Reordered tables on report, added new method to get keyword hits grouped by keyword, and modified recent document extraction

Signed-off-by: Alex Ebadirad <aebadirad@42six.com>

RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractAll.java

@@ -14,7 +14,7 @@ import org.sleuthkit.autopsy.ingest.IngestImageWorkerController;
 public class ExtractAll {
     
        void ExtractAll(){
-            
+              
         }
        
 

RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java

@@ -42,7 +42,7 @@ public class ExtractRegistry {
       public Logger logger = Logger.getLogger(this.getClass().getName());
      private String RR_PATH;
      boolean rrFound = false;
-     
+     private int sysid;
     ExtractRegistry(){
         final File rrRoot = InstalledFileLocator.getDefault().locate("rr", ExtractRegistry.class.getPackage().getName(), false);
          if (rrRoot == null) {
@@ -53,7 +53,18 @@ public class ExtractRegistry {
          else {
              rrFound = true;
          }
-         
+         try{
+              Case currentCase = Case.getCurrentCase(); // get the most updated case
+              SleuthkitCase tempDb = currentCase.getSleuthkitCase();
+               ResultSet artset = tempDb.runQuery("SELECT * from blackboard_artifact_types WHERE type_name = 'TSK_SYS_INFO'");
+                  
+                   while (artset.next()){
+                       sysid = artset.getInt("artifact_type_id");
+                      }
+         }
+         catch(Exception e){
+             
+         }
         final String rrHome = rrRoot.getAbsolutePath();
         logger.log(Level.INFO, "RegRipper home: " + rrHome);
              
@@ -175,7 +186,9 @@ public void getregistryfiles(List<String> image, IngestImageWorkerController con
     {
         Case currentCase = Case.getCurrentCase(); // get the most updated case
         SleuthkitCase tempDb = currentCase.getSleuthkitCase();
+        
          try {
+           
            String regString = new Scanner(new File(regRecord)).useDelimiter("\\Z").next();
            String startdoc = "<document>";
            String result = regString.replaceAll("----------------------------------------","");
@@ -199,7 +212,7 @@ public void getregistryfiles(List<String> image, IngestImageWorkerController con
                
                Element artroot = tempnode.getChild("artifacts");
                List artlist = artroot.getChildren();
-            BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT);
+               
             Collection<BlackboardAttribute> bbattributes = new ArrayList<BlackboardAttribute>();
             bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(), "RecentActivity", context, time));
               Iterator aiterator = artlist.iterator();
@@ -210,16 +223,27 @@ public void getregistryfiles(List<String> image, IngestImageWorkerController con
                   bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", context, name));
                  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_VALUE.getTypeID(), "RecentActivity", context, value));
                }
-                
+                if("recentdocs".equals(context)){
-                
+               BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT);
-                 
-              
                 bbart.addAttributes(bbattributes);
+                 }
+               else if("runMRU".equals(context)){
+                BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT);
+                 bbart.addAttributes(bbattributes);
+    
+                }
+               else
+               {   
+                 
+                   BlackboardArtifact bbart = tempDb.getContentById(orgId).newArtifact(sysid);
+                    bbart.addAttributes(bbattributes);
+               }  
+               
             }
            }
            catch (Exception ex)
            {
-               String hi = "";
+            
             logger.log(Level.WARNING, "Error while trying to read into a sqlite db." +  ex);      
            }
    

RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestService.java

@@ -18,12 +18,12 @@
  */
 package org.sleuthkit.autopsy.recentactivity;
 
+import java.sql.ResultSet;
 import java.util.Collection;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-import javax.swing.JPanel;
 import org.sleuthkit.autopsy.casemodule.Case;
 import org.sleuthkit.autopsy.ingest.IngestImageWorkerController;
 import org.sleuthkit.autopsy.ingest.IngestManager;
@@ -80,7 +80,28 @@ public final class RAImageIngestService implements IngestServiceImage {
 
         try {
             //do the work for(FileSystem img : imageFS )
+            try{
+           ResultSet artset = sCurrentCase.runQuery("SELECT * from blackboard_artifact_types WHERE type_name = 'TSK_SYS_INFO'");
+               int artcount = 0; 
+           while (artset.next()){
+              artcount++;
+              }
+       
+         //  artset.beforeFirst();
+               if(artcount > 0)
+               {
 
