diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/AddImageWizardChooseDataSourceVisual.java b/Core/src/org/sleuthkit/autopsy/casemodule/AddImageWizardChooseDataSourceVisual.java index b4c15cc0e2..4476083f1d 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/AddImageWizardChooseDataSourceVisual.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/AddImageWizardChooseDataSourceVisual.java @@ -54,7 +54,7 @@ final class AddImageWizardChooseDataSourceVisual extends JPanel { private JPanel currentPanel; private Map datasourceProcessorsMap = new HashMap<>(); - + List coreDSPTypes = new ArrayList<>(); /** @@ -83,8 +83,14 @@ final class AddImageWizardChooseDataSourceVisual extends JPanel { // make a list of core DSPs // ensure that the core DSPs are at the top and in a fixed order - coreDSPTypes.add(ImageDSProcessor.getType()); - coreDSPTypes.add(LocalDiskDSProcessor.getType()); + coreDSPTypes.add(ImageDSProcessor.getType()); + // Local disk processing is not allowed for multi-user cases + if (Case.getCurrentCase().getCaseType() != Case.CaseType.MULTI_USER_CASE){ + coreDSPTypes.add(LocalDiskDSProcessor.getType()); + } else { + // remove LocalDiskDSProcessor from list of DSPs + datasourceProcessorsMap.remove(LocalDiskDSProcessor.getType()); + } coreDSPTypes.add(LocalFilesDSProcessor.getType()); for (String dspType : coreDSPTypes) { @@ -127,7 +133,7 @@ final class AddImageWizardChooseDataSourceVisual extends JPanel { logger.log(Level.SEVERE, "discoverDataSourceProcessors(): A DataSourceProcessor already exists for type = {0}", dsProcessor.getDataSourceType()); //NON-NLS } } - } + } private void dspSelectionChanged() { // update the current panel to selection diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties index 8adb686daf..e0836e3168 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties @@ -234,3 +234,8 @@ AddImageWizardIngestConfigPanel.CANCEL_BUTTON.text=Cancel NewCaseVisualPanel1.rbSingleUserCase.text=Single-user NewCaseVisualPanel1.rbMultiUserCase.text=Multi-user NewCaseVisualPanel1.lbBadMultiUserSettings.text= +ImageFilePanel.errorLabel.text=Error Label +DataSourceOnCDriveError.text=Path to multi-user data source is on \"C:\" drive +NewCaseVisualPanel1.CaseFolderOnCDriveError.text=Path to multi-user case folder is on \"C:\" drive +LocalFilesPanel.errorLabel.text=Error Label +NewCaseVisualPanel1.errorLabel.text=Error Label diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle_ja.properties b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle_ja.properties index 0d2bd7e942..a3d3832f82 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle_ja.properties +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle_ja.properties @@ -215,3 +215,6 @@ XMLCaseManagement.open.msgDlg.notAutCase.title=\u30a8\u30e9\u30fc ImageFilePanel.noFatOrphansCheckbox.text=FAT\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306e\u30aa\u30fc\u30d5\u30a1\u30f3\u30d5\u30a1\u30a4\u30eb\u306f\u7121\u8996 LocalDiskPanel.noFatOrphansCheckbox.text=FAT\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306e\u30aa\u30fc\u30d5\u30a1\u30f3\u30d5\u30a1\u30a4\u30eb\u306f\u7121\u8996 AddImageWizardIngestConfigPanel.CANCEL_BUTTON.text=\u30ad\u30e3\u30f3\u30bb\u30eb +ImageFilePanel.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb +LocalFilesPanel.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb +NewCaseVisualPanel1.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/CaseMetadata.java b/Core/src/org/sleuthkit/autopsy/casemodule/CaseMetadata.java new file mode 100644 index 0000000000..8ea3e923ab --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/casemodule/CaseMetadata.java @@ -0,0 +1,72 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2011-2015 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.casemodule; + +import java.nio.file.Path; + +/** + * Provides access to case metadata. + */ +public final class CaseMetadata { + + /** + * Exception thrown by the CaseMetadata class when there is a problem + * accessing the metadata for a case. + */ + public final static class CaseMetadataException extends Exception { + + private CaseMetadataException(String message) { + super(message); + } + + private CaseMetadataException(String message, Throwable cause) { + super(message, cause); + } + } + + private final Case.CaseType caseType; + + /** + * Constructs an object that provides access to case metadata. + * + * @param metadataFilePath + */ + public CaseMetadata(Path metadataFilePath) throws CaseMetadataException { + try { + // NOTE: This class will eventually replace XMLCaseManagement. + // This constructor should parse all of the metadata. In the future, + // case metadata may be moved into the case database. + XMLCaseManagement metadata = new XMLCaseManagement(); + metadata.open(metadataFilePath.toString()); + this.caseType = metadata.getCaseType(); + } catch (CaseActionException ex) { + throw new CaseMetadataException(ex.getLocalizedMessage(), ex); + } + } + + /** + * Gets the case type. + * + * @return The case type. + */ + public Case.CaseType getCaseType(Path thePath) { + return this.caseType; + } + +} diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/CaseNewAction.java b/Core/src/org/sleuthkit/autopsy/casemodule/CaseNewAction.java index 3be5ec7c57..1b89f6f432 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/CaseNewAction.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/CaseNewAction.java @@ -20,6 +20,9 @@ package org.sleuthkit.autopsy.casemodule; import java.awt.event.ActionEvent; +import org.openide.util.HelpCtx; +import org.openide.util.NbBundle; +import org.openide.util.actions.CallableSystemAction; import org.openide.util.actions.SystemAction; import org.openide.util.lookup.ServiceProvider; @@ -29,7 +32,7 @@ import org.openide.util.lookup.ServiceProvider; * @author jantonius */ @ServiceProvider(service = CaseNewActionInterface.class) -public final class CaseNewAction implements CaseNewActionInterface { +public final class CaseNewAction extends CallableSystemAction implements CaseNewActionInterface { private NewCaseWizardAction wizard = SystemAction.get(NewCaseWizardAction.class); @@ -41,4 +44,18 @@ public final class CaseNewAction implements CaseNewActionInterface { public void actionPerformed(ActionEvent e) { wizard.performAction(); } + + @Override + public void performAction() { + } + + @Override + public String getName() { + return NbBundle.getMessage(CaseNewAction.class, "CTL_CaseNewAction"); + } + + @Override + public HelpCtx getHelpCtx() { + return HelpCtx.DEFAULT_HELP; + } } diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.form b/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.form index b4dbaafd63..bfccc9bdd9 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.form +++ b/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.form @@ -43,6 +43,7 @@ + @@ -57,7 +58,9 @@ - + + + @@ -66,7 +69,7 @@ - + @@ -131,5 +134,15 @@ + + + + + + + + + + diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.java b/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.java index 045fe691a4..e9f518eb80 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.java @@ -37,6 +37,7 @@ import org.sleuthkit.autopsy.coreutils.ModuleSettings; import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import java.util.logging.Level; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.coreutils.PathValidator; /** * ImageTypePanel for adding an image file such as .img, .E0x, .00x, etc. @@ -62,6 +63,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener { fc.setFileSelectionMode(JFileChooser.FILES_ONLY); fc.setMultiSelectionEnabled(false); + errorLabel.setVisible(false); + boolean firstFilter = true; for (FileFilter filter: fileChooserFilters ) { if (firstFilter) { // set the first on the list as the default selection @@ -76,7 +79,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener { this.contextName = context; pcs = new PropertyChangeSupport(this); - createTimeZoneList(); + createTimeZoneList(); } /** @@ -98,7 +101,6 @@ public class ImageFilePanel extends JPanel implements DocumentListener { } - /** * This method is called from within the constructor to initialize the form. * WARNING: Do NOT modify this code. The content of this method is always @@ -115,6 +117,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener { timeZoneComboBox = new javax.swing.JComboBox(); noFatOrphansCheckbox = new javax.swing.JCheckBox(); descLabel = new javax.swing.JLabel(); + errorLabel = new javax.swing.JLabel(); setMinimumSize(new java.awt.Dimension(0, 65)); setPreferredSize(new java.awt.Dimension(403, 65)); @@ -139,6 +142,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener { org.openide.awt.Mnemonics.setLocalizedText(descLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.descLabel.text")); // NOI18N + errorLabel.setForeground(new java.awt.Color(255, 0, 0)); + org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.errorLabel.text")); // NOI18N + javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); this.setLayout(layout); layout.setHorizontalGroup( @@ -158,7 +164,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener { .addComponent(noFatOrphansCheckbox) .addGroup(layout.createSequentialGroup() .addGap(21, 21, 21) - .addComponent(descLabel))) + .addComponent(descLabel)) + .addComponent(errorLabel)) .addGap(0, 20, Short.MAX_VALUE)) ); layout.setVerticalGroup( @@ -169,7 +176,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener { .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) .addComponent(browseButton) .addComponent(pathTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)) - .addGap(18, 18, 18) + .addGap(3, 3, 3) + .addComponent(errorLabel) + .addGap(1, 1, 1) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) .addComponent(timeZoneLabel) .addComponent(timeZoneComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)) @@ -177,7 +186,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener { .addComponent(noFatOrphansCheckbox) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addComponent(descLabel) - .addContainerGap(13, Short.MAX_VALUE)) + .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) ); }// //GEN-END:initComponents @@ -211,6 +220,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener { // Variables declaration - do not modify//GEN-BEGIN:variables private javax.swing.JButton browseButton; private javax.swing.JLabel descLabel; + private javax.swing.JLabel errorLabel; private javax.swing.JCheckBox noFatOrphansCheckbox; private javax.swing.JLabel pathLabel; private javax.swing.JTextField pathTextField; @@ -255,19 +265,33 @@ public class ImageFilePanel extends JPanel implements DocumentListener { * @return true if a proper image has been selected, false otherwise */ public boolean validatePanel() { + errorLabel.setVisible(false); String path = getContentPaths(); if (path == null || path.isEmpty()) { return false; } + // display warning if there is one (but don't disable "next" button) + warnIfPathIsInvalid(path); + boolean isExist = Case.pathExists(path); boolean isPhysicalDrive = Case.isPhysicalDrive(path); boolean isPartition = Case.isPartition(path); return (isExist || isPhysicalDrive || isPartition); } - - + + /** + * Validates path to selected data source and displays warning if it is invalid. + * @param path Absolute path to the selected data source + */ + private void warnIfPathIsInvalid(String path){ + if (!PathValidator.isValid(path, Case.getCurrentCase().getCaseType())) { + errorLabel.setVisible(true); + errorLabel.setText(NbBundle.getMessage(this.getClass(), "DataSourceOnCDriveError.text")); + } + } + public void storeSettings() { String imagePathName = getContentPaths(); if (null != imagePathName ) { diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.form b/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.form index d71086457c..55707d9f0c 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.form +++ b/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.form @@ -61,7 +61,7 @@ - + diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.java b/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.java index 38d067c153..3cf6b40bc6 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.java @@ -92,11 +92,11 @@ final class LocalDiskPanel extends JPanel { model = new LocalDiskModel(); diskComboBox.setModel(model); diskComboBox.setRenderer(model); - + + errorLabel.setVisible(false); errorLabel.setText(""); diskComboBox.setEnabled(false); - - } + } /** * This method is called from within the constructor to initialize the form. @@ -167,7 +167,7 @@ final class LocalDiskPanel extends JPanel { .addComponent(noFatOrphansCheckbox) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addComponent(descLabel) - .addContainerGap(21, Short.MAX_VALUE)) + .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) ); }// //GEN-END:initComponents // Variables declaration - do not modify//GEN-BEGIN:variables @@ -224,7 +224,7 @@ final class LocalDiskPanel extends JPanel { * @return true */ //@Override - public boolean validatePanel() { + public boolean validatePanel() { return enableNext; } diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.form b/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.form index cf08c9c38f..eb9d6182bb 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.form +++ b/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.form @@ -60,6 +60,10 @@ + + + + @@ -67,15 +71,16 @@ - + + - + - - + + @@ -136,5 +141,15 @@ + + + + + + + + + + diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.java b/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.java index 256276809b..f2c1d7d82f 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.java @@ -21,6 +21,8 @@ package org.sleuthkit.autopsy.casemodule; import java.beans.PropertyChangeListener; import java.beans.PropertyChangeSupport; import java.io.File; +import java.util.Arrays; +import java.util.List; import java.util.Set; import java.util.TreeSet; import javax.swing.JFileChooser; @@ -30,7 +32,9 @@ import org.openide.util.NbBundle; import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor; import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import java.util.logging.Level; +import org.sleuthkit.autopsy.casemodule.Case.CaseType; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.coreutils.PathValidator; /** * Add input wizard subpanel for adding local files / dirs to the case */ @@ -42,6 +46,7 @@ import org.sleuthkit.autopsy.coreutils.Logger; private static LocalFilesPanel instance; public static final String FILES_SEP = ","; private static final Logger logger = Logger.getLogger(LocalFilesPanel.class.getName()); + /** * Creates new form LocalFilesPanel */ @@ -59,9 +64,9 @@ import org.sleuthkit.autopsy.coreutils.Logger; private void customInit() { localFileChooser.setMultiSelectionEnabled(true); + errorLabel.setVisible(false); selectedPaths.setText(""); - - } + } //@Override public String getContentPaths() { @@ -91,8 +96,32 @@ import org.sleuthkit.autopsy.coreutils.Logger; //@Override public boolean validatePanel() { + + // display warning if there is one (but don't disable "next" button) + warnIfPathIsInvalid(getContentPaths()); + return enableNext; } + + /** + * Validates path to selected data source and displays warning if it is invalid. + * @param path Absolute path to the selected data source + */ + private void warnIfPathIsInvalid(String path) { + errorLabel.setVisible(false); + + // Path variable for "Local files" module is a coma separated string containg multiple paths + List pathsList = Arrays.asList(path.split(",")); + CaseType currentCaseType = Case.getCurrentCase().getCaseType(); + + for (String currentPath : pathsList) { + if (!PathValidator.isValid(currentPath, currentCaseType)) { + errorLabel.setVisible(true); + errorLabel.setText(NbBundle.getMessage(this.getClass(), "DataSourceOnCDriveError.text")); + return; + } + } + } //@Override public void select() { @@ -104,6 +133,7 @@ import org.sleuthkit.autopsy.coreutils.Logger; currentFiles.clear(); selectedPaths.setText(""); enableNext = false; + errorLabel.setVisible(false); //pcs.firePropertyChange(AddImageWizardChooseDataSourceVisual.EVENT.UPDATE_UI.toString(), false, true); } @@ -149,6 +179,7 @@ import org.sleuthkit.autopsy.coreutils.Logger; clearButton = new javax.swing.JButton(); jScrollPane2 = new javax.swing.JScrollPane(); selectedPaths = new javax.swing.JTextArea(); + errorLabel = new javax.swing.JLabel(); localFileChooser.setApproveButtonText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonText")); // NOI18N localFileChooser.setApproveButtonToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonToolTipText")); // NOI18N @@ -184,6 +215,9 @@ import org.sleuthkit.autopsy.coreutils.Logger; selectedPaths.setToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.selectedPaths.toolTipText")); // NOI18N jScrollPane2.setViewportView(selectedPaths); + errorLabel.setForeground(new java.awt.Color(255, 0, 0)); + org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.errorLabel.text")); // NOI18N + javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); this.setLayout(layout); layout.setHorizontalGroup( @@ -198,19 +232,23 @@ import org.sleuthkit.autopsy.coreutils.Logger; .addComponent(selectButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) .addComponent(clearButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) .addGap(2, 2, 2)) + .addGroup(layout.createSequentialGroup() + .addComponent(errorLabel) + .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createSequentialGroup() .addComponent(infoLabel) .addGap(5, 5, 5) - .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false) + .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 82, javax.swing.GroupLayout.PREFERRED_SIZE) .addGroup(layout.createSequentialGroup() .addComponent(selectButton) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 17, Short.MAX_VALUE) - .addComponent(clearButton)) - .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE)) - .addGap(0, 0, 0)) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) + .addComponent(clearButton))) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) + .addComponent(errorLabel)) ); }// //GEN-END:initComponents @@ -258,6 +296,7 @@ import org.sleuthkit.autopsy.coreutils.Logger; // Variables declaration - do not modify//GEN-BEGIN:variables private javax.swing.JButton clearButton; + private javax.swing.JLabel errorLabel; private javax.swing.JLabel infoLabel; private javax.swing.JScrollPane jScrollPane1; private javax.swing.JScrollPane jScrollPane2; diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.form b/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.form index 37314730b4..dc370e00cd 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.form +++ b/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.form @@ -23,33 +23,49 @@ - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - + - - + - @@ -73,12 +89,14 @@ - + - + + + @@ -158,6 +176,9 @@ + + + @@ -168,6 +189,9 @@ + + + @@ -182,5 +206,15 @@ + + + + + + + + + + diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.java b/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.java index 4dd63ca497..0ca9173fee 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.java @@ -29,6 +29,7 @@ import javax.swing.event.DocumentEvent; import javax.swing.event.DocumentListener; import org.sleuthkit.autopsy.casemodule.Case.CaseType; import org.sleuthkit.autopsy.core.UserPreferences; +import org.sleuthkit.autopsy.coreutils.PathValidator; import org.sleuthkit.datamodel.CaseDbConnectionInfo; import org.sleuthkit.datamodel.TskData.DbType; @@ -40,10 +41,11 @@ import org.sleuthkit.datamodel.TskData.DbType; final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { private JFileChooser fc = new JFileChooser(); - private NewCaseWizardPanel1 wizPanel; + private NewCaseWizardPanel1 wizPanel; NewCaseVisualPanel1(NewCaseWizardPanel1 wizPanel) { initComponents(); + errorLabel.setVisible(false); lbBadMultiUserSettings.setText(""); this.wizPanel = wizPanel; caseNameTextField.getDocument().addDocumentListener(this); @@ -145,6 +147,7 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { rbSingleUserCase = new javax.swing.JRadioButton(); rbMultiUserCase = new javax.swing.JRadioButton(); lbBadMultiUserSettings = new javax.swing.JLabel(); + errorLabel = new javax.swing.JLabel(); jLabel1.setFont(new java.awt.Font("Tahoma", 1, 14)); // NOI18N org.openide.awt.Mnemonics.setLocalizedText(jLabel1, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.jLabel1.text_1")); // NOI18N @@ -171,14 +174,27 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { caseTypeButtonGroup.add(rbSingleUserCase); org.openide.awt.Mnemonics.setLocalizedText(rbSingleUserCase, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.rbSingleUserCase.text")); // NOI18N + rbSingleUserCase.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + rbSingleUserCaseActionPerformed(evt); + } + }); caseTypeButtonGroup.add(rbMultiUserCase); org.openide.awt.Mnemonics.setLocalizedText(rbMultiUserCase, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.rbMultiUserCase.text")); // NOI18N + rbMultiUserCase.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + rbMultiUserCaseActionPerformed(evt); + } + }); lbBadMultiUserSettings.setFont(new java.awt.Font("Tahoma", 0, 12)); // NOI18N lbBadMultiUserSettings.setForeground(new java.awt.Color(255, 0, 0)); org.openide.awt.Mnemonics.setLocalizedText(lbBadMultiUserSettings, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.lbBadMultiUserSettings.text")); // NOI18N + errorLabel.setForeground(new java.awt.Color(255, 0, 0)); + org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.errorLabel.text")); // NOI18N + javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); this.setLayout(layout); layout.setHorizontalGroup( @@ -186,27 +202,37 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { .addGroup(layout.createSequentialGroup() .addContainerGap() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(jLabel2) .addGroup(layout.createSequentialGroup() - .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING, false) - .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup() + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addComponent(jLabel2) + .addGroup(layout.createSequentialGroup() + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING) + .addComponent(caseDirTextField, javax.swing.GroupLayout.Alignment.LEADING) + .addGroup(layout.createSequentialGroup() + .addGap(0, 58, Short.MAX_VALUE) + .addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 372, javax.swing.GroupLayout.PREFERRED_SIZE)) + .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup() + .addComponent(jLabel1) + .addGap(0, 0, Short.MAX_VALUE)) + .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup() + .addComponent(caseDirLabel) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) + .addComponent(caseParentDirTextField)) + .addGroup(layout.createSequentialGroup() + .addComponent(caseNameLabel) + .addGap(26, 26, 26) + .addComponent(caseNameTextField))) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) + .addComponent(caseDirBrowseButton))) + .addContainerGap()) + .addGroup(layout.createSequentialGroup() + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addGroup(layout.createSequentialGroup() .addComponent(rbSingleUserCase) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addComponent(rbMultiUserCase)) - .addComponent(jLabel1, javax.swing.GroupLayout.Alignment.LEADING) - .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup() - .addComponent(caseDirLabel) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) - .addComponent(caseParentDirTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 296, javax.swing.GroupLayout.PREFERRED_SIZE)) - .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup() - .addComponent(caseNameLabel) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) - .addComponent(caseNameTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 296, javax.swing.GroupLayout.PREFERRED_SIZE)) - .addComponent(caseDirTextField, javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 372, javax.swing.GroupLayout.PREFERRED_SIZE)) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) - .addComponent(caseDirBrowseButton))) - .