Merge branch 'collaborative' of https://github.com/sleuthkit/autopsy into interim

Core/src/org/sleuthkit/autopsy/casemodule/AddImageWizardChooseDataSourceVisual.java

@@ -54,7 +54,7 @@ final class AddImageWizardChooseDataSourceVisual extends JPanel {
     private JPanel currentPanel;
 
     private Map<String, DataSourceProcessor> datasourceProcessorsMap = new HashMap<>();
-
+    
     List<String> coreDSPTypes = new ArrayList<>();
 
     /**
@@ -83,8 +83,14 @@ final class AddImageWizardChooseDataSourceVisual extends JPanel {
 
         // make a list of core DSPs
         // ensure that the core DSPs are at the top and in a fixed order
-        coreDSPTypes.add(ImageDSProcessor.getType());
+        coreDSPTypes.add(ImageDSProcessor.getType());        
-        coreDSPTypes.add(LocalDiskDSProcessor.getType());
+        // Local disk processing is not allowed for multi-user cases
+        if (Case.getCurrentCase().getCaseType() != Case.CaseType.MULTI_USER_CASE){
+            coreDSPTypes.add(LocalDiskDSProcessor.getType());
+        } else {
+            // remove LocalDiskDSProcessor from list of DSPs
+            datasourceProcessorsMap.remove(LocalDiskDSProcessor.getType());
+        }
         coreDSPTypes.add(LocalFilesDSProcessor.getType());
 
         for (String dspType : coreDSPTypes) {
@@ -127,7 +133,7 @@ final class AddImageWizardChooseDataSourceVisual extends JPanel {
                 logger.log(Level.SEVERE, "discoverDataSourceProcessors(): A DataSourceProcessor already exists for type = {0}", dsProcessor.getDataSourceType()); //NON-NLS
             }
         }
-    }
+    } 
 
     private void dspSelectionChanged() {
         // update the current panel to selection

Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties

@@ -234,3 +234,8 @@ AddImageWizardIngestConfigPanel.CANCEL_BUTTON.text=Cancel
 NewCaseVisualPanel1.rbSingleUserCase.text=Single-user
 NewCaseVisualPanel1.rbMultiUserCase.text=Multi-user
 NewCaseVisualPanel1.lbBadMultiUserSettings.text=
+ImageFilePanel.errorLabel.text=Error Label
+DataSourceOnCDriveError.text=Path to multi-user data source is on \"C:\" drive
+NewCaseVisualPanel1.CaseFolderOnCDriveError.text=Path to multi-user case folder is on \"C:\" drive
+LocalFilesPanel.errorLabel.text=Error Label
+NewCaseVisualPanel1.errorLabel.text=Error Label

Core/src/org/sleuthkit/autopsy/casemodule/Bundle_ja.properties

@@ -215,3 +215,6 @@ XMLCaseManagement.open.msgDlg.notAutCase.title=\u30a8\u30e9\u30fc
 ImageFilePanel.noFatOrphansCheckbox.text=FAT\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306e\u30aa\u30fc\u30d5\u30a1\u30f3\u30d5\u30a1\u30a4\u30eb\u306f\u7121\u8996
 LocalDiskPanel.noFatOrphansCheckbox.text=FAT\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306e\u30aa\u30fc\u30d5\u30a1\u30f3\u30d5\u30a1\u30a4\u30eb\u306f\u7121\u8996
 AddImageWizardIngestConfigPanel.CANCEL_BUTTON.text=\u30ad\u30e3\u30f3\u30bb\u30eb
+ImageFilePanel.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb
+LocalFilesPanel.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb
+NewCaseVisualPanel1.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb

Core/src/org/sleuthkit/autopsy/casemodule/CaseMetadata.java

@@ -0,0 +1,72 @@
+/*
+ * Autopsy Forensic Browser
+ *
+ * Copyright 2011-2015 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.autopsy.casemodule;
+
+import java.nio.file.Path;
+
+/**
+ * Provides access to case metadata.
+ */
+public final class CaseMetadata {
+
+    /**
+     * Exception thrown by the CaseMetadata class when there is a problem
+     * accessing the metadata for a case.
+     */
+    public final static class CaseMetadataException extends Exception {
+
+        private CaseMetadataException(String message) {
+            super(message);
+        }
+
+        private CaseMetadataException(String message, Throwable cause) {
+            super(message, cause);
+        }
+    }
+
+    private final Case.CaseType caseType;
+
+    /**
+     * Constructs an object that provides access to case metadata.
+     *
+     * @param metadataFilePath
+     */
+    public CaseMetadata(Path metadataFilePath) throws CaseMetadataException {
+        try {
+            // NOTE: This class will eventually replace XMLCaseManagement.
+            // This constructor should parse all of the metadata. In the future,
+            // case metadata may be moved into the case database.
+            XMLCaseManagement metadata = new XMLCaseManagement();
+            metadata.open(metadataFilePath.toString());
+            this.caseType = metadata.getCaseType();
+        } catch (CaseActionException ex) {
+            throw new CaseMetadataException(ex.getLocalizedMessage(), ex);
+        }
+    }
+
+    /**
+     * Gets the case type.
+     *
+     * @return The case type.
+     */
+    public Case.CaseType getCaseType(Path thePath) {
+        return this.caseType;
+    }
+
+}

Core/src/org/sleuthkit/autopsy/casemodule/CaseNewAction.java

@@ -20,6 +20,9 @@
 package org.sleuthkit.autopsy.casemodule;
 
 import java.awt.event.ActionEvent;
+import org.openide.util.HelpCtx;
+import org.openide.util.NbBundle;
+import org.openide.util.actions.CallableSystemAction;
 import org.openide.util.actions.SystemAction;
 import org.openide.util.lookup.ServiceProvider;
 
@@ -29,7 +32,7 @@ import org.openide.util.lookup.ServiceProvider;
  * @author jantonius
  */
 @ServiceProvider(service = CaseNewActionInterface.class)
-public final class CaseNewAction implements CaseNewActionInterface {
+public final class CaseNewAction extends CallableSystemAction implements CaseNewActionInterface {
 
     private NewCaseWizardAction wizard = SystemAction.get(NewCaseWizardAction.class);
 
@@ -41,4 +44,18 @@ public final class CaseNewAction implements CaseNewActionInterface {
     public void actionPerformed(ActionEvent e) {
         wizard.performAction();
     }
+
+    @Override
+    public void performAction() {
+    }
+
+    @Override
+    public String getName() {
+        return NbBundle.getMessage(CaseNewAction.class, "CTL_CaseNewAction");
+    }
+
+    @Override
+    public HelpCtx getHelpCtx() {
+        return HelpCtx.DEFAULT_HELP;
+    }   
 }

Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.form

@@ -43,6 +43,7 @@
                       <EmptySpace min="21" pref="21" max="-2" attributes="0"/>
                       <Component id="descLabel" min="-2" max="-2" attributes="0"/>
                   </Group>
+                  <Component id="errorLabel" alignment="0" min="-2" max="-2" attributes="0"/>
               </Group>
               <EmptySpace min="0" pref="20" max="32767" attributes="0"/>
           </Group>
@@ -57,7 +58,9 @@
                   <Component id="browseButton" alignment="3" min="-2" max="-2" attributes="0"/>
                   <Component id="pathTextField" alignment="3" min="-2" max="-2" attributes="0"/>
               </Group>
-              <EmptySpace type="separate" max="-2" attributes="0"/>
+              <EmptySpace min="-2" pref="3" max="-2" attributes="0"/>
+              <Component id="errorLabel" min="-2" max="-2" attributes="0"/>
+              <EmptySpace min="-2" pref="1" max="-2" attributes="0"/>
               <Group type="103" groupAlignment="3" attributes="0">
                   <Component id="timeZoneLabel" alignment="3" min="-2" max="-2" attributes="0"/>
                   <Component id="timeZoneComboBox" alignment="3" min="-2" max="-2" attributes="0"/>
@@ -66,7 +69,7 @@
               <Component id="noFatOrphansCheckbox" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
               <Component id="descLabel" min="-2" max="-2" attributes="0"/>
-              <EmptySpace pref="13" max="32767" attributes="0"/>
+              <EmptySpace max="32767" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>
@@ -131,5 +134,15 @@
         </Property>
       </Properties>
     </Component>
+    <Component class="javax.swing.JLabel" name="errorLabel">
+      <Properties>
+        <Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
+          <Color blue="0" green="0" red="ff" type="rgb"/>
+        </Property>
+        <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+          <ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="ImageFilePanel.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+        </Property>
+      </Properties>
+    </Component>
   </SubComponents>
 </Form>

Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.java

@@ -37,6 +37,7 @@ import org.sleuthkit.autopsy.coreutils.ModuleSettings;
 import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
 import java.util.logging.Level;
 import org.sleuthkit.autopsy.coreutils.Logger;
+import org.sleuthkit.autopsy.coreutils.PathValidator;
 
 /**
  * ImageTypePanel for adding an image file such as .img, .E0x, .00x, etc.
@@ -62,6 +63,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
         fc.setFileSelectionMode(JFileChooser.FILES_ONLY);
         fc.setMultiSelectionEnabled(false);
         
+        errorLabel.setVisible(false);
+        
         boolean firstFilter = true;
         for (FileFilter filter: fileChooserFilters ) {
             if (firstFilter) {  // set the first on the list as the default selection
@@ -76,7 +79,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
         this.contextName = context;
         pcs = new PropertyChangeSupport(this);
         
-        createTimeZoneList();
+        createTimeZoneList();       
     }
     
     /**
@@ -98,7 +101,6 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
     }
     
 
-
     /**
      * This method is called from within the constructor to initialize the form.
      * WARNING: Do NOT modify this code. The content of this method is always
@@ -115,6 +117,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
         timeZoneComboBox = new javax.swing.JComboBox<String>();
         noFatOrphansCheckbox = new javax.swing.JCheckBox();
         descLabel = new javax.swing.JLabel();
+        errorLabel = new javax.swing.JLabel();
 
         setMinimumSize(new java.awt.Dimension(0, 65));
         setPreferredSize(new java.awt.Dimension(403, 65));
@@ -139,6 +142,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
 
         org.openide.awt.Mnemonics.setLocalizedText(descLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.descLabel.text")); // NOI18N
 
+        errorLabel.setForeground(new java.awt.Color(255, 0, 0));
+        org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.errorLabel.text")); // NOI18N
+
         javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
         this.setLayout(layout);
         layout.setHorizontalGroup(
@@ -158,7 +164,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
                     .addComponent(noFatOrphansCheckbox)
                     .addGroup(layout.createSequentialGroup()
                         .addGap(21, 21, 21)
-                        .addComponent(descLabel)))
+                        .addComponent(descLabel))
+                    .addComponent(errorLabel))
                 .addGap(0, 20, Short.MAX_VALUE))
         );
         layout.setVerticalGroup(
@@ -169,7 +176,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
                     .addComponent(browseButton)
                     .addComponent(pathTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
-                .addGap(18, 18, 18)
+                .addGap(3, 3, 3)
+                .addComponent(errorLabel)
+                .addGap(1, 1, 1)
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
                     .addComponent(timeZoneLabel)
                     .addComponent(timeZoneComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
@@ -177,7 +186,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
                 .addComponent(noFatOrphansCheckbox)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                 .addComponent(descLabel)
-                .addContainerGap(13, Short.MAX_VALUE))
+                .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
         );
     }// </editor-fold>//GEN-END:initComponents
 
@@ -211,6 +220,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
     // Variables declaration - do not modify//GEN-BEGIN:variables
     private javax.swing.JButton browseButton;
     private javax.swing.JLabel descLabel;
+    private javax.swing.JLabel errorLabel;
     private javax.swing.JCheckBox noFatOrphansCheckbox;
     private javax.swing.JLabel pathLabel;
     private javax.swing.JTextField pathTextField;
@@ -255,19 +265,33 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
      * @return true if a proper image has been selected, false otherwise
      */
     public boolean validatePanel() {
+        errorLabel.setVisible(false);
         String path = getContentPaths();
         if (path == null || path.isEmpty()) {
             return false;
         }
         
+        // display warning if there is one (but don't disable "next" button)
+        warnIfPathIsInvalid(path);
+        
         boolean isExist = Case.pathExists(path);
         boolean isPhysicalDrive = Case.isPhysicalDrive(path);
         boolean isPartition = Case.isPartition(path);
         
         return (isExist || isPhysicalDrive || isPartition);
     }
-
+    
-
+    /**
+     * Validates path to selected data source and displays warning if it is invalid.
+     * @param path Absolute path to the selected data source
+     */
+    private void warnIfPathIsInvalid(String path){                      
+        if (!PathValidator.isValid(path, Case.getCurrentCase().getCaseType())) {
+            errorLabel.setVisible(true);
+            errorLabel.setText(NbBundle.getMessage(this.getClass(), "DataSourceOnCDriveError.text"));
+        }
+    }
+    
     public void storeSettings() {
         String imagePathName = getContentPaths();
         if (null != imagePathName ) {

Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.form

@@ -61,7 +61,7 @@
               <Component id="noFatOrphansCheckbox" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
               <Component id="descLabel" min="-2" max="-2" attributes="0"/>
-              <EmptySpace pref="21" max="32767" attributes="0"/>
+              <EmptySpace max="32767" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>

Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.java

@@ -92,11 +92,11 @@ final class LocalDiskPanel extends JPanel {
         model = new LocalDiskModel();
         diskComboBox.setModel(model);
         diskComboBox.setRenderer(model);
-
+        
+        errorLabel.setVisible(false);
         errorLabel.setText("");
         diskComboBox.setEnabled(false);
-
+    }     
-    }
 
     /**
      * This method is called from within the constructor to initialize the form.
@@ -167,7 +167,7 @@ final class LocalDiskPanel extends JPanel {
                 .addComponent(noFatOrphansCheckbox)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                 .addComponent(descLabel)
-                .addContainerGap(21, Short.MAX_VALUE))
+                .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
         );
     }// </editor-fold>//GEN-END:initComponents
     // Variables declaration - do not modify//GEN-BEGIN:variables
@@ -224,7 +224,7 @@ final class LocalDiskPanel extends JPanel {
      * @return true
      */
     //@Override
-    public boolean validatePanel() {
+    public boolean validatePanel() {        
         return enableNext;
     }
 

Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.form

@@ -60,6 +60,10 @@
               </Group>
               <EmptySpace min="-2" pref="2" max="-2" attributes="0"/>
           </Group>
+          <Group type="102" alignment="0" attributes="0">
+              <Component id="errorLabel" min="-2" max="-2" attributes="0"/>
+              <EmptySpace max="32767" attributes="0"/>
+          </Group>
       </Group>
     </DimensionLayout>
     <DimensionLayout dim="1">
@@ -67,15 +71,16 @@
           <Group type="102" alignment="0" attributes="0">
               <Component id="infoLabel" min="-2" max="-2" attributes="0"/>
               <EmptySpace min="-2" pref="5" max="-2" attributes="0"/>
-              <Group type="103" groupAlignment="0" attributes="0">
+              <Group type="103" groupAlignment="0" max="-2" attributes="0">
+                  <Component id="jScrollPane2" min="-2" pref="82" max="-2" attributes="0"/>
                   <Group type="102" attributes="0">
                       <Component id="selectButton" min="-2" max="-2" attributes="0"/>
-                      <EmptySpace pref="17" max="32767" attributes="0"/>
+                      <EmptySpace max="32767" attributes="0"/>
                       <Component id="clearButton" min="-2" max="-2" attributes="0"/>
                   </Group>
-                  <Component id="jScrollPane2" pref="0" max="32767" attributes="0"/>
               </Group>
-              <EmptySpace min="0" pref="0" max="-2" attributes="0"/>
+              <EmptySpace max="-2" attributes="0"/>
+              <Component id="errorLabel" min="-2" max="-2" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>
@@ -136,5 +141,15 @@
         </Component>
       </SubComponents>
     </Container>
+    <Component class="javax.swing.JLabel" name="errorLabel">
+      <Properties>
+        <Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
+          <Color blue="0" green="0" red="ff" type="rgb"/>
+        </Property>
+        <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+          <ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+        </Property>
+      </Properties>
+    </Component>
   </SubComponents>
 </Form>

Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.java

@@ -21,6 +21,8 @@ package org.sleuthkit.autopsy.casemodule;
 import java.beans.PropertyChangeListener;
 import java.beans.PropertyChangeSupport;
 import java.io.File;
+import java.util.Arrays;
+import java.util.List;
 import java.util.Set;
 import java.util.TreeSet;
 import javax.swing.JFileChooser;
@@ -30,7 +32,9 @@ import org.openide.util.NbBundle;
 import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor;
 import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
 import java.util.logging.Level;
+import org.sleuthkit.autopsy.casemodule.Case.CaseType;
 import org.sleuthkit.autopsy.coreutils.Logger;
+import org.sleuthkit.autopsy.coreutils.PathValidator;
 /**
  * Add input wizard subpanel for adding local files / dirs to the case
  */
@@ -42,6 +46,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
     private static LocalFilesPanel instance;
     public static final String FILES_SEP = ",";
     private static final Logger logger = Logger.getLogger(LocalFilesPanel.class.getName());
+    
     /**
      * Creates new form LocalFilesPanel
      */
@@ -59,9 +64,9 @@ import org.sleuthkit.autopsy.coreutils.Logger;
 
     private void customInit() {
         localFileChooser.setMultiSelectionEnabled(true);
+        errorLabel.setVisible(false);
         selectedPaths.setText("");
-        
+    }       
-    }
     
     //@Override
     public String getContentPaths() {
@@ -91,8 +96,32 @@ import org.sleuthkit.autopsy.coreutils.Logger;
 