+               }
+               else
+               {
+                   int artint = sCurrentCase.addArtifactType("TSK_SYS_INFO", "System Information"); 
+               }
+           
+            }
+            catch(Exception e)
+            {
+              
+            }
             ext.extractToBlackboard(controller, fsIds);
 
 

Report/src/org/sleuthkit/autopsy/report/report.java

@@ -5,16 +5,14 @@
 package org.sleuthkit.autopsy.report;
 
 import java.sql.ResultSet;
-import java.sql.SQLException;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashMap;
-import java.util.List;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.sleuthkit.autopsy.casemodule.Case;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.BlackboardAttribute;
-import org.sleuthkit.datamodel.FsContent;
 import org.sleuthkit.datamodel.SleuthkitCase;
 
 /**
@@ -199,4 +197,57 @@ public HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> getHashHit() {
     return reportMap;
 }
 
+@Override
+public String getGroupedKeywordHit() {
+    StringBuilder table = new StringBuilder();
+    HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> reportMap = new HashMap();
+    Case currentCase = Case.getCurrentCase(); // get the most updated case
+    SleuthkitCase tempDb = currentCase.getSleuthkitCase();
+    try
+    {
+       ResultSet uniqueresults = tempDb.runQuery("SELECT DISTINCT value_text from blackboard_attributes where attribute_type_id = '10' order by value_text ASC");
+        while(uniqueresults.next())
+        {  
+           table.append("<strong>").append(uniqueresults.getString("value_text")).append("</strong>");
+           table.append("<table><thead><tr><th>").append("File Name").append("</th><th>Preview</th><th>Keyword List</th></tr><tbody>");
+           ArrayList<BlackboardArtifact> artlist = new ArrayList<BlackboardArtifact>();
+           ResultSet tempresults = tempDb.runQuery("select DISTINCT artifact_id from blackboard_attributes where attribute_type_id = '10' and value_text = '" + uniqueresults.getString("value_text") +"'");
+            while(tempresults.next())
+            {
+                artlist.add(tempDb.getBlackboardArtifact(tempresults.getLong("artifact_id")));
+            }
+            for(BlackboardArtifact art : artlist)
+            {
+              String filename = tempDb.getFsContentById(art.getObjectID()).getName();
+              String preview = "";
+              String set = "";
+              table.append("<tr><td>").append(filename).append("</td>");
+              ArrayList<BlackboardAttribute> tempatts = art.getAttributes();
+                for(BlackboardAttribute att : tempatts)
+                {                  
+                    if(att.getAttributeTypeID() == 12)
+                    {
+                        preview = "<td>" + att.getValueString() + "</td>";
+                    }
+                    if(att.getAttributeTypeID() == 13)
+                    {
+                        set = "<td>" + att.getValueString() + "</td>";
+                    }
+                }
+                table.append(preview).append(set).append("</tr>");
+            }
+           
+           
+           table.append("</tbody></table><br /><br />");
+        }
+    }
+    catch (Exception e)
+    {
+        Logger.getLogger(report.class.getName()).log(Level.INFO, "Exception occurred", e);
+    }
+    
+    String result = table.toString();
+    return result;
+}
+
 }

Report/src/org/sleuthkit/autopsy/report/reportHTML.java

@@ -5,7 +5,6 @@
 package org.sleuthkit.autopsy.report;
 
 import java.io.BufferedWriter;
-import java.io.File;
 import java.io.FileWriter;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
@@ -13,13 +12,16 @@ import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.Map.Entry;
+import java.util.TreeMap;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.sleuthkit.autopsy.casemodule.Case;
+import org.sleuthkit.autopsy.ingest.IngestManager;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.BlackboardAttribute;
 import org.sleuthkit.datamodel.FsContent;
 import org.sleuthkit.datamodel.SleuthkitCase;
+import org.sleuthkit.datamodel.TskData;
 
 /**
  *
@@ -31,16 +33,65 @@ public class reportHTML {
     public static StringBuilder formatted_Report = new StringBuilder();
     public static String htmlPath = "";
 public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> report, reportFilter rr){
-            
+    
+    //This is literally a terrible way to count up all the types of artifacts, and doesn't include any added ones. 
+    //Unlike the XML report, which is dynamic, this is formatted and needs to be redone later instead of being hardcoded.
+   
+      int countGen = 0;
+      int countWebBookmark = 0;
+      int countWebCookie = 0;
+      int countWebHistory = 0;
+      int countWebDownload = 0;
+      int countRecentObjects = 0;
+      int countTrackPoint = 0;
+      int countInstalled = 0;
+      int countKeyword = 0;
+      int countHash = 0;
+      for (Entry<BlackboardArtifact,ArrayList<BlackboardAttribute>> entry : report.entrySet()) {
+                    if(entry.getKey().getArtifactTypeID() == 1){  
+                        countGen++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 2){
+                        countWebBookmark++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 3){
+
+                        countWebCookie++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 4){
+
+                        countWebHistory++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 5){
+                         countWebDownload++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 6){
+                         countRecentObjects++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 7){
+                         countTrackPoint++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 8){
+                         countInstalled++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 9){
+                         countKeyword++;
+                    }
+                    if(entry.getKey().getArtifactTypeID() == 10){
+                         countHash++;
+                    } 
+    }
             