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) + .addComponent(errorLabel)) + .addGap(0, 0, Short.MAX_VALUE)))) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) @@ -226,11 +252,13 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { .addComponent(jLabel2) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addComponent(caseDirTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE) - .addGap(18, 18, 18) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE) .addComponent(rbSingleUserCase) .addComponent(rbMultiUserCase)) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) + .addComponent(errorLabel) + .addGap(1, 1, 1) .addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE) .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) ); @@ -261,6 +289,16 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { } }//GEN-LAST:event_caseDirBrowseButtonActionPerformed + private void rbSingleUserCaseActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_rbSingleUserCaseActionPerformed + this.wizPanel.fireChangeEvent(); + updateUI(null); // DocumentEvent is not used inside updateUI + }//GEN-LAST:event_rbSingleUserCaseActionPerformed + + private void rbMultiUserCaseActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_rbMultiUserCaseActionPerformed + this.wizPanel.fireChangeEvent(); + updateUI(null); // DocumentEvent is not used inside updateUI + }//GEN-LAST:event_rbMultiUserCaseActionPerformed + // Variables declaration - do not modify//GEN-BEGIN:variables private javax.swing.JButton caseDirBrowseButton; private javax.swing.JLabel caseDirLabel; @@ -269,6 +307,7 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { private javax.swing.JTextField caseNameTextField; private javax.swing.JTextField caseParentDirTextField; private javax.swing.ButtonGroup caseTypeButtonGroup; + private javax.swing.JLabel errorLabel; private javax.swing.JLabel jLabel1; private javax.swing.JLabel jLabel2; private javax.swing.JLabel lbBadMultiUserSettings; @@ -320,10 +359,13 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { * @param e the document event */ public void updateUI(DocumentEvent e) { + + // Note: DocumentEvent e can be null when called from rbSingleUserCaseActionPerformed() + // and rbMultiUserCaseActionPerformed(). String caseName = getCaseName(); String parentDir = getCaseParentDir(); - + if (!caseName.equals("") && !parentDir.equals("")) { caseDirTextField.setText(parentDir + caseName); wizPanel.setIsFinish(true); @@ -331,5 +373,21 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener { caseDirTextField.setText(""); wizPanel.setIsFinish(false); } + + // display warning if there is one (but don't disable "next" button) + warnIfPathIsInvalid(parentDir); } + + /** + * Validates path to selected case output folder. Displays warning if path is invalid. + * + * @param path Absolute path to the selected case folder + */ + private void warnIfPathIsInvalid(String path) { + errorLabel.setVisible(false); + if (!PathValidator.isValid(path, getCaseType())) { + errorLabel.setVisible(true); + errorLabel.setText(NbBundle.getMessage(this.getClass(), "NewCaseVisualPanel1.CaseFolderOnCDriveError.text")); + } + } } diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseWizardPanel1.java b/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseWizardPanel1.java index 92bad320dd..ccdb48b951 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseWizardPanel1.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/NewCaseWizardPanel1.java @@ -35,7 +35,6 @@ import org.openide.WizardDescriptor; import org.openide.WizardValidationException; import org.openide.util.HelpCtx; import org.sleuthkit.autopsy.casemodule.Case.CaseType; -import org.sleuthkit.autopsy.core.UserPreferences; import org.sleuthkit.autopsy.coreutils.ModuleSettings; /** diff --git a/Core/src/org/sleuthkit/autopsy/core/layer.xml b/Core/src/org/sleuthkit/autopsy/core/layer.xml index 6eaba7d184..8bd8328eca 100644 --- a/Core/src/org/sleuthkit/autopsy/core/layer.xml +++ b/Core/src/org/sleuthkit/autopsy/core/layer.xml @@ -44,7 +44,6 @@ - diff --git a/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessor.java b/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessor.java index e150e871ac..f76f6b29a1 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessor.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessor.java @@ -21,69 +21,70 @@ package org.sleuthkit.autopsy.corecomponentinterfaces; import javax.swing.JPanel; -/* - * Defines an interface used by the Add DataSource wizard to discover different - * Data SourceProcessors. +/** + * Interface used by the Add DataSource wizard to allow different + * types of data sources to be added to a case. Examples of data + * sources include disk images, local files, etc. * - * Each data source may have its unique attributes and may need to be processed - * differently. - * - * The DataSourceProcessor interface defines a uniform mechanism for the Autopsy UI + * The interface provides a uniform mechanism for the Autopsy UI * to: - * - collect details for the data source to be processed. - * - Process the data source in the background - * - Be notified when the processing is complete + * - Collect details from the user about the data source to be processed. + * - Process the data source in the background and add data to the database + * - Provides progress feedback to the user / UI. */ public interface DataSourceProcessor { - /* + /** * The DSP Panel may fire Property change events * The caller must enure to add itself as a listener and * then react appropriately to the events */ enum DSP_PANEL_EVENT { - - UPDATE_UI, // the content of JPanel has changed that MAY warrant updates to the caller UI - FOCUS_NEXT // the caller UI may move focus the the next UI element, following the panel. + UPDATE_UI, ///< the content of JPanel has changed that MAY warrant updates to the caller UI + FOCUS_NEXT ///< the caller UI may move focus the the next UI element, following the panel. }; /** * Returns the type of Data Source it handles. * This name gets displayed in the drop-down listbox - **/ + */ String getDataSourceType(); /** * Returns the picker panel to be displayed along with any other - * runtime options supported by the data source handler. - **/ + * runtime options supported by the data source handler. The + * DSP is responsible for storing the settings so that a later + * call to run() will have the user-specified settings. + * + * Should be less than 544 pixels wide and 173 pixels high. + */ JPanel getPanel(); /** * Called to validate the input data in the panel. * Returns true if no errors, or * Returns false if there is an error. - **/ + */ boolean isPanelValid(); /** - * Called to invoke the handling of Data source in the background. - * Returns after starting the background thread - * @param settings wizard settings to read/store properties - * @param progressPanel progress panel to be updated while processing + * Called to invoke the handling of data source in the background. + * Returns after starting the background thread. * - **/ + * @param progressPanel progress panel to be updated while processing + * @param dspCallback Contains the callback method DataSourceProcessorCallback.done() that the DSP must call when the background thread finishes with errors and status. + */ void run(DataSourceProcessorProgressMonitor progressPanel, DataSourceProcessorCallback dspCallback); /** * Called to cancel the background processing. - **/ + */ void cancel(); /** * Called to reset/reinitialize the DSP. - **/ + */ void reset(); } diff --git a/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorCallback.java b/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorCallback.java index 1b69c03c17..76acfd2efc 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorCallback.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorCallback.java @@ -16,7 +16,6 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.sleuthkit.autopsy.corecomponentinterfaces; import java.awt.EventQueue; @@ -25,42 +24,52 @@ import org.sleuthkit.datamodel.Content; /** * Abstract class for a callback for a DataSourceProcessor. - * - * Ensures that DSP invokes the caller overridden method, doneEDT(), - * in the EDT thread. - * + * + * Ensures that DSP invokes the caller overridden method, doneEDT(), in the EDT + * thread. + * */ public abstract class DataSourceProcessorCallback { - - public enum DataSourceProcessorResult - { - NO_ERRORS, - CRITICAL_ERRORS, - NONCRITICAL_ERRORS, + + public enum DataSourceProcessorResult { + NO_ERRORS, ///< No errors were encountered while ading the data source + CRITICAL_ERRORS, ///< No data was added to the database. There were fundamental errors processing the data (such as no data or system failure). + NONCRITICAL_ERRORS, ///< There was data added to the database, but there were errors from data corruption or a small number of minor issues. }; + - /* - * Invoke the caller supplied callback function on the EDT thread + /** + * Called by a DSP implementation when it is done adding a data source + * to the database. Users of the DSP can override this method if they do + * not want to be notified on the EDT. Otherwise, this method will call + * doneEDT() with the same arguments. + * @param result Code for status + * @param errList List of error strings + * @param newContents List of root Content objects that were added to database. Typically only one is given. */ - public void done(DataSourceProcessorResult result, List errList, List newContents) - { - + public void done(DataSourceProcessorResult result, List errList, List newContents) { + final DataSourceProcessorResult resultf = result; final List errListf = errList; final List newContentsf = newContents; - - // Invoke doneEDT() that runs on the EDT . - EventQueue.invokeLater(new Runnable() { - @Override - public void run() { - doneEDT(resultf, errListf, newContentsf ); - - } - }); + + // Invoke doneEDT() that runs on the EDT . + EventQueue.invokeLater(new Runnable() { + @Override + public void run() { + doneEDT(resultf, errListf, newContentsf); + } + }); } - - /* - * calling code overrides to provide its own calllback - */ - public abstract void doneEDT(DataSourceProcessorResult result, List errList, List newContents); + + /** + * Called by done() if the default implementation is used. Users of DSPs + * that have UI updates to do after the DSP is finished adding the DS can + * implement this method to receive the updates on the EDT. + * + * @param result Code for status + * @param errList List of error strings + * @param newContents List of root Content objects that were added to database. Typically only one is given. + */ + public abstract void doneEDT(DataSourceProcessorResult result, List errList, List newContents); }; diff --git a/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorProgressMonitor.java b/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorProgressMonitor.java index 7495979d71..28001a9d62 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorProgressMonitor.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorProgressMonitor.java @@ -18,10 +18,10 @@ */ package org.sleuthkit.autopsy.corecomponentinterfaces; -/* +/** * An GUI agnostic DataSourceProcessorProgressMonitor interface for DataSourceProcesssors to * indicate progress. - * It models after a JProgressbar though it could use any underlying implementation + * It models after a JProgressbar though it could use any underlying implementation (or NoOps) */ public interface DataSourceProcessorProgressMonitor { diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/FXVideoPanel.java b/Core/src/org/sleuthkit/autopsy/corecomponents/FXVideoPanel.java index 809be1da89..728749ccf6 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/FXVideoPanel.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/FXVideoPanel.java @@ -78,8 +78,10 @@ import org.sleuthkit.datamodel.TskData; @ServiceProvider(service = FrameCapture.class) }) public class FXVideoPanel extends MediaViewVideoPanel { - - private static final String[] EXTENSIONS = new String[]{".mov", ".m4v", ".flv", ".mp4", ".mpg", ".mpeg"}; //NON-NLS + + // Refer to https://docs.oracle.com/javafx/2/api/javafx/scene/media/package-summary.html + // for Javafx supported formats + private static final String[] EXTENSIONS = new String[]{".m4v", ".fxm", ".flv", ".m3u8", ".mp4", ".aif", ".aiff", ".mp3", "m4a", ".wav"}; //NON-NLS private static final List MIMETYPES = Arrays.asList("audio/x-aiff", "video/x-javafx", "video/x-flv", "application/vnd.apple.mpegurl", " audio/mpegurl", "audio/mpeg", "video/mp4", "audio/x-m4a", "video/x-m4v", "audio/x-wav"); //NON-NLS private static final Logger logger = Logger.getLogger(MediaViewVideoPanel.class.getName()); @@ -478,6 +480,10 @@ public class FXVideoPanel extends MediaViewVideoPanel { pauseButton.setOnAction(new EventHandler() { @Override public void handle(ActionEvent e) { + if (mediaPlayer == null) { + return; + } + Status status = mediaPlayer.getStatus(); switch (status) { @@ -496,7 +502,7 @@ public class FXVideoPanel extends MediaViewVideoPanel { // If the MediaPlayer is in an unexpected state, stop playback. mediaPlayer.stop(); setInfoLabelText(NbBundle.getMessage(this.getClass(), - "FXVideoPanel.pauseButton.infoLabel.playbackErr")); + "FXVideoPanel.pauseButton.infoLabel.playbackErr")); break; } } @@ -505,6 +511,10 @@ public class FXVideoPanel extends MediaViewVideoPanel { stopButton.setOnAction(new EventHandler() { @Override public void handle(ActionEvent e) { + if (mediaPlayer == null) { + return; + } + mediaPlayer.stop(); } }); @@ -512,6 +522,10 @@ public class FXVideoPanel extends MediaViewVideoPanel { progressSlider.valueProperty().addListener(new InvalidationListener() { @Override public void invalidated(Observable o) { + if (mediaPlayer == null) { + return; + } + if (progressSlider.isValueChanging()) { mediaPlayer.seek(duration.multiply(progressSlider.getValue() / 100.0)); } @@ -559,6 +573,9 @@ public class FXVideoPanel extends MediaViewVideoPanel { * media. */ private void updateProgress() { + if (mediaPlayer == null) { + return; + } Duration currentTime = mediaPlayer.getCurrentTime(); updateSlider(currentTime); updateTime(currentTime); @@ -634,6 +651,10 @@ public class FXVideoPanel extends MediaViewVideoPanel { @Override public void run() { + if (mediaPlayer == null) { + return; + } + duration = mediaPlayer.getMedia().getDuration(); long durationInMillis = (long) mediaPlayer.getMedia().getDuration().toMillis(); @@ -657,6 +678,10 @@ public class FXVideoPanel extends MediaViewVideoPanel { @Override public void run() { + if (mediaPlayer == null) { + return; + } + Duration beginning = mediaPlayer.getStartTime(); mediaPlayer.stop(); mediaPlayer.pause(); diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/ImageUtils.java b/Core/src/org/sleuthkit/autopsy/coreutils/ImageUtils.java index b5944cd2b4..f8ad010859 100755 --- a/Core/src/org/sleuthkit/autopsy/coreutils/ImageUtils.java +++ b/Core/src/org/sleuthkit/autopsy/coreutils/ImageUtils.java @@ -33,11 +33,9 @@ import java.util.List; import java.util.logging.Level; import javax.imageio.ImageIO; import javax.swing.ImageIcon; -import org.openide.util.Exceptions; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.corelibs.ScalrWrapper; import org.sleuthkit.datamodel.AbstractFile; -import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; import org.sleuthkit.datamodel.Content; @@ -55,7 +53,11 @@ public class ImageUtils { private static final Logger logger = Logger.getLogger(ImageUtils.class.getName()); private static final Image DEFAULT_ICON = new ImageIcon("/org/sleuthkit/autopsy/images/file-icon.png").getImage(); //NON-NLS private static final List SUPP_EXTENSIONS = Arrays.asList(ImageIO.getReaderFileSuffixes()); - private static final List SUPP_MIME_TYPES = Arrays.asList(ImageIO.getReaderMIMETypes()); + private static final List SUPP_MIME_TYPES = new ArrayList<>(Arrays.asList(ImageIO.getReaderMIMETypes())); + static { + SUPP_MIME_TYPES.add("image/x-ms-bmp"); + } + /** * Get the default Icon, which is the icon for a file. * @return @@ -88,14 +90,17 @@ public class ImageUtils { return true; } } + // if the file type is known and we don't support it, bail + if (attributes.size() > 0) { + return false; + } } catch (TskCoreException ex) { logger.log(Level.WARNING, "Error while getting file signature from blackboard.", ex); //NON-NLS } - final String extension = f.getNameExtension(); - // if we have an extension, check it + final String extension = f.getNameExtension(); if (extension.equals("") == false) { // Note: thumbnail generator only supports JPG, GIF, and PNG for now if (SUPP_EXTENSIONS.contains(extension)) { @@ -109,7 +114,8 @@ public class ImageUtils { /** - * Get an icon of a specified size. + * Get a thumbnail of a specified size. Generates the image if it is + * not already cached. * * @param content * @param iconSize @@ -118,6 +124,7 @@ public class ImageUtils { public static Image getIcon(Content content, int iconSize) { Image icon; // If a thumbnail file is already saved locally + // @@@ Bug here in that we do not refer to size in the cache. File file = getFile(content.getId()); if (file.exists()) { try { @@ -125,7 +132,7 @@ public class ImageUtils { if (bicon == null) { icon = DEFAULT_ICON; } else if (bicon.getWidth() != iconSize) { - icon = generateAndSaveIcon(content, iconSize); + icon = generateAndSaveIcon(content, iconSize, file); } else { icon = bicon; } @@ -134,18 +141,17 @@ public class ImageUtils { icon = DEFAULT_ICON; } } else { // Make a new icon - icon = generateAndSaveIcon(content, iconSize); + icon = generateAndSaveIcon(content, iconSize, file); } return icon; } /** - * Get the cached file of the icon. Generates the icon and its file if it - * doesn't already exist, so this method guarantees to return a file that - * exists. + * Get a thumbnail of a specified size. Generates the image if it is + * not already cached. * @param content * @param iconSize - * @return + * @return File object for cached image. Is guaranteed to exist. */ public static File getIconFile(Content content, int iconSize) { if (getIcon(content, iconSize) != null) { @@ -155,13 +161,12 @@ public class ImageUtils { } /** - * Get the cached file of the content object with the given id. - * - * The returned file may not exist. + * Get a file object for where the cached icon should exist. The returned file may not exist. * * @param id * @return */ + // TODO: This should be private and be renamed to something like getCachedThumbnailLocation(). public static File getFile(long id) { return new File(Case.getCurrentCase().getCacheDirectory() + File.separator + id + ".png"); } @@ -223,18 +228,24 @@ public class ImageUtils { } - private static Image generateAndSaveIcon(Content content, int iconSize) { + /** + * Generate an icon and save it to specified location. + * @param content File to generate icon for + * @param iconSize + * @param saveFile Location to save thumbnail to + * @return Generated icon or null on error + */ + private static Image generateAndSaveIcon(Content content, int iconSize, File saveFile) { Image icon = null; try { icon = generateIcon(content, iconSize); if (icon == null) { return DEFAULT_ICON; } else { - File f = getFile(content.getId()); - if (f.exists()) { - f.delete(); + if (saveFile.exists()) { + saveFile.delete(); } - ImageIO.write((BufferedImage) icon, "png", getFile(content.getId())); //NON-NLS + ImageIO.write((BufferedImage) icon, "png", saveFile); //NON-NLS } } catch (IOException ex) { logger.log(Level.WARNING, "Could not write cache thumbnail: " + content, ex); //NON-NLS @@ -243,14 +254,15 @@ public class ImageUtils { } /* - * Generate a scaled image + * Generate and return a scaled image */ private static BufferedImage generateIcon(Content content, int iconSize) { InputStream inputStream = null; + BufferedImage bi = null; try { inputStream = new ReadContentInputStream(content); - BufferedImage bi = ImageIO.read(inputStream); + bi = ImageIO.read(inputStream); if (bi == null) { logger.log(Level.WARNING, "No image reader for file: " + content.getName()); //NON-NLS return null; @@ -258,7 +270,13 @@ public class ImageUtils { BufferedImage biScaled = ScalrWrapper.resizeFast(bi, iconSize); return biScaled; - } catch (OutOfMemoryError e) { + } catch (IllegalArgumentException e) { + // if resizing does not work due to extremely small height/width ratio, + // crop the image instead. + BufferedImage biCropped = ScalrWrapper.cropImage(bi, Math.min(iconSize, bi.getWidth()), Math.min(iconSize, bi.getHeight())); + return biCropped; + } + catch (OutOfMemoryError e) { logger.log(Level.WARNING, "Could not scale image (too large): " + content.getName(), e); //NON-NLS return null; } catch (Exception e) { diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/PathValidator.java b/Core/src/org/sleuthkit/autopsy/coreutils/PathValidator.java new file mode 100644 index 0000000000..b4d842fd88 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/coreutils/PathValidator.java @@ -0,0 +1,57 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2013-2014 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.sleuthkit.autopsy.coreutils; + +import java.util.regex.Matcher; +import java.util.regex.Pattern; +import org.sleuthkit.autopsy.casemodule.Case; + +/** + * Validates absolute path (e.g. to a data source or case output folder) depending on case type. + */ +public final class PathValidator { + + private static final Pattern driveLetterPattern = Pattern.compile("^[Cc]:.