     //@Override
     public boolean validatePanel() {
+        
+        // display warning if there is one (but don't disable "next" button)
+        warnIfPathIsInvalid(getContentPaths());        
+        
         return enableNext;
     }
+    
+    /**
+     * Validates path to selected data source and displays warning if it is invalid. 
+     * @param path Absolute path to the selected data source
+     */
+     private void warnIfPathIsInvalid(String path) {
+         errorLabel.setVisible(false);
+
+         // Path variable for "Local files" module is a coma separated string containg multiple paths
+         List<String> pathsList = Arrays.asList(path.split(","));
+         CaseType currentCaseType = Case.getCurrentCase().getCaseType();
+
+         for (String currentPath : pathsList) {
+             if (!PathValidator.isValid(currentPath, currentCaseType)) {
+                 errorLabel.setVisible(true);
+                 errorLabel.setText(NbBundle.getMessage(this.getClass(), "DataSourceOnCDriveError.text"));
+                 return;
+             }
+         }
+     } 
 
     //@Override
     public void select() {
@@ -104,6 +133,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
         currentFiles.clear();
         selectedPaths.setText("");
         enableNext = false;
+        errorLabel.setVisible(false);
         
         //pcs.firePropertyChange(AddImageWizardChooseDataSourceVisual.EVENT.UPDATE_UI.toString(), false, true);
     }
@@ -149,6 +179,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
         clearButton = new javax.swing.JButton();
         jScrollPane2 = new javax.swing.JScrollPane();
         selectedPaths = new javax.swing.JTextArea();
+        errorLabel = new javax.swing.JLabel();
 
         localFileChooser.setApproveButtonText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonText")); // NOI18N
         localFileChooser.setApproveButtonToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonToolTipText")); // NOI18N
@@ -184,6 +215,9 @@ import org.sleuthkit.autopsy.coreutils.Logger;
         selectedPaths.setToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.selectedPaths.toolTipText")); // NOI18N
         jScrollPane2.setViewportView(selectedPaths);
 
+        errorLabel.setForeground(new java.awt.Color(255, 0, 0));
+        org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.errorLabel.text")); // NOI18N
+
         javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
         this.setLayout(layout);
         layout.setHorizontalGroup(
@@ -198,19 +232,23 @@ import org.sleuthkit.autopsy.coreutils.Logger;
                     .addComponent(selectButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                     .addComponent(clearButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
                 .addGap(2, 2, 2))
+            .addGroup(layout.createSequentialGroup()
+                .addComponent(errorLabel)
+                .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
         );
         layout.setVerticalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
             .addGroup(layout.createSequentialGroup()
                 .addComponent(infoLabel)
                 .addGap(5, 5, 5)
-                .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
+                .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
+                    .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 82, javax.swing.GroupLayout.PREFERRED_SIZE)
                     .addGroup(layout.createSequentialGroup()
                         .addComponent(selectButton)
-                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 17, Short.MAX_VALUE)
+                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                        .addComponent(clearButton))
+                        .addComponent(clearButton)))
-                    .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE))
+                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
-                .addGap(0, 0, 0))
+                .addComponent(errorLabel))
         );
     }// </editor-fold>//GEN-END:initComponents
 
@@ -258,6 +296,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
 
     // Variables declaration - do not modify//GEN-BEGIN:variables
     private javax.swing.JButton clearButton;
+    private javax.swing.JLabel errorLabel;
     private javax.swing.JLabel infoLabel;
     private javax.swing.JScrollPane jScrollPane1;
     private javax.swing.JScrollPane jScrollPane2;

Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.form

@@ -23,33 +23,49 @@
           <Group type="102" attributes="0">
               <EmptySpace max="-2" attributes="0"/>
               <Group type="103" groupAlignment="0" attributes="0">
-                  <Component id="jLabel2" alignment="0" min="-2" max="-2" attributes="0"/>
+                  <Group type="102" attributes="0">
-                  <Group type="102" alignment="0" attributes="0">
+                      <Group type="103" groupAlignment="0" attributes="0">
-                      <Group type="103" groupAlignment="1" max="-2" attributes="0">
+                          <Component id="jLabel2" alignment="0" min="-2" max="-2" attributes="0"/>
                           <Group type="102" alignment="0" attributes="0">
+                              <Group type="103" groupAlignment="1" attributes="0">
+                                  <Component id="caseDirTextField" alignment="0" max="32767" attributes="1"/>
+                                  <Group type="102" alignment="1" attributes="0">
+                                      <EmptySpace min="0" pref="58" max="32767" attributes="0"/>
+                                      <Component id="lbBadMultiUserSettings" min="-2" pref="372" max="-2" attributes="0"/>
+                                  </Group>
+                                  <Group type="102" alignment="0" attributes="0">
+                                      <Component id="jLabel1" min="-2" max="-2" attributes="0"/>
+                                      <EmptySpace min="0" pref="0" max="32767" attributes="0"/>
+                                  </Group>
+                                  <Group type="102" alignment="0" attributes="0">
+                                      <Component id="caseDirLabel" min="-2" max="-2" attributes="0"/>
+                                      <EmptySpace type="unrelated" max="-2" attributes="0"/>
+                                      <Component id="caseParentDirTextField" max="32767" attributes="0"/>
+                                  </Group>
+                                  <Group type="102" attributes="0">
+                                      <Component id="caseNameLabel" min="-2" max="-2" attributes="0"/>
+                                      <EmptySpace min="-2" pref="26" max="-2" attributes="0"/>
+                                      <Component id="caseNameTextField" max="32767" attributes="0"/>
+                                  </Group>
+                              </Group>
+                              <EmptySpace type="unrelated" max="-2" attributes="0"/>
+                              <Component id="caseDirBrowseButton" min="-2" max="-2" attributes="0"/>
+                          </Group>
+                      </Group>
+                      <EmptySpace max="-2" attributes="0"/>
+                  </Group>
+                  <Group type="102" attributes="0">
+                      <Group type="103" groupAlignment="0" attributes="0">
+                          <Group type="102" attributes="0">
                               <Component id="rbSingleUserCase" min="-2" max="-2" attributes="0"/>
                               <EmptySpace type="unrelated" max="-2" attributes="0"/>
                               <Component id="rbMultiUserCase" min="-2" max="-2" attributes="0"/>
                           </Group>
-                          <Component id="jLabel1" alignment="0" min="-2" max="-2" attributes="0"/>
+                          <Component id="errorLabel" alignment="0" min="-2" max="-2" attributes="0"/>
-                          <Group type="102" alignment="0" attributes="0">
-                              <Component id="caseDirLabel" min="-2" max="-2" attributes="0"/>
-                              <EmptySpace type="unrelated" max="-2" attributes="0"/>
-                              <Component id="caseParentDirTextField" min="-2" pref="296" max="-2" attributes="0"/>
-                          </Group>
-                          <Group type="102" alignment="0" attributes="0">
-                              <Component id="caseNameLabel" min="-2" max="-2" attributes="0"/>
-                              <EmptySpace max="32767" attributes="0"/>
-                              <Component id="caseNameTextField" min="-2" pref="296" max="-2" attributes="0"/>
-                          </Group>
-                          <Component id="caseDirTextField" alignment="0" max="32767" attributes="1"/>
-                          <Component id="lbBadMultiUserSettings" alignment="1" min="-2" pref="372" max="-2" attributes="0"/>
                       </Group>
-                      <EmptySpace type="unrelated" max="-2" attributes="0"/>
+                      <EmptySpace min="0" pref="0" max="32767" attributes="0"/>
-                      <Component id="caseDirBrowseButton" min="-2" max="-2" attributes="0"/>
                   </Group>
               </Group>
-              <EmptySpace max="32767" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>
@@ -73,12 +89,14 @@
               <Component id="jLabel2" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
               <Component id="caseDirTextField" min="-2" max="-2" attributes="0"/>
-              <EmptySpace type="separate" max="-2" attributes="0"/>
+              <EmptySpace type="unrelated" max="-2" attributes="0"/>
               <Group type="103" groupAlignment="3" attributes="0">
                   <Component id="rbSingleUserCase" alignment="3" min="-2" max="-2" attributes="0"/>
                   <Component id="rbMultiUserCase" alignment="3" min="-2" max="-2" attributes="0"/>
               </Group>
-              <EmptySpace min="-2" max="-2" attributes="0"/>
+              <EmptySpace max="-2" attributes="0"/>
+              <Component id="errorLabel" min="-2" max="-2" attributes="0"/>
+              <EmptySpace min="-2" pref="1" max="-2" attributes="0"/>
               <Component id="lbBadMultiUserSettings" min="-2" pref="23" max="-2" attributes="0"/>
               <EmptySpace max="32767" attributes="0"/>
           </Group>
@@ -158,6 +176,9 @@
           <ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="NewCaseVisualPanel1.rbSingleUserCase.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
         </Property>
       </Properties>
+      <Events>
+        <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="rbSingleUserCaseActionPerformed"/>
+      </Events>
     </Component>
     <Component class="javax.swing.JRadioButton" name="rbMultiUserCase">
       <Properties>
@@ -168,6 +189,9 @@
           <ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="NewCaseVisualPanel1.rbMultiUserCase.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
         </Property>
       </Properties>
+      <Events>
+        <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="rbMultiUserCaseActionPerformed"/>
+      </Events>
     </Component>
     <Component class="javax.swing.JLabel" name="lbBadMultiUserSettings">
       <Properties>
@@ -182,5 +206,15 @@
         </Property>
       </Properties>
     </Component>
+    <Component class="javax.swing.JLabel" name="errorLabel">
+      <Properties>
+        <Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
+          <Color blue="0" green="0" red="ff" type="rgb"/>
+        </Property>
+        <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+          <ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="NewCaseVisualPanel1.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+        </Property>
+      </Properties>
+    </Component>
   </SubComponents>
 </Form>

Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.java

@@ -29,6 +29,7 @@ import javax.swing.event.DocumentEvent;
 import javax.swing.event.DocumentListener;
 import org.sleuthkit.autopsy.casemodule.Case.CaseType;
 import org.sleuthkit.autopsy.core.UserPreferences;
+import org.sleuthkit.autopsy.coreutils.PathValidator;
 import org.sleuthkit.datamodel.CaseDbConnectionInfo;
 import org.sleuthkit.datamodel.TskData.DbType;
 
@@ -40,10 +41,11 @@ import org.sleuthkit.datamodel.TskData.DbType;
 final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
 
     private JFileChooser fc = new JFileChooser();
-    private NewCaseWizardPanel1 wizPanel;
+    private NewCaseWizardPanel1 wizPanel;   
 
     NewCaseVisualPanel1(NewCaseWizardPanel1 wizPanel) {
         initComponents();
+        errorLabel.setVisible(false);
         lbBadMultiUserSettings.setText("");
         this.wizPanel = wizPanel;
         caseNameTextField.getDocument().addDocumentListener(this);
@@ -145,6 +147,7 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
         rbSingleUserCase = new javax.swing.JRadioButton();
         rbMultiUserCase = new javax.swing.JRadioButton();
         lbBadMultiUserSettings = new javax.swing.JLabel();
+        errorLabel = new javax.swing.JLabel();
 
         jLabel1.setFont(new java.awt.Font("Tahoma", 1, 14)); // NOI18N
         org.openide.awt.Mnemonics.setLocalizedText(jLabel1, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.jLabel1.text_1")); // NOI18N
@@ -171,14 +174,27 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
 
         caseTypeButtonGroup.add(rbSingleUserCase);
         org.openide.awt.Mnemonics.setLocalizedText(rbSingleUserCase, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.rbSingleUserCase.text")); // NOI18N
+        rbSingleUserCase.addActionListener(new java.awt.event.ActionListener() {
+            public void actionPerformed(java.awt.event.ActionEvent evt) {
+                rbSingleUserCaseActionPerformed(evt);
+            }
+        });
 
         caseTypeButtonGroup.add(rbMultiUserCase);
         org.openide.awt.Mnemonics.setLocalizedText(rbMultiUserCase, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.rbMultiUserCase.text")); // NOI18N
+        rbMultiUserCase.addActionListener(new java.awt.event.ActionListener() {
+            public void actionPerformed(java.awt.event.ActionEvent evt) {
+                rbMultiUserCaseActionPerformed(evt);
+            }
+        });
 
         lbBadMultiUserSettings.setFont(new java.awt.Font("Tahoma", 0, 12)); // NOI18N
         lbBadMultiUserSettings.setForeground(new java.awt.Color(255, 0, 0));
         org.openide.awt.Mnemonics.setLocalizedText(lbBadMultiUserSettings, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.lbBadMultiUserSettings.text")); // NOI18N
 
+        errorLabel.setForeground(new java.awt.Color(255, 0, 0));
+        org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.errorLabel.text")); // NOI18N
+
         javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
         this.setLayout(layout);
         layout.setHorizontalGroup(
@@ -186,27 +202,37 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
             .addGroup(layout.createSequentialGroup()
                 .addContainerGap()
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
-                    .addComponent(jLabel2)
                     .addGroup(layout.createSequentialGroup()
-                        .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING, false)
+                        .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
-                            .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
+                            .addComponent(jLabel2)
+                            .addGroup(layout.createSequentialGroup()
+                                .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
+                                    .addComponent(caseDirTextField, javax.swing.GroupLayout.Alignment.LEADING)
+                                    .addGroup(layout.createSequentialGroup()
+                                        .addGap(0, 58, Short.MAX_VALUE)
+                                        .addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 372, javax.swing.GroupLayout.PREFERRED_SIZE))
+                                    .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
+                                        .addComponent(jLabel1)
+                                        .addGap(0, 0, Short.MAX_VALUE))
+                                    .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
+                                        .addComponent(caseDirLabel)
+                                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
+                                        .addComponent(caseParentDirTextField))
+                                    .addGroup(layout.createSequentialGroup()
+                                        .addComponent(caseNameLabel)
+                                        .addGap(26, 26, 26)
+                                        .addComponent(caseNameTextField)))
+                                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
+                                .addComponent(caseDirBrowseButton)))
+                        .addContainerGap())
+                    .addGroup(layout.createSequentialGroup()
+                        .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
+                            .addGroup(layout.createSequentialGroup()
                                 .addComponent(rbSingleUserCase)
                                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
                                 .addComponent(rbMultiUserCase))
-                            .addComponent(jLabel1, javax.swing.GroupLayout.Alignment.LEADING)
+                            .addComponent(errorLabel))
-                            .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
+                        .addGap(0, 0, Short.MAX_VALUE))))
-                                .addComponent(caseDirLabel)
-                                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
-                                .addComponent(caseParentDirTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 296, javax.swing.GroupLayout.PREFERRED_SIZE))
-                            .addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
-                                .addComponent(caseNameLabel)
-                                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                                .addComponent(caseNameTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 296, javax.swing.GroupLayout.PREFERRED_SIZE))
-                            .addComponent(caseDirTextField, javax.swing.GroupLayout.Alignment.LEADING)
-                            .addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 372, javax.swing.GroupLayout.PREFERRED_SIZE))
-                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
-                        .addComponent(caseDirBrowseButton)))
-                .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
         );
         layout.setVerticalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@@ -226,11 +252,13 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
                 .addComponent(jLabel2)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                 .addComponent(caseDirTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
-                .addGap(18, 18, 18)
+                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
                 .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
                     .addComponent(rbSingleUserCase)
                     .addComponent(rbMultiUserCase))
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
+                .addComponent(errorLabel)
+                .addGap(1, 1, 1)
                 .addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE)
                 .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
         );
@@ -261,6 +289,16 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
         }
     }//GEN-LAST:event_caseDirBrowseButtonActionPerformed
 
+    private void rbSingleUserCaseActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_rbSingleUserCaseActionPerformed
+        this.wizPanel.fireChangeEvent();
+        updateUI(null); // DocumentEvent is not used inside updateUI
+    }//GEN-LAST:event_rbSingleUserCaseActionPerformed
+
+    private void rbMultiUserCaseActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_rbMultiUserCaseActionPerformed
+        this.wizPanel.fireChangeEvent();
+        updateUI(null); // DocumentEvent is not used inside updateUI
+    }//GEN-LAST:event_rbMultiUserCaseActionPerformed
+
     // Variables declaration - do not modify//GEN-BEGIN:variables
     private javax.swing.JButton caseDirBrowseButton;
     private javax.swing.JLabel caseDirLabel;
@@ -269,6 +307,7 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
     private javax.swing.JTextField caseNameTextField;
     private javax.swing.JTextField caseParentDirTextField;
     private javax.swing.ButtonGroup caseTypeButtonGroup;
+    private javax.swing.JLabel errorLabel;
     private javax.swing.JLabel jLabel1;
     private javax.swing.JLabel jLabel2;
     private javax.swing.JLabel lbBadMultiUserSettings;
@@ -320,10 +359,13 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
      * @param e the document event
      */
     public void updateUI(DocumentEvent e) {
+        
+        // Note: DocumentEvent e can be null when called from rbSingleUserCaseActionPerformed()
+        // and rbMultiUserCaseActionPerformed().
 
