u30af\u30b9\u30c8\u30e9\u30af\u30bf\u30fc\u306f\u3053\u306e\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u5168\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u62bd\u51fa\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f\u3002
SevenZipIngestModule.UnpackStream.write.exception.msg=\u89e3\u51cd\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u4e0b\u8a18\u3078\u306e\u66f8\u304d\u8fbc\u307f\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\: {0}
SevenZipIngestModule.UnpackedTree.exception.msg=\u6d3e\u751f\u30d5\u30a1\u30a4\u30eb\u3092\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\:{0}\u306b\u8ffd\u52a0\u4e2d\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f

57
Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/SevenZipExtractor.java
View File

@ -40,6 +40,7 @@ import net.sf.sevenzipjbinding.simple.ISimpleInArchive;
import net.sf.sevenzipjbinding.simple.ISimpleInArchiveItem;
import org.netbeans.api.progress.ProgressHandle;
import org.netbeans.api.progress.ProgressHandleFactory;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.services.FileManager;
@ -178,7 +179,7 @@ class SevenZipExtractor {
* @param archiveFileItem the archive item
* @return true if potential zip bomb, false otherwise
*/
private boolean isZipBombArchiveItemCheck(String archiveName, ISimpleInArchiveItem archiveFileItem) {
private boolean isZipBombArchiveItemCheck(AbstractFile archiveFile, ISimpleInArchiveItem archiveFileItem) {
try {
final Long archiveItemSize = archiveFileItem.getSize();
@ -190,19 +191,25 @@ class SevenZipExtractor {
final Long archiveItemPackedSize = archiveFileItem.getPackedSize();
if (archiveItemPackedSize == null || archiveItemPackedSize <= 0) {
logger.log(Level.WARNING, "Cannot getting compression ratio, cannot detect if zipbomb: {0}, item: {1}", new Object[]{archiveName, archiveFileItem.getPath()}); //NON-NLS
logger.log(Level.WARNING, "Cannot getting compression ratio, cannot detect if zipbomb: {0}, item: {1}", new Object[]{archiveFile.getName(), archiveFileItem.getPath()}); //NON-NLS
return false;
}
int cRatio = (int) (archiveItemSize / archiveItemPackedSize);
if (cRatio >= MAX_COMPRESSION_RATIO) {
String itemName = archiveFileItem.getPath();
logger.log(Level.INFO, "Possible zip bomb detected, compression ration: {0} for in archive item: {1}", new Object[]{cRatio, itemName}); //NON-NLS
String msg = NbBundle.getMessage(this.getClass(),
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.isZipBombCheck.warnMsg", archiveName, itemName);
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.isZipBombCheck.warnMsg", archiveFile.getName(), itemName);
String path;
try {
path = archiveFile.getUniquePath();
} catch (TskCoreException ex) {
path = archiveFile.getParentPath() + archiveFile.getName();
}
String details = NbBundle.getMessage(this.getClass(),
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.isZipBombCheck.warnDetails", cRatio);
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.isZipBombCheck.warnDetails", cRatio, path);
//MessageNotifyUtil.Notify.error(msg, details);
services.postMessage(IngestMessage.createWarningMessage(EmbeddedFileExtractorModuleFactory.getModuleName(), msg, details));
return true;
@ -269,20 +276,28 @@ class SevenZipExtractor {
* @return list of unpacked derived files
*/
void unpack(AbstractFile archiveFile) {
String archiveFilePath;
try {
archiveFilePath = archiveFile.getUniquePath();
} catch (TskCoreException ex) {
archiveFilePath = archiveFile.getParentPath() + archiveFile.getName();
}
//check if already has derived files, skip
try {
if (archiveFile.hasChildren()) {
//check if local unpacked dir exists
if (new File(EmbeddedFileExtractorIngestModule.getUniqueName(archiveFile)).exists()) {
logger.log(Level.INFO, "File already has been processed as it has children and local unpacked file, skipping: {0}", archiveFile.getName()); //NON-NLS
logger.log(Level.INFO, "File already has been processed as it has children and local unpacked file, skipping: {0}", archiveFilePath); //NON-NLS
return;
}
}
} catch (TskCoreException e) {
logger.log(Level.INFO, "Error checking if file already has been processed, skipping: {0}", archiveFile.getName()); //NON-NLS
logger.log(Level.INFO, "Error checking if file already has been processed, skipping: {0}", archiveFilePath); //NON-NLS
return;
}
List<AbstractFile> unpackedFiles = Collections.<AbstractFile>emptyList();
//recursion depth check for zip bomb
@ -295,7 +310,7 @@ class SevenZipExtractor {
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.warnMsg.zipBomb", archiveFile.getName());
String details = NbBundle.getMessage(this.getClass(),
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.warnDetails.zipBomb",
parentAr.getDepth());
parentAr.getDepth(), archiveFilePath);
//MessageNotifyUtil.Notify.error(msg, details);
services.postMessage(IngestMessage.createWarningMessage(EmbeddedFileExtractorModuleFactory.getModuleName(), msg, details));
return;
@ -322,7 +337,7 @@ class SevenZipExtractor {
inArchive = SevenZip.openInArchive(options, stream);
int numItems = inArchive.getNumberOfItems();
logger.log(Level.INFO, "Count of items in archive: {0}: {1}", new Object[]{archiveFile.getName(), numItems}); //NON-NLS
logger.log(Level.INFO, "Count of items in archive: {0}: {1}", new Object[]{archiveFilePath, numItems}); //NON-NLS
progress.start(numItems);
progressStarted = true;
@ -381,7 +396,7 @@ class SevenZipExtractor {
}
String msg = NbBundle.getMessage(this.getClass(), "EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.unknownPath.msg",
archiveFile.getName(), pathInArchive);
archiveFilePath, pathInArchive);
logger.log(Level.WARNING, msg);
}
@ -389,7 +404,7 @@ class SevenZipExtractor {
logger.log(Level.INFO, "Extracted item path: {0}", pathInArchive); //NON-NLS
//check if possible zip bomb
if (isZipBombArchiveItemCheck(archiveFile.getName(), item)) {
if (isZipBombArchiveItemCheck(archiveFile, item)) {
continue; //skip the item
}
@ -428,12 +443,12 @@ class SevenZipExtractor {
if (newDiskSpace < MIN_FREE_DISK_SPACE) {
String msg = NbBundle.getMessage(this.getClass(),
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.notEnoughDiskSpace.msg",
archiveFile.getName(), fileName);
archiveFilePath, fileName);
String details = NbBundle.getMessage(this.getClass(),
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.notEnoughDiskSpace.details");
//MessageNotifyUtil.Notify.error(msg, details);
services.postMessage(IngestMessage.createErrorMessage(EmbeddedFileExtractorModuleFactory.getModuleName(), msg, details));
logger.log(Level.INFO, "Skipping archive item due to insufficient disk space: {0}, {1}", new Object[]{archiveFile.getUniquePath(), fileName}); //NON-NLS
logger.log(Level.INFO, "Skipping archive item due to insufficient disk space: {0}, {1}", new Object[]{archiveFilePath, fileName}); //NON-NLS
logger.log(Level.INFO, "Available disk space: {0}", new Object[]{freeDiskSpace}); //NON-NLS
continue; //skip this file
} else {
@ -523,23 +538,17 @@ class SevenZipExtractor {
//TODO decide if anything to cleanup, for now bailing
}
} catch (SevenZipException | TskCoreException ex) {
} catch (SevenZipException ex) {
logger.log(Level.SEVERE, "Error unpacking file: " + archiveFile, ex); //NON-NLS
//inbox message
String fullName;
try {
fullName = archiveFile.getUniquePath();
} catch (TskCoreException ex1) {
fullName = archiveFile.getName();
}
// print a message if the file is allocated
if (archiveFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.ALLOC)) {
String msg = NbBundle.getMessage(this.getClass(), "EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.errUnpacking.msg",
archiveFile.getName());
String details = NbBundle.getMessage(this.getClass(),
"EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.errUnpacking.details",
fullName, ex.getMessage());
archiveFilePath, ex.getMessage());
services.postMessage(IngestMessage.createErrorMessage(EmbeddedFileExtractorModuleFactory.getModuleName(), msg, details));
}
} finally {
@ -573,7 +582,7 @@ class SevenZipExtractor {
artifact.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), EmbeddedFileExtractorModuleFactory.getModuleName(), encryptionType));
services.fireModuleDataEvent(new ModuleDataEvent(EmbeddedFileExtractorModuleFactory.getModuleName(), BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED));
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error creating blackboard artifact for encryption detected for file: " + archiveFile, ex); //NON-NLS
logger.log(Level.SEVERE, "Error creating blackboard artifact for encryption detected for file: " + archiveFilePath, ex); //NON-NLS
}
String msg = NbBundle.getMessage(this.getClass(), "EmbeddedFileExtractorIngestModule.ArchiveExtractor.unpack.encrFileDetected.msg");