         try{
+            
+             String ingestwarning = "<h2 style=\"color: red;\">Warning, this report was run before ingest services completed!</h2>";
              Case currentCase = Case.getCurrentCase(); // get the most updated case
              SleuthkitCase skCase = currentCase.getSleuthkitCase();
              String caseName = currentCase.getName();
-             String rrpath = System.getProperty("user.dir");
-             rrpath = rrpath.substring(0, rrpath.length()-14);
-             rrpath = rrpath + "autopsy\\thirdparty\\";
              Integer imagecount = currentCase.getImageIDs().length;
+             Integer totalfiles = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG);
+             Integer totaldirs = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR);
+             int reportsize = report.size();
              Integer filesystemcount = currentCase.getRootObjectsCount();
              DateFormat datetimeFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");
              DateFormat dateFormat = new SimpleDateFormat("MM-dd-yyyy");
@@ -68,20 +119,27 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
             // Add summary information now
            
             formatted_Report.append("<h1>Report for Case: ").append(caseName).append("</h1>");
+            if(IngestManager.getDefault().isIngestRunning())
+            {
+                formatted_Report.append(ingestwarning);
+            }
             formatted_Report.append("<h2>Case Summary</h2><p>HTML Report Generated by <strong>Autopsy 3</strong> on ").append(datetime).append("<br /><ul>");
             formatted_Report.append("<li># of Images: ").append(imagecount).append("</li>");
             formatted_Report.append("<li>FileSystems: ").append(filesystemcount).append("</li>");
-            String tableHeader = "<table><thead><tr><th>Artifact ID</th><th>Name</th><th>Size</th><th>Attribute</th><th>Value</th></tr></thead><tbody>";
+            formatted_Report.append("<li># of Files: ").append(totalfiles.toString()).append("</li>");
-             StringBuilder nodeGen = new StringBuilder("<h3>General Information</h3>" + tableHeader);
+            formatted_Report.append("<li># of Dirs: ").append(totaldirs.toString()).append("</li>");
-             StringBuilder nodeWebBookmark =  new StringBuilder("<h3>Web Bookmarks</h3>" + tableHeader);
+            formatted_Report.append("<li># of Artifacts: ").append(reportsize).append("</li>");
-             StringBuilder nodeWebCookie =  new StringBuilder("<h3>Web Cookies</h3>" + tableHeader);
+            String tableHeader = "<table><thead><tr><th>Artifact ID</th><th>Name</th><th>Size</th>";
-             StringBuilder nodeWebHistory =  new StringBuilder("<h3>Web History</h3>" + tableHeader);
+             StringBuilder nodeGen = new StringBuilder("<h3>General Information (").append(countGen).append(")</h3>").append(tableHeader).append("<th>Attribute</th><th>Value</th></tr></thead><tbody>");
-             StringBuilder nodeWebDownload =  new StringBuilder("<h3>Web Downloads</h3>" + tableHeader);
+             StringBuilder nodeWebBookmark =  new StringBuilder("<h3>Web Bookmarks (").append(countWebBookmark).append(")</h3>").append(tableHeader).append("<th>URL</th><th>Title</th><th>Program</th></tr></thead><tbody>");
-             StringBuilder nodeRecentObjects =  new StringBuilder("<h3>Recent Documents</h3>" + tableHeader);
+             StringBuilder nodeWebCookie =  new StringBuilder("<h3>Web Cookies (").append(countWebCookie).append(")</h3>").append(tableHeader).append("<th>URL</th><th>Date</th><th>Name</th><th>Value</th><th>Program</th></tr></thead><tbody>");
-             StringBuilder nodeTrackPoint =  new StringBuilder("<h3>Track Points</h3>" + tableHeader);
+             StringBuilder nodeWebHistory =  new StringBuilder("<h3>Web History (").append(countWebHistory).append(")</h3>").append(tableHeader).append("<th>URL</th><th>Date</th><th>Referrer</th><th>Title</th><th>Program</th></tr></thead><tbody>");
-             StringBuilder nodeInstalled =  new StringBuilder("<h3>Installed Programs</h3>" + tableHeader);
+             StringBuilder nodeWebDownload =  new StringBuilder("<h3>Web Downloads (").append(countWebDownload).append(")</h3>").append(tableHeader).append("<th>Attribute</th><th>Value</th></tr></thead><tbody>");
-             StringBuilder nodeKeyword =  new StringBuilder("<h3>Keyword Search Hits</h3>" + tableHeader);
+             StringBuilder nodeRecentObjects =  new StringBuilder("<h3>Recent Documents (").append(countRecentObjects).append(")</h3>").append(tableHeader).append("<th>Name</th><th>Path</th></tr></thead><tbody>");
-             StringBuilder nodeHash =  new StringBuilder("<h3>Hashset Hits</h3>" + tableHeader);
+             StringBuilder nodeTrackPoint =  new StringBuilder("<h3>Track Points (").append(countTrackPoint).append(")</h3>").append(tableHeader).append("<th>Attribute</th><th>Value</th></tr></thead><tbody>");
+             StringBuilder nodeInstalled =  new StringBuilder("<h3>Installed Programs (").append(countInstalled).append(")</h3>").append(tableHeader).append("<th>Attribute</th><th>Value</th></tr></thead><tbody>");
+             StringBuilder nodeKeyword =  new StringBuilder("<h3>Keyword Search Hits (").append(countKeyword).append(")</h3>");
+             StringBuilder nodeHash =  new StringBuilder("<h3>Hashset Hits (").append(countHash).append(")</h3>").append(tableHeader).append("<th>File Name</th><th>Hashset Name</th></tr></thead><tbody>");
             