         String caseName = getCaseName();
         String parentDir = getCaseParentDir();
-
+        
         if (!caseName.equals("") && !parentDir.equals("")) {
             caseDirTextField.setText(parentDir + caseName);
             wizPanel.setIsFinish(true);
@@ -331,5 +373,21 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
             caseDirTextField.setText("");
             wizPanel.setIsFinish(false);
         }
+        
+        // display warning if there is one (but don't disable "next" button)
+        warnIfPathIsInvalid(parentDir);              
     }
+    
+    /**
+     * Validates path to selected case output folder. Displays warning if path is invalid.
+     *
+     * @param path Absolute path to the selected case folder
+     */
+    private void warnIfPathIsInvalid(String path) {
+        errorLabel.setVisible(false);
+        if (!PathValidator.isValid(path, getCaseType())) {
+            errorLabel.setVisible(true);
+            errorLabel.setText(NbBundle.getMessage(this.getClass(), "NewCaseVisualPanel1.CaseFolderOnCDriveError.text"));
+        }
+    } 
 }

Core/src/org/sleuthkit/autopsy/casemodule/NewCaseWizardPanel1.java

@@ -35,7 +35,6 @@ import org.openide.WizardDescriptor;
 import org.openide.WizardValidationException;
 import org.openide.util.HelpCtx;
 import org.sleuthkit.autopsy.casemodule.Case.CaseType;
-import org.sleuthkit.autopsy.core.UserPreferences;
 import org.sleuthkit.autopsy.coreutils.ModuleSettings;
 
 /**

Core/src/org/sleuthkit/autopsy/core/layer.xml

@@ -44,7 +44,6 @@
             <file name="org-sleuthkit-autopsy-casemodule-CaseNewAction.instance">
                 <attr name="delegate" newvalue="org.sleuthkit.autopsy.casemodule.CaseNewAction"/>
                 <attr name="displayName" bundlevalue="org.sleuthkit.autopsy.casemodule.Bundle#CTL_CaseNewAction"/>
-                <attr name="instanceCreate" methodvalue="org.openide.awt.Actions.alwaysEnabled"/>
                 <attr name="noIconInMenu" boolvalue="false"/>
             </file>
             <file name="org-sleuthkit-autopsy-casemodule-CasePropertiesAction.instance"/>

Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessor.java

@@ -21,69 +21,70 @@ package org.sleuthkit.autopsy.corecomponentinterfaces;
 
 import javax.swing.JPanel;
 
-/*
+/**
- * Defines an interface used by the Add DataSource wizard to discover different
+ * Interface used by the Add DataSource wizard to allow different 
- * Data SourceProcessors. 
+ * types of data sources to be added to a case.  Examples of data 
+ * sources include disk images, local files, etc. 
  * 
- * Each data source may have its unique attributes and may need to be processed 
+ * The interface provides a uniform mechanism for the Autopsy UI
- * differently.
- * 
- * The DataSourceProcessor interface defines a uniform mechanism for the Autopsy UI
  * to:
- *  - collect details for the data source to be processed.
+ *  - Collect details from the user about the data source to be processed.
- *  - Process the data source in the background
+ *  - Process the data source in the background and add data to the database
- *  - Be notified when the processing is complete
+ *  - Provides progress feedback to the user / UI. 
  */
 public interface DataSourceProcessor {
    
-    /*
+    /**
      * The DSP Panel may fire Property change events
      * The caller must enure to add itself as a listener and 
      * then react appropriately to the events
      */
     enum DSP_PANEL_EVENT {
-
+        UPDATE_UI,  ///< the content of JPanel has changed that MAY warrant updates to the caller UI
-        UPDATE_UI,  // the content of JPanel has changed that MAY warrant updates to the caller UI
+        FOCUS_NEXT  ///< the caller UI may move focus the the next UI element, following the panel.
-        FOCUS_NEXT  // the caller UI may move focus the the next UI element, following the panel.
     };
     
     
    /**
     * Returns the type of Data Source it handles. 
     * This name gets displayed in the drop-down listbox
-    **/
+    */
     String getDataSourceType();
     
    /**
     * Returns the picker panel to be displayed along with any other
-    * runtime options supported by the data source handler. 
+    * runtime options supported by the data source handler.  The
-    **/
+    * DSP is responsible for storing the settings so that a later 
+    * call to run() will have the user-specified settings.  
+    * 
+    * Should be less than 544 pixels wide and 173 pixels high. 
+    */
     JPanel getPanel();
     
    /**
     * Called to validate the input data in the panel.
     * Returns true if no errors, or 
     * Returns false if there is an error.  
-    **/
+    */
     boolean isPanelValid();
     
    /**
-    * Called to invoke the handling of Data source in the background.
+    * Called to invoke the handling of data source in the background.
-    * Returns after starting the background thread 
+    * Returns after starting the background thread.   
-    * @param settings wizard settings to read/store properties
-    * @param progressPanel progress panel to be updated while processing
     * 
-    **/
+    * @param progressPanel progress panel to be updated while processing
+    * @param dspCallback Contains the callback method DataSourceProcessorCallback.done() that the DSP must call when the background thread finishes with errors and status. 
+    */
     void run(DataSourceProcessorProgressMonitor progressPanel, DataSourceProcessorCallback dspCallback);
     
     
    /**
     * Called to cancel the background processing.
-    **/
+    */
     void cancel();
     
    /**
     * Called to reset/reinitialize  the DSP.
-    **/
+    */
     void reset();
 }

Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorCallback.java

@@ -16,7 +16,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-
 package org.sleuthkit.autopsy.corecomponentinterfaces;
 
 import java.awt.EventQueue;
@@ -25,42 +24,52 @@ import org.sleuthkit.datamodel.Content;
 
 /**
  * Abstract class for a callback for a DataSourceProcessor.
- * 
+ *
- * Ensures that DSP invokes the caller overridden method, doneEDT(), 
+ * Ensures that DSP invokes the caller overridden method, doneEDT(), in the EDT
- * in the EDT thread. 
+ * thread.
- * 
+ *
  */
 public abstract class DataSourceProcessorCallback {
-    
+
-    public enum DataSourceProcessorResult 
+    public enum DataSourceProcessorResult {
-            {
+        NO_ERRORS,  ///< No errors were encountered while ading the data source
-                NO_ERRORS, 
+        CRITICAL_ERRORS, ///< No data was added to the database. There were fundamental errors processing the data (such as no data or system failure).  
-                CRITICAL_ERRORS,
+        NONCRITICAL_ERRORS, ///< There was data added to the database, but there were errors from data corruption or a small number of minor issues. 
-                NONCRITICAL_ERRORS,
     };
+
     
-    /*
+    /**
-     * Invoke the caller supplied callback function on the EDT thread
+     * Called by a DSP implementation when it is done adding a data source
+     * to the database. Users of the DSP can override this method if they do
+     * not want to be notified on the EDT.  Otherwise, this method will call 
+     * doneEDT() with the same arguments. 
+     * @param result Code for status
+     * @param errList List of error strings
+     * @param newContents List of root Content objects that were added to database. Typically only one is given.
      */
-    public void done(DataSourceProcessorResult result, List<String> errList,  List<Content> newContents)
+    public void done(DataSourceProcessorResult result, List<String> errList, List<Content> newContents) {
-    {
+
-        
         final DataSourceProcessorResult resultf = result;
         final List<String> errListf = errList;
         final List<Content> newContentsf = newContents;
-                
+
-            // Invoke doneEDT() that runs on the EDT .
+        // Invoke doneEDT() that runs on the EDT .
-            EventQueue.invokeLater(new Runnable() {
+        EventQueue.invokeLater(new Runnable() {
-               @Override
+            @Override
-               public void run() {
+            public void run() {
-                   doneEDT(resultf, errListf, newContentsf );
+                doneEDT(resultf, errListf, newContentsf);
-                   
+            }
-               }
+        });
-           }); 
     }
-    
+
-    /*
+    /**
-     * calling code overrides to provide its own calllback 
+     * Called by done() if the default implementation is used.  Users of DSPs
-     */
+     * that have UI updates to do after the DSP is finished adding the DS can
-    public abstract void doneEDT(DataSourceProcessorResult result, List<String> errList,  List<Content> newContents);
+     * implement this method to receive the updates on the EDT.
+     *
+     * @param result Code for status
+     * @param errList List of error strings
+     * @param newContents List of root Content objects that were added to database. Typically only one is given.
+     */ 
+    public abstract void doneEDT(DataSourceProcessorResult result, List<String> errList, List<Content> newContents);
 };

Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorProgressMonitor.java

@@ -18,10 +18,10 @@
  */
 package org.sleuthkit.autopsy.corecomponentinterfaces;
 
-/*
+/**
  * An GUI agnostic DataSourceProcessorProgressMonitor interface for DataSourceProcesssors to 
  * indicate progress.
- * It models after a JProgressbar though it could use any underlying implementation
+ * It models after a JProgressbar though it could use any underlying implementation (or NoOps)
  */
 public interface DataSourceProcessorProgressMonitor {
  

Core/src/org/sleuthkit/autopsy/corecomponents/FXVideoPanel.java

@@ -78,8 +78,10 @@ import org.sleuthkit.datamodel.TskData;
     @ServiceProvider(service = FrameCapture.class)
 })
 public class FXVideoPanel extends MediaViewVideoPanel {
-
+    
-    private static final String[] EXTENSIONS = new String[]{".mov", ".m4v", ".flv", ".mp4", ".mpg", ".mpeg"}; //NON-NLS
+    // Refer to https://docs.oracle.com/javafx/2/api/javafx/scene/media/package-summary.html
+    // for Javafx supported formats 
+    private static final String[] EXTENSIONS = new String[]{".m4v", ".fxm", ".flv", ".m3u8", ".mp4", ".aif", ".aiff", ".mp3", "m4a", ".wav"}; //NON-NLS
     private static final List<String> MIMETYPES = Arrays.asList("audio/x-aiff", "video/x-javafx", "video/x-flv", "application/vnd.apple.mpegurl", " audio/mpegurl", "audio/mpeg", "video/mp4", "audio/x-m4a", "video/x-m4v", "audio/x-wav"); //NON-NLS
     private static final Logger logger = Logger.getLogger(MediaViewVideoPanel.class.getName());
 
@@ -478,6 +480,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
             pauseButton.setOnAction(new EventHandler<ActionEvent>() {
                 @Override
                 public void handle(ActionEvent e) {
+                    if (mediaPlayer == null) {
+                        return;
+                    }
+
                     Status status = mediaPlayer.getStatus();
 
                     switch (status) {
@@ -496,7 +502,7 @@ public class FXVideoPanel extends MediaViewVideoPanel {
                             // If the MediaPlayer is in an unexpected state, stop playback.
                             mediaPlayer.stop();
                             setInfoLabelText(NbBundle.getMessage(this.getClass(),
-                                                                 "FXVideoPanel.pauseButton.infoLabel.playbackErr"));
+                                    "FXVideoPanel.pauseButton.infoLabel.playbackErr"));
                             break;
                     }
                 }
@@ -505,6 +511,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
             stopButton.setOnAction(new EventHandler<ActionEvent>() {
                 @Override
                 public void handle(ActionEvent e) {
+                    if (mediaPlayer == null) {
+                        return;
+                    }
+
                     mediaPlayer.stop();
                 }
             });
@@ -512,6 +522,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
             progressSlider.valueProperty().addListener(new InvalidationListener() {
                 @Override
                 public void invalidated(Observable o) {
+                    if (mediaPlayer == null) {
+                        return;
+                    }
+
                     if (progressSlider.isValueChanging()) {
                         mediaPlayer.seek(duration.multiply(progressSlider.getValue() / 100.0));
                     }
@@ -559,6 +573,9 @@ public class FXVideoPanel extends MediaViewVideoPanel {
          * media.
          */
         private void updateProgress() {
+            if (mediaPlayer == null) {
+                return;
+            }
             Duration currentTime = mediaPlayer.getCurrentTime();
             updateSlider(currentTime);
             updateTime(currentTime);
@@ -634,6 +651,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
 
             @Override
             public void run() {
+                if (mediaPlayer == null) {
+                    return;
+                }
+                
                 duration = mediaPlayer.getMedia().getDuration();
                 long durationInMillis = (long) mediaPlayer.getMedia().getDuration().toMillis();
 
@@ -657,6 +678,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
 
             @Override
             public void run() {
+                if (mediaPlayer == null) {
+                    return;
+                }
+
                 Duration beginning = mediaPlayer.getStartTime();
                 mediaPlayer.stop();
                 mediaPlayer.pause();

Core/src/org/sleuthkit/autopsy/coreutils/ImageUtils.java

@@ -33,11 +33,9 @@ import java.util.List;
 import java.util.logging.Level;
 import javax.imageio.ImageIO;
 import javax.swing.ImageIcon;
-import org.openide.util.Exceptions;
 import org.sleuthkit.autopsy.casemodule.Case;
 import org.sleuthkit.autopsy.corelibs.ScalrWrapper;
 import org.sleuthkit.datamodel.AbstractFile;
-import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.BlackboardAttribute;
 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
 import org.sleuthkit.datamodel.Content;
@@ -55,7 +53,11 @@ public class ImageUtils {
     private static final Logger logger = Logger.getLogger(ImageUtils.class.getName());
     private static final Image DEFAULT_ICON = new ImageIcon("/org/sleuthkit/autopsy/images/file-icon.png").getImage(); //NON-NLS
     private static final List<String> SUPP_EXTENSIONS = Arrays.asList(ImageIO.getReaderFileSuffixes());
-    private static final List<String> SUPP_MIME_TYPES = Arrays.asList(ImageIO.getReaderMIMETypes());
+    private static final List<String> SUPP_MIME_TYPES = new ArrayList<>(Arrays.asList(ImageIO.getReaderMIMETypes()));
+    static {
+        SUPP_MIME_TYPES.add("image/x-ms-bmp");
+    }
+    
     /**
      * Get the default Icon, which is the icon for a file.
      * @return 
@@ -88,14 +90,17 @@ public class ImageUtils {
                     return true;
                 }
             }
+            // if the file type is known and we don't support it, bail
+            if (attributes.size() > 0) {
+                return false;
+            }
         } 
         catch (TskCoreException ex) {
             logger.log(Level.WARNING, "Error while getting file signature from blackboard.", ex); //NON-NLS
         }
         
-        final String extension = f.getNameExtension();
-        
         // if we have an extension, check it
+        final String extension = f.getNameExtension();
         if (extension.equals("") == false) {
             // Note: thumbnail generator only supports JPG, GIF, and PNG for now
             if (SUPP_EXTENSIONS.contains(extension)) {
@@ -109,7 +114,8 @@ public class ImageUtils {
 
    
     /**
-     * Get an icon of a specified size.
+     * Get a thumbnail of a specified size. Generates the image if it is 
+     * not already cached. 
      * 
      * @param content
      * @param iconSize
@@ -118,6 +124,7 @@ public class ImageUtils {
     public static Image getIcon(Content content, int iconSize) {
         Image icon;
         // If a thumbnail file is already saved locally
+        // @@@ Bug here in that we do not refer to size in the cache. 
         File file = getFile(content.getId());
         if (file.exists()) {
             try {
@@ -125,7 +132,7 @@ public class ImageUtils {
                 if (bicon == null) {
                     icon = DEFAULT_ICON;
                 } else if (bicon.getWidth() != iconSize) {
-                    icon = generateAndSaveIcon(content, iconSize);    
+                    icon = generateAndSaveIcon(content, iconSize, file);    
                 } else {
                     icon = bicon;    
                 }
@@ -134,18 +141,17 @@ public class ImageUtils {
                 icon = DEFAULT_ICON;
             }
         } else { // Make a new icon
-            icon = generateAndSaveIcon(content, iconSize);
+            icon = generateAndSaveIcon(content, iconSize, file);
         }
         return icon;
     }
     
     /**
-     * Get the cached file of the icon. Generates the icon and its file if it 
+     * Get a thumbnail of a specified size. Generates the image if it is 
-     * doesn't already exist, so this method guarantees to return a file that
+     * not already cached. 
-     * exists.
      * @param content
      * @param iconSize
-     * @return 
+     * @return File object for cached image. Is guaranteed to exist. 
      */
     public static File getIconFile(Content content, int iconSize) {
         if (getIcon(content, iconSize) != null) {
@@ -155,13 +161,12 @@ public class ImageUtils {
     }
     
     /**
-     * Get the cached file of the content object with the given id. 
+     * Get a file object for where the cached icon should exist.  The returned file may not exist.
-     * 
-     * The returned file may not exist.
      * 
      * @param id
      * @return 
      */
+    // TODO: This should be private and be renamed to something like  getCachedThumbnailLocation().
     public static File getFile(long id) {
         return new File(Case.getCurrentCase().getCacheDirectory() + File.separator + id + ".png");
     }
@@ -223,18 +228,24 @@ public class ImageUtils {
     }
     
     
-    private static Image generateAndSaveIcon(Content content, int iconSize) { 
+    /**
+     * Generate an icon and save it to specified location. 
+     * @param content File to generate icon for
+     * @param iconSize
+     * @param saveFile Location to save thumbnail to
+     * @return Generated icon or null on error
+     */
+    private static Image generateAndSaveIcon(Content content, int iconSize, File saveFile) { 
         Image icon = null;
         try {
             icon = generateIcon(content, iconSize);
             if (icon == null) {
                 return DEFAULT_ICON;
             } else {
-                File f = getFile(content.getId());
+                if (saveFile.exists()) {
-                if (f.exists()) {
+                    saveFile.delete();
-                    f.delete();
                 }
-                ImageIO.write((BufferedImage) icon, "png", getFile(content.getId())); //NON-NLS
+                ImageIO.write((BufferedImage) icon, "png", saveFile); //NON-NLS
             }         
         } catch (IOException ex) {
             logger.log(Level.WARNING, "Could not write cache thumbnail: " + content, ex); //NON-NLS
@@ -243,14 +254,15 @@ public class ImageUtils {
     }
     
     /*
-     * Generate a scaled image
+     * Generate and return a scaled image
      */
     private static BufferedImage generateIcon(Content content, int iconSize) {
 
         InputStream inputStream = null;
+        BufferedImage bi = null;
         try {
             inputStream = new ReadContentInputStream(content);
-            BufferedImage bi = ImageIO.read(inputStream);
+            bi = ImageIO.read(inputStream);
             if (bi == null) {
                 logger.log(Level.WARNING, "No image reader for file: " + content.getName()); //NON-NLS
                 return null;
@@ -258,7 +270,13 @@ public class ImageUtils {
             BufferedImage biScaled = ScalrWrapper.resizeFast(bi, iconSize);
 
             return biScaled;
-        } catch (OutOfMemoryError e) {
+        } catch (IllegalArgumentException e) {
+            // if resizing does not work due to extremely small height/width ratio,
+            // crop the image instead.
+            BufferedImage biCropped = ScalrWrapper.cropImage(bi, Math.min(iconSize, bi.getWidth()), Math.min(iconSize, bi.getHeight()));
+            return biCropped;
+        }
+        catch (OutOfMemoryError e) {
             logger.log(Level.WARNING, "Could not scale image (too large): " + content.getName(), e); //NON-NLS
             return null;
         } catch (Exception e) {