*$"); + public static boolean isValid(String path, Case.CaseType caseType) { + + if (caseType == Case.CaseType.MULTI_USER_CASE) { + // check that path is not on "C:" drive + if (pathOnCDrive(path)) { + return false; + } + } else { + // single user case - no validation needed + } + + return true; + } + + + /** + * Checks whether a file path contains drive letter defined by pattern. + * + * @param filePath Input file absolute path + * @return true if path matches the pattern, false otherwise. + */ + private static boolean pathOnCDrive(String filePath) { + Matcher m = driveLetterPattern.matcher(filePath); + return m.find(); + } +} \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/directorytree/CollapseAction.java b/Core/src/org/sleuthkit/autopsy/directorytree/CollapseAction.java index d554f63e04..5ed8778618 100644 --- a/Core/src/org/sleuthkit/autopsy/directorytree/CollapseAction.java +++ b/Core/src/org/sleuthkit/autopsy/directorytree/CollapseAction.java @@ -44,7 +44,14 @@ class CollapseAction extends AbstractAction { // Collapse all BeanTreeView tree = DirectoryTreeTopComponent.findInstance().getTree(); - collapseAll(tree, selectedNode[0]); + if(selectedNode.length != 0) { + collapseSelectedNode(tree, selectedNode[0]); + } else { + // If no node is selected, all the level-2 nodes (children of the + // root node) are collapsed. + for(Node childOfRoot: em.getRootContext().getChildren().getNodes()) + collapseSelectedNode(tree, childOfRoot); + } } /** @@ -53,13 +60,13 @@ class CollapseAction extends AbstractAction { * @param tree the given tree * @param currentNode the current selectedNode */ - private void collapseAll(BeanTreeView tree, Node currentNode) { + private void collapseSelectedNode(BeanTreeView tree, Node currentNode) { Children c = currentNode.getChildren(); for (Node next : c.getNodes()) { if (tree.isExpanded(next)) { - this.collapseAll(tree, next); + this.collapseSelectedNode(tree, next); } } diff --git a/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterNode.java b/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterNode.java index 15da98c0b7..dbbb906a4e 100755 --- a/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterNode.java +++ b/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterNode.java @@ -39,6 +39,7 @@ import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Directory; import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.TskCoreException; +import org.sleuthkit.datamodel.VirtualDirectory; /** * This class sets the actions for the nodes in the directory tree and creates @@ -106,22 +107,35 @@ class DirectoryTreeFilterNode extends FilterNode { actions.add(ExtractAction.getInstance()); } - // file search action final Image img = this.getLookup().lookup(Image.class); - if (img != null) { - actions.add(new FileSearchAction( - NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.openFileSrcByAttr.text"))); + + VirtualDirectory virtualDirectory = this.getLookup().lookup(VirtualDirectory.class); + // determine if the virtualDireory is at root-level (Logical File Set). + boolean isRootVD = false; + if (virtualDirectory != null) { + try { + if (virtualDirectory.getParent() == null) { + isRootVD = true; + } + } catch (TskCoreException ex) { + logger.log(Level.WARNING, "Error determining the parent of the virtual directory", ex); // NON-NLS + } } - //ingest action - actions.add(new AbstractAction( - NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.runIngestMods.text")) { - @Override - public void actionPerformed(ActionEvent e) { - final RunIngestModulesDialog ingestDialog = new RunIngestModulesDialog(Collections.singletonList(content)); - ingestDialog.display(); - } - }); + // 'run ingest' action and 'file search' action are added only if the + // selected node is img node or a root level virtual directory. + if (img != null || isRootVD) { + actions.add(new FileSearchAction( + NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.openFileSrcByAttr.text"))); + actions.add(new AbstractAction( + NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.runIngestMods.text")) { + @Override + public void actionPerformed(ActionEvent e) { + final RunIngestModulesDialog ingestDialog = new RunIngestModulesDialog(Collections.singletonList(content)); + ingestDialog.display(); + } + }); + } } //check if delete actions should be added diff --git a/Core/src/org/sleuthkit/autopsy/directorytree/ExtractUnallocAction.java b/Core/src/org/sleuthkit/autopsy/directorytree/ExtractUnallocAction.java index 1b1b284d34..dc580d41f8 100644 --- a/Core/src/org/sleuthkit/autopsy/directorytree/ExtractUnallocAction.java +++ b/Core/src/org/sleuthkit/autopsy/directorytree/ExtractUnallocAction.java @@ -165,8 +165,7 @@ import org.sleuthkit.datamodel.VolumeSystem; * Gets all the unallocated files in a given Content. * * @param c Content to get Unallocated Files from - * @return A list if it didn't crash List may be empty. Returns - * null on failure. + * @return A list if it didn't crash List may be empty. */ private List getUnallocFiles(Content c) { UnallocVisitor uv = new UnallocVisitor(); @@ -178,7 +177,7 @@ import org.sleuthkit.datamodel.VolumeSystem; } catch (TskCoreException tce) { logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at sending out the visitor ", tce); //NON-NLS } - return null; + return Collections.emptyList(); } /** @@ -372,7 +371,7 @@ import org.sleuthkit.datamodel.VolumeSystem; * return the single instance of unallocated space. * * @param lf the LayoutFile the visitor encountered - * @return A list of size 1, returns null if it fails + * @return A list of size 1 */ @Override public List visit(final org.sleuthkit.datamodel.LayoutFile lf) { @@ -389,7 +388,7 @@ import org.sleuthkit.datamodel.VolumeSystem; * * @param fs the FileSystem the visitor encountered * @return A list containing the layout files from - * subsequent Visits(), returns null if it fails + * subsequent Visits(), or an empty list */ @Override public List visit(FileSystem fs) { @@ -402,7 +401,7 @@ import org.sleuthkit.datamodel.VolumeSystem; } catch (TskCoreException tce) { logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at visiting FileSystem " + fs.getId(), tce); //NON-NLS } - return null; + return Collections.emptyList(); } /** @@ -410,12 +409,12 @@ import org.sleuthkit.datamodel.VolumeSystem; * * @param vd VirtualDirectory the visitor encountered * @return A list containing all the LayoutFile in ld, - * returns null if it fails + * or an empty list. */ @Override public List visit(VirtualDirectory vd) { try { - List lflst = new ArrayList(); + List lflst = new ArrayList<>(); for (Content layout : vd.getChildren()) { lflst.add((LayoutFile) layout); } @@ -423,7 +422,7 @@ import org.sleuthkit.datamodel.VolumeSystem; } catch (TskCoreException tce) { logger.log(Level.WARNING, "Could not get list of Layout Files, failed at visiting Layout Directory", tce); //NON-NLS } - return null; + return Collections.emptyList(); } /** @@ -432,7 +431,7 @@ import org.sleuthkit.datamodel.VolumeSystem; * * @param dir the directory this visitor encountered * @return A list containing LayoutFiles encountered during - * subsequent Visits(), returns null if it fails + * subsequent Visits(), or an empty list. */ @Override public List visit(Directory dir) { @@ -445,12 +444,12 @@ import org.sleuthkit.datamodel.VolumeSystem; } catch (TskCoreException tce) { logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at visiting Directory " + dir.getId(), tce); //NON-NLS } - return null; + return Collections.emptyList(); } @Override protected List defaultVisit(Content cntnt) { - return null; + return Collections.emptyList(); } } diff --git a/Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java index a6dc6af76b..e3420e0468 100755 --- a/Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java @@ -98,7 +98,7 @@ class SampleFileIngestModule implements FileIngestModule { @Override public IngestModule.ProcessResult process(AbstractFile file) { - if (attrId != -1) { + if (attrId == -1) { return IngestModule.ProcessResult.ERROR; } diff --git a/Core/src/org/sleuthkit/autopsy/ingest/DataSourceIngestPipeline.java b/Core/src/org/sleuthkit/autopsy/ingest/DataSourceIngestPipeline.java index 8e5fedbcf6..7bd84436d6 100755 --- a/Core/src/org/sleuthkit/autopsy/ingest/DataSourceIngestPipeline.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/DataSourceIngestPipeline.java @@ -24,6 +24,7 @@ import java.util.List; import java.util.logging.Level; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.datamodel.Content; /** @@ -110,6 +111,11 @@ final class DataSourceIngestPipeline { logger.log(Level.INFO, "{0} analysis of {1} (jobId={2}) finished", new Object[]{module.getDisplayName(), this.job.getDataSource().getName(), this.job.getDataSource().getId()}); } catch (Throwable ex) { // Catch-all exception firewall errors.add(new IngestModuleError(module.getDisplayName(), ex)); + String msg = ex.getMessage(); + // Jython run-time errors don't seem to have a message, but have details in toString. + if (msg == null) + msg = ex.toString(); + MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg); } if (this.job.isCancelled()) { break; diff --git a/Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java b/Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java index 78db0b482d..7fb43176fc 100755 --- a/Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java @@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.ingest; import java.util.ArrayList; import java.util.Date; import java.util.List; +import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil; import org.sleuthkit.datamodel.AbstractFile; /** @@ -119,6 +120,11 @@ final class FileIngestPipeline { module.process(file); } catch (Throwable ex) { // Catch-all exception firewall errors.add(new IngestModuleError(module.getDisplayName(), ex)); + String msg = ex.getMessage(); + // Jython run-time errors don't seem to have a message, but have details in toString. + if (msg == null) + msg = ex.toString(); + MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg); } if (this.job.isCancelled()) { break; @@ -144,6 +150,11 @@ final class FileIngestPipeline { module.shutDown(); } catch (Throwable ex) { // Catch-all exception firewall errors.add(new IngestModuleError(module.getDisplayName(), ex)); + String msg = ex.getMessage(); + // Jython run-time errors don't seem to have a message, but have details in toString. + if (msg == null) + msg = ex.toString(); + MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg); } } this.running = false; diff --git a/Core/src/org/sleuthkit/autopsy/modules/exif/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/exif/Bundle.properties index 2987fc2ae8..d50338a4b5 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/exif/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/modules/exif/Bundle.properties @@ -6,3 +6,4 @@ OpenIDE-Module-Name=ExifParser OpenIDE-Module-Short-Description=Exif metadata ingest module ExifParserFileIngestModule.moduleName.text=Exif Parser ExifParserFileIngestModule.getDesc.text=Ingests JPEG files and retrieves their EXIF metadata. +ExifParserFileIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector. \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java index a045f48a5e..013247c086 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2011-2014 Basis Technology Corp. + * Copyright 2011-2015 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -34,13 +34,14 @@ import java.util.Collection; import java.util.Date; import java.util.concurrent.atomic.AtomicInteger; import java.util.logging.Level; -import org.sleuthkit.autopsy.coreutils.ImageUtils; +import org.openide.util.NbBundle; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.ingest.FileIngestModule; import org.sleuthkit.autopsy.ingest.IngestJobContext; import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter; +import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; @@ -59,10 +60,11 @@ public final class ExifParserFileIngestModule implements FileIngestModule { private static final Logger logger = Logger.getLogger(ExifParserFileIngestModule.class.getName()); private final IngestServices services = IngestServices.getInstance(); - private AtomicInteger filesProcessed = new AtomicInteger(0); + private final AtomicInteger filesProcessed = new AtomicInteger(0); private volatile boolean filesToFire = false; private long jobId; private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter(); + private FileTypeDetector fileTypeDetector; ExifParserFileIngestModule() { } @@ -71,9 +73,13 @@ public final class ExifParserFileIngestModule implements FileIngestModule { public void startUp(IngestJobContext context) throws IngestModuleException { jobId = context.getJobId(); refCounter.incrementAndGet(jobId); + try { + fileTypeDetector = new FileTypeDetector(); + } catch (FileTypeDetector.FileTypeDetectorInitException ex) { + throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "ExifParserFileIngestModule.startUp.fileTypeDetectorInitializationException.msg")); + } } - - + @Override public ProcessResult process(AbstractFile content) { //skip unalloc @@ -197,7 +203,12 @@ public final class ExifParserFileIngestModule implements FileIngestModule { * @return true if to be processed */ private boolean parsableFormat(AbstractFile f) { - return ImageUtils.isJpegFileHeader(f); + try { + return fileTypeDetector.getFileType(f).equals("image/jpeg"); + } catch (TskCoreException ex) { + logger.log(Level.SEVERE, "Failed to detect file type", ex); //NON-NLS + return false; + } } @Override diff --git a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/Bundle.properties index 38dd22806b..cca8104c38 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/Bundle.properties @@ -44,3 +44,6 @@ FileTypeIdGlobalSettingsPanel.newTypeButton.text=New FileTypeIdGlobalSettingsPanel.jLabel1.text=Custom File Types FileTypeIdGlobalSettingsPanel.jLabel2.text=MIME Types: FileTypeIdGlobalSettingsPanel.jLabel3.text=Autopsy can automatically detect many file types. Add your custom file types here. +FileTypeIdGlobalSettingsPanel.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector. +FileTypeIdIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector. + diff --git a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java index bd7418d2a2..cd87737537 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java +++ b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java @@ -18,6 +18,7 @@ */ package org.sleuthkit.autopsy.modules.filetypeid; +import java.util.ArrayList; import java.util.Map; import java.util.SortedSet; import org.apache.tika.Tika; @@ -27,6 +28,7 @@ import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskCoreException; +import org.sleuthkit.datamodel.TskData; /** * Detects the type of a file by an inspection of its contents. @@ -94,15 +96,39 @@ public class FileTypeDetector { } /** - * Detect the MIME type of a file, posting it to the blackboard if detection - * succeeds. + * Look up the MIME type of a file using the blackboard. If it is not already + * posted, detect the type of the file, posting it to the blackboard if + * detection succeeds. * * @param file The file to test. - * @param moduleName The name of the module posting to the blackboard. - * @return The MIME type name id detection was successful, null otherwise. - * @throws TskCoreException if there is an error posting to the blackboard. + * @return The MIME type name if detection was successful, null otherwise. + * @throws TskCoreException */ - public synchronized String detectAndPostToBlackboard(AbstractFile file) throws TskCoreException { + public String getFileType(AbstractFile file) throws TskCoreException { + String fileType; + ArrayList attributes = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); + for (BlackboardAttribute attribute : attributes) { + /** + * Get the first TSK_FILE_TYPE_SIG attribute. + */ + fileType = attribute.getValueString(); + if (null != fileType && !fileType.isEmpty()) { + return fileType; + } + } + return detectAndPostToBlackboard(file); + } + + /** + * Detect the MIME type of a file, posting it to the blackboard if detection + * succeeds. Note that this method should currently be called at most once + * per file. + * + * @param file The file to test. + * @return The MIME type name id detection was successful, null otherwise. + * @throws TskCoreException + */ + public String detectAndPostToBlackboard(AbstractFile file) throws TskCoreException { String mimeType = detect(file); if (null != mimeType) { /** @@ -122,9 +148,19 @@ public class FileTypeDetector { * Detect the MIME type of a file. * * @param file The file to test. - * @return The MIME type name id detection was successful, null otherwise. + * @return The MIME type name if detection was successful, null otherwise. + * @throws TskCoreException */ public String detect(AbstractFile file) throws TskCoreException { + // consistently mark non-regular files (refer TskData.TSK_FS_META_TYPE_ENUM), + // 0 sized files, unallocated, and unused blocks (refer TskData.TSK_DB_FILES_TYPE_ENUM) + // as octet-stream. + if (!file.isFile() || file.getSize() <= 0 + || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) + || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)) { + return MimeTypes.OCTET_STREAM; + } + String fileType = detectUserDefinedType(file); if (null == fileType) { try { @@ -164,23 +200,24 @@ public class FileTypeDetector { * * @param file The file to test. * @return The file type name string or null, if no match is detected. + * @throws TskCoreException */ private String detectUserDefinedType(AbstractFile file) throws TskCoreException { for (FileType fileType : userDefinedFileTypes.values()) { if (fileType.matches(file)) { if (fileType.alertOnMatch()) { BlackboardArtifact artifact; - artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); - BlackboardAttribute setNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getFilesSetName()); - artifact.addAttribute(setNameAttribute); + artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); + BlackboardAttribute setNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getFilesSetName()); + artifact.addAttribute(setNameAttribute); - /** - * Use the MIME type as the category, i.e., the rule - * that determined this file belongs to the interesting - * files set. - */ - BlackboardAttribute ruleNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType()); - artifact.addAttribute(ruleNameAttribute); + /** + * Use the MIME type as the category, i.e., the rule that + * determined this file belongs to the interesting files + * set. + */ + BlackboardAttribute ruleNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType()); + artifact.addAttribute(ruleNameAttribute); } return fileType.getMimeType(); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java index f1fe3e26bd..0be2445ed7 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java @@ -27,7 +27,6 @@ import org.sleuthkit.autopsy.ingest.IngestJobContext; import org.sleuthkit.autopsy.ingest.IngestMessage; import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.datamodel.AbstractFile; -import org.sleuthkit.datamodel.TskData; import org.sleuthkit.datamodel.TskData.FileKnown; import org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult; import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter; @@ -83,9 +82,7 @@ public class FileTypeIdIngestModule implements FileIngestModule { try { fileTypeDetector = new FileTypeDetector(); } catch (FileTypeDetector.FileTypeDetectorInitException ex) { - String errorMessage = "Failed to create file type detector"; //NON-NLS - logger.log(Level.SEVERE, errorMessage, ex); - throw new IngestModuleException(errorMessage); + throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "FileTypeIdIngestModule.startUp.fileTypeDetectorInitializationException.msg")); } } @@ -95,15 +92,6 @@ public class FileTypeIdIngestModule implements FileIngestModule { @Override public ProcessResult process(AbstractFile file) { - /** - * Skip unallocated space and unused blocks files. - */ - if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) - || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) - || (file.isFile() == false)) { - return ProcessResult.OK; - } - /** * Skip known files if configured to do so. */ @@ -118,7 +106,7 @@ public class FileTypeIdIngestModule implements FileIngestModule { */ try { long startTime = System.currentTimeMillis(); - fileTypeDetector.detectAndPostToBlackboard(file); + fileTypeDetector.getFileType(file); addToTotals(jobId, (System.currentTimeMillis() - startTime)); return ProcessResult.OK; } catch (Exception e) { diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java index a3d8cc44ba..dcd80a55d4 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java @@ -85,6 +85,11 @@ class CallLogAnalyzer { SleuthkitCase skCase = currentCase.getSleuthkitCase(); try { AbstractFile f = skCase.getAbstractFileById(fId); + if(f == null){ + logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS + return; + } + try { resultSet = statement.executeQuery( "SELECT number,date,duration,type, name FROM calls ORDER BY date DESC;"); //NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java index cb6c9279bf..cc0d05c12d 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java @@ -101,6 +101,11 @@ class ContactAnalyzer { SleuthkitCase skCase = currentCase.getSleuthkitCase(); try { AbstractFile f = skCase.getAbstractFileById(fId); + if(f == null){ + logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS + return; + } + try { // get display_name, mimetype(email or phone number) and data1 (phonenumber or email address depending on mimetype) //sorted by name, so phonenumber/email would be consecutive for a person if they exist. diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java index e32c857793..ff1e5402cd 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java @@ -85,6 +85,11 @@ class TextMessageAnalyzer { SleuthkitCase skCase = currentCase.getSleuthkitCase(); try { AbstractFile f = skCase.getAbstractFileById(fId); + if(f == null){ + logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS + return; + } + try { resultSet = statement.executeQuery( "SELECT address,date,type,subject,body FROM sms;"); //NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java index da78665e73..8a35a4edbf 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java @@ -248,7 +248,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule { */ @Override public void shutDown() { - if (refCounter.decrementAndGet(this.context.getJobId()) == 0) { + if (this.context != null && refCounter.decrementAndGet(this.context.getJobId()) == 0) { try { // The last instance of this module for an ingest job cleans out // the working paths map entry for the job and deletes the temp dir. diff --git a/Core/src/org/sleuthkit/autopsy/modules/sevenzip/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/sevenzip/Bundle.properties index f0540e3482..8f93fde59b 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/sevenzip/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/modules/sevenzip/Bundle.properties @@ -29,3 +29,4 @@ SevenZipIngestModule.unpack.encrFileDetected.msg=Encrypted files in archive dete SevenZipIngestModule.unpack.encrFileDetected.details=Some files in archive\: {0} are encrypted. {1} extractor was unable to extract all files from this archive. SevenZipIngestModule.UnpackStream.write.exception.msg=Error writing unpacked file to\: {0} SevenZipIngestModule.UnpackedTree.exception.msg=Error adding a derived file to db\:{0} +SevenZipIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector. diff --git a/Core/src/org/sleuthkit/autopsy/modules/sevenzip/SevenZipIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/sevenzip/SevenZipIngestModule.java index 16739e0f8a..c8047203cb 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/sevenzip/SevenZipIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/sevenzip/SevenZipIngestModule.java @@ -24,7 +24,6 @@ import java.io.FileNotFoundException; import java.io.FileOutputStream; import java.io.IOException; import java.io.OutputStream; -import java.nio.ByteBuffer; import java.util.ArrayList; import java.util.Collections; import java.util.Date; @@ -62,6 +61,7 @@ import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter; import net.sf.sevenzipjbinding.ArchiveFormat; import static net.sf.sevenzipjbinding.ArchiveFormat.RAR; +import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector; /** * 7Zip ingest module extracts supported archives, adds extracted DerivedFiles, @@ -87,13 +87,10 @@ public final class SevenZipIngestModule implements FileIngestModule { private static final long MIN_FREE_DISK_SPACE = 1 * 1000 * 1000000L; //1GB //counts archive depth private ArchiveDepthCountTree archiveDepthCountTree; - //buffer for checking file headers and signatures - private static final int readHeaderSize = 4; - private final byte[] fileHeaderBuffer = new byte[readHeaderSize]; - private static final int ZIP_SIGNATURE_BE = 0x504B0304; private IngestJobContext context; private long jobId; private final static IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter(); + private FileTypeDetector fileTypeDetector; SevenZipIngestModule() { } @@ -103,6 +100,12 @@ public final class SevenZipIngestModule implements FileIngestModule { this.context = context; jobId = context.getJobId(); + try { + fileTypeDetector = new FileTypeDetector(); + } catch (FileTypeDetector.FileTypeDetectorInitException ex) { + throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "SevenZipIngestModule.startUp.fileTypeDetectorInitializationException.msg")); + } + final Case currentCase = Case.getCurrentCase(); moduleDirRelative = currentCase.getModuleOutputDirectoryRelativePath() + File.separator + ArchiveFileExtractorModuleFactory.getModuleName(); @@ -284,7 +287,7 @@ public final class SevenZipIngestModule implements FileIngestModule { } if (detectedFormat == null) { - logger.log(Level.WARNING, "Could not detect format for file: " + archiveFile); //NON-NLS + logger.log(Level.WARNING, "Could not detect format for file: {0}", archiveFile); //NON-NLS // if we don't have attribute info then use file extension String extension = archiveFile.getNameExtension(); @@ -657,24 +660,12 @@ public final class SevenZipIngestModule implements FileIngestModule { * @return true if zip file, false otherwise */ private boolean isZipFileHeader(AbstractFile file) { - if (file.getSize() < readHeaderSize) { - return false; - } - try { - int bytesRead = file.read(fileHeaderBuffer, 0, readHeaderSize); - if (bytesRead != readHeaderSize) { - return false; - } + return fileTypeDetector.getFileType(file).equals("application/zip"); //NON-NLS } catch (TskCoreException ex) { - //ignore if can't read the first few bytes, not a ZIP + logger.log(Level.SEVERE, "Failed to detect file type", ex); //NON-NLS return false; } - - ByteBuffer bytes = ByteBuffer.wrap(fileHeaderBuffer); - int signature = bytes.getInt(); - - return signature == ZIP_SIGNATURE_BE; } /** diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java b/Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java index e9f7bd4c43..963cc717e6 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java @@ -96,16 +96,16 @@ public class STIXReportModule implements GeneralReportModule { /** * . * - * @param path path to save the report + * @param baseReportDir path to save the report * @param progressPanel panel to update the report's progress */ @Override - public void generateReport(String path, ReportProgressPanel progressPanel) { + public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) { // Start the progress bar and setup the report progressPanel.setIndeterminate(false); progressPanel.start(); progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "STIXReportModule.progress.readSTIX")); - reportPath = path + getRelativeFilePath(); + reportPath = baseReportDir + getRelativeFilePath(); // Check if the user wants to display all output or just hits reportAllResults = configPanel.getShowAllResults(); diff --git a/Core/src/org/sleuthkit/autopsy/python/Bundle.properties b/Core/src/org/sleuthkit/autopsy/python/Bundle.properties index 27d48af5ef..9016f7518a 100755 --- a/Core/src/org/sleuthkit/autopsy/python/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/python/Bundle.properties @@ -1,2 +1,2 @@ JythonModuleLoader.errorMessages.failedToOpenModule=Failed to open {0}. See log for details. -JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0} from {1}. See log for details. \ No newline at end of file +JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0}. {1}. See log for details. \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java b/Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java index 860a2eaaa4..50e9895fd2 100755 --- a/Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java +++ b/Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java @@ -81,8 +81,9 @@ public final class JythonModuleLoader { objects.add( createObjectFromScript(script, className, interfaceClass)); } catch (Exception ex) { logger.log(Level.SEVERE, String.format("Failed to load %s from %s", className, script.getAbsolutePath()), ex); //NON-NLS + // NOTE: using ex.toString() because the current version is always returning null for ex.getMessage(). DialogDisplayer.getDefault().notify(new NotifyDescriptor.Message( - NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, script.getAbsolutePath()), + NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, ex.toString()), NotifyDescriptor.ERROR_MESSAGE)); } } diff --git a/Core/src/org/sleuthkit/autopsy/report/FileReportModule.java b/Core/src/org/sleuthkit/autopsy/report/FileReportModule.java index e69f4c0ac8..393467685b 100755 --- a/Core/src/org/sleuthkit/autopsy/report/FileReportModule.java +++ b/Core/src/org/sleuthkit/autopsy/report/FileReportModule.java @@ -29,9 +29,9 @@ import org.sleuthkit.datamodel.AbstractFile; interface FileReportModule extends ReportModule { /** * Initialize the report which will be stored at the given path. - * @param path + * @param baseReportDir Base directory to store the report file in. Report should go into baseReportDir + getRelativeFilePath(). */ - public void startReport(String path); + public void startReport(String baseReportDir); /** * End the report. diff --git a/Core/src/org/sleuthkit/autopsy/report/FileReportText.java b/Core/src/org/sleuthkit/autopsy/report/FileReportText.java index bdfd7c284c..2dd7e8b676 100755 --- a/Core/src/org/sleuthkit/autopsy/report/FileReportText.java +++ b/Core/src/org/sleuthkit/autopsy/report/FileReportText.java @@ -54,8 +54,8 @@ import org.sleuthkit.datamodel.AbstractFile; } @Override - public void startReport(String path) { - this.reportPath = path + FILE_NAME; + public void startReport(String baseReportDir) { + this.reportPath = baseReportDir + FILE_NAME; try { out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(this.reportPath))); } catch (IOException ex) { diff --git a/Core/src/org/sleuthkit/autopsy/report/GeneralReportModule.java b/Core/src/org/sleuthkit/autopsy/report/GeneralReportModule.java index 08aa476b9f..8d5bf001b0 100644 --- a/Core/src/org/sleuthkit/autopsy/report/GeneralReportModule.java +++ b/Core/src/org/sleuthkit/autopsy/report/GeneralReportModule.java @@ -26,10 +26,10 @@ public interface GeneralReportModule extends ReportModule { * Called to generate the report. Method is responsible for saving the file at the * path specified and updating progress via the progressPanel object. * - * @param reportPath path to save the report + * @param baseReportDir Base directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath(). * @param progressPanel panel to update the report's progress with */ - public void generateReport(String reportPath, ReportProgressPanel progressPanel); + public void generateReport(String baseReportDir, ReportProgressPanel progressPanel); /** * Returns the configuration panel for the report, which is displayed in diff --git a/Core/src/org/sleuthkit/autopsy/report/GeneralReportModuleAdapter.java b/Core/src/org/sleuthkit/autopsy/report/GeneralReportModuleAdapter.java index 6e8bc52500..f66b1c69a2 100755 --- a/Core/src/org/sleuthkit/autopsy/report/GeneralReportModuleAdapter.java +++ b/Core/src/org/sleuthkit/autopsy/report/GeneralReportModuleAdapter.java @@ -38,7 +38,7 @@ public abstract class GeneralReportModuleAdapter implements GeneralReportModule } @Override - public abstract void generateReport(String reportPath, ReportProgressPanel progressPanel); + public abstract void generateReport(String baseReportDir, ReportProgressPanel progressPanel); @Override public JPanel getConfigurationPanel() { diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportBodyFile.java b/Core/src/org/sleuthkit/autopsy/report/ReportBodyFile.java index da99257f56..da730f28d9 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportBodyFile.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportBodyFile.java @@ -63,16 +63,17 @@ import org.sleuthkit.datamodel.*; /** * Generates a body file format report for use with the MAC time tool. - * @param path path to save the report + * @param baseReportDir path to save the report * @param progressPanel panel to update the report's progress */ @Override - public void generateReport(String path, ReportProgressPanel progressPanel) { + @SuppressWarnings("deprecation") + public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) { // Start the progress bar and setup the report progressPanel.setIndeterminate(false); progressPanel.start(); progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportBodyFile.progress.querying")); - reportPath = path + "BodyFile.txt"; //NON-NLS + reportPath = baseReportDir + "BodyFile.txt"; //NON-NLS currentCase = Case.getCurrentCase(); skCase = currentCase.getSleuthkitCase(); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportExcel.java b/Core/src/org/sleuthkit/autopsy/report/ReportExcel.java index c348e79f5c..8b9d6dd7cb 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportExcel.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportExcel.java @@ -58,12 +58,12 @@ import org.sleuthkit.datamodel.TskCoreException; /** * Start the Excel report by creating the Workbook, initializing styles, * and writing the summary. - * @param path path to save the report + * @param baseReportDir path to save the report */ @Override - public void startReport(String path) { + public void startReport(String baseReportDir) { // Set the path and save it for when the report is written to disk. - this.reportPath = path + getRelativeFilePath(); + this.reportPath = baseReportDir + getRelativeFilePath(); // Make a workbook. wb = new XSSFWorkbook(); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java index 9220227c0d..d08bfa6259 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java @@ -806,7 +806,10 @@ import org.sleuthkit.datamodel.TskData; logger.log(Level.WARNING, "Error while getting content from a blackboard artifact to report on.", ex); //NON-NLS return; } - checkIfFileIsImage(file); + + if(file != null){ + checkIfFileIsImage(file); + } } /** @@ -993,8 +996,11 @@ import org.sleuthkit.datamodel.TskData; String list = resultSet.getString("list"); //NON-NLS String uniquePath = ""; - try { - uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + try { + AbstractFile f = skCase.getAbstractFileById(objId); + if(f != null){ + uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + } } catch (TskCoreException ex) { errorList.add( NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID")); @@ -1138,7 +1144,10 @@ import org.sleuthkit.datamodel.TskData; String uniquePath = ""; try { - uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + AbstractFile f = skCase.getAbstractFileById(objId); + if(f != null){ + uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + } } catch (TskCoreException ex) { errorList.add( NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileFromID")); @@ -1801,15 +1810,23 @@ import org.sleuthkit.datamodel.TskData; break; case TSK_EXT_MISMATCH_DETECTED: AbstractFile file = skCase.getAbstractFileById(getObjectID()); - orderedRowData.add(file.getName()); - orderedRowData.add(file.getNameExtension()); - List attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); - if (!attrs.isEmpty()) { - orderedRowData.add(attrs.get(0).getValueString()); + if(file != null){ + orderedRowData.add(file.getName()); + orderedRowData.add(file.getNameExtension()); + List attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); + if (!attrs.isEmpty()) { + orderedRowData.add(attrs.get(0).getValueString()); + } else { + orderedRowData.add(""); + } + orderedRowData.add(file.getUniquePath()); } else { - orderedRowData.add(""); - } - orderedRowData.add(file.getUniquePath()); + // Make empty rows to make sure the formatting is correct + orderedRowData.add(null); + orderedRowData.add(null); + orderedRowData.add(null); + orderedRowData.add(null); + } break; case TSK_OS_INFO: orderedRowData.add(mappedAttributes.get(ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE.getTypeID())); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java index 67a2cbbbf5..18d41df409 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportHTML.java @@ -299,14 +299,14 @@ import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM; /** * Start this report by setting the path, refreshing member variables, * and writing the skeleton for the HTML report. - * @param path path to save the report + * @param baseReportDir path to save the report */ @Override - public void startReport(String path) { + public void startReport(String baseReportDir) { // Refresh the HTML report refresh(); // Setup the path for the HTML report - this.path = path + "HTML Report" + File.separator; //NON-NLS + this.path = baseReportDir + "HTML Report" + File.separator; //NON-NLS this.thumbsPath = this.path + "thumbs" + File.separator; //NON-NLS try { FileUtil.createFolder(new File(this.path)); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportKML.java b/Core/src/org/sleuthkit/autopsy/report/ReportKML.java index 1f6c5a665b..061329bf4a 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportKML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportKML.java @@ -70,18 +70,18 @@ class ReportKML implements GeneralReportModule { /** * Generates a body file format report for use with the MAC time tool. * - * @param path path to save the report + * @param baseReportDir path to save the report * @param progressPanel panel to update the report's progress */ @Override - public void generateReport(String path, ReportProgressPanel progressPanel) { + public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) { // Start the progress bar and setup the report progressPanel.setIndeterminate(false); progressPanel.start(); progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportKML.progress.querying")); - reportPath = path + "ReportKML.kml"; //NON-NLS - String reportPath2 = path + "ReportKML.txt"; //NON-NLS + reportPath = baseReportDir + "ReportKML.kml"; //NON-NLS + String reportPath2 = baseReportDir + "ReportKML.txt"; //NON-NLS currentCase = Case.getCurrentCase(); skCase = currentCase.getSleuthkitCase(); @@ -131,12 +131,14 @@ class ReportKML implements GeneralReportModule { if (lon != 0 && lat != 0) { aFile = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID()); - extractedToPath = reportPath + aFile.getName(); - geoPath = extractedToPath; - f = new File(extractedToPath); - f.createNewFile(); - copyFileUsingStream(aFile, f); - imageName = aFile.getName(); + if(aFile != null){ + extractedToPath = reportPath + aFile.getName(); + geoPath = extractedToPath; + f = new File(extractedToPath); + f.createNewFile(); + copyFileUsingStream(aFile, f); + imageName = aFile.getName(); + } out.write(String.valueOf(lat)); out.write(";"); out.write(String.valueOf(lon)); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportModule.java b/Core/src/org/sleuthkit/autopsy/report/ReportModule.java index 2d0ab6b0d2..7441835263 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportModule.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportModule.java @@ -40,11 +40,11 @@ interface ReportModule { /** * Gets the relative path of the report file, if any, generated by this - * module. The path should be relative to the time stamp subdirectory of - * reports directory. + * module. The path should be relative to the location that gets passed in + * to generateReport() (or similar). * - * @return Report file path relative to the time stamp subdirectory reports - * directory, may be null if the module does not produce a report file. + * @return Relative path to where report will be stored. + * May be null if the module does not produce a report file. */ public String getRelativeFilePath(); } diff --git a/Core/src/org/sleuthkit/autopsy/report/TableReportModule.java b/Core/src/org/sleuthkit/autopsy/report/TableReportModule.java index 448afe753f..cb5e9c3b28 100644 --- a/Core/src/org/sleuthkit/autopsy/report/TableReportModule.java +++ b/Core/src/org/sleuthkit/autopsy/report/TableReportModule.java @@ -35,9 +35,9 @@ import java.util.List; * Start the report. Open any output streams, initialize member variables, * write summary and navigation pages. Considered the "constructor" of the report. * - * @param path String path to save the report + * @param baseReportDir Directory to save the report file into. Report should go into baseReportDir + getRelativeFilePath(). */ - public void startReport(String path); + public void startReport(String baseReportDir); /** * End the report. Close all output streams and write any end-of-report diff --git a/Core/src/org/sleuthkit/autopsy/timeline/TimeLineController.java b/Core/src/org/sleuthkit/autopsy/timeline/TimeLineController.java index 7bd6eb7fe2..703e5f0b0d 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/TimeLineController.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/TimeLineController.java @@ -362,7 +362,7 @@ public class TimeLineController { @SuppressWarnings("deprecation") private long getCaseLastArtifactID(final SleuthkitCase sleuthkitCase) { long caseLastArtfId = -1; - String query = "SELECT MAX(artifact_id) AS max_id FROM blackboard_artifacts"; // NON-NLS + String query = "select Max(artifact_id) as max_id from blackboard_artifacts"; // NON-NLS try (CaseDbQuery dbQuery = sleuthkitCase.executeQuery(query)) { ResultSet resultSet = dbQuery.getResultSet(); while (resultSet.next()) { @@ -573,6 +573,12 @@ public class TimeLineController { monitorTask(selectTimeAndTypeTask); } + /** + * submit a task for execution and add it to the list of tasks whose + * progress is monitored and displayed in the progress bar + * + * @param task + */ synchronized public void monitorTask(final Task task) { if (task != null) { Platform.runLater(() -> { @@ -606,9 +612,16 @@ public class TimeLineController { break; case SCHEDULED: case RUNNING: + case SUCCEEDED: case CANCELLED: case FAILED: + tasks.remove(task); + if (tasks.isEmpty() == false) { + progress.bind(tasks.get(0).progressProperty()); + message.bind(tasks.get(0).messageProperty()); + taskTitle.bind(tasks.get(0).titleProperty()); + } break; } }); diff --git a/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java b/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java index 2d2ec777d9..d07824c96f 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java @@ -250,32 +250,37 @@ public class EventsRepository { } else { try { AbstractFile f = skCase.getAbstractFileById(fID); - //TODO: This is broken for logical files? fix -jm - //TODO: logical files don't necessarily have valid timestamps, so ... -jm - final String uniquePath = f.getUniquePath(); - final String parentPath = f.getParentPath(); - String datasourceName = StringUtils.substringBefore(StringUtils.stripStart(uniquePath, "/"), parentPath); - String rootFolder = StringUtils.substringBetween(parentPath, "/", "/"); - String shortDesc = datasourceName + "/" + StringUtils.defaultIfBlank(rootFolder, ""); - String medD = datasourceName + parentPath; + + if(f != null){ + //TODO: This is broken for logical files? fix -jm + //TODO: logical files don't necessarily have valid timestamps, so ... -jm + final String uniquePath = f.getUniquePath(); + final String parentPath = f.getParentPath(); + String datasourceName = StringUtils.substringBefore(StringUtils.stripStart(uniquePath, "/"), parentPath); + String rootFolder = StringUtils.substringBetween(parentPath, "/", "/"); + String shortDesc = datasourceName + "/" + StringUtils.defaultIfBlank(rootFolder, ""); + String medD = datasourceName + parentPath; - //insert it into the db if time is > 0 => time is legitimate (drops logical files) - if (f.getAtime() > 0) { - eventDB.insertEvent(f.getAtime(), FileSystemTypes.FILE_ACCESSED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } - if (f.getMtime() > 0) { - eventDB.insertEvent(f.getMtime(), FileSystemTypes.FILE_MODIFIED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } - if (f.getCtime() > 0) { - eventDB.insertEvent(f.getCtime(), FileSystemTypes.FILE_CHANGED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } - if (f.getCrtime() > 0) { - eventDB.insertEvent(f.getCrtime(), FileSystemTypes.FILE_CREATED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } + //insert it into the db if time is > 0 => time is legitimate (drops logical files) + if (f.getAtime() > 0) { + eventDB.insertEvent(f.getAtime(), FileSystemTypes.FILE_ACCESSED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } + if (f.getMtime() > 0) { + eventDB.insertEvent(f.getMtime(), FileSystemTypes.FILE_MODIFIED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } + if (f.getCtime() > 0) { + eventDB.insertEvent(f.getCtime(), FileSystemTypes.FILE_CHANGED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } + if (f.getCrtime() > 0) { + eventDB.insertEvent(f.getCrtime(), FileSystemTypes.FILE_CREATED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } - process(Arrays.asList(new ProgressWindow.ProgressUpdate(i, numFiles, - NbBundle.getMessage(this.getClass(), - "EventsRepository.progressWindow.msg.populateMacEventsFiles2"), f.getName()))); + process(Arrays.asList(new ProgressWindow.ProgressUpdate(i, numFiles, + NbBundle.getMessage(this.getClass(), + "EventsRepository.progressWindow.msg.populateMacEventsFiles2"), f.getName()))); + } else { + LOGGER.log(Level.WARNING, "failed to look up data for file : " + fID); // NON-NLS + } } catch (TskCoreException tskCoreException) { LOGGER.log(Level.WARNING, "failed to insert mac event for file : " + fID, tskCoreException); // NON-NLS } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java index db097ad884..375f159cd4 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java @@ -28,6 +28,7 @@ import org.apache.commons.lang3.StringUtils; import org.openide.util.Exceptions; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel; +import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskCoreException; @@ -129,7 +130,11 @@ public enum MiscTypes implements EventType, ArtifactEventType { (BlackboardArtifact t, Map u) -> { try { - return t.getSleuthkitCase().getAbstractFileById(t.getObjectID()).getName(); + AbstractFile f = t.getSleuthkitCase().getAbstractFileById(t.getObjectID()); + if(f != null){ + return f.getName(); + } + return " error loading file name"; // NON-NLS } catch (TskCoreException ex) { Exceptions.printStackTrace(ex); return " error loading file name"; // NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java b/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java index 93c7b469be..b56dc46986 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java @@ -101,13 +101,18 @@ public class EventRootNode extends DisplayableItemNode { if (eventID >= 0) { final TimeLineEvent eventById = filteredEvents.getEventById(eventID); try { - if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) { - return new EventNode(eventById, Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID())); - } else { - AbstractFile file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID()); - BlackboardArtifact blackboardArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(eventById.getArtifactID()); + AbstractFile file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID()); + if(file != null){ + if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) { + return new EventNode(eventById, file); + } else { + BlackboardArtifact blackboardArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(eventById.getArtifactID()); - return new EventNode(eventById, file, blackboardArtifact); + return new EventNode(eventById, file, blackboardArtifact); + } + } else { + LOGGER.log(Level.WARNING, "Failed to lookup sleuthkit object backing TimeLineEvent."); // NON-NLS + return null; } } catch (TskCoreException tskCoreException) { diff --git a/CoreLibs/src/org/sleuthkit/autopsy/corelibs/ScalrWrapper.java b/CoreLibs/src/org/sleuthkit/autopsy/corelibs/ScalrWrapper.java index ef2cf7c876..a5ee9d1c68 100644 --- a/CoreLibs/src/org/sleuthkit/autopsy/corelibs/ScalrWrapper.java +++ b/CoreLibs/src/org/sleuthkit/autopsy/corelibs/ScalrWrapper.java @@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.corelibs; import java.awt.image.BufferedImage; +import java.awt.image.BufferedImageOp; import org.imgscalr.Scalr; import org.imgscalr.Scalr.Method; @@ -48,4 +49,8 @@ import org.imgscalr.Scalr.Method; public static synchronized BufferedImage resizeFast(BufferedImage input, int width, int height) { return Scalr.resize(input, Method.SPEED, Scalr.Mode.AUTOMATIC, width, height, Scalr.OP_ANTIALIAS); } + + public static synchronized BufferedImage cropImage(BufferedImage input, int width, int height) { + return Scalr.crop(input, width, height, (BufferedImageOp) null); + } } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java index fb1825605f..08f00d5df8 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2013 Basis Technology Corp. + * Copyright 2013-15 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -58,9 +58,9 @@ import org.openide.util.Exceptions; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.History; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.imagegallery.datamodel.Category; import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB; import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile; -import org.sleuthkit.autopsy.imagegallery.datamodel.Category; import org.sleuthkit.autopsy.imagegallery.grouping.GroupManager; import org.sleuthkit.autopsy.imagegallery.grouping.GroupViewState; import org.sleuthkit.autopsy.imagegallery.gui.NoGroupsDialog; @@ -158,8 +158,8 @@ public final class ImageGalleryController { public GroupManager getGroupManager() { return groupManager; } - - public DrawableDB getDatabase(){ + + public DrawableDB getDatabase() { return db; } @@ -180,7 +180,7 @@ public final class ImageGalleryController { stale.set(b); }); if (Case.isCaseOpen()) { - new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.MODULE_NAME, PerCaseProperties.STALE, b.toString()); + new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.getModuleName(), PerCaseProperties.STALE, b.toString()); } } @@ -201,7 +201,7 @@ public final class ImageGalleryController { }); groupManager.getAnalyzedGroups().addListener((Observable o) -> { - if(Case.isCaseOpen()){ + if (Case.isCaseOpen()) { checkForGroups(); } }); @@ -335,7 +335,7 @@ public final class ImageGalleryController { */ public synchronized void setCase(Case c) { - this.db = DrawableDB.getDrawableDB(c.getModuleDirectory() + File.separator + IMAGEGALLERY, this); + this.db = DrawableDB.getDrawableDB(c.getModulesOutputDirAbsPath() + File.separator + ImageGalleryModule.getModuleName(), this); setListeningEnabled(ImageGalleryModule.isEnabledforCase(c)); setStale(ImageGalleryModule.isCaseStale(c)); @@ -517,7 +517,7 @@ public final class ImageGalleryController { try { // @@@ Could probably do something more fancy here and check if we've been canceled every now and then InnerTask it = workQueue.take(); - + if (it.cancelled == false) { it.run(); } @@ -631,16 +631,16 @@ public final class ImageGalleryController { */ @Override public void run() { - try{ + try { DrawableFile drawableFile = DrawableFile.create(getFile(), true, db.isVideoFile(getFile())); db.updateFile(drawableFile); - } catch (NullPointerException | TskCoreException ex){ + } catch (NullPointerException | TskCoreException ex) { // This is one of the places where we get many errors if the case is closed during processing. // We don't want to print out a ton of exceptions if this is the case. - if(Case.isCaseOpen()){ + if (Case.isCaseOpen()) { Logger.getLogger(UpdateFileTask.class.getName()).log(Level.SEVERE, "Error in UpdateFile task"); } - } + } } } @@ -658,16 +658,16 @@ public final class ImageGalleryController { */ @Override public void run() { - try{ - db.removeFile(getFile().getId()); - } catch (NullPointerException ex){ + try { + db.removeFile(getFile().getId()); + } catch (NullPointerException ex) { // This is one of the places where we get many errors if the case is closed during processing. // We don't want to print out a ton of exceptions if this is the case. - if(Case.isCaseOpen()){ + if (Case.isCaseOpen()) { Logger.getLogger(RemoveFileTask.class.getName()).log(Level.SEVERE, "Case was closed out from underneath RemoveFile task"); } } - + } } @@ -774,8 +774,9 @@ public final class ImageGalleryController { * netbeans and ImageGallery progress/status */ class PrePopulateDataSourceFiles extends InnerTask { + private final Content dataSource; - + /** * here we grab by extension but in file_done listener we look at file * type id attributes but fall back on jpeg signatures and extensions to @@ -787,7 +788,7 @@ public final class ImageGalleryController { private ProgressHandle progressHandle = ProgressHandleFactory.createHandle("prepopulating image/video database"); /** - + * * @param dataSourceId Data source object ID */ public PrePopulateDataSourceFiles(Content dataSource) { @@ -809,23 +810,22 @@ public final class ImageGalleryController { final List files; try { List fsObjIds = new ArrayList<>(); - + String fsQuery; if (dataSource instanceof Image) { - Image image = (Image)dataSource; + Image image = (Image) dataSource; for (FileSystem fs : image.getFileSystems()) { fsObjIds.add(fs.getId()); } - fsQuery = "(fs_obj_id = " + StringUtils.join(fsObjIds, " OR fs_obj_id = ") + ") "; - } - // NOTE: Logical files currently (Apr '15) have a null value for fs_obj_id in DB. + fsQuery = "(fs_obj_id = " + StringUtils.join(fsObjIds, " or fs_obj_id = ") + ") "; + } // NOTE: Logical files currently (Apr '15) have a null value for fs_obj_id in DB. // for them, we will not specify a fs_obj_id, which means we will grab files // from another data source, but the drawable DB is smart enough to de-dupe them. else { fsQuery = "(fs_obj_id IS NULL) "; } - - files = getSleuthKitCase().findAllFilesWhere(fsQuery + " AND " + DRAWABLE_QUERY); + + files = getSleuthKitCase().findAllFilesWhere(fsQuery + " and " + DRAWABLE_QUERY); progressHandle.switchToDeterminate(files.size()); //do in transaction @@ -853,7 +853,7 @@ public final class ImageGalleryController { Logger.getLogger(PrePopulateDataSourceFiles.class.getName()).log(Level.WARNING, "failed to transfer all database contents", ex); } catch (IllegalStateException | NullPointerException ex) { Logger.getLogger(PrePopulateDataSourceFiles.class.getName()).log(Level.WARNING, "Case was closed out from underneath prepopulating database"); - } + } progressHandle.finish(); } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java index 91ba34260b..603d23a0f9 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2013-14 Basis Technology Corp. + * Copyright 2013-15 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -42,7 +42,11 @@ public class ImageGalleryModule { private static final Logger LOGGER = Logger.getLogger(ImageGalleryModule.class.getName()); - static final String MODULE_NAME = ImageGalleryModule.class.getSimpleName(); + private static final String MODULE_NAME = "Image Gallery"; + + static String getModuleName() { + return MODULE_NAME; + } private static final Set videoExtensions = Sets.newHashSet("aaf", "3gp", "asf", "avi", "m1v", "m2v", "m4v", "mp4", @@ -60,7 +64,7 @@ public class ImageGalleryModule { /** mime types of files we can display */ private static final Set supportedMimes = Sets.union(imageMimes, videoMimes); - public static Set getSupportedMimes() { + static Set getSupportedMimes() { return Collections.unmodifiableSet(supportedMimes); } @@ -99,8 +103,8 @@ public class ImageGalleryModule { } } - public static Set getAllSupportedExtensions() { - return supportedExtensions; + static Set getAllSupportedExtensions() { + return Collections.unmodifiableSet(supportedExtensions); } /** is the given file suported by image analyzer: ie, does it have a @@ -111,7 +115,7 @@ public class ImageGalleryModule { * * @return true if this file is supported or false if not */ - public static Boolean isSupported(AbstractFile file) { + static Boolean isSupported(AbstractFile file) { //if there were no file type attributes, or we failed to read it, fall back on extension and jpeg header return Optional.ofNullable(hasSupportedMimeType(file)).orElseGet(() -> { return supportedExtensions.contains(getFileExtension(file)) @@ -127,7 +131,7 @@ public class ImageGalleryModule { * TSK_GEN_INFO that is in the supported list. False if there was an * unsupported attribute, null if no attributes were found */ - public static Boolean hasSupportedMimeType(AbstractFile file) { + static Boolean hasSupportedMimeType(AbstractFile file) { try { ArrayList fileSignatureAttrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); if (fileSignatureAttrs.isEmpty() == false) { @@ -170,7 +174,7 @@ public class ImageGalleryModule { * @return true if the given {@link AbstractFile} is 'supported' and not * 'known', else false */ - static public boolean isSupportedAndNotKnown(AbstractFile abstractFile) { + public static boolean isSupportedAndNotKnown(AbstractFile abstractFile) { return (abstractFile.getKnown() != TskData.FileKnown.KNOWN) && ImageGalleryModule.isSupported(abstractFile); } } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryOptionsPanel.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryOptionsPanel.java index b80b95d1c0..e08a45a798 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryOptionsPanel.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryOptionsPanel.java @@ -130,7 +130,7 @@ final class ImageGalleryOptionsPanel extends javax.swing.JPanel { ImageGalleryPreferences.setEnabledByDefault(enabledByDefaultBox.isSelected()); ImageGalleryController.getDefault().setListeningEnabled(enabledForCaseBox.isSelected()); if (Case.isCaseOpen()) { - new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.MODULE_NAME, PerCaseProperties.ENABLED, Boolean.toString(enabledForCaseBox.isSelected())); + new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.getModuleName(), PerCaseProperties.ENABLED, Boolean.toString(enabledForCaseBox.isSelected())); } } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/PerCaseProperties.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/PerCaseProperties.java index 9c709b975c..c8d1c66410 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/PerCaseProperties.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/PerCaseProperties.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2013 Basis Technology Corp. + * Copyright 2013-15 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -18,11 +18,12 @@ */ package org.sleuthkit.autopsy.imagegallery; -import java.io.File; -import java.io.FileInputStream; -import java.io.FileOutputStream; import java.io.IOException; import java.io.InputStream; +import java.io.OutputStream; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; import java.util.HashMap; import java.util.Map; import java.util.Properties; @@ -32,7 +33,7 @@ import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Logger; /** - * Provides access to per case module properties + * Provides access to per-case module properties/settings. */ class PerCaseProperties { @@ -40,13 +41,10 @@ class PerCaseProperties { public static final String STALE = "stale"; - private final Case c; + private final Case theCase; - /** - * the constructor - */ PerCaseProperties(Case c) { - this.c = c; + this.theCase = c; } /** @@ -56,19 +54,21 @@ class PerCaseProperties { * @param moduleName - The name of the config file to make * * @return True if successfully created, false if already exists or an error - * is thrown. + * is thrown. */ public synchronized boolean makeConfigFile(String moduleName) { if (!configExists(moduleName)) { - File propPath = new File(getPropertyPath(moduleName)); - File parent = new File(propPath.getParent()); - if (!parent.exists()) { - parent.mkdirs(); - } + Path propPath = getPropertyPath(moduleName); + Path parent = propPath.getParent(); + Properties props = new Properties(); try { - propPath.createNewFile(); - try (FileOutputStream fos = new FileOutputStream(propPath)) { + if (!Files.exists(parent)) { + Files.createDirectories(parent); + } + Files.createFile(propPath); + + try (OutputStream fos = Files.newOutputStream(propPath)) { props.store(fos, ""); } } catch (IOException e) { @@ -88,8 +88,8 @@ class PerCaseProperties { * @return true if the config exists, false otherwise. */ public synchronized boolean configExists(String moduleName) { - File f = new File(getPropertyPath(moduleName)); // NON-NLS - return f.exists(); + Path get = Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties"); + return Files.exists(get); } public synchronized boolean settingExists(String moduleName, String settingName) { @@ -111,16 +111,16 @@ class PerCaseProperties { * @param moduleName - The name of the config file to evaluate * * @return The path of the given config file. Returns null if the config - * file doesn't exist. + * file doesn't exist. */ - private synchronized String getPropertyPath(String moduleName) { - return c.getModuleDirectory() + File.separator + moduleName + File.separator + moduleName + ".properties"; //NON-NLS + private synchronized Path getPropertyPath(String moduleName) { + return Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties"); //NON-NLS } /** * Returns the given properties file's setting as specific by settingName. * - * @param moduleName - The name of the config file to read from. + * @param moduleName - The name of the config file to read from. * @param settingName - The setting name to retrieve. * * @return - the value associated with the setting. @@ -150,7 +150,7 @@ class PerCaseProperties { * @param moduleName - the name of the config file to read from. * * @return - the map of all key:value pairs representing the settings of the - * config. + * config. * * @throws IOException */ @@ -181,8 +181,8 @@ class PerCaseProperties { * Sets the given properties file to the given setting map. * * @param moduleName - The name of the module to be written to. - * @param settings - The mapping of all key:value pairs of settings to add - * to the config. + * @param settings - The mapping of all key:value pairs of settings to add + * to the config. */ public synchronized void setConfigSettings(String moduleName, Map settings) { if (!configExists(moduleName)) { @@ -196,8 +196,7 @@ class PerCaseProperties { props.setProperty(kvp.getKey(), kvp.getValue()); } - File path = new File(getPropertyPath(moduleName)); - try (FileOutputStream fos = new FileOutputStream(path)) { + try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) { props.store(fos, "Changed config settings(batch)"); //NON-NLS } } catch (IOException e) { @@ -208,9 +207,9 @@ class PerCaseProperties { /** * Sets the given properties file to the given settings. * - * @param moduleName - The name of the module to be written to. + * @param moduleName - The name of the module to be written to. * @param settingName - The name of the setting to be modified. - * @param settingVal - the value to set the setting to. + * @param settingVal - the value to set the setting to. */ public synchronized void setConfigSetting(String moduleName, String settingName, String settingVal) { if (!configExists(moduleName)) { @@ -223,8 +222,7 @@ class PerCaseProperties { props.setProperty(settingName, settingVal); - File path = new File(getPropertyPath(moduleName)); - try (FileOutputStream fos = new FileOutputStream(path)) { + try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) { props.store(fos, "Changed config settings(single)"); //NON-NLS } } catch (IOException e) { @@ -236,7 +234,7 @@ class PerCaseProperties { * Removes the given key from the given properties file. * * @param moduleName - The name of the properties file to be modified. - * @param key - the name of the key to remove. + * @param key - the name of the key to remove. */ public synchronized void removeProperty(String moduleName, String key) { if (!configExists(moduleName)) { @@ -249,8 +247,7 @@ class PerCaseProperties { Properties props = fetchProperties(moduleName); props.remove(key); - File path = new File(getPropertyPath(moduleName)); - try (FileOutputStream fos = new FileOutputStream(path)) { + try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) { props.store(fos, "Removed " + key); //NON-NLS } } @@ -274,7 +271,7 @@ class PerCaseProperties { Logger.getLogger(PerCaseProperties.class.getName()).log(Level.INFO, "File did not exist. Created file [" + moduleName + ".properties]"); //NON-NLS NON-NLS } Properties props; - try (InputStream inputStream = new FileInputStream(getPropertyPath(moduleName))) { + try (InputStream inputStream = Files.newInputStream(getPropertyPath(moduleName))) { props = new Properties(); props.load(inputStream); } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ThumbnailCache.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ThumbnailCache.java index ee7c74e981..e22eb75488 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ThumbnailCache.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ThumbnailCache.java @@ -153,6 +153,7 @@ public enum ThumbnailCache { } private static File getCacheFile(long id) { + // @@@ should use ImageUtils.getFile(); return new File(Case.getCurrentCase().getCacheDirectory() + File.separator + id + ".png"); } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java index 7cdd45b0ae..f69d2e63f5 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java @@ -95,22 +95,15 @@ public class CategorizeAction extends AddTagAction { //remove old category tag if necessary List allContentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByContent(file); - boolean hadExistingCategory = false; for (ContentTag ct : allContentTags) { //this is bad: treating tags as categories as long as their names start with prefix //TODO: abandon using tags for categories and instead add a new column to DrawableDB if (ct.getName().getDisplayName().startsWith(Category.CATEGORY_PREFIX)) { - LOGGER.log(Level.INFO, "removing old category from {0}", file.getName()); + //LOGGER.log(Level.INFO, "removing old category from {0}", file.getName()); Case.getCurrentCase().getServices().getTagsManager().deleteContentTag(ct); controller.getDatabase().decrementCategoryCount(Category.fromDisplayName(ct.getName().getDisplayName())); - hadExistingCategory = true; } } - - // If the image was uncategorized, decrement the uncategorized count - if(! hadExistingCategory){ - controller.getDatabase().decrementCategoryCount(Category.ZERO); - } controller.getDatabase().incrementCategoryCount(Category.fromDisplayName(tagName.getDisplayName())); if (tagName != Category.ZERO.getTagName()) { // no tags for cat-0 diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/Category.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/Category.java index dcf0862875..030dc5329d 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/Category.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/Category.java @@ -66,7 +66,7 @@ public enum Category implements Comparable { private final static Set listeners = new HashSet<>(); public static void fireChange(Collection ids) { - Set listenersCopy = new HashSet(listeners); + Set listenersCopy = new HashSet<>(); synchronized (listeners) { listenersCopy.addAll(listeners); } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java index b77d65f710..4af06f8d1a 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java @@ -50,6 +50,8 @@ import org.sleuthkit.autopsy.imagegallery.grouping.GroupManager; import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy; import static org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy.GROUP_BY_VALUE; import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.BlackboardArtifact; +import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.ContentTag; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TagName; @@ -1123,6 +1125,56 @@ public class DrawableDB { } } + /* + * The following groups of functions are used to store information in memory instead + * of in the database. Due to the change listeners in the GUI, this data is requested + * many, many times when browsing the images, and especially when making any + * changes to things like categories. + * + * I don't like having multiple copies of the data, but these were causing major + * bottlenecks when they were all database lookups. + */ + + @GuardedBy("hashSetMap") + private final Map> hashSetMap = new HashMap<>(); + + @GuardedBy("hashSetMap") + public boolean isInHashSet(Long id){ + if(! hashSetMap.containsKey(id)){ + updateHashSetsForFile(id); + } + return (! hashSetMap.get(id).isEmpty()); + } + + @GuardedBy("hashSetMap") + public Set getHashSetsForFile(Long id){ + if(! isInHashSet(id)){ + updateHashSetsForFile(id); + } + return hashSetMap.get(id); + } + + @GuardedBy("hashSetMap") + public void updateHashSetsForFile(Long id){ + + try { + List arts = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, id); + Set hashNames = new HashSet<>(); + for(BlackboardArtifact a:arts){ + List attrs = a.getAttributes(); + for(BlackboardAttribute attr:attrs){ + if(attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()){ + hashNames.add(attr.getValueString()); + } + } + } + hashSetMap.put(id, hashNames); + } catch (IllegalStateException | TskCoreException ex) { + LOGGER.log(Level.WARNING, "could not access case during updateHashSetsForFile()", ex); + + } + } + /** * For performance reasons, keep a list of all file IDs currently in the image database. * Otherwise the database is queried many times to retrieve the same data. @@ -1148,6 +1200,12 @@ public class DrawableDB { } } + public int getNumberOfImageFilesInList(){ + synchronized (fileIDlist){ + return fileIDlist.size(); + } + } + public void initializeImageList(){ synchronized (fileIDlist){ dbReadLock(); @@ -1173,63 +1231,52 @@ public class DrawableDB { private final Map categoryCounts = new HashMap<>(); public void incrementCategoryCount(Category cat) throws TskCoreException{ - synchronized(categoryCounts){ - int count = getCategoryCount(cat); - count++; - categoryCounts.put(cat, count); + if(cat != Category.ZERO){ + synchronized(categoryCounts){ + int count = getCategoryCount(cat); + count++; + categoryCounts.put(cat, count); + } } } public void decrementCategoryCount(Category cat) throws TskCoreException{ - synchronized(categoryCounts){ - int count = getCategoryCount(cat); - count--; - categoryCounts.put(cat, count); + if(cat != Category.ZERO){ + synchronized(categoryCounts){ + int count = getCategoryCount(cat); + count--; + categoryCounts.put(cat, count); + } } } public int getCategoryCount(Category cat) throws TskCoreException{ synchronized(categoryCounts){ - if(categoryCounts.containsKey(cat)){ + if(cat == Category.ZERO){ + // Keeping track of the uncategorized files is a bit tricky while ingest + // is going on, so always use the list of file IDs we already have along with the + // other category counts instead of trying to track it separately. + int allOtherCatCount = getCategoryCount(Category.ONE) + getCategoryCount(Category.TWO) + getCategoryCount(Category.THREE) + + getCategoryCount(Category.FOUR) + getCategoryCount(Category.FIVE); + return getNumberOfImageFilesInList() - allOtherCatCount; + } + else if(categoryCounts.containsKey(cat)){ return categoryCounts.get(cat); } else{ try { - if (cat == Category.ZERO) { - - // Category Zero (Uncategorized) files will not be tagged as such - - // this is really just the default setting. So we count the number of files - // tagged with the other categories and subtract from the total. - int allOtherCatCount = 0; - TagName[] tns = {Category.FOUR.getTagName(), Category.THREE.getTagName(), Category.TWO.getTagName(), Category.ONE.getTagName(), Category.FIVE.getTagName()}; - for (TagName tn : tns) { - List contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn); - for (ContentTag ct : contentTags) { - if(ct.getContent() instanceof AbstractFile){ - AbstractFile f = (AbstractFile)ct.getContent(); - if(this.isImageFile(f.getId())){ - allOtherCatCount++; - } - } - } - } - categoryCounts.put(cat, this.countAllFiles() - allOtherCatCount); - return categoryCounts.get(cat); - } else { - - int fileCount = 0; - List contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(cat.getTagName()); - for (ContentTag ct : contentTags) { - if(ct.getContent() instanceof AbstractFile){ - AbstractFile f = (AbstractFile)ct.getContent(); - if(this.isImageFile(f.getId())){ - fileCount++; - } + int fileCount = 0; + List contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(cat.getTagName()); + for (ContentTag ct : contentTags) { + if(ct.getContent() instanceof AbstractFile){ + AbstractFile f = (AbstractFile)ct.getContent(); + if(this.isImageFile(f.getId())){ + fileCount++; } } - categoryCounts.put(cat, fileCount); - return fileCount; } + categoryCounts.put(cat, fileCount); + return fileCount; } catch(IllegalStateException ex){ throw new TskCoreException("Case closed while getting files"); } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java index 886f70e9a7..c04cb2c900 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java @@ -35,6 +35,7 @@ import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.text.WordUtils; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.imagegallery.ImageGalleryController; import org.sleuthkit.autopsy.imagegallery.ImageGalleryModule; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; @@ -97,8 +98,6 @@ public abstract class DrawableFile extends AbstractFile private final SimpleObjectProperty category = new SimpleObjectProperty<>(null); - private Collection hashHitSetNames; - private String make; private String model; @@ -116,16 +115,11 @@ public abstract class DrawableFile extends AbstractFile public abstract boolean isVideo(); - public Collection getHashHitSetNames() { - updateHashSets(); + synchronized public Collection getHashHitSetNames() { + Collection hashHitSetNames = ImageGalleryController.getDefault().getDatabase().getHashSetsForFile(getId()); return hashHitSetNames; } - @SuppressWarnings("unchecked") - private void updateHashSets() { - hashHitSetNames = (Collection) getValuesOfBBAttribute(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME); - } - @Override public boolean isRoot() { return false; diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/DrawableGroup.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/DrawableGroup.java index 9ad39ac18f..457f1a07e7 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/DrawableGroup.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/DrawableGroup.java @@ -25,14 +25,12 @@ import javafx.collections.FXCollections; import javafx.collections.ObservableList; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.imagegallery.ImageGalleryController; -import org.sleuthkit.datamodel.BlackboardArtifact; -import org.sleuthkit.datamodel.TskCoreException; /** * Represents a set of image/video files in a group. The UI listens to changes * to the group membership and updates itself accordingly. */ -public class DrawableGroup implements Comparable{ +public class DrawableGroup implements Comparable { private static final Logger LOGGER = Logger.getLogger(DrawableGroup.class.getName()); @@ -65,18 +63,26 @@ public class DrawableGroup implements Comparable{ return getFilesWithHashSetHitsCount() / (double) getSize(); } + /** + * Call to indicate that an image has been added or removed from the group, + * so the hash counts may not longer be accurate. + */ + synchronized public void invalidateHashSetHitsCount() { + filesWithHashSetHitsCount = -1; + } + synchronized public int getFilesWithHashSetHitsCount() { //TODO: use the drawable db for this ? -jm if (filesWithHashSetHitsCount < 0) { filesWithHashSetHitsCount = 0; for (Long fileID : fileIds()) { + try { - long artcount = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, fileID); - if (artcount > 0) { + if (ImageGalleryController.getDefault().getDatabase().isInHashSet(fileID)) { filesWithHashSetHitsCount++; } - } catch (IllegalStateException | TskCoreException ex) { - LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()", ex); + } catch (IllegalStateException | NullPointerException ex) { + LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()"); break; } } @@ -109,18 +115,20 @@ public class DrawableGroup implements Comparable{ } synchronized public void addFile(Long f) { + invalidateHashSetHitsCount(); if (fileIDs.contains(f) == false) { fileIDs.add(f); } } synchronized public void removeFile(Long f) { + invalidateHashSetHitsCount(); fileIDs.removeAll(f); } - + // By default, sort by group key name @Override - public int compareTo(DrawableGroup other){ + public int compareTo(DrawableGroup other) { return this.groupKey.getValueDisplayName().compareTo(other.groupKey.getValueDisplayName()); } } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/GroupManager.