              for (Entry<BlackboardArtifact,ArrayList<BlackboardAttribute>> entry : report.entrySet()) {
                  if(reportFilter.cancel == true){
@@ -94,57 +152,87 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
                 FsContent file = skCase.getFsContentById(objId);
            
                 Long filesize = file.getSize();
-                
+                 artifact.append("<tr><td>").append(objId.toString());
-               
+                 artifact.append("</td><td><strong>").append(file.getName().toString()).append("</strong></td>");
-                
+                 artifact.append("<td>").append(filesize.toString()).append("</td>");  
-                    // Get all the attributes for this guy
+                 
+                 TreeMap<Integer, String> attributes = new TreeMap<Integer,String>();
+                    // Get all the attributes, line them up to be added.
                      for (BlackboardAttribute tempatt : entry.getValue())
                          {
-                              if(reportFilter.cancel == true){
+                             if(reportFilter.cancel == true){
                                  break;
                                  }
-                          artifact.append("<tr><td>").append(objId.toString());
-                           artifact.append("</td><td><strong>").append(file.getName().toString()).append("</strong></td>");
-                            //artifact.append("Path: ").append(file.getParentPath());
-                            artifact.append("<td>").append(filesize.toString()).append("</td>");    
-                          StringBuilder attribute = new StringBuilder("<td>").append(tempatt.getAttributeTypeDisplayName()).append("</td>");
-                          attribute.append("<td>").append(tempatt.getValueString()).append("</td></tr>");
-                          //attribute.append("<li style=\"list-style-type: none;\"> Context:  ").append(tempatt.getContext()).append("</li>");
                           