12
Core/src/org/sleuthkit/autopsy/modules/photoreccarver/Bundle.properties
View File

@ -3,14 +3,14 @@ OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Long-Description=PhotoRec Carver ingest module. \n\n Carves unallocated space and feeds the resulting carved files back into the system for processing.
OpenIDE-Module-Short-Description=Carves unallocated space and feeds carved files back into the system for processing.
moduleDisplayName.text=PhotoRec Carver
moduleDescription.text=Runs PhotoRec carver against unallocated space on the system.
moduleDescription.text=Runs PhotoRec carver against unallocated space in the data source.
unallocatedSpaceProcessingSettingsError.message="Process Unallocated Space" is not checked. This module is designed to carve unallocated space. Either allow processing of unallocated space, or do not use this module.
unsupportedOS.message=Module is not supported for other than Windows platforms
missingExecutable.message=Unable to locate unallocated carver executable.
cannotRunExecutable.message=Unable to execute unallocated carver
unallocatedSpaceProcessingSettingsError.message="Process Unallocated Space" is not checked. The PhotoRec module is designed to carve unallocated space. Either enable processing of unallocated space or disable this module.
unsupportedOS.message=PhotoRec Module is supported only on Windows platforms
missingExecutable.message=Unable to locate PhotoRec executable.
cannotRunExecutable.message=Unable to execute PhotoRec
cannotCreateOutputDir.message=Unable to create output directory: {0}
PhotoRecIngestModule.processTerminated=PhotoRec Carver ingest module was terminated due to exceeding max allowable run time when scanning
PhotoRecIngestModule.processTerminated=PhotoRec Carver ingest module was terminated due to exceeding max allowable run time when scanning
PhotoRecIngestModule.moduleError=PhotoRec Carver Module Error
PhotoRecIngestModule.UnableToCarve=Unable to carve file: {0}
PhotoRecIngestModule.NotEnoughDiskSpace=Not enough disk space to save unallocated file. Carving will be skipped.