Core/src/org/sleuthkit/autopsy/coreutils/PathValidator.java

@@ -0,0 +1,57 @@
+/*
+ * Autopsy Forensic Browser
+ * 
+ * Copyright 2013-2014 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.sleuthkit.autopsy.coreutils;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.sleuthkit.autopsy.casemodule.Case;
+
+/**
+ * Validates absolute path (e.g. to a data source or case output folder) depending on case type.
+ */
+public final class PathValidator {
+    
+    private static final Pattern driveLetterPattern = Pattern.compile("^[Cc]:.*$");    
+    public static boolean isValid(String path, Case.CaseType caseType) {
+
+        if (caseType == Case.CaseType.MULTI_USER_CASE) {
+            // check that path is not on "C:" drive
+            if (pathOnCDrive(path)) {
+                return false;
+            }
+        } else {
+            // single user case - no validation needed
+        }
+        
+        return true;
+    }
+    
+    
+    /**
+     * Checks whether a file path contains drive letter defined by pattern.
+     *
+     * @param filePath Input file absolute path
+     * @return true if path matches the pattern, false otherwise.
+     */
+    private static boolean pathOnCDrive(String filePath) {
+        Matcher m = driveLetterPattern.matcher(filePath);
+        return m.find();
+    }        
+}

Core/src/org/sleuthkit/autopsy/directorytree/CollapseAction.java

@@ -44,7 +44,14 @@ class CollapseAction extends AbstractAction {
         // Collapse all
 
         BeanTreeView tree = DirectoryTreeTopComponent.findInstance().getTree();
-        collapseAll(tree, selectedNode[0]);
+        if(selectedNode.length != 0) {
+            collapseSelectedNode(tree, selectedNode[0]);
+        } else {
+            // If no node is selected, all the level-2 nodes (children of the
+            // root node) are collapsed.
+            for(Node childOfRoot: em.getRootContext().getChildren().getNodes())
+                collapseSelectedNode(tree, childOfRoot);
+        }
     }
 
     /**
@@ -53,13 +60,13 @@ class CollapseAction extends AbstractAction {
      * @param tree          the given tree
      * @param currentNode   the current selectedNode
      */
-    private void collapseAll(BeanTreeView tree, Node currentNode) {
+    private void collapseSelectedNode(BeanTreeView tree, Node currentNode) {
 
         Children c = currentNode.getChildren();
 
         for (Node next : c.getNodes()) {
             if (tree.isExpanded(next)) {
-                this.collapseAll(tree, next);
+                this.collapseSelectedNode(tree, next);
             }
         }
 

Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterNode.java

@@ -39,6 +39,7 @@ import org.sleuthkit.datamodel.Content;
 import org.sleuthkit.datamodel.Directory;
 import org.sleuthkit.datamodel.Image;
 import org.sleuthkit.datamodel.TskCoreException;
+import org.sleuthkit.datamodel.VirtualDirectory;
 
 /**
  * This class sets the actions for the nodes in the directory tree and creates
@@ -106,22 +107,35 @@ class DirectoryTreeFilterNode extends FilterNode {
                 actions.add(ExtractAction.getInstance());
             }
 
-            // file search action
             final Image img = this.getLookup().lookup(Image.class);
-            if (img != null) {
+
-                actions.add(new FileSearchAction(
+            VirtualDirectory virtualDirectory = this.getLookup().lookup(VirtualDirectory.class);
-                        NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.openFileSrcByAttr.text")));
+            // determine if the virtualDireory is at root-level (Logical File Set).
+            boolean isRootVD = false;
+            if (virtualDirectory != null) {
+                try {
+                    if (virtualDirectory.getParent() == null) {
+                        isRootVD = true;
+                    }
+                } catch (TskCoreException ex) {
+                    logger.log(Level.WARNING, "Error determining the parent of the virtual directory", ex); // NON-NLS
+                }
             }
 
-            //ingest action
+            // 'run ingest' action and 'file search' action are added only if the
-            actions.add(new AbstractAction(
+            // selected node is img node or a root level virtual directory.
-                    NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.runIngestMods.text")) {
+            if (img != null || isRootVD) {
-                        @Override
+                actions.add(new FileSearchAction(
-                        public void actionPerformed(ActionEvent e) {
+                        NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.openFileSrcByAttr.text")));
-                            final RunIngestModulesDialog ingestDialog = new RunIngestModulesDialog(Collections.<Content>singletonList(content));
+                actions.add(new AbstractAction(
-                            ingestDialog.display();
+                        NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.runIngestMods.text")) {
-                        }
+                            @Override
-                    });
+                            public void actionPerformed(ActionEvent e) {
+                                final RunIngestModulesDialog ingestDialog = new RunIngestModulesDialog(Collections.<Content>singletonList(content));
+                                ingestDialog.display();
+                            }
+                        });
+            }
         }
 
         //check if delete actions should be added

Core/src/org/sleuthkit/autopsy/directorytree/ExtractUnallocAction.java

@@ -165,8 +165,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
      * Gets all the unallocated files in a given Content.
      *
      * @param c Content to get Unallocated Files from
-     * @return A list<LayoutFile> if it didn't crash List may be empty. Returns
+     * @return A list<LayoutFile> if it didn't crash List may be empty.
-     * null on failure.
      */
     private List<LayoutFile> getUnallocFiles(Content c) {
         UnallocVisitor uv = new UnallocVisitor();
@@ -178,7 +177,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
         } catch (TskCoreException tce) {
             logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at sending out the visitor ", tce); //NON-NLS
         }
-        return null;
+        return Collections.emptyList();
     }
 
     /**
@@ -372,7 +371,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
          * return the single instance of unallocated space.
          *
          * @param lf the LayoutFile the visitor encountered
-         * @return A list<LayoutFile> of size 1, returns null if it fails
+         * @return A list<LayoutFile> of size 1
          */
         @Override
         public List<LayoutFile> visit(final org.sleuthkit.datamodel.LayoutFile lf) {
@@ -389,7 +388,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
          *
          * @param fs the FileSystem the visitor encountered
          * @return A list<LayoutFile> containing the layout files from
-         * subsequent Visits(), returns null if it fails
+         * subsequent Visits(), or an empty list
          */
         @Override
         public List<LayoutFile> visit(FileSystem fs) {
@@ -402,7 +401,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
             } catch (TskCoreException tce) {
                 logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at visiting FileSystem " + fs.getId(), tce); //NON-NLS
             }
-            return null;
+            return Collections.emptyList();
         }
 
         /**
@@ -410,12 +409,12 @@ import org.sleuthkit.datamodel.VolumeSystem;
          *
          * @param vd VirtualDirectory the visitor encountered
          * @return A list<LayoutFile> containing all the LayoutFile in ld,
-         * returns null if it fails
+         * or an empty list.
          */
         @Override
         public List<LayoutFile> visit(VirtualDirectory vd) {
             try {
-                List<LayoutFile> lflst = new ArrayList<LayoutFile>();
+                List<LayoutFile> lflst = new ArrayList<>();
                 for (Content layout : vd.getChildren()) {
                     lflst.add((LayoutFile) layout);
                 }
@@ -423,7 +422,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
             } catch (TskCoreException tce) {
                 logger.log(Level.WARNING, "Could not get list of Layout Files, failed at visiting Layout Directory", tce); //NON-NLS
             }
-            return null;
+            return Collections.emptyList();
         }
 
         /**
@@ -432,7 +431,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
          *
          * @param dir the directory this visitor encountered
          * @return A list<LayoutFile> containing LayoutFiles encountered during
-         * subsequent Visits(), returns null if it fails
+         * subsequent Visits(), or an empty list.
          */
         @Override
         public List<LayoutFile> visit(Directory dir) {
@@ -445,12 +444,12 @@ import org.sleuthkit.datamodel.VolumeSystem;
             } catch (TskCoreException tce) {
                 logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at visiting Directory " + dir.getId(), tce); //NON-NLS
             }
-            return null;
+            return Collections.emptyList();
         }
 
         @Override
         protected List<LayoutFile> defaultVisit(Content cntnt) {
-            return null;
+            return Collections.emptyList();
         }
     }
 

Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java

@@ -98,7 +98,7 @@ class SampleFileIngestModule implements FileIngestModule {
 
     @Override
     public IngestModule.ProcessResult process(AbstractFile file) {
-        if (attrId != -1) {
+        if (attrId == -1) {
             return IngestModule.ProcessResult.ERROR;
         }
 

Core/src/org/sleuthkit/autopsy/ingest/DataSourceIngestPipeline.java

@@ -24,6 +24,7 @@ import java.util.List;
 import java.util.logging.Level;
 import org.openide.util.NbBundle;
 import org.sleuthkit.autopsy.coreutils.Logger;
+import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
 import org.sleuthkit.datamodel.Content;
 
 /**
@@ -110,6 +111,11 @@ final class DataSourceIngestPipeline {
                 logger.log(Level.INFO, "{0} analysis of {1} (jobId={2}) finished", new Object[]{module.getDisplayName(), this.job.getDataSource().getName(), this.job.getDataSource().getId()});
             } catch (Throwable ex) { // Catch-all exception firewall
                 errors.add(new IngestModuleError(module.getDisplayName(), ex));
+                String msg = ex.getMessage();
+                // Jython run-time errors don't seem to have a message, but have details in toString.
+                if (msg == null)
+                    msg = ex.toString();
+                MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
             }
             if (this.job.isCancelled()) {
                 break;

Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java

@@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.ingest;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
+import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
 import org.sleuthkit.datamodel.AbstractFile;
 
 /**
@@ -119,6 +120,11 @@ final class FileIngestPipeline {
                 module.process(file);
             } catch (Throwable ex) { // Catch-all exception firewall
                 errors.add(new IngestModuleError(module.getDisplayName(), ex));
+                String msg = ex.getMessage();
+                // Jython run-time errors don't seem to have a message, but have details in toString.
+                if (msg == null)
+                    msg = ex.toString();
+                MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
             }
             if (this.job.isCancelled()) {
                 break;
@@ -144,6 +150,11 @@ final class FileIngestPipeline {
                 module.shutDown();
             } catch (Throwable ex) { // Catch-all exception firewall
                 errors.add(new IngestModuleError(module.getDisplayName(), ex));
+                String msg = ex.getMessage();
+                // Jython run-time errors don't seem to have a message, but have details in toString.
+                if (msg == null)
+                    msg = ex.toString();
+                MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
             }
         }
         this.running = false;

Core/src/org/sleuthkit/autopsy/modules/exif/Bundle.properties

@@ -6,3 +6,4 @@ OpenIDE-Module-Name=ExifParser
 OpenIDE-Module-Short-Description=Exif metadata ingest module
 ExifParserFileIngestModule.moduleName.text=Exif Parser
 ExifParserFileIngestModule.getDesc.text=Ingests JPEG files and retrieves their EXIF metadata.
+ExifParserFileIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.

Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2011-2014 Basis Technology Corp.
+ * Copyright 2011-2015 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -34,13 +34,14 @@ import java.util.Collection;
 import java.util.Date;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.logging.Level;
-import org.sleuthkit.autopsy.coreutils.ImageUtils;
+import org.openide.util.NbBundle;
 import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.autopsy.ingest.FileIngestModule;
 import org.sleuthkit.autopsy.ingest.IngestJobContext;
 import org.sleuthkit.autopsy.ingest.IngestServices;
 import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
 import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
+import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
 import org.sleuthkit.datamodel.AbstractFile;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.BlackboardAttribute;
@@ -59,10 +60,11 @@ public final class ExifParserFileIngestModule implements FileIngestModule {
 
     private static final Logger logger = Logger.getLogger(ExifParserFileIngestModule.class.getName());
     private final IngestServices services = IngestServices.getInstance();
-    private AtomicInteger filesProcessed = new AtomicInteger(0);
+    private final AtomicInteger filesProcessed = new AtomicInteger(0);
     private volatile boolean filesToFire = false;
     private long jobId;
     private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
+    private FileTypeDetector fileTypeDetector;
         
     ExifParserFileIngestModule() {
     }
@@ -71,9 +73,13 @@ public final class ExifParserFileIngestModule implements FileIngestModule {
     public void startUp(IngestJobContext context) throws IngestModuleException {    
         jobId = context.getJobId();
         refCounter.incrementAndGet(jobId);
+        try {
+            fileTypeDetector = new FileTypeDetector();
+        } catch (FileTypeDetector.FileTypeDetectorInitException ex) {
+            throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "ExifParserFileIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
+        }
     }
-
+  
-    
     @Override
     public ProcessResult process(AbstractFile content) {
         //skip unalloc
@@ -197,7 +203,12 @@ public final class ExifParserFileIngestModule implements FileIngestModule {
      * @return true if to be processed
      */
     private boolean parsableFormat(AbstractFile f) {
-        return ImageUtils.isJpegFileHeader(f);
+        try {
+            return fileTypeDetector.getFileType(f).equals("image/jpeg");
+        } catch (TskCoreException ex) {
+            logger.log(Level.SEVERE, "Failed to detect file type", ex); //NON-NLS
+            return false;
+        }
     }
 
     @Override

Core/src/org/sleuthkit/autopsy/modules/filetypeid/Bundle.properties

@@ -44,3 +44,6 @@ FileTypeIdGlobalSettingsPanel.newTypeButton.text=New
 FileTypeIdGlobalSettingsPanel.jLabel1.text=Custom File Types
 FileTypeIdGlobalSettingsPanel.jLabel2.text=MIME Types:
 FileTypeIdGlobalSettingsPanel.jLabel3.text=Autopsy can automatically detect many file types. Add your custom file types here.
+FileTypeIdGlobalSettingsPanel.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.
+FileTypeIdIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.
+

Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java

@@ -18,6 +18,7 @@
  */
 package org.sleuthkit.autopsy.modules.filetypeid;
 
+import java.util.ArrayList;
 import java.util.Map;
 import java.util.SortedSet;
 import org.apache.tika.Tika;
@@ -27,6 +28,7 @@ import org.sleuthkit.datamodel.AbstractFile;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.BlackboardAttribute;
 import org.sleuthkit.datamodel.TskCoreException;
+import org.sleuthkit.datamodel.TskData;
 
 /**
  * Detects the type of a file by an inspection of its contents.
@@ -94,15 +96,39 @@ public class FileTypeDetector {
     }
 
     /**
-     * Detect the MIME type of a file, posting it to the blackboard if detection
+     * Look up the MIME type of a file using the blackboard. If it is not already
-     * succeeds.
+     * posted, detect the type of the file, posting it to the blackboard if
+     * detection succeeds.
      *
      * @param file The file to test.
-     * @param moduleName The name of the module posting to the blackboard.
+     * @return The MIME type name if detection was successful, null otherwise.
-     * @return The MIME type name id detection was successful, null otherwise.
+     * @throws TskCoreException
-     * @throws TskCoreException if there is an error posting to the blackboard.
      */
-    public synchronized String detectAndPostToBlackboard(AbstractFile file) throws TskCoreException {
+    public String getFileType(AbstractFile file) throws TskCoreException {
+        String fileType;
+        ArrayList<BlackboardAttribute> attributes = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
+        for (BlackboardAttribute attribute : attributes) {
+            /**
+             * Get the first TSK_FILE_TYPE_SIG attribute.
+             */
+            fileType = attribute.getValueString();
+            if (null != fileType && !fileType.isEmpty()) {
+                return fileType;
+            }
+        }
+        return detectAndPostToBlackboard(file);
+    }
+
+    /**
+     * Detect the MIME type of a file, posting it to the blackboard if detection
+     * succeeds. Note that this method should currently be called at most once
+     * per file.
+     *
+     * @param file The file to test.
+     * @return The MIME type name id detection was successful, null otherwise.
+     * @throws TskCoreException
+     */
+    public String detectAndPostToBlackboard(AbstractFile file) throws TskCoreException {
         String mimeType = detect(file);
         if (null != mimeType) {
             /**
@@ -122,9 +148,19 @@ public class FileTypeDetector {
      * Detect the MIME type of a file.
      *
      * @param file The file to test.
-     * @return The MIME type name id detection was successful, null otherwise.
+     * @return The MIME type name if detection was successful, null otherwise.
+     * @throws TskCoreException
      */
     public String detect(AbstractFile file) throws TskCoreException {
+        // consistently mark non-regular files (refer TskData.TSK_FS_META_TYPE_ENUM),
+        // 0 sized files, unallocated, and unused blocks (refer TskData.TSK_DB_FILES_TYPE_ENUM)
+        // as octet-stream.
+        if (!file.isFile() || file.getSize() <= 0
+                || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
+                || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)) {
+            return MimeTypes.OCTET_STREAM;
+        }
+
         String fileType = detectUserDefinedType(file);
         if (null == fileType) {
             try {
@@ -164,23 +200,24 @@ public class FileTypeDetector {
      *
      * @param file The file to test.
      * @return The file type name string or null, if no match is detected.
+     * @throws TskCoreException
      */
     private String detectUserDefinedType(AbstractFile file) throws TskCoreException {
         for (FileType fileType : userDefinedFileTypes.values()) {
             if (fileType.matches(file)) {
                 if (fileType.alertOnMatch()) {
                     BlackboardArtifact artifact;
-                        artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
+                    artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
-                        BlackboardAttribute setNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getFilesSetName());
+                    BlackboardAttribute setNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getFilesSetName());
-                        artifact.addAttribute(setNameAttribute);
+                    artifact.addAttribute(setNameAttribute);
 
-                        /**
+                    /**
-                         * Use the MIME type as the category, i.e., the rule
+                     * Use the MIME type as the category, i.e., the rule that
-                         * that determined this file belongs to the interesting
+                     * determined this file belongs to the interesting files
-                         * files set.
+                     * set.
-                         */
+                     */
-                        BlackboardAttribute ruleNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType());
+                    BlackboardAttribute ruleNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType());
-                        artifact.addAttribute(ruleNameAttribute);
+                    artifact.addAttribute(ruleNameAttribute);
                 }
                 return fileType.getMimeType();
             }

Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java

@@ -27,7 +27,6 @@ import org.sleuthkit.autopsy.ingest.IngestJobContext;
 import org.sleuthkit.autopsy.ingest.IngestMessage;
 import org.sleuthkit.autopsy.ingest.IngestServices;
 import org.sleuthkit.datamodel.AbstractFile;
-import org.sleuthkit.datamodel.TskData;
 import org.sleuthkit.datamodel.TskData.FileKnown;
 import org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult;
 import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
@@ -83,9 +82,7 @@ public class FileTypeIdIngestModule implements FileIngestModule {
         try {
             fileTypeDetector = new FileTypeDetector();
         } catch (FileTypeDetector.FileTypeDetectorInitException ex) {
-            String errorMessage = "Failed to create file type detector"; //NON-NLS
+            throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "FileTypeIdIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
-            logger.log(Level.SEVERE, errorMessage, ex);
-            throw new IngestModuleException(errorMessage);
         }        
     }
 
@@ -95,15 +92,6 @@ public class FileTypeIdIngestModule implements FileIngestModule {
     @Override
     public ProcessResult process(AbstractFile file) {
 
-        /**
-         * Skip unallocated space and unused blocks files.
-         */
-        if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
-                || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
-                || (file.isFile() == false)) {
-            return ProcessResult.OK;
-        }
-
         /**
          * Skip known files if configured to do so.
          */
@@ -118,7 +106,7 @@ public class FileTypeIdIngestModule implements FileIngestModule {
          */
         try {
             long startTime = System.currentTimeMillis();
-            fileTypeDetector.detectAndPostToBlackboard(file);
+            fileTypeDetector.getFileType(file);
             addToTotals(jobId, (System.currentTimeMillis() - startTime));
             return ProcessResult.OK;
         } catch (Exception e) {

Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java

@@ -85,6 +85,11 @@ class CallLogAnalyzer {
         SleuthkitCase skCase = currentCase.getSleuthkitCase();
         try {
             AbstractFile f = skCase.getAbstractFileById(fId);
+            if(f == null){
+                logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
+                return;
+            }
+            
             try {
                 resultSet = statement.executeQuery(
                         "SELECT number,date,duration,type, name FROM calls ORDER BY date DESC;"); //NON-NLS

Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java

@@ -101,6 +101,11 @@ class ContactAnalyzer {
         SleuthkitCase skCase = currentCase.getSleuthkitCase();
         try {
             AbstractFile f = skCase.getAbstractFileById(fId);
+            if(f == null){
+                logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
+                return;
+            }
+            
             try {
                 // get display_name, mimetype(email or phone number) and data1 (phonenumber or email address depending on mimetype)
                 //sorted by name, so phonenumber/email would be consecutive for a person if they exist.

Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java

@@ -85,6 +85,11 @@ class TextMessageAnalyzer {
         SleuthkitCase skCase = currentCase.getSleuthkitCase();
         try {
             AbstractFile f = skCase.getAbstractFileById(fId);
+            if(f == null){
+                logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
+                return;
+            }
+            
             try {
                 resultSet = statement.executeQuery(
                         "SELECT address,date,type,subject,body FROM sms;"); //NON-NLS

Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java

@@ -248,7 +248,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
      */
     @Override
     public void shutDown() {
-        if (refCounter.decrementAndGet(this.context.getJobId()) == 0) {
+        if (this.context != null && refCounter.decrementAndGet(this.context.getJobId()) == 0) {
             try {
                 // The last instance of this module for an ingest job cleans out 
                 // the working paths map entry for the job and deletes the temp dir.

Core/src/org/sleuthkit/autopsy/modules/sevenzip/Bundle.properties

@@ -29,3 +29,4 @@ SevenZipIngestModule.unpack.encrFileDetected.msg=Encrypted files in archive dete
 SevenZipIngestModule.unpack.encrFileDetected.details=Some files in archive\: {0} are encrypted. {1} extractor was unable to extract all files from this archive.
 SevenZipIngestModule.UnpackStream.write.exception.msg=Error writing unpacked file to\: {0}
 SevenZipIngestModule.UnpackedTree.exception.msg=Error adding a derived file to db\:{0}
+SevenZipIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.

Core/src/org/sleuthkit/autopsy/modules/sevenzip/SevenZipIngestModule.java

@@ -24,7 +24,6 @@ import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Date;
@@ -62,6 +61,7 @@ import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
 import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
 import net.sf.sevenzipjbinding.ArchiveFormat;
 import static net.sf.sevenzipjbinding.ArchiveFormat.RAR;
+import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
 
 /**
  * 7Zip ingest module extracts supported archives, adds extracted DerivedFiles,
@@ -87,13 +87,10 @@ public final class SevenZipIngestModule implements FileIngestModule {
     private static final long MIN_FREE_DISK_SPACE = 1 * 1000 * 1000000L; //1GB
     //counts archive depth
     private ArchiveDepthCountTree archiveDepthCountTree;
-    //buffer for checking file headers and signatures
-    private static final int readHeaderSize = 4;
-    private final byte[] fileHeaderBuffer = new byte[readHeaderSize];
-    private static final int ZIP_SIGNATURE_BE = 0x504B0304;
     private IngestJobContext context;
     private long jobId;
     private final static IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
+    private FileTypeDetector fileTypeDetector;
 
     SevenZipIngestModule() {
     }
@@ -103,6 +100,12 @@ public final class SevenZipIngestModule implements FileIngestModule {
         this.context = context;
         jobId = context.getJobId();
 
+        try {
+            fileTypeDetector = new FileTypeDetector();
+        } catch (FileTypeDetector.FileTypeDetectorInitException ex) {
+            throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "SevenZipIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
+        }
+
         final Case currentCase = Case.getCurrentCase();
 
         moduleDirRelative = currentCase.getModuleOutputDirectoryRelativePath() + File.separator + ArchiveFileExtractorModuleFactory.getModuleName();
@@ -284,7 +287,7 @@ public final class SevenZipIngestModule implements FileIngestModule {
         }     
         
         if (detectedFormat == null) {
-            logger.log(Level.WARNING, "Could not detect format for file: " + archiveFile); //NON-NLS
+            logger.log(Level.WARNING, "Could not detect format for file: {0}", archiveFile); //NON-NLS
             
             // if we don't have attribute info then use file extension
             String extension = archiveFile.getNameExtension();
@@ -657,24 +660,12 @@ public final class SevenZipIngestModule implements FileIngestModule {
      * @return true if zip file, false otherwise
      */
     private boolean isZipFileHeader(AbstractFile file) {
-        if (file.getSize() < readHeaderSize) {
-            return false;
-        }
-
         try {
-            int bytesRead = file.read(fileHeaderBuffer, 0, readHeaderSize);
+            return fileTypeDetector.getFileType(file).equals("application/zip"); //NON-NLS
-            if (bytesRead != readHeaderSize) {
-                return false;
-            }
         } catch (TskCoreException ex) {
-            //ignore if can't read the first few bytes, not a ZIP
+            logger.log(Level.SEVERE, "Failed to detect file type", ex); //NON-NLS
             return false;
         }
-
-        ByteBuffer bytes = ByteBuffer.wrap(fileHeaderBuffer);
-        int signature = bytes.getInt();
-
-        return signature == ZIP_SIGNATURE_BE;
     }
 
     /**

Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java

@@ -96,16 +96,16 @@ public class STIXReportModule implements GeneralReportModule {
     /**
      * .
      *
-     * @param path path to save the report
+     * @param baseReportDir path to save the report
      * @param progressPanel panel to update the report's progress
      */
     @Override
-    public void generateReport(String path, ReportProgressPanel progressPanel) {
+    public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
         // Start the progress bar and setup the report
         progressPanel.setIndeterminate(false);
         progressPanel.start();
         progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "STIXReportModule.progress.readSTIX"));
-        reportPath = path + getRelativeFilePath();
+        reportPath = baseReportDir + getRelativeFilePath();
 
         // Check if the user wants to display all output or just hits
         reportAllResults = configPanel.getShowAllResults();

Core/src/org/sleuthkit/autopsy/python/Bundle.properties

@@ -1,2 +1,2 @@
 JythonModuleLoader.errorMessages.failedToOpenModule=Failed to open {0}. See log for details.
-JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0} from {1}.  See log for details.
+JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0}.  {1}.  See log for details.

Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java

@@ -81,8 +81,9 @@ public final class JythonModuleLoader {
                                     objects.add( createObjectFromScript(script, className, interfaceClass));
                                 } catch (Exception ex) {
                                     logger.log(Level.SEVERE, String.format("Failed to load %s from %s", className, script.getAbsolutePath()), ex); //NON-NLS
+                                    // NOTE: using ex.toString() because the current version is always returning null for ex.getMessage().
                                     DialogDisplayer.getDefault().notify(new NotifyDescriptor.Message(
-                                            NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, script.getAbsolutePath()),
+                                            NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, ex.toString()),
                                             NotifyDescriptor.ERROR_MESSAGE));
                                 }
                             }

Core/src/org/sleuthkit/autopsy/report/FileReportModule.java

@@ -29,9 +29,9 @@ import org.sleuthkit.datamodel.AbstractFile;
  interface FileReportModule extends ReportModule {
     /** 
      * Initialize the report which will be stored at the given path.
-     * @param path 
+     * @param baseReportDir Base directory to store the report file in.   Report should go into baseReportDir + getRelativeFilePath().
      */
-    public void startReport(String path);
+    public void startReport(String baseReportDir);
     
     /**
      * End the report. 

Core/src/org/sleuthkit/autopsy/report/FileReportText.java

@@ -54,8 +54,8 @@ import org.sleuthkit.datamodel.AbstractFile;
     }
     
     @Override
-    public void startReport(String path) {
+    public void startReport(String baseReportDir) {
-        this.reportPath = path + FILE_NAME;
+        this.reportPath = baseReportDir + FILE_NAME;
         try {
             out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(this.reportPath)));
         } catch (IOException ex) {

Core/src/org/sleuthkit/autopsy/report/GeneralReportModule.java

@@ -26,10 +26,10 @@ public interface GeneralReportModule extends ReportModule {
      * Called to generate the report.  Method is responsible for saving the file at the 
      * path specified and updating progress via the progressPanel object.
      * 
-     * @param reportPath path to save the report
+     * @param baseReportDir Base directory that reports are being stored in.   Report should go into baseReportDir + getRelativeFilePath().
      * @param progressPanel panel to update the report's progress with
      */
-    public void generateReport(String reportPath, ReportProgressPanel progressPanel);
+    public void generateReport(String baseReportDir, ReportProgressPanel progressPanel);
     
     /**
      * Returns the configuration panel for the report, which is displayed in

Core/src/org/sleuthkit/autopsy/report/GeneralReportModuleAdapter.java

@@ -38,7 +38,7 @@ public abstract class GeneralReportModuleAdapter implements GeneralReportModule
     }
 
     @Override
-    public abstract void generateReport(String reportPath, ReportProgressPanel progressPanel);
+    public abstract void generateReport(String baseReportDir, ReportProgressPanel progressPanel);
 
     @Override
     public JPanel getConfigurationPanel() {

Core/src/org/sleuthkit/autopsy/report/ReportBodyFile.java

@@ -63,16 +63,17 @@ import org.sleuthkit.datamodel.*;
 
     /**
      * Generates a body file format report for use with the MAC time tool.
-     * @param path path to save the report
+     * @param baseReportDir path to save the report
      * @param progressPanel panel to update the report's progress
      */
     @Override
-    public void generateReport(String path, ReportProgressPanel progressPanel) {
+    @SuppressWarnings("deprecation")
+    public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
         // Start the progress bar and setup the report
         progressPanel.setIndeterminate(false);
         progressPanel.start();
         progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportBodyFile.progress.querying"));
-        reportPath = path + "BodyFile.txt"; //NON-NLS
+        reportPath = baseReportDir + "BodyFile.txt"; //NON-NLS
         currentCase = Case.getCurrentCase();
         skCase = currentCase.getSleuthkitCase();
         

Core/src/org/sleuthkit/autopsy/report/ReportExcel.java

@@ -58,12 +58,12 @@ import org.sleuthkit.datamodel.TskCoreException;
     /**
      * Start the Excel report by creating the Workbook, initializing styles,
      * and writing the summary.
-     * @param path path to save the report
+     * @param baseReportDir path to save the report
      */
     @Override
-    public void startReport(String path) {        
+    public void startReport(String baseReportDir) {        
         // Set the path and save it for when the report is written to disk.
-        this.reportPath = path + getRelativeFilePath();
+        this.reportPath = baseReportDir + getRelativeFilePath();
                 
         // Make a workbook.
         wb = new XSSFWorkbook();

Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java

@@ -806,7 +806,10 @@ import org.sleuthkit.datamodel.TskData;
                 logger.log(Level.WARNING, "Error while getting content from a blackboard artifact to report on.", ex); //NON-NLS
                 return;
             }
-            checkIfFileIsImage(file);
+            
+            if(file != null){
+                checkIfFileIsImage(file);
+            }
         }
         
         /**
@@ -993,8 +996,11 @@ import org.sleuthkit.datamodel.TskData;
                 String list = resultSet.getString("list"); //NON-NLS
                 String uniquePath = "";
 
-                 try {
+                try {
-                    uniquePath = skCase.getAbstractFileById(objId).getUniquePath();
+                    AbstractFile f = skCase.getAbstractFileById(objId);
+                    if(f != null){
+                        uniquePath = skCase.getAbstractFileById(objId).getUniquePath();
+                    }
                 } catch (TskCoreException ex) {
                     errorList.add(
                             NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
@@ -1138,7 +1144,10 @@ import org.sleuthkit.datamodel.TskData;
                 String uniquePath = "";
                 
                 try {
-                    uniquePath = skCase.getAbstractFileById(objId).getUniquePath();
+                    AbstractFile f = skCase.getAbstractFileById(objId);
+                    if(f != null){
+                        uniquePath = skCase.getAbstractFileById(objId).getUniquePath();
+                    }
                 } catch (TskCoreException ex) {
                     errorList.add(
                             NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileFromID"));
@@ -1801,15 +1810,23 @@ import org.sleuthkit.datamodel.TskData;
                      break;
                 case TSK_EXT_MISMATCH_DETECTED:
                     AbstractFile file = skCase.getAbstractFileById(getObjectID());
-                    orderedRowData.add(file.getName());
+                    if(file != null){
-                    orderedRowData.add(file.getNameExtension());
+                        orderedRowData.add(file.getName());
-                    List<BlackboardAttribute> attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
+                        orderedRowData.add(file.getNameExtension());
-                    if (!attrs.isEmpty()) {
+                        List<BlackboardAttribute> attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
-                        orderedRowData.add(attrs.get(0).getValueString());
+                        if (!attrs.isEmpty()) {
+                            orderedRowData.add(attrs.get(0).getValueString());
+                        } else {
+                            orderedRowData.add("");
+                        }                   
+                        orderedRowData.add(file.getUniquePath());
                     } else {
-                        orderedRowData.add("");
+                        // Make empty rows to make sure the formatting is correct
-                    }                   
+                        orderedRowData.add(null);
-                    orderedRowData.add(file.getUniquePath());
+                        orderedRowData.add(null);
+                        orderedRowData.add(null);
+                        orderedRowData.add(null);
+                    }
                     break;
                 case TSK_OS_INFO:
                     orderedRowData.add(mappedAttributes.get(ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE.getTypeID()));

Core/src/org/sleuthkit/autopsy/report/ReportHTML.java

@@ -299,14 +299,14 @@ import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
     /**
      * Start this report by setting the path, refreshing member variables,
      * and writing the skeleton for the HTML report.
-     * @param path path to save the report
+     * @param baseReportDir path to save the report
      */
     @Override
-    public void startReport(String path) {
+    public void startReport(String baseReportDir) {
         // Refresh the HTML report
         refresh();
         // Setup the path for the HTML report
-        this.path = path + "HTML Report" + File.separator; //NON-NLS
+        this.path = baseReportDir + "HTML Report" + File.separator; //NON-NLS
         this.thumbsPath = this.path + "thumbs" + File.separator; //NON-NLS
         try {
             FileUtil.createFolder(new File(this.path));

Core/src/org/sleuthkit/autopsy/report/ReportKML.java

@@ -70,18 +70,18 @@ class ReportKML implements GeneralReportModule {
     /**
      * Generates a body file format report for use with the MAC time tool.
      *
-     * @param path path to save the report
+     * @param baseReportDir path to save the report
      * @param progressPanel panel to update the report's progress
      */
     @Override
-    public void generateReport(String path, ReportProgressPanel progressPanel) {
+    public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
 
         // Start the progress bar and setup the report
         progressPanel.setIndeterminate(false);
         progressPanel.start();
         progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportKML.progress.querying"));
-        reportPath = path + "ReportKML.kml"; //NON-NLS
+        reportPath = baseReportDir + "ReportKML.kml"; //NON-NLS
-        String reportPath2 = path + "ReportKML.txt"; //NON-NLS
+        String reportPath2 = baseReportDir + "ReportKML.txt"; //NON-NLS
         currentCase = Case.getCurrentCase();
         skCase = currentCase.getSleuthkitCase();
 
@@ -131,12 +131,14 @@ class ReportKML implements GeneralReportModule {
                     if (lon != 0 && lat != 0) {
                         aFile = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID());
 
-                        extractedToPath = reportPath + aFile.getName();
+                        if(aFile != null){
-                        geoPath = extractedToPath;
+                            extractedToPath = reportPath + aFile.getName();
-                        f = new File(extractedToPath);
+                            geoPath = extractedToPath;
-                        f.createNewFile();
+                            f = new File(extractedToPath);
-                        copyFileUsingStream(aFile, f);
+                            f.createNewFile();
-                        imageName = aFile.getName();
+                            copyFileUsingStream(aFile, f);
+                            imageName = aFile.getName();
+                        }
                         out.write(String.valueOf(lat));
                         out.write(";");
                         out.write(String.valueOf(lon));