-                          artifact.append(attribute);
+                         int type = tempatt.getAttributeTypeID();
+                         String value = tempatt.getValueString();
+                          attributes.put(type, value);
                           cc++;
                          }
-                    //artifact.append("</tr>");
+                     
+                    
                     if(entry.getKey().getArtifactTypeID() == 1){  
+                        
+                        artifact.append("</tr>");
                         nodeGen.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 2){
+                        artifact.append("<td>").append(attributes.get(1)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(3)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(4)).append("</td>");
+                        artifact.append("</tr>");
                         nodeWebBookmark.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 3){
-
+                        artifact.append("<td>").append(attributes.get(1)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(2)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(3)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(6)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(4)).append("</td>");
+                        artifact.append("</tr>");
                         nodeWebCookie.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 4){
-
+                        artifact.append("<td>").append(attributes.get(1)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(2)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(32)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(3)).append("</td>");
+                        artifact.append("<td>").append(attributes.get(4)).append("</td>");
+                        artifact.append("</tr>");
                         nodeWebHistory.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 5){
+                        
+                         artifact.append("</tr>");
                          nodeWebDownload.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 6){
+                        
+                         artifact.append("</tr>");
                          nodeRecentObjects.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 7){
+                        
+                         artifact.append("</tr>");
                          nodeTrackPoint.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 8){
+                        
+                         artifact.append("</tr>");
                          nodeInstalled.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 9){
-                         nodeKeyword.append(artifact);
+                         
+                       //  artifact.append("<table><thead><tr><th>Artifact ID</th><th>Name</th><th>Size</th>");
+                         
+                     //    artifact.append("</tr></table>");
+                     //    nodeKeyword.append(artifact);
                     }
                     if(entry.getKey().getArtifactTypeID() == 10){
+                        
+                         artifact.append("<td>").append(attributes.get(31)).append("</td>");
+                         artifact.append("<td>").append(attributes.get(30)).append("</td>");
+                         artifact.append("</tr>");
                          nodeHash.append(artifact);
                     } 
                     cc++;
@@ -166,9 +254,15 @@ public reportHTML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> re
             formatted_Report.append(nodeTrackPoint);
             formatted_Report.append("</tbody></table>");
             formatted_Report.append(nodeInstalled);
-            formatted_Report.append("</tbody></table>");
+            formatted_Report.append("</tbody></table>");           
             formatted_Report.append(nodeKeyword);
-            formatted_Report.append("</tbody></table>");
+            if(countKeyword > 0){
+            report keywords = new report();
+            formatted_Report.append(keywords.getGroupedKeywordHit());
+            // "<table><thead><tr><th>Artifact ID</th><th>Name</th><th>Size</th>
+           // formatted_Report.append("</tbody></table>");
+            }
+            
             formatted_Report.append(nodeHash); 
             formatted_Report.append("</tbody></table>");
             //end of master loop

Report/src/org/sleuthkit/autopsy/report/reportInterface.java

@@ -22,4 +22,5 @@ public interface reportInterface{
     public HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> getRecentObject();
     public HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> getHashHit();
     public HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> getKeywordHit();
+    public String getGroupedKeywordHit();
 }

Report/src/org/sleuthkit/autopsy/report/reportXML.java

@@ -19,6 +19,7 @@ import org.jdom.Document.*;
 import org.jdom.Element;
 import org.jdom.output.XMLOutputter;
 import org.sleuthkit.autopsy.casemodule.Case;
+import org.sleuthkit.autopsy.ingest.IngestManager;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.BlackboardAttribute;
 import org.sleuthkit.datamodel.Content;
@@ -27,6 +28,7 @@ import org.sleuthkit.datamodel.Directory;
 import org.sleuthkit.datamodel.File;
 import org.sleuthkit.datamodel.Image;
 import org.sleuthkit.datamodel.SleuthkitCase;
+import org.sleuthkit.datamodel.TskData;
 public class reportXML {
     public static Document xmldoc = new Document();
     public reportXML (HashMap<BlackboardArtifact,ArrayList<BlackboardAttribute>> report, reportFilter rr){
@@ -36,6 +38,8 @@ public class reportXML {
          String caseName = currentCase.getName();
          Integer imagecount = currentCase.getImageIDs().length;
          Integer filesystemcount = currentCase.getRootObjectsCount();
+         Integer totalfiles = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG);
+         Integer totaldirs = skCase.countFsContentType(TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR);
          Element root = new Element("Case");
          xmldoc = new Document(root);
          DateFormat datetimeFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");
@@ -47,9 +51,15 @@ public class reportXML {
          root.addContent(comment);
          //Create summary node involving how many of each type
          Element summary = new Element("Summary");
+          if(IngestManager.getDefault().isIngestRunning())
+            {
+              summary.addContent(new Element("Warning").setText("Report was run before ingest services completed!"));
+            }
          summary.addContent(new Element("Name").setText(caseName));
          summary.addContent(new Element("Total-Images").setText(imagecount.toString()));
          summary.addContent(new Element("Total-FileSystems").setText(filesystemcount.toString()));
+         summary.addContent(new Element("Total-Files").setText(totalfiles.toString()));
+         summary.addContent(new Element("Total-Directories").setText(totaldirs.toString()));
          root.addContent(summary);
          //generate the nodes for each of the types so we can use them later
          Element nodeGen = new Element("General-Information");