12
Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java
View File

@ -26,10 +26,10 @@ import java.nio.file.FileAlreadyExistsException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
@ -38,12 +38,18 @@ import org.openide.modules.InstalledFileLocator;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.ExecUtil;
import org.sleuthkit.autopsy.coreutils.FileUtil;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.coreutils.PlatformUtil;
import org.sleuthkit.autopsy.datamodel.ContentUtils;
import org.sleuthkit.autopsy.ingest.FileIngestModule;
import org.sleuthkit.autopsy.ingest.FileIngestModuleProcessTerminator;
import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.autopsy.ingest.IngestModule;
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleContentEvent;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.Image;
@ -87,7 +93,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
public void startUp(IngestJobContext context) throws IngestModule.IngestModuleException {
this.context = context;
this.services = IngestServices.getInstance();
// If the global unallocated space processing setting and the module
// process unallocated space only setting are not in sych, throw an
// exception. Although the result would not be incorrect, it would be

2
Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java
View File

@ -120,7 +120,7 @@ public final class JythonModuleLoader {
interpreter.exec("import sys"); //NON-NLS
String path = Matcher.quoteReplacement(script.getParent());
interpreter.exec("sys.path.append('" + path + "')"); //NON-NLS
String moduleName = script.getName().replaceAll(".py", ""); //NON-NLS
String moduleName = script.getName().replaceAll("\\.py$", ""); //NON-NLS
// reload the module so that the changes made to it can be loaded.
interpreter.exec("import " + moduleName); //NON-NLS

1
CoreLibs/ivy.xml
View File

@ -38,7 +38,6 @@
<!-- timeline and image analyzer -->
<dependency conf="autopsy_core->*" org="org.controlsfx" name="controlsfx" rev="8.40.9" />
<dependency conf="autopsy_core->*" org="org.controlsfx" name="openjfx-dialogs" rev="1.0.3"/>
<!-- timeline and -->
<dependency conf="autopsy_core->*" org="joda-time" name="joda-time" rev="2.4" />

13
CoreLibs/nbproject/project.xml
View File

@ -64,7 +64,6 @@
<package>com.sun.mail.smtp</package>
<package>com.sun.mail.util</package>
<package>com.sun.mail.util.logging</package>
<package>javafx.scene.control</package>
<package>javassist</package>
<package>javassist.bytecode</package>
<package>javassist.bytecode.analysis</package>
@ -616,10 +615,6 @@
<runtime-relative-path>ext/logkit-1.0.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/logkit-1.0.1.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/openjfx-dialogs-1.0.3.jar</runtime-relative-path>
<binary-origin>release/modules/ext/openjfx-dialogs-1.0.3.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/imgscalr-lib-4.2-javadoc.jar</runtime-relative-path>
<binary-origin>release/modules/ext/imgscalr-lib-4.2-javadoc.jar</binary-origin>
@ -768,14 +763,14 @@
<runtime-relative-path>ext/slf4j-simple-1.6.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/slf4j-simple-1.6.1.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/controlsfx-8.40.9.jar</runtime-relative-path>
<binary-origin>release/modules/ext/controlsfx-8.40.9.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/commons-lang3-3.0-javadoc.jar</runtime-relative-path>
<binary-origin>release/modules/ext/commons-lang3-3.0-javadoc.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/controlsfx-8.40.9.jar</runtime-relative-path>
<binary-origin>release/modules/ext/controlsfx-8.40.9.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/platform-3.4.0.jar</runtime-relative-path>
<binary-origin>release/modules/ext/platform-3.4.0.jar</binary-origin>

1
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java
View File

@ -237,7 +237,6 @@ public final class ImageGalleryController {
IngestManager.getInstance().addIngestJobEventListener((PropertyChangeEvent evt) -> {
Platform.runLater(this::updateRegroupDisabled);
});
// metaDataCollapsed.bind(Toolbar.getDefault().showMetaDataProperty());
}
public ReadOnlyBooleanProperty getCanAdvance() {

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java
View File

@ -80,7 +80,7 @@ public class ImageGalleryModule {
* @return the Path to the ModuleOuput subfolder for Image Gallery
*/
static Path getModuleOutputDir(Case theCase) {
return Paths.get(theCase.getModulesOutputDirAbsPath(), getModuleName());
return Paths.get(theCase.getModuleDirectory(), getModuleName());
}
/** provides static utilities, can not be instantiated */

4
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/PerCaseProperties.java
View File

@ -88,7 +88,7 @@ class PerCaseProperties {
* @return true if the config exists, false otherwise.
*/
public synchronized boolean configExists(String moduleName) {
Path get = Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties");
Path get = Paths.get(theCase.getModuleDirectory(), moduleName, theCase.getName() + ".properties");
return Files.exists(get);
}
@ -114,7 +114,7 @@ class PerCaseProperties {
* file doesn't exist.
*/
private synchronized Path getPropertyPath(String moduleName) {
return Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties"); //NON-NLS
return Paths.get(theCase.getModuleDirectory(), moduleName, theCase.getName() + ".properties"); //NON-NLS
}
/**

40
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/AddDrawableTagAction.java
View File