Core/src/org/sleuthkit/autopsy/report/ReportModule.java

@@ -40,11 +40,11 @@ interface ReportModule {
 
     /**
      * Gets the relative path of the report file, if any, generated by this
-     * module. The path should be relative to the time stamp subdirectory of
+     * module. The path should be relative to the location that gets passed in 
-     * reports directory.
+     * to generateReport() (or similar). 
      *
-     * @return Report file path relative to the time stamp subdirectory reports
+     * @return Relative path to where report will be stored.  
-     * directory, may be null if the module does not produce a report file.
+     * May be null if the module does not produce a report file.
      */
     public String getRelativeFilePath();
 }

Core/src/org/sleuthkit/autopsy/report/TableReportModule.java

@@ -35,9 +35,9 @@ import java.util.List;
      * Start the report. Open any output streams, initialize member variables,
      * write summary and navigation pages. Considered the "constructor" of the report.
      * 
-     * @param path String path to save the report
+     * @param baseReportDir Directory to save the report file into.  Report should go into baseReportDir + getRelativeFilePath().
      */
-    public void startReport(String path);
+    public void startReport(String baseReportDir);
     
     /**
      * End the report. Close all output streams and write any end-of-report

Core/src/org/sleuthkit/autopsy/timeline/TimeLineController.java

@@ -362,7 +362,7 @@ public class TimeLineController {
     @SuppressWarnings("deprecation")
     private long getCaseLastArtifactID(final SleuthkitCase sleuthkitCase) {
         long caseLastArtfId = -1;
-        String query = "SELECT MAX(artifact_id) AS max_id FROM blackboard_artifacts"; // NON-NLS
+        String query = "select Max(artifact_id) as max_id from blackboard_artifacts"; // NON-NLS
         try (CaseDbQuery dbQuery = sleuthkitCase.executeQuery(query)) {
             ResultSet resultSet = dbQuery.getResultSet();
             while (resultSet.next()) {
@@ -573,6 +573,12 @@ public class TimeLineController {
         monitorTask(selectTimeAndTypeTask);
     }
 
+    /**
+     * submit a task for execution and add it to the list of tasks whose
+     * progress is monitored and displayed in the progress bar
+     *
+     * @param task
+     */
     synchronized public void monitorTask(final Task<?> task) {
         if (task != null) {
             Platform.runLater(() -> {
@@ -606,9 +612,16 @@ public class TimeLineController {
                         break;
                     case SCHEDULED:
                     case RUNNING:
+
                     case SUCCEEDED:
                     case CANCELLED:
                     case FAILED:
+                        tasks.remove(task);
+                        if (tasks.isEmpty() == false) {
+                            progress.bind(tasks.get(0).progressProperty());
+                            message.bind(tasks.get(0).messageProperty());
+                            taskTitle.bind(tasks.get(0).titleProperty());
+                        }
                         break;
                 }
             });

Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java

@@ -250,32 +250,37 @@ public class EventsRepository {
                 } else {
                     try {
                         AbstractFile f = skCase.getAbstractFileById(fID);
-                        //TODO: This is broken for logical files? fix -jm
+                        
-                        //TODO: logical files don't necessarily have valid timestamps, so ... -jm
+                        if(f != null){
-                        final String uniquePath = f.getUniquePath();
+                            //TODO: This is broken for logical files? fix -jm
-                        final String parentPath = f.getParentPath();
+                            //TODO: logical files don't necessarily have valid timestamps, so ... -jm
-                        String datasourceName = StringUtils.substringBefore(StringUtils.stripStart(uniquePath, "/"), parentPath);
+                            final String uniquePath = f.getUniquePath();
-                        String rootFolder = StringUtils.substringBetween(parentPath, "/", "/");
+                            final String parentPath = f.getParentPath();
-                        String shortDesc = datasourceName + "/" + StringUtils.defaultIfBlank(rootFolder, "");
+                            String datasourceName = StringUtils.substringBefore(StringUtils.stripStart(uniquePath, "/"), parentPath);
-                        String medD = datasourceName  + parentPath;
+                            String rootFolder = StringUtils.substringBetween(parentPath, "/", "/");
+                            String shortDesc = datasourceName + "/" + StringUtils.defaultIfBlank(rootFolder, "");
+                            String medD = datasourceName  + parentPath;
 
-                        //insert it into the db if time is > 0  => time is legitimate (drops logical files)
+                            //insert it into the db if time is > 0  => time is legitimate (drops logical files)
-                        if (f.getAtime() > 0) {
+                            if (f.getAtime() > 0) {
-                            eventDB.insertEvent(f.getAtime(), FileSystemTypes.FILE_ACCESSED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
+                                eventDB.insertEvent(f.getAtime(), FileSystemTypes.FILE_ACCESSED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
-                        }
+                            }
-                        if (f.getMtime() > 0) {
+                            if (f.getMtime() > 0) {
-                            eventDB.insertEvent(f.getMtime(), FileSystemTypes.FILE_MODIFIED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
+                                eventDB.insertEvent(f.getMtime(), FileSystemTypes.FILE_MODIFIED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
-                        }
+                            }
-                        if (f.getCtime() > 0) {
+                            if (f.getCtime() > 0) {
-                            eventDB.insertEvent(f.getCtime(), FileSystemTypes.FILE_CHANGED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
+                                eventDB.insertEvent(f.getCtime(), FileSystemTypes.FILE_CHANGED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
-                        }
+                            }
-                        if (f.getCrtime() > 0) {
+                            if (f.getCrtime() > 0) {
-                            eventDB.insertEvent(f.getCrtime(), FileSystemTypes.FILE_CREATED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
+                                eventDB.insertEvent(f.getCrtime(), FileSystemTypes.FILE_CREATED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans);
-                        }
+                            }
 
-                        process(Arrays.asList(new ProgressWindow.ProgressUpdate(i, numFiles,
+                            process(Arrays.asList(new ProgressWindow.ProgressUpdate(i, numFiles,
-                                                                                NbBundle.getMessage(this.getClass(),
+                                                                                                NbBundle.getMessage(this.getClass(),
-                                                                                                    "EventsRepository.progressWindow.msg.populateMacEventsFiles2"), f.getName())));
+                                                                                                        "EventsRepository.progressWindow.msg.populateMacEventsFiles2"), f.getName())));
+                        } else {
+                            LOGGER.log(Level.WARNING, "failed to look up data for file : " + fID); // NON-NLS
+                        }
                     } catch (TskCoreException tskCoreException) {
                         LOGGER.log(Level.WARNING, "failed to insert mac event for file : " + fID, tskCoreException); // NON-NLS
                     }

Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java

@@ -28,6 +28,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.openide.util.Exceptions;
 import org.openide.util.NbBundle;
 import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel;
+import org.sleuthkit.datamodel.AbstractFile;
 import org.sleuthkit.datamodel.BlackboardArtifact;
 import org.sleuthkit.datamodel.BlackboardAttribute;
 import org.sleuthkit.datamodel.TskCoreException;
@@ -129,7 +130,11 @@ public enum MiscTypes implements EventType, ArtifactEventType {
          (BlackboardArtifact t,
           Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> u) -> {
              try {
-                 return t.getSleuthkitCase().getAbstractFileById(t.getObjectID()).getName();
+                 AbstractFile f = t.getSleuthkitCase().getAbstractFileById(t.getObjectID());
+                 if(f != null){
+                    return f.getName();
+                 }
+                 return " error loading file name"; // NON-NLS
              } catch (TskCoreException ex) {
                  Exceptions.printStackTrace(ex);
                  return " error loading file name"; // NON-NLS

Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java

@@ -101,13 +101,18 @@ public class EventRootNode extends DisplayableItemNode {
             if (eventID >= 0) {
                 final TimeLineEvent eventById = filteredEvents.getEventById(eventID);
                 try {
-                    if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) {
+                    AbstractFile file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID());
-                        return new EventNode(eventById, Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID()));
+                    if(file != null){
-                    } else {
+                        if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) {
-                        AbstractFile file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID());
+                            return new EventNode(eventById, file);
-                        BlackboardArtifact blackboardArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(eventById.getArtifactID());
+                        } else {
+                            BlackboardArtifact blackboardArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(eventById.getArtifactID());
 
-                        return new EventNode(eventById, file, blackboardArtifact);
+                            return new EventNode(eventById, file, blackboardArtifact);
+                        }
+                    } else {
+                        LOGGER.log(Level.WARNING, "Failed to lookup sleuthkit object backing TimeLineEvent."); // NON-NLS
+                        return null; 
                     }
 
                 } catch (TskCoreException tskCoreException) {

CoreLibs/src/org/sleuthkit/autopsy/corelibs/ScalrWrapper.java

@@ -20,6 +20,7 @@
 package org.sleuthkit.autopsy.corelibs;
 
 import java.awt.image.BufferedImage;
+import java.awt.image.BufferedImageOp;
 import org.imgscalr.Scalr;
 import org.imgscalr.Scalr.Method;
 
@@ -48,4 +49,8 @@ import org.imgscalr.Scalr.Method;
      public static synchronized BufferedImage resizeFast(BufferedImage input, int width, int height) {
         return Scalr.resize(input, Method.SPEED, Scalr.Mode.AUTOMATIC, width, height, Scalr.OP_ANTIALIAS);
     }
+
+     public static synchronized BufferedImage cropImage(BufferedImage input, int width, int height) {
+         return Scalr.crop(input, width, height, (BufferedImageOp) null);
+     }
 }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2013 Basis Technology Corp.
+ * Copyright 2013-15 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -58,9 +58,9 @@ import org.openide.util.Exceptions;
 import org.sleuthkit.autopsy.casemodule.Case;
 import org.sleuthkit.autopsy.coreutils.History;
 import org.sleuthkit.autopsy.coreutils.Logger;
+import org.sleuthkit.autopsy.imagegallery.datamodel.Category;
 import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB;
 import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile;
-import org.sleuthkit.autopsy.imagegallery.datamodel.Category;
 import org.sleuthkit.autopsy.imagegallery.grouping.GroupManager;
 import org.sleuthkit.autopsy.imagegallery.grouping.GroupViewState;
 import org.sleuthkit.autopsy.imagegallery.gui.NoGroupsDialog;
@@ -158,8 +158,8 @@ public final class ImageGalleryController {
     public GroupManager getGroupManager() {
         return groupManager;
     }
-    
+
-    public DrawableDB getDatabase(){
+    public DrawableDB getDatabase() {
         return db;
     }
 
@@ -180,7 +180,7 @@ public final class ImageGalleryController {
             stale.set(b);
         });
         if (Case.isCaseOpen()) {
-            new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.MODULE_NAME, PerCaseProperties.STALE, b.toString());
+            new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.getModuleName(), PerCaseProperties.STALE, b.toString());
         }
     }
 
@@ -201,7 +201,7 @@ public final class ImageGalleryController {
         });
 
         groupManager.getAnalyzedGroups().addListener((Observable o) -> {
-            if(Case.isCaseOpen()){
+            if (Case.isCaseOpen()) {
                 checkForGroups();
             }
         });
@@ -335,7 +335,7 @@ public final class ImageGalleryController {
      */
     public synchronized void setCase(Case c) {
 
-        this.db = DrawableDB.getDrawableDB(c.getModuleDirectory() + File.separator + IMAGEGALLERY, this);
+        this.db = DrawableDB.getDrawableDB(c.getModulesOutputDirAbsPath() + File.separator + ImageGalleryModule.getModuleName(), this);
 
         setListeningEnabled(ImageGalleryModule.isEnabledforCase(c));
         setStale(ImageGalleryModule.isCaseStale(c));
@@ -517,7 +517,7 @@ public final class ImageGalleryController {
                 try {
                     // @@@ Could probably do something more fancy here and check if we've been canceled every now and then
                     InnerTask it = workQueue.take();
-                    
+
                     if (it.cancelled == false) {
                         it.run();
                     }
@@ -631,16 +631,16 @@ public final class ImageGalleryController {
          */
         @Override
         public void run() {
-            try{
+            try {
                 DrawableFile<?> drawableFile = DrawableFile.create(getFile(), true, db.isVideoFile(getFile()));
                 db.updateFile(drawableFile);
-            } catch (NullPointerException | TskCoreException ex){
+            } catch (NullPointerException | TskCoreException ex) {
                 // This is one of the places where we get many errors if the case is closed during processing.
                 // We don't want to print out a ton of exceptions if this is the case.
-                if(Case.isCaseOpen()){
+                if (Case.isCaseOpen()) {
                     Logger.getLogger(UpdateFileTask.class.getName()).log(Level.SEVERE, "Error in UpdateFile task");
                 }
-            }    
+            }
         }
     }
 
@@ -658,16 +658,16 @@ public final class ImageGalleryController {
          */
         @Override
         public void run() {
-            try{
+            try {
-              db.removeFile(getFile().getId());
+                db.removeFile(getFile().getId());
-            } catch (NullPointerException ex){
+            } catch (NullPointerException ex) {
                 // This is one of the places where we get many errors if the case is closed during processing.
                 // We don't want to print out a ton of exceptions if this is the case.
-                if(Case.isCaseOpen()){
+                if (Case.isCaseOpen()) {
                     Logger.getLogger(RemoveFileTask.class.getName()).log(Level.SEVERE, "Case was closed out from underneath RemoveFile task");
                 }
             }
-            
+
         }
     }
 
@@ -774,8 +774,9 @@ public final class ImageGalleryController {
      * netbeans and ImageGallery progress/status
      */
     class PrePopulateDataSourceFiles extends InnerTask {
+
         private final Content dataSource;
-        
+
         /**
          * here we grab by extension but in file_done listener we look at file
          * type id attributes but fall back on jpeg signatures and extensions to
@@ -787,7 +788,7 @@ public final class ImageGalleryController {
         private ProgressHandle progressHandle = ProgressHandleFactory.createHandle("prepopulating image/video database");
 
         /**
-         
+         *
          * @param dataSourceId Data source object ID
          */
         public PrePopulateDataSourceFiles(Content dataSource) {
@@ -809,23 +810,22 @@ public final class ImageGalleryController {
             final List<AbstractFile> files;
             try {
                 List<Long> fsObjIds = new ArrayList<>();
-                
+
                 String fsQuery;
                 if (dataSource instanceof Image) {
-                    Image image = (Image)dataSource;
+                    Image image = (Image) dataSource;
                     for (FileSystem fs : image.getFileSystems()) {
                         fsObjIds.add(fs.getId());
                     }
-                    fsQuery = "(fs_obj_id = " + StringUtils.join(fsObjIds, " OR fs_obj_id = ") + ") ";
+                    fsQuery = "(fs_obj_id = " + StringUtils.join(fsObjIds, " or fs_obj_id = ") + ") ";
-                }
+                } // NOTE: Logical files currently (Apr '15) have a null value for fs_obj_id in DB.
-                // NOTE: Logical files currently (Apr '15) have a null value for fs_obj_id in DB.
                 // for them, we will not specify a fs_obj_id, which means we will grab files
                 // from another data source, but the drawable DB is smart enough to de-dupe them.
                 else {
                     fsQuery = "(fs_obj_id IS NULL) ";
                 }
-                
+
-                files = getSleuthKitCase().findAllFilesWhere(fsQuery + " AND " + DRAWABLE_QUERY);
+                files = getSleuthKitCase().findAllFilesWhere(fsQuery + " and " + DRAWABLE_QUERY);
                 progressHandle.switchToDeterminate(files.size());
 
                 //do in transaction
@@ -853,7 +853,7 @@ public final class ImageGalleryController {
                 Logger.getLogger(PrePopulateDataSourceFiles.class.getName()).log(Level.WARNING, "failed to transfer all database contents", ex);
             } catch (IllegalStateException | NullPointerException ex) {
                 Logger.getLogger(PrePopulateDataSourceFiles.class.getName()).log(Level.WARNING, "Case was closed out from underneath prepopulating database");
-            } 
+            }
 
             progressHandle.finish();
         }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2013-14 Basis Technology Corp.
+ * Copyright 2013-15 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -42,7 +42,11 @@ public class ImageGalleryModule {
 
     private static final Logger LOGGER = Logger.getLogger(ImageGalleryModule.class.getName());
 
-    static final String MODULE_NAME = ImageGalleryModule.class.getSimpleName();
+    private static final String MODULE_NAME = "Image Gallery";
+
+    static String getModuleName() {
+        return MODULE_NAME;
+    }
 
     private static final Set<String> videoExtensions
             = Sets.newHashSet("aaf", "3gp", "asf", "avi", "m1v", "m2v", "m4v", "mp4",
@@ -60,7 +64,7 @@ public class ImageGalleryModule {
     /** mime types of files we can display */
     private static final Set<String> supportedMimes = Sets.union(imageMimes, videoMimes);
 
-    public static Set<String> getSupportedMimes() {
+    static Set<String> getSupportedMimes() {
         return Collections.unmodifiableSet(supportedMimes);
     }
 
@@ -99,8 +103,8 @@ public class ImageGalleryModule {
         }
     }
 
-    public static Set<String> getAllSupportedExtensions() {
+    static Set<String> getAllSupportedExtensions() {
-        return supportedExtensions;
+        return Collections.unmodifiableSet(supportedExtensions);
     }
 