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/GroupManager.java index 39871d3cf7..72c288b817 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/GroupManager.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/GroupManager.java @@ -281,18 +281,23 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { final DrawableGroup group = getGroupForKey(groupKey); if (group != null) { group.removeFile(fileID); - if (group.fileIds().isEmpty()) { - synchronized (groupMap) { - groupMap.remove(groupKey, group); - } - Platform.runLater(() -> { - analyzedGroups.remove(group); - synchronized (unSeenGroups) { - unSeenGroups.remove(group); - } - }); - } + // If we're grouping by category, we don't want to remove empty groups. + if (group.groupKey.getValueDisplayName().startsWith("CAT-")) { + return; + } else { + if (group.fileIds().isEmpty()) { + synchronized (groupMap) { + groupMap.remove(groupKey, group); + } + Platform.runLater(() -> { + analyzedGroups.remove(group); + synchronized (unSeenGroups) { + unSeenGroups.remove(group); + } + }); + } + } } } @@ -317,13 +322,13 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { * was still running) */ if (task == null || (task.isCancelled() == false)) { DrawableGroup g = makeGroup(groupKey, filesInGroup); - + populateAnalyzedGroup(g, task); } } - + private synchronized > void populateAnalyzedGroup(final DrawableGroup g, ReGroupTask task) { - + if (task == null || (task.isCancelled() == false)) { final boolean groupSeen = db.isGroupSeen(g.groupKey); Platform.runLater(() -> { @@ -427,7 +432,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { * @return */ @SuppressWarnings({"unchecked"}) - public > List findValuesForAttribute(DrawableAttribute groupBy) { + public > List findValuesForAttribute(DrawableAttribute groupBy) { List values; try { switch (groupBy.attrName) { @@ -453,12 +458,12 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { } return values; - } catch(TskCoreException ex){ + } catch (TskCoreException ex) { LOGGER.log(Level.WARNING, "TSK error getting list of type " + groupBy.getDisplayName()); return new ArrayList(); } - - } + + } public List getFileIDsInGroup(GroupKey groupKey) throws TskCoreException { switch (groupKey.getAttribute().attrName) { @@ -487,7 +492,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { for (TagName tn : tns) { List contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn); for (ContentTag ct : contentTags) { - if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) { + if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) { files.add(ct.getContent().getId()); } } @@ -499,7 +504,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { List files = new ArrayList<>(); List contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(category.getTagName()); for (ContentTag ct : contentTags) { - if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) { + if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) { + files.add(ct.getContent().getId()); } } @@ -511,14 +517,17 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { throw ex; } } - + /** * Count the number of files with the given category. * This is faster than getFileIDsWithCategory and should be used if only the * counts are needed and not the file IDs. + * * @param category Category to match against + * * @return Number of files with the given category - * @throws TskCoreException + * + * @throws TskCoreException */ public int countFilesWithCategory(Category category) throws TskCoreException { return db.getCategoryCount(category); @@ -529,7 +538,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { List files = new ArrayList<>(); List contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tagName); for (ContentTag ct : contentTags) { - if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) { + if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) { + files.add(ct.getContent().getId()); } } @@ -576,10 +586,10 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { */ public > void regroup(final DrawableAttribute groupBy, final GroupSortBy sortBy, final SortOrder sortOrder, Boolean force) { - if(! Case.isCaseOpen()){ + if (!Case.isCaseOpen()) { return; } - + //only re-query the db if the group by attribute changed or it is forced if (groupBy != getGroupBy() || force == true) { setGroupBy(groupBy); @@ -608,15 +618,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { } } - - /** * an executor to submit async ui related background tasks to. */ final ExecutorService regroupExecutor = Executors.newSingleThreadExecutor(new BasicThreadFactory.Builder().namingPattern("ui task -%d").build()); - - public ReadOnlyDoubleProperty regroupProgress() { return regroupProgress.getReadOnlyProperty(); } @@ -625,6 +631,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { * handle {@link FileUpdateEvent} sent from Db when files are * inserted/updated * + * TODO: why isn't this just two methods! + * * @param evt */ @Override @@ -638,10 +646,10 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { for (GroupKey gk : groupsForFile) { removeFromGroup(gk, fileId); - + DrawableGroup g = getGroupForKey(gk); - if (g == null){ + if (g == null) { // It may be that this was the last unanalyzed file in the group, so test // whether the group is now fully analyzed. //TODO: use method in groupmanager ? @@ -649,7 +657,9 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { if (checkAnalyzed != null) { // => the group is analyzed, so add it to the ui populateAnalyzedGroup(gk, checkAnalyzed); } - } + } else { + g.invalidateHashSetHitsCount(); + } } } @@ -669,6 +679,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { */ for (final long fileId : fileIDs) { + db.updateHashSetsForFile(fileId); + //get grouping(s) this file would be in Set> groupsForFile = getGroupKeysForFileID(fileId); @@ -688,13 +700,13 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { } } } - - Category.fireChange(fileIDs); + if (evt.getChangedAttribute() == DrawableAttribute.CATEGORY) { + Category.fireChange(fileIDs); + } if (evt.getChangedAttribute() == DrawableAttribute.TAGS) { TagUtils.fireChange(fileIDs); } break; - } } @@ -743,10 +755,10 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { synchronized (groupMap) { groupMap.clear(); } - + // Get the list of group keys final List vals = findValuesForAttribute(groupBy); - + // Make a list of each group final List groups = new ArrayList<>(); @@ -767,22 +779,22 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener { List checkAnalyzed = checkAnalyzed(groupKey); if (checkAnalyzed != null) { // != null => the group is analyzed, so add it to the ui - + // makeGroup will create the group and add it to the map groupMap, but does not // update anything else DrawableGroup g = makeGroup(groupKey, checkAnalyzed); groups.add(g); } } - + // Sort the group list Collections.sort(groups, sortBy.getGrpComparator(sortOrder)); - + // Officially add all groups in order - for(DrawableGroup g:groups){ + for (DrawableGroup g : groups) { populateAnalyzedGroup(g, ReGroupTask.this); } - + updateProgress(1, 1); return null; } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/DrawableView.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/DrawableView.java index b7a58534f5..9de7704d7a 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/DrawableView.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/DrawableView.java @@ -1,6 +1,7 @@ package org.sleuthkit.autopsy.imagegallery.gui; import java.util.Collection; +import java.util.logging.Level; import javafx.application.Platform; import javafx.scene.layout.Border; import javafx.scene.layout.BorderStroke; @@ -9,6 +10,7 @@ import javafx.scene.layout.BorderWidths; import javafx.scene.layout.CornerRadii; import javafx.scene.layout.Region; import javafx.scene.paint.Color; +import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.ThreadConfined; import org.sleuthkit.autopsy.imagegallery.TagUtils; import org.sleuthkit.autopsy.imagegallery.datamodel.Category; @@ -56,7 +58,14 @@ public interface DrawableView extends Category.CategoryListener, TagUtils.TagLis void handleTagsChanged(Collection ids); default boolean hasHashHit() { - return getFile().getHashHitSetNames().isEmpty() == false; + try{ + return getFile().getHashHitSetNames().isEmpty() == false; + } catch (NullPointerException ex){ + // I think this happens when we're in the process of removing images from the view while + // also trying to update it? + Logger.getLogger(DrawableView.class.getName()).log(Level.WARNING, "Error looking up hash set hits"); + return false; + } } static Border getCategoryBorder(Category category) { diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/SingleDrawableViewBase.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/SingleDrawableViewBase.java index 7ff83043af..92037461c6 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/SingleDrawableViewBase.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/SingleDrawableViewBase.java @@ -370,7 +370,7 @@ public abstract class SingleDrawableViewBase extends AnchorPane implements Drawa } else { Category.registerListener(this); TagUtils.registerListener(this); - + getFile(); updateSelectionState(); updateCategoryBorder(); diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java index bd43ed4b9b..2f34aec2e1 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java @@ -1,8 +1,28 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2013-15 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ package org.sleuthkit.autopsy.imagegallery.gui.navpanel; +import static java.util.Objects.isNull; +import java.util.Optional; import javafx.application.Platform; +import javafx.beans.InvalidationListener; import javafx.beans.Observable; -import javafx.scene.Node; import javafx.scene.control.OverrunStyle; import javafx.scene.control.Tooltip; import javafx.scene.control.TreeCell; @@ -13,93 +33,95 @@ import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute; import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup; /** - * A {@link Node} in the tree that listens to its associated group. Manages - * visual representation of TreeNode in Tree. Listens to properties of group - * that don't impact hierarchy and updates ui to reflect them + * A cell in the NavPanel tree that listens to its associated group's fileids. + * Manages visual representation of TreeNode in Tree. Listens to properties of + * group that don't impact hierarchy and updates ui to reflect them */ class GroupTreeCell extends TreeCell { /** * icon to use if this cell's TreeNode doesn't represent a group but just a - * folder(with no DrawableFiles) in the hierarchy. + * folder(with no DrawableFiles) in the file system hierarchy. */ private static final Image EMPTY_FOLDER_ICON = new Image("org/sleuthkit/autopsy/imagegallery/images/folder.png"); + /** + * reference to listener that allows us to remove it from a group when a new + * group is assigned to this Cell + */ + private InvalidationListener listener; + public GroupTreeCell() { + //TODO: move this to .css file //adjust indent, default is 10 which uses up a lot of space. setStyle("-fx-indent:5;"); //since end of path is probably more interesting put ellipsis at front setTextOverrun(OverrunStyle.LEADING_ELLIPSIS); + Platform.runLater(() -> { + prefWidthProperty().bind(getTreeView().widthProperty().subtract(15)); + }); + } @Override - synchronized protected void updateItem(final TreeNode tNode, boolean empty) { - super.updateItem(tNode, empty); - prefWidthProperty().bind(getTreeView().widthProperty().subtract(15)); + protected synchronized void updateItem(final TreeNode tNode, boolean empty) { + //if there was a previous group, remove the listener + Optional.ofNullable(getItem()) + .map(TreeNode::getGroup) + .ifPresent((DrawableGroup t) -> { + t.fileIds().removeListener(listener); + }); - if (tNode == null || empty) { + super.updateItem(tNode, empty); + + if (isNull(tNode) || empty) { Platform.runLater(() -> { setTooltip(null); setText(null); setGraphic(null); }); } else { - final String name = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN); - Platform.runLater(() -> { - setTooltip(new Tooltip(name)); - }); - + final String groupName = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN); - if (tNode.getGroup() == null) { + if (isNull(tNode.getGroup())) { + //"dummy" group in file system tree <=> a folder with no drawables Platform.runLater(() -> { - setText(name); + setTooltip(new Tooltip(groupName)); + setText(groupName); setGraphic(new ImageView(EMPTY_FOLDER_ICON)); }); } else { - //if number of files in this group changes (eg file is recategorized), update counts - tNode.getGroup().fileIds().addListener((Observable o) -> { + listener = (Observable o) -> { + final String countsText = getCountsText(); Platform.runLater(() -> { - setText(name + " (" + getNumerator() + getDenominator() + ")"); + setText(groupName + countsText); }); - }); + }; + //if number of files in this group changes (eg file is recategorized), update counts via listener + tNode.getGroup().fileIds().addListener(listener); + //... and use icon corresponding to group type + final Image icon = tNode.getGroup().groupKey.getAttribute().getIcon(); + final String countsText = getCountsText(); Platform.runLater(() -> { - //this TreeNode has a group so append counts to name ... - setText(name + " (" + getNumerator() + getDenominator() + ")"); - //... and use icon corresponding to group type - setGraphic(new ImageView(tNode.getGroup().groupKey.getAttribute().getIcon())); + setTooltip(new Tooltip(groupName)); + setGraphic(new ImageView(icon)); + setText(groupName + countsText); }); - } } } - /** - * @return the Numerator of the count to append to the group name = number - * of hashset hits + "/" - */ - synchronized private String getNumerator() { - try { - final String numerator = (getItem().getGroup().groupKey.getAttribute() != DrawableAttribute.HASHSET) - ? getItem().getGroup().getFilesWithHashSetHitsCount() + "/" - : ""; - return numerator; - } catch (NullPointerException e) { - //instead of this try catch block, remove the listener when assigned a null treeitem / group - return ""; - } - } + private synchronized String getCountsText() { + final String counts = Optional.ofNullable(getItem()) + .map(TreeNode::getGroup) + .map((DrawableGroup t) -> { + return " (" + ((t.groupKey.getAttribute() == DrawableAttribute.HASHSET) + ? Integer.toString(t.getSize()) + : t.getFilesWithHashSetHitsCount() + "/" + t.getSize()) + ")"; + }).orElse(""); //if item is null or group is null - /** - * @return the Denominator of the count to append to the group name = number - * of files in group - */ - synchronized private Integer getDenominator() { - try { - return getItem().getGroup().getSize(); - } catch (NullPointerException ex) { - return 0; - } + return counts; } } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java index 2c6b2d3666..37925b47bb 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java @@ -37,10 +37,28 @@ import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup; */ class GroupTreeItem extends TreeItem implements Comparable { + static GroupTreeItem getTreeItemForGroup(GroupTreeItem root, DrawableGroup grouping) { + if (Objects.equals(root.getValue().getGroup(), grouping)) { + return root; + } else { + synchronized (root.getChildren()) { + for (TreeItem child : root.getChildren()) { + final GroupTreeItem childGTI = (GroupTreeItem) child; + + GroupTreeItem val = getTreeItemForGroup(childGTI, grouping); + if (val != null) { + return val; + } + } + } + } + return null; + } + /** * maps a path segment to the child item of this item with that path segment */ - private Map childMap = new HashMap<>(); + private final Map childMap = new HashMap<>(); /** * the comparator if any used to sort the children of this item */ @@ -68,7 +86,7 @@ class GroupTreeItem extends TreeItem implements Comparable implements Comparable { + synchronized (getChildren()) { + getChildren().add(newTreeItem); } }); @@ -109,14 +124,11 @@ class GroupTreeItem extends TreeItem implements Comparable { + synchronized (getChildren()) { + getChildren().add(newTreeItem); + if (comp != null) { + FXCollections.sort(getChildren(), comp); } } }); @@ -129,7 +141,7 @@ class GroupTreeItem extends TreeItem implements Comparable path, DrawableGroup g, Boolean tree) { @@ -147,12 +159,9 @@ class GroupTreeItem extends TreeItem implements Comparable { + synchronized (getChildren()) { + getChildren().add(newTreeItem); } }); @@ -169,14 +178,11 @@ class GroupTreeItem extends TreeItem implements Comparable { + synchronized (getChildren()) { + getChildren().add(newTreeItem); + if (comp != null) { + FXCollections.sort(getChildren(), comp); } } }); @@ -189,24 +195,6 @@ class GroupTreeItem extends TreeItem implements Comparable child : root.getChildren()) { - final GroupTreeItem childGTI = (GroupTreeItem) child; - - GroupTreeItem val = getTreeItemForGroup(childGTI, grouping); - if (val != null) { - return val; - } - } - } - } - return null; - } - GroupTreeItem getTreeItemForPath(List path) { // end of recursion if (path.isEmpty()) { @@ -253,4 +241,5 @@ class GroupTreeItem extends TreeItem implements Comparable sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.imagegallery.gui.navpanel; import java.net.URL; import java.util.Arrays; -import java.util.Collection; import java.util.List; import java.util.ResourceBundle; import javafx.application.Platform; @@ -41,23 +40,21 @@ import javafx.scene.control.TreeView; import javafx.scene.layout.Priority; import javafx.scene.layout.VBox; import org.apache.commons.lang3.StringUtils; -import org.openide.util.Exceptions; import org.sleuthkit.autopsy.coreutils.ThreadConfined; import org.sleuthkit.autopsy.coreutils.ThreadConfined.ThreadType; import org.sleuthkit.autopsy.imagegallery.FXMLConstructor; import org.sleuthkit.autopsy.imagegallery.ImageGalleryController; import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute; -import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile; import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup; -import org.sleuthkit.autopsy.imagegallery.grouping.GroupKey; -import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy; import org.sleuthkit.autopsy.imagegallery.grouping.GroupViewState; -import org.sleuthkit.datamodel.TskCoreException; /** * Display two trees. one shows all folders (groups) and calls out folders with * images. the user can select folders with images to see them in the main * GroupPane The other shows folders with hash set hits. + * + * //TODO: there is too much code duplication between the navTree and the + * hashTree. Extract the common code to some new class. */ public class NavPanel extends TabPane { @@ -170,24 +167,15 @@ public class NavPanel extends TabPane { removeFromNavTree(g); removeFromHashTree(g); } - if(change.wasPermutated()){ + if (change.wasPermutated()) { // Handle this afterward wasPermuted = true; } } - - if(wasPermuted){ - // Remove everything and add it again in the new order - for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){ - removeFromNavTree(g); - removeFromHashTree(g); - } - for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){ - insertIntoNavTree(g); - if (g.getFilesWithHashSetHitsCount() > 0) { - insertIntoHashTree(g); - } - } + + if (wasPermuted) { + rebuildTrees(); + } }); @@ -205,6 +193,27 @@ public class NavPanel extends TabPane { }); } + private void rebuildTrees() { + navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get()); + hashTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get()); + + ObservableList groups = controller.getGroupManager().getAnalyzedGroups(); + + for (DrawableGroup g : groups) { + insertIntoNavTree(g); + if (g.getFilesWithHashSetHitsCount() > 0) { + insertIntoHashTree(g); + } + } + + Platform.runLater(() -> { + navTree.setRoot(navTreeRoot); + navTreeRoot.setExpanded(true); + hashTree.setRoot(hashTreeRoot); + hashTreeRoot.setExpanded(true); + }); + } + private void updateControllersGroup() { final TreeItem selectedItem = activeTreeProperty.get().getSelectionModel().getSelectedItem(); if (selectedItem != null && selectedItem.getValue() != null && selectedItem.getValue().getGroup() != null) { @@ -216,11 +225,6 @@ public class NavPanel extends TabPane { hashTreeRoot.resortChildren(sortByBox.getSelectionModel().getSelectedItem()); } - private void insertIntoHashTree(DrawableGroup g) { - initHashTree(); - hashTreeRoot.insert(g.groupKey.getValueDisplayName(), g, false); - } - /** * Set the tree to the passed in group * @@ -234,27 +238,29 @@ public class NavPanel extends TabPane { final GroupTreeItem treeItemForGroup = ((GroupTreeItem) activeTreeProperty.get().getRoot()).getTreeItemForPath(path); if (treeItemForGroup != null) { - /* When we used to run the below code on the FX thread, it would - * get into infinite loops when the next group button was pressed quickly - * because the udpates became out of order and History could not keep - * track of what was current. Currently (4/2/15), this method is - * already on the FX thread, so it is OK. */ + /* When we used to run the below code on the FX thread, it would + * get into infinite loops when the next group button was pressed + * quickly because the udpates became out of order and History could + * not + * keep track of what was current. + * + * Currently (4/2/15), this method is already on the FX thread, so + * it is OK. */ //Platform.runLater(() -> { - TreeItem ti = treeItemForGroup; - while (ti != null) { - ti.setExpanded(true); - ti = ti.getParent(); - } - int row = activeTreeProperty.get().getRow(treeItemForGroup); - if (row != -1) { - activeTreeProperty.get().getSelectionModel().select(treeItemForGroup); - activeTreeProperty.get().scrollTo(row); - } - //}); + TreeItem ti = treeItemForGroup; + while (ti != null) { + ti.setExpanded(true); + ti = ti.getParent(); + } + int row = activeTreeProperty.get().getRow(treeItemForGroup); + if (row != -1) { + activeTreeProperty.get().getSelectionModel().select(treeItemForGroup); + activeTreeProperty.get().scrollTo(row); + } + //}); //end Platform.runLater } } - @SuppressWarnings("fallthrough") private static List groupingToPath(DrawableGroup g) { if (g.groupKey.getAttribute() == DrawableAttribute.PATH) { @@ -269,11 +275,14 @@ public class NavPanel extends TabPane { } } + private void insertIntoHashTree(DrawableGroup g) { + initHashTree(); + hashTreeRoot.insert(groupingToPath(g), g, false); + } + private void insertIntoNavTree(DrawableGroup g) { initNavTree(); - List path = groupingToPath(g); - - navTreeRoot.insert(path, g, true); + navTreeRoot.insert(groupingToPath(g), g, true); } private void removeFromNavTree(DrawableGroup g) { @@ -313,22 +322,4 @@ public class NavPanel extends TabPane { }); } } - - //these are not used anymore, but could be usefull at some point - //TODO: remove them or find a use and undeprecate - @Deprecated - private void rebuildNavTree() { - navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get()); - - ObservableList groups = controller.getGroupManager().getAnalyzedGroups(); - - for (DrawableGroup g : groups) { - insertIntoNavTree(g); - } - - Platform.runLater(() -> { - navTree.setRoot(navTreeRoot); - navTreeRoot.setExpanded(true); - }); - } } diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties index 31644316f7..0eb71bec79 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties @@ -283,3 +283,4 @@ KeywordSearchModuleFactory.createFileIngestModule.exception.msg=Expected setting SearchRunner.Searcher.done.err.msg=Error performing keyword search KeywordSearchGlobalSearchSettingsPanel.timeRadioButton5.toolTipText=Fastest overall, but no results until the end KeywordSearchGlobalSearchSettingsPanel.timeRadioButton5.text=No periodic searches +KeywordSearchIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector. diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java index 97e4e14119..a8dc0b849e 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java @@ -37,7 +37,6 @@ import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.keywordsearch.Ingester.IngesterException; import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector; import org.sleuthkit.datamodel.AbstractFile; -import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskData; import org.sleuthkit.datamodel.TskData.FileKnown; @@ -74,7 +73,8 @@ public final class KeywordSearchIngestModule implements FileIngestModule { private final IngestServices services = IngestServices.getInstance(); private Ingester ingester = null; private Indexer indexer; - //only search images from current ingest, not images previously ingested/indexed + private FileTypeDetector fileTypeDetector; +//only search images from current ingest, not images previously ingested/indexed //accessed read-only by searcher thread private boolean startedSearching = false; @@ -130,6 +130,11 @@ public final class KeywordSearchIngestModule implements FileIngestModule { jobId = context.getJobId(); dataSourceId = context.getDataSource().getId(); + try { + fileTypeDetector = new FileTypeDetector(); + } catch (FileTypeDetector.FileTypeDetectorInitException ex) { + throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.startUp.fileTypeDetectorInitializationException.msg")); + } ingester = Server.getIngester(); this.context = context; @@ -470,30 +475,12 @@ public final class KeywordSearchIngestModule implements FileIngestModule { return; } - - - // try to get the file type from the BB - String detectedFormat = null; + String detectedFormat; try { - ArrayList attributes = aFile.