@ -19,18 +19,24 @@
package org.sleuthkit.autopsy.imagegallery.actions;
import java.util.HashSet;
import java.util.List;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.ExecutionException;
import java.util.logging.Level;
import javafx.application.Platform;
import javafx.scene.control.Alert;
import javafx.scene.control.ButtonType;
import javafx.scene.control.Menu;
import javax.swing.JOptionPane;
import javax.swing.SwingWorker;
import org.openide.util.Utilities;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.imagegallery.FileIDSelectionModel;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableTagsManager;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.ContentTag;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
@ -73,14 +79,32 @@ public class AddDrawableTagAction extends AddTagAction {
protected Void doInBackground() throws Exception {
for (Long fileID : selectedFiles) {
try {
DrawableFile<?> file = controller.getFileFromId(fileID);
final DrawableFile<?> file = controller.getFileFromId(fileID);
LOGGER.log(Level.INFO, "tagging {0} with {1} and comment {2}", new Object[]{file.getName(), tagName.getDisplayName(), comment});
controller.getTagsManager().addContentTag(file, tagName, comment);
} catch (IllegalStateException ex) {
LOGGER.log(Level.SEVERE, "Case was closed out from underneath Updatefile task", ex);
} catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "Error tagging result", ex);
JOptionPane.showMessageDialog(null, "Unable to tag " + fileID + ".", "Tagging Error", JOptionPane.ERROR_MESSAGE);
// check if the same tag is being added for the same abstract file.
DrawableTagsManager tagsManager = controller.getTagsManager();
List<ContentTag> contentTags = tagsManager.getContentTagsByContent(file);
Optional<TagName> duplicateTagName = contentTags.stream()
.map(ContentTag::getName)
.filter(tagName::equals)
.findAny();
if (duplicateTagName.isPresent()) {
Platform.runLater(() -> {
Alert alert = new Alert(Alert.AlertType.WARNING, "Unable to tag " + file.getName() + ". It has already been tagged as \"" + tagName.getDisplayName() + ". Cannot reapply the same tag.", ButtonType.OK);
alert.setHeaderText("Tag Error");
alert.show();
});
} else {
controller.getTagsManager().addContentTag(file, tagName, comment);
}
} catch (TskCoreException tskCoreException) {
LOGGER.log(Level.SEVERE, "Error tagging result", tskCoreException);
Platform.runLater(() -> {
new Alert(Alert.AlertType.ERROR, "Unable to file " + fileID + ".").show();
});
}
}
return null;

3
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/AddTagAction.java
View File

@ -28,7 +28,6 @@ import org.sleuthkit.autopsy.actions.GetTagNameAndCommentDialog;
import org.sleuthkit.autopsy.actions.GetTagNameDialog;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.autopsy.imagegallery.datamodel.CategoryManager;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.datamodel.TagName;
/**
@ -104,7 +103,6 @@ abstract class AddTagAction {
TagName tagName = GetTagNameDialog.doDialog();
if (tagName != null) {
addTag(tagName, NO_COMMENT);
}
});
});
@ -124,7 +122,6 @@ abstract class AddTagAction {
} else {
new AddDrawableTagAction(controller).addTag(tagNameAndComment.getTagName(), tagNameAndComment.getComment());
}
}
});
});

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java
View File

@ -144,7 +144,7 @@ public class CategorizeAction extends AddTagAction {
LOGGER.log(Level.SEVERE, "Error removing old categories result", ex);
}
});
} else {
} else {
//add cat tag if no existing cat tag for that cat
if (fileTags.stream()
.map(Tag::getName)

4
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/DeleteFollowUpTagAction.java
View File

@ -24,9 +24,9 @@ import javafx.event.ActionEvent;
import javax.swing.SwingWorker;
import org.controlsfx.control.action.Action;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableTagsManager;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableTagsManager;
import org.sleuthkit.datamodel.ContentTag;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
@ -49,7 +49,7 @@ public class DeleteFollowUpTagAction extends Action {
try {
final TagName followUpTagName = tagsManager.getFollowUpTagName();
List<ContentTag> contentTagsByContent = tagsManager.getContentTagsByContent(file);
for (ContentTag ct : contentTagsByContent) {
if (ct.getName().getDisplayName().equals(followUpTagName.getDisplayName())) {

64
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java
View File

@ -34,6 +34,7 @@ import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.locks.Lock;
@ -582,27 +583,25 @@ public final class DrawableDB {
stmt.setBoolean(8, f.isAnalyzed());
stmt.executeUpdate();
final Collection<String> hashSetNames = DrawableAttribute.HASHSET.getValue(f);
final Collection<String> hashSetNames = getHashSetsForFileFromAutopsy(f.getId());
if (hashSetNames.isEmpty() == false) {
for (String name : hashSetNames) {
for (String name : hashSetNames) {
// "INSERT OR IGNORE INTO hash_sets (hash_set_name) VALUES (?)"
insertHashSetStmt.setString(1, name);
insertHashSetStmt.executeUpdate();
// "insert or ignore into hash_sets (hash_set_name) values (?)"
insertHashSetStmt.setString(1, name);
insertHashSetStmt.executeUpdate();
//TODO: use nested select to get hash_set_id rather than seperate statement/query
//"SELECT hash_set_id FROM hash_sets WHERE hash_set_name = ?"
selectHashSetStmt.setString(1, name);
try (ResultSet rs = selectHashSetStmt.executeQuery()) {
while (rs.next()) {
int hashsetID = rs.getInt("hash_set_id");
//"INSERT OR IGNORE INTO hash_set_hits (hash_set_id, obj_id) VALUES (?,?)";
insertHashHitStmt.setInt(1, hashsetID);
insertHashHitStmt.setLong(2, f.getId());
insertHashHitStmt.executeUpdate();
break;
}
//TODO: use nested select to get hash_set_id rather than seperate statement/query
//"select hash_set_id from hash_sets where hash_set_name = ?"
selectHashSetStmt.setString(1, name);
try (ResultSet rs = selectHashSetStmt.executeQuery()) {
while (rs.next()) {
int hashsetID = rs.getInt("hash_set_id");
//"insert or ignore into hash_set_hits (hash_set_id, obj_id) values (?,?)";
insertHashHitStmt.setInt(1, hashsetID);
insertHashHitStmt.setLong(2, f.getId());
insertHashHitStmt.executeUpdate();
break;
}
}
}
@ -1095,6 +1094,8 @@ public final class DrawableDB {
removeFileStmt.setLong(1, id);
removeFileStmt.executeUpdate();
tr.addRemovedFile(id);
//TODO: delete from hash_set_hits table also...
} catch (SQLException ex) {
LOGGER.log(Level.WARNING, "failed to delete row for obj_id = " + id, ex);
} finally {
@ -1122,16 +1123,13 @@ public final class DrawableDB {
*
* @return a set of names, each of which is a hashset that the given file is
* in.
*
*
* //TODO: why does this go to the SKC? don't we already have this info
* in the drawable db?
*/
@Nonnull
public Set<String> getHashSetsForFile(long fileID) {
public Set<String> getHashSetsForFileFromAutopsy(long fileID) {
try {
Set<String> hashNames = new HashSet<>();
List<BlackboardArtifact> arts = tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, fileID);
for (BlackboardArtifact a : arts) {
List<BlackboardAttribute> attrs = a.getAttributes();
for (BlackboardAttribute attr : attrs) {
@ -1139,8 +1137,8 @@ public final class DrawableDB {
hashNames.add(attr.getValueString());
}
}
return hashNames;
}
return hashNames;
} catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, "failed to get hash sets for file", ex);
}
@ -1199,10 +1197,24 @@ public final class DrawableDB {
/**
* For performance reasons, keep the file type in memory
*/
private final Map<AbstractFile, Boolean> videoFileMap = new ConcurrentHashMap<>();
private final Map<Long, Boolean> videoFileMap = new ConcurrentHashMap<>();
/**
* is this File a video file?
*
* @param f check if this file is a video. will return false for null file.
*
* @return returns true if this file is a video as determined by {@link ImageGalleryModule#isVideoFile(org.sleuthkit.datamodel.AbstractFile)
* } but caches the result.
* returns false if passed a null AbstractFile
*/
public boolean isVideoFile(AbstractFile f) {
return videoFileMap.computeIfAbsent(f, ImageGalleryModule::isVideoFile);
if (Objects.isNull(f)) {
return false;
} else {
return videoFileMap.computeIfAbsent(f.getId(), (id) -> ImageGalleryModule.isVideoFile(f));
}
}
/**