     /** is the given file suported by image analyzer: ie, does it have a
@@ -111,7 +115,7 @@ public class ImageGalleryModule {
      *
      * @return true if this file is supported or false if not
      */
-    public static Boolean isSupported(AbstractFile file) {
+    static Boolean isSupported(AbstractFile file) {
         //if there were no file type attributes, or we failed to read it, fall back on extension and jpeg header
         return Optional.ofNullable(hasSupportedMimeType(file)).orElseGet(() -> {
             return supportedExtensions.contains(getFileExtension(file))
@@ -127,7 +131,7 @@ public class ImageGalleryModule {
      *         TSK_GEN_INFO that is in the supported list. False if there was an
      *         unsupported attribute, null if no attributes were found
      */
-    public static Boolean hasSupportedMimeType(AbstractFile file) {
+    static Boolean hasSupportedMimeType(AbstractFile file) {
         try {
             ArrayList<BlackboardAttribute> fileSignatureAttrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
             if (fileSignatureAttrs.isEmpty() == false) {
@@ -170,7 +174,7 @@ public class ImageGalleryModule {
      * @return true if the given {@link AbstractFile} is 'supported' and not
      *         'known', else false
      */
-    static public boolean isSupportedAndNotKnown(AbstractFile abstractFile) {
+    public static boolean isSupportedAndNotKnown(AbstractFile abstractFile) {
         return (abstractFile.getKnown() != TskData.FileKnown.KNOWN) && ImageGalleryModule.isSupported(abstractFile);
     }
 }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryOptionsPanel.java

@@ -130,7 +130,7 @@ final class ImageGalleryOptionsPanel extends javax.swing.JPanel {
         ImageGalleryPreferences.setEnabledByDefault(enabledByDefaultBox.isSelected());
         ImageGalleryController.getDefault().setListeningEnabled(enabledForCaseBox.isSelected());
         if (Case.isCaseOpen()) {
-            new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.MODULE_NAME, PerCaseProperties.ENABLED, Boolean.toString(enabledForCaseBox.isSelected()));
+            new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.getModuleName(), PerCaseProperties.ENABLED, Boolean.toString(enabledForCaseBox.isSelected()));
         }
     }
 

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/PerCaseProperties.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2013 Basis Technology Corp.
+ * Copyright 2013-15 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,11 +18,12 @@
  */
 package org.sleuthkit.autopsy.imagegallery;
 
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
@@ -32,7 +33,7 @@ import org.sleuthkit.autopsy.casemodule.Case;
 import org.sleuthkit.autopsy.coreutils.Logger;
 
 /**
- * Provides access to per case module properties
+ * Provides access to per-case module properties/settings.
  */
 class PerCaseProperties {
 
@@ -40,13 +41,10 @@ class PerCaseProperties {
 
     public static final String STALE = "stale";
 
-    private final Case c;
+    private final Case theCase;
 
-    /**
-     * the constructor
-     */
     PerCaseProperties(Case c) {
-        this.c = c;
+        this.theCase = c;
     }
 
     /**
@@ -56,19 +54,21 @@ class PerCaseProperties {
      * @param moduleName - The name of the config file to make
      *
      * @return True if successfully created, false if already exists or an error
-     * is thrown.
+     *         is thrown.
      */
     public synchronized boolean makeConfigFile(String moduleName) {
         if (!configExists(moduleName)) {
-            File propPath = new File(getPropertyPath(moduleName));
+            Path propPath = getPropertyPath(moduleName);
-            File parent = new File(propPath.getParent());
+            Path parent = propPath.getParent();
-            if (!parent.exists()) {
+
-                parent.mkdirs();
-            }
             Properties props = new Properties();
             try {
-                propPath.createNewFile();
+                if (!Files.exists(parent)) {
-                try (FileOutputStream fos = new FileOutputStream(propPath)) {
+                    Files.createDirectories(parent);
+                }
+                Files.createFile(propPath);
+
+                try (OutputStream fos = Files.newOutputStream(propPath)) {
                     props.store(fos, "");
                 }
             } catch (IOException e) {
@@ -88,8 +88,8 @@ class PerCaseProperties {
      * @return true if the config exists, false otherwise.
      */
     public synchronized boolean configExists(String moduleName) {
-        File f = new File(getPropertyPath(moduleName)); // NON-NLS
+        Path get = Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties");
-        return f.exists();
+        return Files.exists(get);
     }
 
     public synchronized boolean settingExists(String moduleName, String settingName) {
@@ -111,16 +111,16 @@ class PerCaseProperties {
      * @param moduleName - The name of the config file to evaluate
      *
      * @return The path of the given config file. Returns null if the config
-     * file doesn't exist.
+     *         file doesn't exist.
      */
-    private synchronized String getPropertyPath(String moduleName) {
+    private synchronized Path getPropertyPath(String moduleName) {
-        return c.getModuleDirectory() + File.separator + moduleName + File.separator + moduleName + ".properties"; //NON-NLS
+        return Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties"); //NON-NLS
     }
 
     /**
      * Returns the given properties file's setting as specific by settingName.
      *
-     * @param moduleName - The name of the config file to read from.
+     * @param moduleName  - The name of the config file to read from.
      * @param settingName - The setting name to retrieve.
      *
      * @return - the value associated with the setting.
@@ -150,7 +150,7 @@ class PerCaseProperties {
      * @param moduleName - the name of the config file to read from.
      *
      * @return - the map of all key:value pairs representing the settings of the
-     * config.
+     *         config.
      *
      * @throws IOException
      */
@@ -181,8 +181,8 @@ class PerCaseProperties {
      * Sets the given properties file to the given setting map.
      *
      * @param moduleName - The name of the module to be written to.
-     * @param settings - The mapping of all key:value pairs of settings to add
+     * @param settings   - The mapping of all key:value pairs of settings to add
-     * to the config.
+     *                   to the config.
      */
     public synchronized void setConfigSettings(String moduleName, Map<String, String> settings) {
         if (!configExists(moduleName)) {
@@ -196,8 +196,7 @@ class PerCaseProperties {
                 props.setProperty(kvp.getKey(), kvp.getValue());
             }
 
-            File path = new File(getPropertyPath(moduleName));
+            try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) {
-            try (FileOutputStream fos = new FileOutputStream(path)) {
                 props.store(fos, "Changed config settings(batch)"); //NON-NLS
             }
         } catch (IOException e) {
@@ -208,9 +207,9 @@ class PerCaseProperties {
     /**
      * Sets the given properties file to the given settings.
      *
-     * @param moduleName - The name of the module to be written to.
+     * @param moduleName  - The name of the module to be written to.
      * @param settingName - The name of the setting to be modified.
-     * @param settingVal - the value to set the setting to.
+     * @param settingVal  - the value to set the setting to.
      */
     public synchronized void setConfigSetting(String moduleName, String settingName, String settingVal) {
         if (!configExists(moduleName)) {
@@ -223,8 +222,7 @@ class PerCaseProperties {
 
             props.setProperty(settingName, settingVal);
 
-            File path = new File(getPropertyPath(moduleName));
+            try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) {
-            try (FileOutputStream fos = new FileOutputStream(path)) {
                 props.store(fos, "Changed config settings(single)"); //NON-NLS
             }
         } catch (IOException e) {
@@ -236,7 +234,7 @@ class PerCaseProperties {
      * Removes the given key from the given properties file.
      *
      * @param moduleName - The name of the properties file to be modified.
-     * @param key - the name of the key to remove.
+     * @param key        - the name of the key to remove.
      */
     public synchronized void removeProperty(String moduleName, String key) {
         if (!configExists(moduleName)) {
@@ -249,8 +247,7 @@ class PerCaseProperties {
                 Properties props = fetchProperties(moduleName);
 
                 props.remove(key);
-                File path = new File(getPropertyPath(moduleName));
+                try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) {
-                try (FileOutputStream fos = new FileOutputStream(path)) {
                     props.store(fos, "Removed " + key); //NON-NLS
                 }
             }
@@ -274,7 +271,7 @@ class PerCaseProperties {
             Logger.getLogger(PerCaseProperties.class.getName()).log(Level.INFO, "File did not exist. Created file [" + moduleName + ".properties]"); //NON-NLS NON-NLS
         }
         Properties props;
-        try (InputStream inputStream = new FileInputStream(getPropertyPath(moduleName))) {
+        try (InputStream inputStream = Files.newInputStream(getPropertyPath(moduleName))) {
             props = new Properties();
             props.load(inputStream);
         }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ThumbnailCache.java

@@ -153,6 +153,7 @@ public enum ThumbnailCache {
     }
 
     private static File getCacheFile(long id) {
+        // @@@ should use ImageUtils.getFile();
         return new File(Case.getCurrentCase().getCacheDirectory() + File.separator + id + ".png");
     }
 

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java

@@ -95,22 +95,15 @@ public class CategorizeAction extends AddTagAction {
                         //remove old category tag if necessary
                         List<ContentTag> allContentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByContent(file);
 
-                        boolean hadExistingCategory = false;
                         for (ContentTag ct : allContentTags) {
                             //this is bad: treating tags as categories as long as their names start with prefix
                             //TODO:  abandon using tags for categories and instead add a new column to DrawableDB
                             if (ct.getName().getDisplayName().startsWith(Category.CATEGORY_PREFIX)) {
-                                LOGGER.log(Level.INFO, "removing old category from {0}", file.getName());
+                                //LOGGER.log(Level.INFO, "removing old category from {0}", file.getName());
                                 Case.getCurrentCase().getServices().getTagsManager().deleteContentTag(ct);
                                 controller.getDatabase().decrementCategoryCount(Category.fromDisplayName(ct.getName().getDisplayName()));
-                                hadExistingCategory = true;
                             }
                         }
-                        
-                        // If the image was uncategorized, decrement the uncategorized count
-                        if(! hadExistingCategory){
-                            controller.getDatabase().decrementCategoryCount(Category.ZERO);
-                        }
 
                         controller.getDatabase().incrementCategoryCount(Category.fromDisplayName(tagName.getDisplayName()));
                         if (tagName != Category.ZERO.getTagName()) { // no tags for cat-0

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/Category.java

@@ -66,7 +66,7 @@ public enum Category implements Comparable<Category> {
     private final static Set<CategoryListener> listeners = new HashSet<>();
 
     public static void fireChange(Collection<Long> ids) {
-        Set<CategoryListener> listenersCopy = new HashSet<CategoryListener>(listeners);
+        Set<CategoryListener> listenersCopy = new HashSet<>();
         synchronized (listeners) {
             listenersCopy.addAll(listeners);
         }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java

@@ -50,6 +50,8 @@ import org.sleuthkit.autopsy.imagegallery.grouping.GroupManager;
 import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy;
 import static org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy.GROUP_BY_VALUE;
 import org.sleuthkit.datamodel.AbstractFile;
+import org.sleuthkit.datamodel.BlackboardArtifact;
+import org.sleuthkit.datamodel.BlackboardAttribute;
 import org.sleuthkit.datamodel.ContentTag;
 import org.sleuthkit.datamodel.SleuthkitCase;
 import org.sleuthkit.datamodel.TagName;
@@ -1123,6 +1125,56 @@ public class DrawableDB {
         }
     }
     
+    /*
+     * The following groups of functions are used to store information in memory instead
+     * of in the database. Due to the change listeners in the GUI, this data is requested
+     * many, many times when browsing the images, and especially when making any
+     * changes to things like categories.
+     *
+     * I don't like having multiple copies of the data, but these were causing major
+     * bottlenecks when they were all database lookups.
+     */
+    
+    @GuardedBy("hashSetMap")
+    private final Map<Long, Set<String>> hashSetMap = new HashMap<>();
+    
+    @GuardedBy("hashSetMap")
+    public boolean isInHashSet(Long id){
+        if(! hashSetMap.containsKey(id)){
+            updateHashSetsForFile(id);
+        }
+        return (! hashSetMap.get(id).isEmpty());
+    }
+    
+    @GuardedBy("hashSetMap")
+    public Set<String> getHashSetsForFile(Long id){
+        if(! isInHashSet(id)){
+            updateHashSetsForFile(id);
+        }
+        return hashSetMap.get(id);
+    }
+
+    @GuardedBy("hashSetMap")
+    public void updateHashSetsForFile(Long id){
+        
+        try {
+            List<BlackboardArtifact> arts = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, id);
+            Set<String> hashNames = new HashSet<>();
+            for(BlackboardArtifact a:arts){
+                List<BlackboardAttribute> attrs = a.getAttributes();
+                for(BlackboardAttribute attr:attrs){
+                    if(attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()){
+                        hashNames.add(attr.getValueString());
+                    }
+                }
+            }
+            hashSetMap.put(id, hashNames);
+        } catch (IllegalStateException | TskCoreException ex) {
+            LOGGER.log(Level.WARNING, "could not access case during updateHashSetsForFile()", ex);
+          
+        }
+    }
+    
     /**
      * For performance reasons, keep a list of all file IDs currently in the image database.
      * Otherwise the database is queried many times to retrieve the same data.
@@ -1148,6 +1200,12 @@ public class DrawableDB {
         }
     }
     
+    public int getNumberOfImageFilesInList(){
+        synchronized (fileIDlist){
+            return fileIDlist.size();
+        }
+    }
+    
     public void initializeImageList(){
         synchronized (fileIDlist){
             dbReadLock();
@@ -1173,63 +1231,52 @@ public class DrawableDB {
     private final Map<Category, Integer> categoryCounts = new HashMap<>();    
     
     public void incrementCategoryCount(Category cat) throws TskCoreException{
-        synchronized(categoryCounts){
+        if(cat != Category.ZERO){
-            int count = getCategoryCount(cat);
+            synchronized(categoryCounts){
-            count++;
+                int count = getCategoryCount(cat);
-            categoryCounts.put(cat, count);
+                count++;
+                categoryCounts.put(cat, count);
+            }
         }
     }
     
     public void decrementCategoryCount(Category cat) throws TskCoreException{
-        synchronized(categoryCounts){
+        if(cat != Category.ZERO){
-            int count = getCategoryCount(cat);
+            synchronized(categoryCounts){
-            count--;
+                int count = getCategoryCount(cat);
-            categoryCounts.put(cat, count);            
+                count--;
+                categoryCounts.put(cat, count);            
+            }
         }
     }
     
     public int getCategoryCount(Category cat) throws TskCoreException{
         synchronized(categoryCounts){
-            if(categoryCounts.containsKey(cat)){
+            if(cat == Category.ZERO){
+                // Keeping track of the uncategorized files is a bit tricky while ingest
+                // is going on, so always use the list of file IDs we already have along with the
+                // other category counts instead of trying to track it separately.
+                int allOtherCatCount = getCategoryCount(Category.ONE) + getCategoryCount(Category.TWO) + getCategoryCount(Category.THREE) + 
+                        getCategoryCount(Category.FOUR) + getCategoryCount(Category.FIVE);
+                return getNumberOfImageFilesInList() - allOtherCatCount;
+            }
+            else if(categoryCounts.containsKey(cat)){
                 return categoryCounts.get(cat);
             }
             else{
                 try {
-                    if (cat == Category.ZERO) {
+                    int fileCount = 0;
-
+                    List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(cat.getTagName());
-                        // Category Zero (Uncategorized) files will not be tagged as such - 
+                    for (ContentTag ct : contentTags) {
-                        // this is really just the default setting. So we count the number of files
+                        if(ct.getContent() instanceof AbstractFile){
-                        // tagged with the other categories and subtract from the total.
+                            AbstractFile f = (AbstractFile)ct.getContent();
-                        int allOtherCatCount = 0;
+                            if(this.isImageFile(f.getId())){
-                        TagName[] tns = {Category.FOUR.getTagName(), Category.THREE.getTagName(), Category.TWO.getTagName(), Category.ONE.getTagName(), Category.FIVE.getTagName()};
+                                fileCount++;
-                        for (TagName tn : tns) {
-                            List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn);
-                            for (ContentTag ct : contentTags) {
-                                if(ct.getContent() instanceof AbstractFile){
-                                    AbstractFile f = (AbstractFile)ct.getContent();
-                                    if(this.isImageFile(f.getId())){
-                                        allOtherCatCount++;
-                                    }
-                                }
-                            }
-                        } 
-                        categoryCounts.put(cat, this.countAllFiles() - allOtherCatCount);
-                        return categoryCounts.get(cat);
-                    } else {
-
-                        int fileCount = 0;
-                        List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(cat.getTagName());
-                        for (ContentTag ct : contentTags) {
-                            if(ct.getContent() instanceof AbstractFile){
-                                AbstractFile f = (AbstractFile)ct.getContent();
-                                if(this.isImageFile(f.getId())){
-                                    fileCount++;
-                                }
                             }
                         }
-                        categoryCounts.put(cat, fileCount);
-                        return fileCount;
                     }
+                    categoryCounts.put(cat, fileCount);
+                    return fileCount;
                 } catch(IllegalStateException ex){
                     throw new TskCoreException("Case closed while getting files");
                 }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java

@@ -35,6 +35,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.text.WordUtils;
 import org.sleuthkit.autopsy.casemodule.Case;
 import org.sleuthkit.autopsy.coreutils.Logger;
+import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
 import org.sleuthkit.autopsy.imagegallery.ImageGalleryModule;
 import org.sleuthkit.datamodel.AbstractFile;
 import org.sleuthkit.datamodel.BlackboardArtifact;
@@ -97,8 +98,6 @@ public abstract class DrawableFile<T extends AbstractFile> extends AbstractFile
 
     private final SimpleObjectProperty<Category> category = new SimpleObjectProperty<>(null);
 
-    private Collection<String> hashHitSetNames;
-
     private String make;
 
     private String model;
@@ -116,16 +115,11 @@ public abstract class DrawableFile<T extends AbstractFile> extends AbstractFile
 
     public abstract boolean isVideo();
 
-    public Collection<String> getHashHitSetNames() {
+    synchronized public Collection<String> getHashHitSetNames() {
-        updateHashSets();
+        Collection<String> hashHitSetNames = ImageGalleryController.getDefault().getDatabase().getHashSetsForFile(getId());
         return hashHitSetNames;
     }
 
-    @SuppressWarnings("unchecked")
-    private void updateHashSets() {
-        hashHitSetNames = (Collection<String>) getValuesOfBBAttribute(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME);
-    }
-
     @Override
     public boolean isRoot() {
         return false;