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); - for (BlackboardAttribute attribute : attributes) { - detectedFormat = attribute.getValueString(); - break; - } + detectedFormat = fileTypeDetector.getFileType(aFile); } catch (TskCoreException ex) { - } - // else, use FileType module to detect the format - if (detectedFormat == null) { - try { - detectedFormat = new FileTypeDetector().detectAndPostToBlackboard(aFile); - } catch (FileTypeDetector.FileTypeDetectorInitException | TskCoreException ex) { - logger.log(Level.WARNING, "Could not detect format using file type detector for file: {0}", aFile); //NON-NLS - return; - } - if (detectedFormat == null) { - logger.log(Level.WARNING, "Could not detect format using file type detector for file: {0}", aFile); //NON-NLS - return; - } + logger.log(Level.SEVERE, String.format("Could not detect format using fileTypeDetector for file: %s", aFile), ex); //NON-NLS + return; } // we skip archive formats that are opened by the archive module. diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java index 72e564c11b..aef452b7d5 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java @@ -340,7 +340,6 @@ class LuceneQuery implements KeywordSearchQuery { List snippetList = highlightResponse.get(docId).get(Server.Schema.TEXT.toString()); // list is null if there wasn't a snippet if (snippetList != null) { - snippetList.sort(null); snippet = EscapeUtil.unEscapeHtml(snippetList.get(0)).trim(); } } @@ -440,7 +439,6 @@ class LuceneQuery implements KeywordSearchQuery { //docs says makes sense for the original Highlighter only, but not really //analyze all content SLOW! consider lowering q.setParam("hl.maxAnalyzedChars", Server.HL_ANALYZE_CHARS_UNLIMITED); //NON-NLS - q.setParam("hl.preserveMulti", true); //NON-NLS try { QueryResponse response = solrServer.query(q, METHOD.POST); @@ -453,8 +451,6 @@ class LuceneQuery implements KeywordSearchQuery { if (contentHighlights == null) { return ""; } else { - // Sort contentHighlights in order to get consistently same snippet. - contentHighlights.sort(null); // extracted content is HTML-escaped, but snippet goes in a plain text field return EscapeUtil.unEscapeHtml(contentHighlights.get(0)).trim(); } diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java index 131fb319c3..2f6997be76 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java @@ -1097,8 +1097,7 @@ public class Server { filterQuery = filterQuery + Server.ID_CHUNK_SEP + chunkID; } q.addFilterQuery(filterQuery); - // sort the TEXT field - q.setSortField(Schema.TEXT.toString(), SolrQuery.ORDER.asc); + q.setFields(Schema.TEXT.toString()); try { // Get the first result. SolrDocument solrDocument = solrCore.query(q).getResults().get(0); diff --git a/docs/doxygen/Doxyfile b/docs/doxygen/Doxyfile index 1dba6b8cfd..8df9518e7b 100755 --- a/docs/doxygen/Doxyfile +++ b/docs/doxygen/Doxyfile @@ -133,7 +133,7 @@ ALWAYS_DETAILED_SEC = NO # operators of the base classes will not be shown. # The default value is: NO. -INLINE_INHERITED_MEMB = NO +INLINE_INHERITED_MEMB = YES # If the FULL_PATH_NAMES tag is set to YES, doxygen will prepend the full path # before files name in the file list and in the header files. If set to NO the diff --git a/docs/doxygen/modDevPython.dox b/docs/doxygen/modDevPython.dox index f853842288..7ec3d3112c 100755 --- a/docs/doxygen/modDevPython.dox +++ b/docs/doxygen/modDevPython.dox @@ -60,7 +60,7 @@ To distribute and share your Python module, ZIP up the folder and send it around Jython allows you to access all of the Java classes. So, you should read the following sections of this document. All you should ignore is the Java environment setup sections. There are only two types of modules that you can make with Python. Those (along with a sample file) are listed below: -- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/ingestmodule.py +- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/ - Report Modules: https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/reportmodule.py */ diff --git a/docs/doxygen/modIngest.dox b/docs/doxygen/modIngest.dox index 8bbcbd043b..0f3d4a1ebb 100755 --- a/docs/doxygen/modIngest.dox +++ b/docs/doxygen/modIngest.dox @@ -100,10 +100,12 @@ Before we cover the specific interfaces of the two different types of modules, l To create a data source ingest module: -# Create the ingest module class by either: - - Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE + - Copy and paste the sample modules from: + - Java: Core/src/org/sleuthkit/autopsy/examples/SampleDataSourceIngestModule.java + - Python: pythonExamples/dataSourceIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples) + - Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE will complain that you have not implemented one or more of the required methods. You can use its "hints" to automatically generate stubs for the missing methods. - - Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py. -# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isDataSourceIngestModuleFactory() method to return true and have the createDataSourceIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code: \code @@ -119,8 +121,8 @@ You can use its "hints" to automatically generate stubs for the missing methods. \endcode -# Use this page, the sample, and the documentation for the org.sleuthkit.autopsy.ingest.DataSourceIngestModule interfaces to implement the startUp() and process() methods. - -The process() method is where all of the work of a data source ingest module is + - org.sleuthkit.autopsy.ingest.DataSourceIngestModule.startUp() is where any initialiation occurs. If your module has a critical failure and will not be able to run, your startUp method should throw an IngestModuleException to stop ingest. + - org.sleuthkit.autopsy.ingest.DataSourceIngestModule.process() is where all of the work of a data source ingest module is done. It will be called exactly once. The process() method receives a reference to an org.sleuthkit.datamodel.Content object and an org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress object. @@ -140,10 +142,12 @@ org.sleuthkit.autopsy.casemodule.services.FileManager class. See To create a file ingest module: To create a data source ingest module: -# Create the ingest module class by either: - - Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE + - Copy and paste the sample modules from: + - Java: Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java + - Python: pythonExamples/fileIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples) + - Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE will complain that you have not implemented one or more of the required methods. You can use its "hints" to automatically generate stubs for the missing methods. - - Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py. -# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isFileIngestModuleFactory() method to return true and have the createFileIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code: \code @@ -160,9 +164,8 @@ You can use its "hints" to automatically generate stubs for the missing methods. -# Use this page, the sample, and the documentation for the org.sleuthkit.autopsy.ingest.FileIngestModule interface to implement the startUp(), and process(), and shutDown() methods. - - -The process() method is where all of the work of a file ingest module is + - org.sleuthkit.autopsy.ingest.FileIngestModule.startUp() should have any code that you need to initialize your module. If you have any startup errors, be sure to throw a IngestModuleException exception to stop ingest. + - org.sleuthkit.autopsy.ingest.FileIngestModule.process() is where all of the work of a file ingest module is done. It will be called repeatedly between startUp() and shutDown(), once for each file Autopsy feeds into the pipeline of which the module instance is a part. The process() method receives a reference to a org.sleuthkit.datamodel.AbstractFile @@ -271,17 +274,22 @@ that the samples do not do anything particularly useful. Autopsy allows you to provide a graphical panel that will be displayed when the user decides to enable the ingest module. This panel is supposed to be for settings that the user may turn on or off for different data sources. + To provide options for each ingest job: - Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.hasIngestJobSettingsPanel() in your factory class to return true. -- Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.getIngestJobSettingsPanel() in your factory class to return a IngestModuleIngestJobSettingsPanel that displays the needed configuration options and returns a IngestModuleIngestJobSettings object based on the settings. This will get passed in the last configuration setting that was used, so that you can populate the panel accordlingly and the user doesn't have to choose new settings. -- Create a class based on org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings to store the settings. +- Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.getIngestJobSettingsPanel() in your factory class to return a IngestModuleIngestJobSettingsPanel that displays the needed configuration options. The org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel.getSettings() method should return an instance of a org.sleutkit.autopsy.ingest.IngestModuleIngestJobSettings object based on the user-specified settings (see next bullet). +- Create a class that implements org.sleutkit.autopsy.ingest.IngestModuleIngestJobSettings. Your IngestModuleIngestJobSettingsPanel should store settings in here. This class needs to be Serializable, so keep all data types simple or mark them as transient with some custom deserialization code. You should also set the serialVersionUID (see http://stackoverflow.com/questions/285793/what-is-a-serialversionuid-and-why-should-i-use-it). +- If you decide to store settings internal to the module (NOT RECOMMENDED), the getSettings() method can return an instance of NoIngestModuleIngestJobSettings. +- Your instance of IngestModuleIngestJobSettings will be saved and passed to your panel the next time so that you can pre-populate it accordingly. + +Your panel should create the IngestModuleIngestJobSettings class to store the settings and that will be passed back into your factory with each call to createDataSourceIngestModule() or createFileIngestModule(). The way that we have implemented this in Autopsy modules is that the factory casts the IngestModuleINgestJobSettings object to the module-specific implementation and then passes it into the constructor of the ingest module. The ingest module can then call whatever getter methods that were defined based on the panel settings. -Your panel should create the IngestModuleIngestJobSettings class to store the settings and that will be passed back into your factory with each call to createDataSourceIngestModule() or createFileIngestModule(). The factory should cast it to its internal class that implements IngestModuleIngestJobSettings and pass that object into the constructor of its ingest module so that it can use the settings when it runs. You can also implement the getDefaultIngestJobSettings() method to return an instance of your IngestModuleIngestJobSettings class with default settings. Autopsy will call this when the module has not been run before. NOTE: We recommend storing simple data in the IngestModuleIngestJobSettings-based class. In the case of our hash lookup module, we store the string names of the hash databases to do lookups in. We then get the hash database handles in the call to startUp() using the global module settings. + NOTE: The main benefit of using the IngestModuleIngestJobSettings-based class to store settings (versus some static variables in your package) are: - When multiple jobs are running at the same time, each can have their own settings. - Autopsy persists them so that the last used settings get passed into the call to getIngestJobSettingsPanel() and you don't need to save them yoursevles to provide the user the benefit of re-using the last settings. diff --git a/docs/doxygen/platformConcepts.dox b/docs/doxygen/platformConcepts.dox index f567f4e747..8600b23aa5 100755 --- a/docs/doxygen/platformConcepts.dox +++ b/docs/doxygen/platformConcepts.dox @@ -44,12 +44,10 @@ The blackboard allows modules to communicate with each other and the UI. It has The blackboard is not unique to Autopsy. It is part of The Sleuth Kit datamodel and The Sleuth Kit Framework. In the name of reducing the amount of documentation that we need to maintain, we provide links here to those documentation sources. -- Details on the blackboard concepts (artifacts versus attributes) can be found at http://sleuthkit.org/sleuthkit/docs/framework-docs/mod_bbpage.html. These documents are about the C++ implementation of the blackboard, but it is the same concepts. -- Details of the Java classes can be found in \ref jni_blackboard section of the The Sleuth Kit JNI documents (http://sleuthkit.org/sleuthkit/docs/jni-docs/). +- \ref mod_bbpage (http://sleuthkit.org/sleuthkit/docs/jni-docs/mod_bbpage.html) - -\subsection mod_dev_other_services Framework Services and Utilities +\section mod_dev_other_services Framework Services and Utilities The following are basic services that are available to any module. They are provided here to be used as a reference. When you are developing your module and feel like something should be provided by the framework, then refer to this list to find out where it could be. If you don't find it, let us know and we'll talk about adding it for other writers to benefit. diff --git a/pythonExamples/README.txt b/pythonExamples/README.txt index 3ea200a82e..fb17a7c101 100755 --- a/pythonExamples/README.txt +++ b/pythonExamples/README.txt @@ -1,7 +1,13 @@ -reportmodule.py -> Report module which implements GeneralReportModuleAdapter. -simpleingestmodule -> Data source ingest module without any GUI example code. -ingestmodule.py -> Both data source ingest module as well as file ingest module WITH an example of GUI code. +This folder contains sample python module files. They are public +domain, so you are free to copy and paste them and modify them to +your needs. + +See the developer guide for more details and how to use and load +the modules. + + http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html + +Each module in this folder should have a brief description about what they +can do. + -NOTE: The Python modules must be inside folder inside the folder opened by Tools > Plugins. -For example, place the ingestmodule.py inside folder ingest. Move that ingest folder inside opened by Tools > Plugins -The directory opened by Tools > Plugins is cleared every time the project is cleaned. \ No newline at end of file diff --git a/pythonExamples/simpleingestmodule.py b/pythonExamples/dataSourceIngestModule.py similarity index 57% rename from pythonExamples/simpleingestmodule.py rename to pythonExamples/dataSourceIngestModule.py index 548a12800d..7d6a535aaa 100755 --- a/pythonExamples/simpleingestmodule.py +++ b/pythonExamples/dataSourceIngestModule.py @@ -27,95 +27,125 @@ # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR # OTHER DEALINGS IN THE SOFTWARE. +# Simple data source-level ingest module for Autopsy. +# Search for TODO for the things that you need to change +# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation + import jarray from java.lang import System +from java.util.logging import Level from org.sleuthkit.datamodel import SleuthkitCase from org.sleuthkit.datamodel import AbstractFile from org.sleuthkit.datamodel import ReadContentInputStream from org.sleuthkit.datamodel import BlackboardArtifact from org.sleuthkit.datamodel import BlackboardAttribute from org.sleuthkit.autopsy.ingest import IngestModule +from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException from org.sleuthkit.autopsy.ingest import DataSourceIngestModule from org.sleuthkit.autopsy.ingest import FileIngestModule from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter from org.sleuthkit.autopsy.ingest import IngestMessage from org.sleuthkit.autopsy.ingest import IngestServices +from org.sleuthkit.autopsy.coreutils import Logger from org.sleuthkit.autopsy.casemodule import Case from org.sleuthkit.autopsy.casemodule.services import Services from org.sleuthkit.autopsy.casemodule.services import FileManager -# Sample factory that defines basic functionality and features of the module -class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter): +# Factory that defines the name and details of the module and allows Autopsy +# to create instances of the modules that will do the analysis. +# TODO: Rename this to something more specific. Search and replace for it because it is used a few times +class SampleJythonDataSourceIngestModuleFactory(IngestModuleFactoryAdapter): + + # TODO: give it a unique name. Will be shown in module list, logs, etc. + moduleName = "Sample Data Source Module" + def getModuleDisplayName(self): - return "Sample Jython ingest module" - + return self.moduleName + + # TODO: Give it a description def getModuleDescription(self): - return "Sample Jython Ingest Module without GUI example code" + return "Sample module that does X, Y, and Z." def getModuleVersionNumber(self): return "1.0" - # Return true if module wants to get passed in a data source def isDataSourceIngestModuleFactory(self): return True - # can return null if isDataSourceIngestModuleFactory returns false def createDataSourceIngestModule(self, ingestOptions): + # TODO: Change the class name to the name you'll make below return SampleJythonDataSourceIngestModule() - # Return true if module wants to get called for each file - def isFileIngestModuleFactory(self): - return True - - # can return null if isFileIngestModuleFactory returns false - def createFileIngestModule(self, ingestOptions): - return SampleJythonFileIngestModule() - # Data Source-level ingest module. One gets created per data source. -# Queries for various files. -# If you don't need a data source-level module, delete this class. +# TODO: Rename this to something more specific. Could just remove "Factory" from above name. class SampleJythonDataSourceIngestModule(DataSourceIngestModule): def __init__(self): self.context = None + # Where any setup and configuration is done + # TODO: Add any setup code that you need here. def startUp(self, context): self.context = context - + # Throw an IngestModule.IngestModuleException exception if there was a problem setting up + # raise IngestModuleException(IngestModule(), "Oh No!") + + # Where the analysis is done. + # TODO: Add your analysis code in here. def process(self, dataSource, progressBar): if self.context.isJobCancelled(): return IngestModule.ProcessResult.OK + + logger = Logger.getLogger(SampleJythonDataSourceIngestModuleFactory.moduleName) - # Configure progress bar for 2 tasks - progressBar.switchToDeterminate(2) + # we don't know how much work there is yet + progressBar.switchToIndeterminate() autopsyCase = Case.getCurrentCase() sleuthkitCase = autopsyCase.getSleuthkitCase() services = Services(sleuthkitCase) fileManager = services.getFileManager() - # Get count of files with "test" in name. - fileCount = 0; + # For our example, we will use FileManager to get all + # files with the word "test" + # in the name and then count and read them files = fileManager.findFiles(dataSource, "%test%") + + numFiles = len(files) + logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "found " + str(numFiles) + " files") + progressBar.switchToDeterminate(numFiles) + fileCount = 0; for file in files: + + # Check if the user pressed cancel while we were busy + if self.context.isJobCancelled(): + return IngestModule.ProcessResult.OK + + logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "Processing file: " + file.getName()) fileCount += 1 - progressBar.progress(1) - if self.context.isJobCancelled(): - return IngestModule.ProcessResult.OK + # Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of + # artfiact. Refer to the developer docs for other examples. + art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT) + att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonDataSourceIngestModuleFactory.moduleName, "Test file") + art.addAttribute(att) - # Get files by creation time. - currentTime = System.currentTimeMillis() / 1000 - minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks. - otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime) - for otherFile in otherFiles: - fileCount += 1 - progressBar.progress(1); + + # To further the example, this code will read the contents of the file and count the number of bytes + inputStream = ReadContentInputStream(file) + buffer = jarray.zeros(1024, "b") + totLen = 0 + readLen = inputStream.read(buffer) + while (readLen != -1): + totLen = totLen + readLen + readLen = inputStream.read(buffer) + + + # Update the progress bar + progressBar.progress(fileCount) - if self.context.isJobCancelled(): - return IngestModule.ProcessResult.OK; #Post a message to the ingest messages in box. message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, @@ -123,38 +153,3 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule): IngestServices.getInstance().postMessage(message) return IngestModule.ProcessResult.OK; - - -# File-level ingest module. One gets created per thread. -# Looks at the attributes of the passed in file. -# if you don't need a file-level module, delete this class. -class SampleJythonFileIngestModule(FileIngestModule): - - def startUp(self, context): - pass - - def process(self, file): - # If the file has a txt extension, post an artifact to the blackboard. - if file.getName().find("test") != -1: - art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT) - att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), "Sample Jython File Ingest Module", "Text Files") - art.addAttribute(att) - - # Read the contents of the file. - inputStream = ReadContentInputStream(file) - buffer = jarray.zeros(1024, "b") - totLen = 0 - len = inputStream.read(buffer) - while (len != -1): - totLen = totLen + len - len = inputStream.read(buffer) - - # Send the size of the file to the ingest messages in box. - msgText = "Size of %s is %d bytes" % ((file.getName(), totLen)) - message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule", msgText) - ingestServices = IngestServices.getInstance().postMessage(message) - - return IngestModule.ProcessResult.OK - - def shutDown(self): - pass \ No newline at end of file diff --git a/pythonExamples/fileIngestModule.py b/pythonExamples/fileIngestModule.py new file mode 100755 index 0000000000..579348ad36 --- /dev/null +++ b/pythonExamples/fileIngestModule.py @@ -0,0 +1,129 @@ +# Sample module in the public domain. Feel free to use this as a template +# for your modules (and you can remove this header and take complete credit +# and liability) +# +# Contact: Brian Carrier [carrier sleuthkit [dot] org] +# +# This is free and unencumbered software released into the public domain. +# +# Anyone is free to copy, modify, publish, use, compile, sell, or +# distribute this software, either in source code form or as a compiled +# binary, for any purpose, commercial or non-commercial, and by any +# means. +# +# In jurisdictions that recognize copyright laws, the author or authors +# of this software dedicate any and all copyright interest in the +# software to the public domain. We make this dedication for the benefit +# of the public at large and to the detriment of our heirs and +# successors. We intend this dedication to be an overt act of +# relinquishment in perpetuity of all present and future rights to this +# software under copyright law. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +# OTHER DEALINGS IN THE SOFTWARE. + +# Simple file-level ingest module for Autopsy. +# Search for TODO for the things that you need to change +# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation + +import jarray +from java.lang import System +from java.util.logging import Level +from org.sleuthkit.datamodel import SleuthkitCase +from org.sleuthkit.datamodel import AbstractFile +from org.sleuthkit.datamodel import ReadContentInputStream +from org.sleuthkit.datamodel import BlackboardArtifact +from org.sleuthkit.datamodel import BlackboardAttribute +from org.sleuthkit.autopsy.ingest import IngestModule +from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException +from org.sleuthkit.autopsy.ingest import DataSourceIngestModule +from org.sleuthkit.autopsy.ingest import FileIngestModule +from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter +from org.sleuthkit.autopsy.ingest import IngestMessage +from org.sleuthkit.autopsy.ingest import IngestServices +from org.sleuthkit.autopsy.coreutils import Logger +from org.sleuthkit.autopsy.casemodule import Case +from org.sleuthkit.autopsy.casemodule.services import Services +from org.sleuthkit.autopsy.casemodule.services import FileManager + +# Factory that defines the name and details of the module and allows Autopsy +# to create instances of the modules that will do the anlaysis. +# TODO: Rename this to something more specific. Search and replace for it because it is used a few times +class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter): + + # TODO: give it a unique name. Will be shown in module list, logs, etc. + moduleName = "Sample file ingest Module" + + def getModuleDisplayName(self): + return self.moduleName + + # TODO: Give it a description + def getModuleDescription(self): + return "Sample module that does X, Y, and Z." + + def getModuleVersionNumber(self): + return "1.0" + + # Return true if module wants to get called for each file + def isFileIngestModuleFactory(self): + return True + + # can return null if isFileIngestModuleFactory returns false + def createFileIngestModule(self, ingestOptions): + return SampleJythonFileIngestModule() + + +# File-level ingest module. One gets created per thread. +# TODO: Rename this to something more specific. Could just remove "Factory" from above name. +# Looks at the attributes of the passed in file. +class SampleJythonFileIngestModule(FileIngestModule): + + # Where any setup and configuration is done + # TODO: Add any setup code that you need here. + def startUp(self, context): + self.logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName) + self.filesFound = 0 + + # Throw an IngestModule.IngestModuleException exception if there was a problem setting up + # raise IngestModuleException(IngestModule(), "Oh No!") + pass + + # Where the analysis is done. Each file will be passed into here. + # TODO: Add your analysis code in here. + def process(self, file): + + # For an example, we will flag files with .txt in the name and make a blackboard artifact. + if file.getName().find(".txt") != -1: + + self.logger.logp(Level.INFO, SampleJythonFileIngestModule.__name__, "process", "Found a text file: " + file.getName()) + self.filesFound+=1 + + # Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of + # artfiact. Refer to the developer docs for other examples. + art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT) + att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonFileIngestModuleFactory.moduleName, "Text Files") + art.addAttribute(att) + + + # To further the example, this code will read the contents of the file and count the number of bytes + inputStream = ReadContentInputStream(file) + buffer = jarray.zeros(1024, "b") + totLen = 0 + len = inputStream.read(buffer) + while (len != -1): + totLen = totLen + len + len = inputStream.read(buffer) + + return IngestModule.ProcessResult.OK + + # Where any shutdown code is run and resources are freed. + # TODO: Add any shutdown code that you need here. + def shutDown(self): + # As a final part of this example, we'll send a message to the ingest inbox with the number of files found (in this thread) + message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName, str(self.filesFound) + " files found") + ingestServices = IngestServices.getInstance().postMessage(message) \ No newline at end of file diff --git a/pythonExamples/fileIngestModuleWithGui.py b/pythonExamples/fileIngestModuleWithGui.py new file mode 100755 index 0000000000..7780dcf3f2 --- /dev/null +++ b/pythonExamples/fileIngestModuleWithGui.py @@ -0,0 +1,204 @@ +# Sample module in the public domain. Feel free to use this as a template +# for your modules (and you can remove this header and take complete credit +# and liability) +# +# Contact: Brian Carrier [carrier sleuthkit [dot] org] +# +# This is free and unencumbered software released into the public domain. +# +# Anyone is free to copy, modify, publish, use, compile, sell, or +# distribute this software, either in source code form or as a compiled +# binary, for any purpose, commercial or non-commercial, and by any +# means. +# +# In jurisdictions that recognize copyright laws, the author or authors +# of this software dedicate any and all copyright interest in the +# software to the public domain. We make this dedication for the benefit +# of the public at large and to the detriment of our heirs and +# successors. We intend this dedication to be an overt act of +# relinquishment in perpetuity of all present and future rights to this +# software under copyright law. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +# OTHER DEALINGS IN THE SOFTWARE. + + +# Ingest module for Autopsy with GUI +# +# Difference between other modules in this folder is that it has a GUI +# for user options. This is not needed for very basic modules. If you +# don't need a configuration UI, start with the other sample module. +# +# Search for TODO for the things that you need to change +# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation + + +import jarray +from java.lang import System +from java.util.logging import Level +from javax.swing import JCheckBox +from javax.swing import BoxLayout +from org.sleuthkit.autopsy.casemodule import Case +from org.sleuthkit.autopsy.casemodule.services import Services +from org.sleuthkit.autopsy.ingest import DataSourceIngestModule +from org.sleuthkit.autopsy.ingest import FileIngestModule +from org.sleuthkit.autopsy.ingest import IngestMessage +from org.sleuthkit.autopsy.ingest import IngestModule +from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException +from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter +from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings +from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel +from org.sleuthkit.autopsy.ingest import IngestServices +from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel +from org.sleuthkit.datamodel import BlackboardArtifact +from org.sleuthkit.datamodel import BlackboardAttribute +from org.sleuthkit.datamodel import ReadContentInputStream +from org.sleuthkit.autopsy.coreutils import Logger +from java.lang import IllegalArgumentException + +# TODO: Rename this to something more specific +class SampleFileIngestModuleWithUIFactory(IngestModuleFactoryAdapter): + def __init__(self): + self.settings = None + + # TODO: give it a unique name. Will be shown in module list, logs, etc. + moduleName = "Sample Data Source Module with UI" + + def getModuleDisplayName(self): + return self.moduleName + + # TODO: Give it a description + def getModuleDescription(self): + return "Sample module that does X, Y, and Z." + + def getModuleVersionNumber(self): + return "1.0" + + # TODO: Update class name to one that you create below + def getDefaultIngestJobSettings(self): + return SampleFileIngestModuleWithUISettings() + + # TODO: Keep enabled only if you need ingest job-specific settings UI + def hasIngestJobSettingsPanel(self): + return True + + # TODO: Update class names to ones that you create below + def getIngestJobSettingsPanel(self, settings): + if not isinstance(settings, SampleFileIngestModuleWithUISettings): + raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings") + self.settings = settings + return SampleFileIngestModuleWithUISettingsPanel(self.settings) + + + def isFileIngestModuleFactory(self): + return True + + + # TODO: Update class name to one that you create below + def createFileIngestModule(self, ingestOptions): + return SampleFileIngestModuleWithUI(self.settings) + + +# File-level ingest module. One gets created per thread. +# TODO: Rename this to something more specific. Could just remove "Factory" from above name. +# Looks at the attributes of the passed in file. +class SampleFileIngestModuleWithUI(FileIngestModule): + + # Autopsy will pass in the settings from the UI panel + def __init__(self, settings): + self.local_settings = settings + + + # Where any setup and configuration is done + # TODO: Add any setup code that you need here. + def startUp(self, context): + self.logger = Logger.getLogger(SampleFileIngestModuleWithUIFactory.moduleName) + + # As an example, determine if user configured a flag in UI + if self.local_settings.getFlag(): + self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is set") + else: + self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is not set") + + # Throw an IngestModule.IngestModuleException exception if there was a problem setting up + # raise IngestModuleException(IngestModule(), "Oh No!") + pass + + # Where the analysis is done. Each file will be passed into here. + # TODO: Add your analysis code in here. + def process(self, file): + # See code in pythonExamples/fileIngestModule.py for example code + return IngestModule.ProcessResult.OK + + # Where any shutdown code is run and resources are freed. + # TODO: Add any shutdown code that you need here. + def shutDown(self): + pass + +# Stores the settings that can be changed for each ingest job +# All fields in here must be serializable. It will be written to disk. +# TODO: Rename this class +class SampleFileIngestModuleWithUISettings(IngestModuleIngestJobSettings): + serialVersionUID = 1L + + def __init__(self): + self.flag = False + + def getVersionNumber(self): + return serialVersionUID + + # TODO: Define getters and settings for data you want to store from UI + def getFlag(self): + return self.flag + + def setFlag(self, flag): + self.flag = flag + + +# UI that is shown to user for each ingest job so they can configure the job. +# TODO: Rename this +class SampleFileIngestModuleWithUISettingsPanel(IngestModuleIngestJobSettingsPanel): + # Note, we can't use a self.settings instance variable. + # Rather, self.local_settings is used. + # https://wiki.python.org/jython/UserGuide#javabean-properties + # Jython Introspector generates a property - 'settings' on the basis + # of getSettings() defined in this class. Since only getter function + # is present, it creates a read-only 'settings' property. This auto- + # generated read-only property overshadows the instance-variable - + # 'settings' + + # We get passed in a previous version of the settings so that we can + # prepopulate the UI + # TODO: Update this for your UI + def __init__(self, settings): + self.local_settings = settings + self.initComponents() + self.customizeComponents() + + # TODO: Update this for your UI + def checkBoxEvent(self, event): + if self.checkbox.isSelected(): + self.local_settings.setFlag(True) + else: + self.local_settings.setFlag(False) + + # TODO: Update this for your UI + def initComponents(self): + self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS)) + self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent) + self.add(self.checkbox) + + # TODO: Update this for your UI + def customizeComponents(self): + self.checkbox.setSelected(self.local_settings.getFlag()) + + # Return the settings used + def getSettings(self): + return self.local_settings + + diff --git a/pythonExamples/ingestmodule.py b/pythonExamples/ingestmodule.py deleted file mode 100755 index e0d6296136..0000000000 --- a/pythonExamples/ingestmodule.py +++ /dev/null @@ -1,266 +0,0 @@ -# Sample module in the public domain. Feel free to use this as a template -# for your modules (and you can remove this header and take complete credit -# and liability) -# -# Contact: Brian Carrier [carrier sleuthkit [dot] org] -# -# This is free and unencumbered software released into the public domain. -# -# Anyone is free to copy, modify, publish, use, compile, sell, or -# distribute this software, either in source code form or as a compiled -# binary, for any purpose, commercial or non-commercial, and by any -# means. -# -# In jurisdictions that recognize copyright laws, the author or authors -# of this software dedicate any and all copyright interest in the -# software to the public domain. We make this dedication for the benefit -# of the public at large and to the detriment of our heirs and -# successors. We intend this dedication to be an overt act of -# relinquishment in perpetuity of all present and future rights to this -# software under copyright law. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. -# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR -# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, -# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -# OTHER DEALINGS IN THE SOFTWARE. - -import jarray -from java.lang import System -from javax.swing import JCheckBox -from javax.swing import BoxLayout -from org.sleuthkit.autopsy.casemodule import Case -from org.sleuthkit.autopsy.casemodule.services import Services -from org.sleuthkit.autopsy.ingest import DataSourceIngestModule -from org.sleuthkit.autopsy.ingest import FileIngestModule -from org.sleuthkit.autopsy.ingest import IngestMessage -from org.sleuthkit.autopsy.ingest import IngestModule -from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter -from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings -from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel -from org.sleuthkit.autopsy.ingest import IngestServices -from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel -from org.sleuthkit.datamodel import BlackboardArtifact -from org.sleuthkit.datamodel import BlackboardAttribute -from org.sleuthkit.datamodel import ReadContentInputStream -from org.sleuthkit.autopsy.coreutils import Logger -from java.lang import IllegalArgumentException - -# Sample factory that defines basic functionality and features of the module -# It implements IngestModuleFactoryAdapter which is a no-op implementation of -# IngestModuleFactory. -class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter): - def __init__(self): - self.settings = None - - def getModuleDisplayName(self): - return "Sample Jython(GUI) ingest module" - - def getModuleDescription(self): - return "Sample Jython Ingest Module with GUI example code" - - def getModuleVersionNumber(self): - return "1.0" - - def getDefaultIngestJobSettings(self): - return SampleIngestModuleSettings() - - def hasIngestJobSettingsPanel(self): - return True - - def getIngestJobSettingsPanel(self, settings): - if not isinstance(settings, SampleIngestModuleSettings): - raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings") - self.settings = settings - return SampleIngestModuleSettingsPanel(self.settings) - - # Return true if module wants to get passed in a data source - def isDataSourceIngestModuleFactory(self): - return True - - # can return null if isDataSourceIngestModuleFactory returns false - def createDataSourceIngestModule(self, ingestOptions): - return SampleJythonDataSourceIngestModule(self.settings) - - # Return true if module wants to get called for each file - - def isFileIngestModuleFactory(self): - return True - - # can return null if isFileIngestModuleFactory returns false - def createFileIngestModule(self, ingestOptions): - return SampleJythonFileIngestModule(self.settings) - - def hasGlobalSettingsPanel(self): - return True - - def getGlobalSettingsPanel(self): - globalSettingsPanel = SampleIngestModuleGlobalSettingsPanel(); - return globalSettingsPanel - - -class SampleIngestModuleGlobalSettingsPanel(IngestModuleGlobalSettingsPanel): - def __init__(self): - self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS)) - checkbox = JCheckBox("Flag inside the Global Settings Panel") - self.add(checkbox) - - -class SampleJythonDataSourceIngestModule(DataSourceIngestModule): - ''' - Data Source-level ingest module. One gets created per data source. - Queries for various files. If you don't need a data source-level module, - delete this class. - ''' - - def __init__(self, settings): - self.local_settings = settings - self.context = None - - def startUp(self, context): - # Used to verify if the GUI checkbox event been recorded or not. - logger = Logger.getLogger("SampleJythonFileIngestModule") - if self.local_settings.getFlag(): - logger.info("flag is set") - else: - logger.info("flag is not set") - - self.context = context - - def process(self, dataSource, progressBar): - if self.context.isJobCancelled(): - return IngestModule.ProcessResult.OK - - # Configure progress bar for 2 tasks - progressBar.switchToDeterminate(2) - - autopsyCase = Case.getCurrentCase() - sleuthkitCase = autopsyCase.getSleuthkitCase() - services = Services(sleuthkitCase) - fileManager = services.getFileManager() - - # Get count of files with "test" in name. - fileCount = 0; - files = fileManager.findFiles(dataSource, "%test%") - for file in files: - fileCount += 1 - progressBar.progress(1) - - if self.context.isJobCancelled(): - return IngestModule.ProcessResult.OK - - # Get files by creation time. - currentTime = System.currentTimeMillis() / 1000 - minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks. - otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime) - for otherFile in otherFiles: - fileCount += 1 - progressBar.progress(1); - - if self.context.isJobCancelled(): - return IngestModule.ProcessResult.OK; - - # Post a message to the ingest messages in box. - message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, - "Sample Jython Data Source Ingest Module", "Found %d files" % fileCount) - IngestServices.getInstance().postMessage(message) - - return IngestModule.ProcessResult.OK; - - -class SampleJythonFileIngestModule(FileIngestModule): - ''' - File-level ingest module. One gets created per thread. Looks at the - attributes of the passed in file. if you don't need a file-level module, - delete this class. - ''' - - def __init__(self, settings): - self.local_settings = settings - - def startUp(self, context): - # Used to verify if the GUI checkbox event been recorded or not. - logger = Logger.getLogger("SampleJythonFileIngestModule") - if self.local_settings.getFlag(): - logger.info("flag is set") - else: - logger.info("flag is not set") - pass - - def process(self, file): - # If the file has a txt extension, post an artifact to the blackboard. - if file.getName().find("test") != -1: - art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT) - att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), - "Sample Jython File Ingest Module", "Text Files") - art.addAttribute(att) - - # Read the contents of the file. - inputStream = ReadContentInputStream(file) - buffer = jarray.zeros(1024, "b") - totLen = 0 - len = inputStream.read(buffer) - while (len != -1): - totLen = totLen + len - len = inputStream.read(buffer) - - # Send the size of the file to the ingest messages in box. - msgText = "Size of %s is %d bytes" % ((file.getName(), totLen)) - message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule", - msgText) - ingestServices = IngestServices.getInstance().postMessage(message) - - return IngestModule.ProcessResult.OK - - def shutDown(self): - pass - - -class SampleIngestModuleSettings(IngestModuleIngestJobSettings): - serialVersionUID = 1L - - def __init__(self): - self.flag = False - - def getVersionNumber(self): - return serialVersionUID - - def getFlag(self): - return self.flag - - def setFlag(self, flag): - self.flag = flag - - -class SampleIngestModuleSettingsPanel(IngestModuleIngestJobSettingsPanel): - # self.settings instance variable not used. Rather, self.local_settings is used. - # https://wiki.python.org/jython/UserGuide#javabean-properties - # Jython Introspector generates a property - 'settings' on the basis - # of getSettings() defined in this class. Since only getter function - # is present, it creates a read-only 'settings' property. This auto- - # generated read-only property overshadows the instance-variable - - # 'settings' - - def checkBoxEvent(self, event): - if self.checkbox.isSelected(): - self.local_settings.setFlag(True) - else: - self.local_settings.setFlag(False) - - def initComponents(self): - self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS)) - self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent) - self.add(self.checkbox) - - def customizeComponents(self): - self.checkbox.setSelected(self.local_settings.getFlag()) - - def __init__(self, settings): - self.local_settings = settings - self.initComponents() - self.customizeComponents() - - def getSettings(self): - return self.local_settings \ No newline at end of file diff --git a/pythonExamples/reportmodule.py b/pythonExamples/reportmodule.py index 566ad0f1c3..fc1c017905 100755 --- a/pythonExamples/reportmodule.py +++ b/pythonExamples/reportmodule.py @@ -27,25 +27,36 @@ # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR # OTHER DEALINGS IN THE SOFTWARE. + +# Report module for Autopsy. +# +# Search for TODO for the things that you need to change +# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation + from java.lang import System from org.sleuthkit.autopsy.casemodule import Case from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter -# Sample module that writes a file with the number of files -# created in the last 2 weeks. +# TODO: Rename this to something more specific class SampleGeneralReportModule(GeneralReportModuleAdapter): + # TODO: Rename this. Will be shown to users when making a report def getName(self): return "Sample Jython Report Module" + # TODO: rewrite this def getDescription(self): return "A sample Jython report module" + # TODO: Update this to reflect where the report file will be written to def getRelativeFilePath(self): return "sampleReport.txt" - def generateReport(self, reportPath, progressBar): - # Configure progress bar for 2 tasks + # TODO: Update this method to make a report + def generateReport(self, baseReportDir, progressBar): + + # For an example, we write a file with the number of files created in the past 2 weeks + # Configure progress bar for 2 tasks progressBar.setIndeterminate(False) progressBar.start() progressBar.setMaximumProgress(2) @@ -62,9 +73,10 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter): progressBar.increment() # Write the result to the report file. - report = open(reportPath + '\\' + self.getRelativeFilePath(), 'w') + report = open(baseReportDir + '\\' + self.getRelativeFilePath(), 'w') report.write("file count = %d" % fileCount) Case.getCurrentCase().addReport(report.name, "SampleGeneralReportModule", "Sample Python Report"); report.close() + progressBar.increment() progressBar.complete() \ No newline at end of file