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableTagsManager.java
View File

@ -200,7 +200,7 @@ public class DrawableTagsManager {
public ContentTag addContentTag(DrawableFile<?> file, TagName tagName, String comment) throws TskCoreException {
synchronized (autopsyTagsManagerLock) {
return autopsyTagsManager.addContentTag(file, tagName, comment);
return autopsyTagsManager.addContentTag(file.getAbstractFile(), tagName, comment);
}
}

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/HashSetManager.java
View File

@ -36,7 +36,7 @@ public class HashSetManager {
* @return the names of the hashsets the given fileID is in
*/
private Set<String> getHashSetsForFileHelper(long fileID) {
return db.getHashSetsForFile(fileID);
return db.getHashSetsForFileFromAutopsy(fileID);
}
/**

33
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/grouping/GroupManager.java
View File

@ -25,7 +25,6 @@ import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.Comparator;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
@ -44,7 +43,6 @@ import javafx.beans.property.ReadOnlyDoubleProperty;
import javafx.beans.property.ReadOnlyDoubleWrapper;
import javafx.collections.FXCollections;
import javafx.collections.ObservableList;
import javafx.collections.transformation.SortedList;
import static javafx.concurrent.Worker.State.CANCELLED;
import static javafx.concurrent.Worker.State.FAILED;
import static javafx.concurrent.Worker.State.READY;
@ -108,12 +106,12 @@ public class GroupManager {
*/
@ThreadConfined(type = ThreadType.JFX)
private final ObservableList<DrawableGroup> analyzedGroups = FXCollections.observableArrayList();
private final SortedList<DrawableGroup> unmodifiableAnalyzedGroups = new SortedList<>(analyzedGroups);
private final ObservableList<DrawableGroup> unmodifiableAnalyzedGroups = FXCollections.unmodifiableObservableList(analyzedGroups);
/** list of unseen groups */
@ThreadConfined(type = ThreadType.JFX)
private final ObservableList<DrawableGroup> unSeenGroups = FXCollections.observableArrayList();
private final SortedList<DrawableGroup> unmodifiableUnSeenGroups = new SortedList<>(unSeenGroups);
private final ObservableList<DrawableGroup> unmodifiableUnSeenGroups = FXCollections.unmodifiableObservableList(unSeenGroups);
private ReGroupTask<?> groupByTask;
@ -248,15 +246,7 @@ public class GroupManager {
/**
* 'mark' the given group as seen. This removes it from the queue of
* groups
* files.
* public DrawableGroup makeGroup(GroupKey<?> groupKey, Set<Long> files) {
*
* Set<Long> newFiles = ObjectUtils.defaultIfNull(files, new
* HashSet<Long>());
* }
* groups
* to review, and is persisted in the drawable db.
* groups to review, and is persisted in the drawable db.
*
* @param group the {@link DrawableGroup} to mark as seen
*/
@ -270,6 +260,7 @@ public class GroupManager {
} else if (unSeenGroups.contains(group) == false) {
unSeenGroups.add(group);
}
FXCollections.sort(unSeenGroups, sortBy.getGrpComparator(sortOrder));
}
/**
@ -294,11 +285,12 @@ public class GroupManager {
Platform.runLater(() -> {
if (analyzedGroups.contains(group)) {
analyzedGroups.remove(group);
FXCollections.sort(analyzedGroups, sortBy.getGrpComparator(sortOrder));
}
if (unSeenGroups.contains(group)) {
unSeenGroups.remove(group);
FXCollections.sort(unSeenGroups, sortBy.getGrpComparator(sortOrder));
}
});
}
} else { //group == null
@ -535,8 +527,8 @@ public class GroupManager {
setSortBy(sortBy);
setSortOrder(sortOrder);
Platform.runLater(() -> {
unmodifiableAnalyzedGroups.setComparator(sortBy.getGrpComparator(sortOrder));
unmodifiableUnSeenGroups.setComparator(sortBy.getGrpComparator(sortOrder));
FXCollections.sort(analyzedGroups, sortBy.getGrpComparator(sortOrder));
FXCollections.sort(unSeenGroups, sortBy.getGrpComparator(sortOrder));
});
}
}
@ -681,6 +673,9 @@ public class GroupManager {
Platform.runLater(() -> {
if (analyzedGroups.contains(group) == false) {
analyzedGroups.add(group);
if (Objects.isNull(task)) {
FXCollections.sort(analyzedGroups, sortBy.getGrpComparator(sortOrder));
}
}
markGroupSeen(group, groupSeen);
});
@ -733,10 +728,6 @@ public class GroupManager {
Platform.runLater(() -> {
analyzedGroups.clear();
unSeenGroups.clear();
final Comparator<DrawableGroup> grpComparator = sortBy.getGrpComparator(sortOrder);
unmodifiableAnalyzedGroups.setComparator(grpComparator);
unmodifiableUnSeenGroups.setComparator(grpComparator);
});
// Get the list of group keys
@ -756,7 +747,7 @@ public class GroupManager {
groupProgress.progress("regrouping files by " + groupBy.attrName.toString() + " : " + val, p);
popuplateIfAnalyzed(new GroupKey<A>(groupBy, val), this);
}
FXCollections.sort(analyzedGroups, sortBy.getGrpComparator(sortOrder));
updateProgress(1, 1);
return null;
}

1
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/Toolbar.java
View File

@ -41,7 +41,6 @@ import javafx.scene.image.ImageView;
import javafx.scene.layout.HBox;
import javax.swing.SortOrder;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableTagsManager;
import org.sleuthkit.autopsy.imagegallery.FXMLConstructor;
import org.sleuthkit.autopsy.imagegallery.FileIDSelectionModel;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/DrawableTileBase.java
View File

@ -283,7 +283,7 @@ public abstract class DrawableTileBase extends DrawableUIBase {
}
@Override
protected void setFileHelper(final Long newFileID) {
synchronized protected void setFileHelper(final Long newFileID) {
setFileIDOpt(Optional.ofNullable(newFileID));
disposeContent();

14
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/DrawableUIBase.java
View File

@ -35,9 +35,9 @@ abstract public class DrawableUIBase extends AnchorPane implements DrawableView
private final ImageGalleryController controller;
volatile private Optional<DrawableFile<?>> fileOpt = Optional.empty();
private Optional<DrawableFile<?>> fileOpt = Optional.empty();
volatile private Optional<Long> fileIDOpt = Optional.empty();
private Optional<Long> fileIDOpt = Optional.empty();
public DrawableUIBase(ImageGalleryController controller) {
this.controller = controller;
@ -53,16 +53,16 @@ abstract public class DrawableUIBase extends AnchorPane implements DrawableView
return fileIDOpt;
}
void setFileIDOpt(Optional<Long> fileIDOpt) {
synchronized void setFileIDOpt(Optional<Long> fileIDOpt) {
this.fileIDOpt = fileIDOpt;
}
void setFileOpt(Optional<DrawableFile<?>> fileOpt) {
synchronized void setFileOpt(Optional<DrawableFile<?>> fileOpt) {
this.fileOpt = fileOpt;
}
@Override
public Optional<DrawableFile<?>> getFile() {
synchronized public Optional<DrawableFile<?>> getFile() {
if (fileIDOpt.isPresent()) {
if (fileOpt.isPresent() && fileOpt.get().getId() == fileIDOpt.get()) {
return fileOpt;
@ -83,7 +83,7 @@ abstract public class DrawableUIBase extends AnchorPane implements DrawableView
protected abstract void setFileHelper(Long newFileID);
@Override
public void setFile(Long newFileID) {
synchronized public void setFile(Long newFileID) {
if (getFileID().isPresent()) {
if (Objects.equals(newFileID, getFileID().get()) == false) {
setFileHelper(newFileID);
@ -92,6 +92,4 @@ abstract public class DrawableUIBase extends AnchorPane implements DrawableView
setFileHelper(newFileID);
}
}
}

3
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/GroupPane.java
View File

@ -115,7 +115,6 @@ import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute;
import org.sleuthkit.autopsy.imagegallery.datamodel.grouping.DrawableGroup;
import org.sleuthkit.autopsy.imagegallery.datamodel.grouping.GroupViewMode;
import org.sleuthkit.autopsy.imagegallery.datamodel.grouping.GroupViewState;
import org.sleuthkit.autopsy.imagegallery.gui.GuiUtils;
import org.sleuthkit.autopsy.imagegallery.gui.Toolbar;
import org.sleuthkit.datamodel.TagName;
import org.sleuthkit.datamodel.TskCoreException;
@ -360,7 +359,7 @@ public class GroupPane extends BorderPane {
if (t1) {
ArrayList<MenuItem> selTagMenues = new ArrayList<>();
for (final TagName tn : getController().getTagsManager().getNonCategoryTagNames()) {
MenuItem menuItem = GuiUtils.createSelTagMenuItem(tn, grpTagSplitMenu, controller);
MenuItem menuItem = createGrpTagMenuItem(tn);
selTagMenues.add(menuItem);
}
grpTagSplitMenu.getItems().setAll(selTagMenues);

3
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/MetaDataPane.java
View File

@ -75,6 +75,7 @@ public class MetaDataPane extends DrawableUIBase {
public MetaDataPane(ImageGalleryController controller) {
super(controller);
FXMLLoader fxmlLoader = new FXMLLoader(getClass().getResource("MetaDataPane.fxml"));
fxmlLoader.setRoot(this);
fxmlLoader.setController(this);
@ -83,7 +84,6 @@ public class MetaDataPane extends DrawableUIBase {
fxmlLoader.load();
} catch (IOException exception) {
throw new RuntimeException(exception);
}
}
@ -211,5 +211,4 @@ public class MetaDataPane extends DrawableUIBase {
}
});
}
}

3
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/SlideShowView.java
View File

@ -290,7 +290,7 @@ public class SlideShowView extends DrawableTileBase {
* 1 => right / forward
*/
@ThreadConfined(type = ThreadType.JFX)
private void cycleSlideShowImage(int direction) {
synchronized private void cycleSlideShowImage(int direction) {
stopVideo();
final int groupSize = getGroupPane().getGrouping().fileIds().size();
final Integer nextIndex = getFileID().map(fileID -> {
@ -363,7 +363,6 @@ public class SlideShowView extends DrawableTileBase {
new CategorizeAction(getController()).addTag(getController().getTagsManager().getTagName(cat), "");
}
});
}
}
}

3
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java
View File

@ -107,7 +107,6 @@ class GroupTreeCell extends TreeCell<TreeNode> {
setStyle("");
});
} else {
if (isNull(treeNode.getGroup())) {
final String groupName = getGroupName();
//"dummy" group in file system tree <=> a folder with no drawables
@ -141,7 +140,7 @@ class GroupTreeCell extends TreeCell<TreeNode> {
private String getGroupName() {
return Optional.ofNullable(getItem())
.map((TreeNode t) -> StringUtils.defaultIfBlank(t.getPath(), DrawableGroup.getBlankGroupName()))
.map(treeNode -> StringUtils.defaultIfBlank(treeNode.getPath(), DrawableGroup.getBlankGroupName()))
.orElse("");
}

26
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/NavPanel.java
View File

@ -28,7 +28,6 @@ import javafx.beans.property.SimpleObjectProperty;
import javafx.beans.value.ObservableValue;
import javafx.collections.FXCollections;
import javafx.collections.ListChangeListener;
import javafx.collections.ObservableList;
import javafx.fxml.FXML;
import javafx.scene.control.ComboBox;
import javafx.scene.control.ListView;
@ -151,13 +150,15 @@ public class NavPanel extends TabPane {
}
});
initHashTree();
initNavTree();
controller.getGroupManager().getAnalyzedGroups().addListener((ListChangeListener.Change<? extends DrawableGroup> change) -> {
TreeItem<TreeNode> selectedItem = activeTreeProperty.get().getSelectionModel().getSelectedItem();
boolean wasPermuted = false;
while (change.next()) {
if (change.wasPermutated()) {
// Handle this afterward
wasPermuted = true;
break;
}
for (DrawableGroup g : change.getAddedSubList()) {
insertIntoNavTree(g);
if (g.getHashSetHitsCount() > 0) {
@ -168,11 +169,6 @@ public class NavPanel extends TabPane {
removeFromNavTree(g);
removeFromHashTree(g);
}
if (change.wasPermutated()) {
// Handle this afterward
wasPermuted = true;
break;
}
}
if (wasPermuted) {
@ -182,16 +178,10 @@ public class NavPanel extends TabPane {
Platform.runLater(() -> {
setFocusedGroup(selectedItem.getValue().getGroup());
});
}
});
for (DrawableGroup g : controller.getGroupManager().getAnalyzedGroups()) {
insertIntoNavTree(g);
if (g.getHashSetHitsCount() > 0) {
insertIntoHashTree(g);
}
}
rebuildTrees();
controller.viewState().addListener((ObservableValue<? extends GroupViewState> observable, GroupViewState oldValue, GroupViewState newValue) -> {
if (newValue != null && newValue.getGroup() != null) {
@ -204,9 +194,7 @@ public class NavPanel extends TabPane {
navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
hashTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
ObservableList<DrawableGroup> groups = controller.getGroupManager().getAnalyzedGroups();
for (DrawableGroup g : groups) {
for (DrawableGroup g : controller.getGroupManager().getAnalyzedGroups()) {
insertIntoNavTree(g);
if (g.getHashSetHitsCount() > 0) {
insertIntoHashTree(g);

2
KeywordSearch/manifest.mf
View File

@ -1,7 +1,7 @@
Manifest-Version: 1.0
AutoUpdate-Show-In-Client: true
OpenIDE-Module: org.sleuthkit.autopsy.keywordsearch/6
OpenIDE-Module-Implementation-Version: 13
OpenIDE-Module-Implementation-Version: 14
OpenIDE-Module-Install: org/sleuthkit/autopsy/keywordsearch/Installer.class
OpenIDE-Module-Layer: org/sleuthkit/autopsy/keywordsearch/layer.xml
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/keywordsearch/Bundle.properties

10
NEWS.txt
View File

@ -1,3 +1,13 @@
---------------- VERSION 3.1.3 --------------
Improvements:
- New Embedded File Extractor module that incorporates ZIP file module and extracts images from Office documents
- Views area counts updates when ZIP files and such are found
- Updates to python scripting for new version of Python, scripts are reloaded each time ingest is run, and errors are better shown.
- Updated right click actions to be consistent accross all file types
- Changed logic of Interesting Files module to look for substrings of parent path.
- Lots of minor fixes and enhancements
---------------- VERSION 3.1.2 --------------
Improvements:
- New PhotoRec carving ingest module

2
RecentActivity/manifest.mf
View File

@ -1,6 +1,6 @@
Manifest-Version: 1.0
OpenIDE-Module: org.sleuthkit.autopsy.recentactivity/6
OpenIDE-Module-Implementation-Version: 12
OpenIDE-Module-Implementation-Version: 13
OpenIDE-Module-Layer: org/sleuthkit/autopsy/recentactivity/layer.xml
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/recentactivity/Bundle.properties
OpenIDE-Module-Requires:

14
docs/doxygen/modDevPython.dox
View File

@ -7,9 +7,9 @@ go into the page for that module type. -->
This page describes the basic concepts and setup that are needed for all types of Python modules. It is not needed for Java module development.
Autopsy uses Jython (http://www.jython.org) to enable Python scripting. Jython looks like Python and gets converted into Java byte code and run on the JVM. Its biggest limitations are:
- Limited to Python 2.5
- Limited to Python 2.7 (as of Autopsy 3.1.3)
- Can't use Python libraries that have native code
- You can't make any UIs. This means that you can't make content viewer modules or have configuration settings for your ingest modules.
- You can't easily make UIs. This means that you can't make content viewer modules or easily have configuration settings for your ingest modules. We have done it, but it is tedious compared to using a Java tool to place UI widgets in various places.
Using it is very easy though in Autopsy and it allows you to access all of the Java services and classes that you need.
@ -29,10 +29,11 @@ Autopsy requires that you have a self-contained folder for each Python module.
You will need to copy this folder into Autopsy's Python script folder. It will scan this folder each time it looks for modules. You can find the location of this folder from the "Tools -> Python Scripts" menu item.
\subsection mod_dev_py_create_create Module Creation
-# Create a folder
-# Add a .py file to it (see later sections for details on its contents)
-# Copy one of the sample modules from the github repository (listed below) or make one from scratch
-# Copy the folder to the previously mentioned folder to make updates during development.
That's it. Autopsy will find the module each time it needs it and you can make updates without having to restart Autopsy each time.
@ -52,6 +53,11 @@ from neededLib.mylib import neededClass
Jython will look in the module's folder to resolve these libraries.
\subsection mod_dev_py_misc Minor Gotchas
This section lists some helpful tips that we have found. These are all now in the sample modules, so refer to those for examples and a place to copy and paste from.
- We haven't found a good way to debug while running inside of Autopsy. So, logging becomes critical. You need to go through a bunch of steps to get the logger to display your module name. See the sample module for a log() method that does all of this for you.
- When you name the file with your Python module in it, restrict its name to letters, numbers, and underscore (_).
\section mod_dev_py_distribute Distribution
To distribute and share your Python module, ZIP up the folder and send it around. Other users of the module should expand the ZIP file and drop the folder into their Autopsy Python folder.
@ -63,5 +69,7 @@ There are only two types of modules that you can make with Python. Those (along
- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/
- Report Modules: https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/reportmodule.py
*/

2
nbproject/project.properties
View File

@ -4,7 +4,7 @@ app.title=Autopsy
### lowercase version of above
app.name=${branding.token}
### if left unset, version will default to today's date
app.version=3.1.2
app.version=3.1.3
### Build type isn't used at this point, but it may be useful
### Must be one of: DEVELOPMENT, RELEASE
#build.type=RELEASE

21
pythonExamples/fileIngestModule.py
View File

@ -48,6 +48,7 @@ from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.ingest import ModuleDataEvent
from org.sleuthkit.autopsy.coreutils import Logger
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
@ -107,20 +108,28 @@ class SampleJythonFileIngestModule(FileIngestModule):
# TODO: Add your analysis code in here.
def process(self, file):
# Skip non-files
if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) or (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) or (file.isFile() == False)):
if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) or
(file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) or
(file.isFile() == False)):
return IngestModule.ProcessResult.OK
# For an example, we will flag files with .txt in the name and make a blackboard artifact.
if file.getName().find(".txt") != -1:
if file.getName().lower().endswith(".txt"):
self.log(Level.INFO, "Found a text file: " + file.getName())
self.filesFound+=1
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
# artfiact. Refer to the developer docs for other examples.
# artifact. Refer to the developer docs for other examples.
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonFileIngestModuleFactory.moduleName, "Text Files")
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(),
SampleJythonFileIngestModuleFactory.moduleName, "Text Files")
art.addAttribute(att)
# Fire an event to notify the UI and others that there is a new artifact
IngestServices.getInstance().fireModuleDataEvent(
ModuleDataEvent(SampleJythonFileIngestModuleFactory.moduleName,
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, None));
# For the example (this wouldn't be needed normally), we'll query the blackboard for data that was added
# by other modules. We then iterate over its attributes. We'll just print them, but you would probably
@ -146,5 +155,7 @@ class SampleJythonFileIngestModule(FileIngestModule):
# TODO: Add any shutdown code that you need here.
def shutDown(self):
# As a final part of this example, we'll send a message to the ingest inbox with the number of files found (in this thread)
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName, str(self.filesFound) + " files found")
message = IngestMessage.createMessage(
IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName,
str(self.filesFound) + " files found")
ingestServices = IngestServices.getInstance().postMessage(message)

5
pythonExamples/reportmodule.py
View File

@ -36,6 +36,7 @@
from java.lang import System
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
import os
# TODO: Rename this to something more specific
class SampleGeneralReportModule(GeneralReportModuleAdapter):
@ -73,10 +74,10 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
progressBar.increment()
# Write the result to the report file.
report = open(baseReportDir + '\\' + self.getRelativeFilePath(), 'w')
report = open(os.path.join(baseReportDir, self.getRelativeFilePath()), 'w')
report.write("file count = %d" % fileCount)
Case.getCurrentCase().addReport(report.name, "SampleGeneralReportModule", "Sample Python Report");
report.close()
progressBar.increment()
progressBar.complete()
progressBar.complete()

2
thunderbirdparser/manifest.mf
View File

@ -1,7 +1,7 @@
Manifest-Version: 1.0
AutoUpdate-Show-In-Client: true
OpenIDE-Module: org.sleuthkit.autopsy.thunderbirdparser/4
OpenIDE-Module-Implementation-Version: 13
OpenIDE-Module-Implementation-Version: 14
OpenIDE-Module-Layer: org/sleuthkit/autopsy/thunderbirdparser/layer.xml
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/thunderbirdparser/Bundle.properties