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/DrawableGroup.java

@@ -25,14 +25,12 @@ import javafx.collections.FXCollections;
 import javafx.collections.ObservableList;
 import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
-import org.sleuthkit.datamodel.BlackboardArtifact;
-import org.sleuthkit.datamodel.TskCoreException;
 
 /**
  * Represents a set of image/video files in a group. The UI listens to changes
  * to the group membership and updates itself accordingly.
  */
-public class DrawableGroup implements Comparable<DrawableGroup>{
+public class DrawableGroup implements Comparable<DrawableGroup> {
 
     private static final Logger LOGGER = Logger.getLogger(DrawableGroup.class.getName());
 
@@ -65,18 +63,26 @@ public class DrawableGroup implements Comparable<DrawableGroup>{
         return getFilesWithHashSetHitsCount() / (double) getSize();
     }
 
+    /**
+     * Call to indicate that an image has been added or removed from the group,
+     * so the hash counts may not longer be accurate.
+     */
+    synchronized public void invalidateHashSetHitsCount() {
+        filesWithHashSetHitsCount = -1;
+    }
+
     synchronized public int getFilesWithHashSetHitsCount() {
         //TODO: use the drawable db for this ? -jm
         if (filesWithHashSetHitsCount < 0) {
             filesWithHashSetHitsCount = 0;
             for (Long fileID : fileIds()) {
+
                 try {
-                    long artcount = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, fileID);
+                    if (ImageGalleryController.getDefault().getDatabase().isInHashSet(fileID)) {
-                    if (artcount > 0) {
                         filesWithHashSetHitsCount++;
                     }
-                } catch (IllegalStateException | TskCoreException ex) {
+                } catch (IllegalStateException | NullPointerException ex) {
-                    LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()", ex);
+                    LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()");
                     break;
                 }
             }
@@ -109,18 +115,20 @@ public class DrawableGroup implements Comparable<DrawableGroup>{
     }
 
     synchronized public void addFile(Long f) {
+        invalidateHashSetHitsCount();
         if (fileIDs.contains(f) == false) {
             fileIDs.add(f);
         }
     }
 
     synchronized public void removeFile(Long f) {
+        invalidateHashSetHitsCount();
         fileIDs.removeAll(f);
     }
-    
+
     // By default, sort by group key name
     @Override
-    public int compareTo(DrawableGroup other){
+    public int compareTo(DrawableGroup other) {
         return this.groupKey.getValueDisplayName().compareTo(other.groupKey.getValueDisplayName());
     }
 }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/GroupManager.java

@@ -281,18 +281,23 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
         final DrawableGroup group = getGroupForKey(groupKey);
         if (group != null) {
             group.removeFile(fileID);
-            if (group.fileIds().isEmpty()) {
-                synchronized (groupMap) {
-                    groupMap.remove(groupKey, group);
-                }
-                Platform.runLater(() -> {
-                    analyzedGroups.remove(group);
-                    synchronized (unSeenGroups) {
-                        unSeenGroups.remove(group);
-                    }
-                });
-            }
 
+            // If we're grouping by category, we don't want to remove empty groups.
+            if (group.groupKey.getValueDisplayName().startsWith("CAT-")) {
+                return;
+            } else {
+                if (group.fileIds().isEmpty()) {
+                    synchronized (groupMap) {
+                        groupMap.remove(groupKey, group);
+                    }
+                    Platform.runLater(() -> {
+                        analyzedGroups.remove(group);
+                        synchronized (unSeenGroups) {
+                            unSeenGroups.remove(group);
+                        }
+                    });
+                }
+            }
         }
     }
 
@@ -317,13 +322,13 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
          * was still running) */
         if (task == null || (task.isCancelled() == false)) {
             DrawableGroup g = makeGroup(groupKey, filesInGroup);
-            
+
             populateAnalyzedGroup(g, task);
         }
     }
-    
+
     private synchronized <A extends Comparable<A>> void populateAnalyzedGroup(final DrawableGroup g, ReGroupTask<A> task) {
-    
+
         if (task == null || (task.isCancelled() == false)) {
             final boolean groupSeen = db.isGroupSeen(g.groupKey);
             Platform.runLater(() -> {
@@ -427,7 +432,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
      * @return
      */
     @SuppressWarnings({"unchecked"})
-    public <A extends Comparable<A>> List<A> findValuesForAttribute(DrawableAttribute<A> groupBy) { 
+    public <A extends Comparable<A>> List<A> findValuesForAttribute(DrawableAttribute<A> groupBy) {
         List<A> values;
         try {
             switch (groupBy.attrName) {
@@ -453,12 +458,12 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
             }
 
             return values;
-        } catch(TskCoreException ex){
+        } catch (TskCoreException ex) {
             LOGGER.log(Level.WARNING, "TSK error getting list of type " + groupBy.getDisplayName());
             return new ArrayList<A>();
         }
-            
+
-    }  
+    }
 
     public List<Long> getFileIDsInGroup(GroupKey<?> groupKey) throws TskCoreException {
         switch (groupKey.getAttribute().attrName) {
@@ -487,7 +492,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
                 for (TagName tn : tns) {
                     List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn);
                     for (ContentTag ct : contentTags) {
-                        if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
+                        if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
                             files.add(ct.getContent().getId());
                         }
                     }
@@ -499,7 +504,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
                 List<Long> files = new ArrayList<>();
                 List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(category.getTagName());
                 for (ContentTag ct : contentTags) {
-                    if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
+                    if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
+
                         files.add(ct.getContent().getId());
                     }
                 }
@@ -511,14 +517,17 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
             throw ex;
         }
     }
-    
+
     /**
      * Count the number of files with the given category.
      * This is faster than getFileIDsWithCategory and should be used if only the
      * counts are needed and not the file IDs.
+     *
      * @param category Category to match against
+     *
      * @return Number of files with the given category
-     * @throws TskCoreException 
+     *
+     * @throws TskCoreException
      */
     public int countFilesWithCategory(Category category) throws TskCoreException {
         return db.getCategoryCount(category);
@@ -529,7 +538,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
             List<Long> files = new ArrayList<>();
             List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tagName);
             for (ContentTag ct : contentTags) {
-                if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
+                if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
+
                     files.add(ct.getContent().getId());
                 }
             }
@@ -576,10 +586,10 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
      */
     public <A extends Comparable<A>> void regroup(final DrawableAttribute<A> groupBy, final GroupSortBy sortBy, final SortOrder sortOrder, Boolean force) {
 
-        if(! Case.isCaseOpen()){
+        if (!Case.isCaseOpen()) {
             return;
         }
-        
+
         //only re-query the db if the group by attribute changed or it is forced
         if (groupBy != getGroupBy() || force == true) {
             setGroupBy(groupBy);
@@ -608,15 +618,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
         }
     }
 
-   
-
     /**
      * an executor to submit async ui related background tasks to.
      */
     final ExecutorService regroupExecutor = Executors.newSingleThreadExecutor(new BasicThreadFactory.Builder().namingPattern("ui task -%d").build());
 
-  
-
     public ReadOnlyDoubleProperty regroupProgress() {
         return regroupProgress.getReadOnlyProperty();
     }
@@ -625,6 +631,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
      * handle {@link FileUpdateEvent} sent from Db when files are
      * inserted/updated
      *
+     * TODO: why isn't this just two methods!
+     *
      * @param evt
      */
     @Override
@@ -638,10 +646,10 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
 
                     for (GroupKey<?> gk : groupsForFile) {
                         removeFromGroup(gk, fileId);
-                        
+
                         DrawableGroup g = getGroupForKey(gk);
 
-                        if (g == null){
+                        if (g == null) {
                             // It may be that this was the last unanalyzed file in the group, so test
                             // whether the group is now fully analyzed.
                             //TODO: use method in groupmanager ?
@@ -649,7 +657,9 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
                             if (checkAnalyzed != null) { // => the group is analyzed, so add it to the ui
                                 populateAnalyzedGroup(gk, checkAnalyzed);
                             }
-                        }                        
+                        } else {
+                            g.invalidateHashSetHitsCount();
+                        }
                     }
                 }
 
@@ -669,6 +679,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
                  */
                 for (final long fileId : fileIDs) {
 
+                    db.updateHashSetsForFile(fileId);
+
                     //get grouping(s) this file would be in
                     Set<GroupKey<?>> groupsForFile = getGroupKeysForFileID(fileId);
 
@@ -688,13 +700,13 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
                         }
                     }
                 }
-
+                if (evt.getChangedAttribute() == DrawableAttribute.CATEGORY) {
-                Category.fireChange(fileIDs);
+                    Category.fireChange(fileIDs);
+                }
                 if (evt.getChangedAttribute() == DrawableAttribute.TAGS) {
                     TagUtils.fireChange(fileIDs);
                 }
                 break;
-            
         }
     }
 
@@ -743,10 +755,10 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
             synchronized (groupMap) {
                 groupMap.clear();
             }
-            
+
             // Get the list of group keys
             final List<A> vals = findValuesForAttribute(groupBy);
-            
+
             // Make a list of each group 
             final List<DrawableGroup> groups = new ArrayList<>();
 
@@ -767,22 +779,22 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
 
                 List<Long> checkAnalyzed = checkAnalyzed(groupKey);
                 if (checkAnalyzed != null) { // != null => the group is analyzed, so add it to the ui
-                    
+
                     // makeGroup will create the group and add it to the map groupMap, but does not
                     // update anything else
                     DrawableGroup g = makeGroup(groupKey, checkAnalyzed);
                     groups.add(g);
                 }
             }
-            
+
             // Sort the group list
             Collections.sort(groups, sortBy.getGrpComparator(sortOrder));
-            
+
             // Officially add all groups in order
-            for(DrawableGroup g:groups){
+            for (DrawableGroup g : groups) {
                 populateAnalyzedGroup(g, ReGroupTask.this);
             }
-            
+
             updateProgress(1, 1);
             return null;
         }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/DrawableView.java

@@ -1,6 +1,7 @@
 package org.sleuthkit.autopsy.imagegallery.gui;
 
 import java.util.Collection;
+import java.util.logging.Level;
 import javafx.application.Platform;
 import javafx.scene.layout.Border;
 import javafx.scene.layout.BorderStroke;
@@ -9,6 +10,7 @@ import javafx.scene.layout.BorderWidths;
 import javafx.scene.layout.CornerRadii;
 import javafx.scene.layout.Region;
 import javafx.scene.paint.Color;
+import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.autopsy.coreutils.ThreadConfined;
 import org.sleuthkit.autopsy.imagegallery.TagUtils;
 import org.sleuthkit.autopsy.imagegallery.datamodel.Category;
@@ -56,7 +58,14 @@ public interface DrawableView extends Category.CategoryListener, TagUtils.TagLis
     void handleTagsChanged(Collection<Long> ids);
 
     default boolean hasHashHit() {
-        return getFile().getHashHitSetNames().isEmpty() == false;
+        try{
+            return getFile().getHashHitSetNames().isEmpty() == false;
+        } catch (NullPointerException ex){
+            // I think this happens when we're in the process of removing images from the view while
+            // also trying to update it? 
+            Logger.getLogger(DrawableView.class.getName()).log(Level.WARNING, "Error looking up hash set hits");
+            return false;
+        }
     }
 
     static Border getCategoryBorder(Category category) {

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/SingleDrawableViewBase.java

@@ -370,7 +370,7 @@ public abstract class SingleDrawableViewBase extends AnchorPane implements Drawa
             } else {
                 Category.registerListener(this);
                 TagUtils.registerListener(this);
-
+ 
                 getFile();
                 updateSelectionState();
                 updateCategoryBorder();

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java

@@ -1,8 +1,28 @@
+/*
+ * Autopsy Forensic Browser
+ *
+ * Copyright 2013-15 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package org.sleuthkit.autopsy.imagegallery.gui.navpanel;
 
+import static java.util.Objects.isNull;
+import java.util.Optional;
 import javafx.application.Platform;
+import javafx.beans.InvalidationListener;
 import javafx.beans.Observable;
-import javafx.scene.Node;
 import javafx.scene.control.OverrunStyle;
 import javafx.scene.control.Tooltip;
 import javafx.scene.control.TreeCell;
@@ -13,93 +33,95 @@ import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute;
 import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
 
 /**
- * A {@link Node} in the tree that listens to its associated group. Manages
+ * A cell in the NavPanel tree that listens to its associated group's fileids.
- * visual representation of TreeNode in Tree. Listens to properties of group
+ * Manages visual representation of TreeNode in Tree. Listens to properties of
- * that don't impact hierarchy and updates ui to reflect them
+ * group that don't impact hierarchy and updates ui to reflect them
  */
 class GroupTreeCell extends TreeCell<TreeNode> {
 
     /**
      * icon to use if this cell's TreeNode doesn't represent a group but just a
-     * folder(with no DrawableFiles) in the hierarchy.
+     * folder(with no DrawableFiles) in the file system hierarchy.
      */
     private static final Image EMPTY_FOLDER_ICON = new Image("org/sleuthkit/autopsy/imagegallery/images/folder.png");
 
+    /**
+     * reference to listener that allows us to remove it from a group when a new
+     * group is assigned to this Cell
+     */
+    private InvalidationListener listener;
+
     public GroupTreeCell() {
+        //TODO: move this to .css file
         //adjust indent, default is 10 which uses up a lot of space.
         setStyle("-fx-indent:5;");
         //since end of path is probably more interesting put ellipsis at front
         setTextOverrun(OverrunStyle.LEADING_ELLIPSIS);
+        Platform.runLater(() -> {
+            prefWidthProperty().bind(getTreeView().widthProperty().subtract(15));
+        });
+
     }
 
     @Override
-    synchronized protected void updateItem(final TreeNode tNode, boolean empty) {
+    protected synchronized void updateItem(final TreeNode tNode, boolean empty) {
-        super.updateItem(tNode, empty);
+        //if there was a previous group, remove the listener
-        prefWidthProperty().bind(getTreeView().widthProperty().subtract(15));
+        Optional.ofNullable(getItem())
+                .map(TreeNode::getGroup)
+                .ifPresent((DrawableGroup t) -> {
+                    t.fileIds().removeListener(listener);
+                });
 
-        if (tNode == null || empty) {
+        super.updateItem(tNode, empty);
+
+        if (isNull(tNode) || empty) {
             Platform.runLater(() -> {
                 setTooltip(null);
                 setText(null);
                 setGraphic(null);
             });
         } else {
-            final String name = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN);
+            final String groupName = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN);
-            Platform.runLater(() -> {
-                setTooltip(new Tooltip(name));
-            });
-            
 
-            if (tNode.getGroup() == null) {
+            if (isNull(tNode.getGroup())) {
+                //"dummy" group in file system tree <=>  a folder with no drawables
                 Platform.runLater(() -> {
-                    setText(name);
+                    setTooltip(new Tooltip(groupName));
+                    setText(groupName);
                     setGraphic(new ImageView(EMPTY_FOLDER_ICON));
                 });
 
             } else {
-                //if number of files in this group changes (eg file is recategorized), update counts
+                listener = (Observable o) -> {
-                tNode.getGroup().fileIds().addListener((Observable o) -> {
+                    final String countsText = getCountsText();
                     Platform.runLater(() -> {
-                        setText(name + " (" + getNumerator() + getDenominator() + ")");
+                        setText(groupName + countsText);
                     });
-                });
+                };
+                //if number of files in this group changes (eg file is recategorized), update counts via listener
+                tNode.getGroup().fileIds().addListener(listener);
 
+                //... and use icon corresponding to group type
+                final Image icon = tNode.getGroup().groupKey.getAttribute().getIcon();
+                final String countsText = getCountsText();
                 Platform.runLater(() -> {
-                    //this TreeNode has a group so append counts to name ...
+                    setTooltip(new Tooltip(groupName));
-                    setText(name + " (" + getNumerator() + getDenominator() + ")");
+                    setGraphic(new ImageView(icon));
-                    //... and use icon corresponding to group type
+                    setText(groupName + countsText);
-                    setGraphic(new ImageView(tNode.getGroup().groupKey.getAttribute().getIcon()));
                 });
-                
             }
         }
     }
 
-    /**
+    private synchronized String getCountsText() {
-     * @return the Numerator of the count to append to the group name = number
+        final String counts = Optional.ofNullable(getItem())
-     * of hashset hits + "/"
+                .map(TreeNode::getGroup)
-     */
+                .map((DrawableGroup t) -> {
-    synchronized private String getNumerator() {
+                    return " (" + ((t.groupKey.getAttribute() == DrawableAttribute.HASHSET)
-        try {
+                            ? Integer.toString(t.getSize())
-            final String numerator = (getItem().getGroup().groupKey.getAttribute() != DrawableAttribute.HASHSET)
+                            : t.getFilesWithHashSetHitsCount() + "/" + t.getSize()) + ")";
-                    ? getItem().getGroup().getFilesWithHashSetHitsCount() + "/"
+                }).orElse(""); //if item is null or group is null
-                    : "";
-            return numerator;
-        } catch (NullPointerException e) {
-            //instead of this try catch block, remove the listener when assigned a null treeitem / group
-            return "";
-        }
-    }
 
-    /**
+        return counts;
-     * @return the Denominator of the count to append to the group name = number
-     * of files in group
-     */
-    synchronized private Integer getDenominator() {
-        try {
-            return getItem().getGroup().getSize();
-        } catch (NullPointerException ex) {
-            return 0;
-        }
     }
 }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java

@@ -37,10 +37,28 @@ import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
  */
 class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeItem> {
 
+    static GroupTreeItem getTreeItemForGroup(GroupTreeItem root, DrawableGroup grouping) {
+        if (Objects.equals(root.getValue().getGroup(), grouping)) {
+            return root;
+        } else {
+            synchronized (root.getChildren()) {
+                for (TreeItem<TreeNode> child : root.getChildren()) {
+                    final GroupTreeItem childGTI = (GroupTreeItem) child;
+
+                    GroupTreeItem val = getTreeItemForGroup(childGTI, grouping);
+                    if (val != null) {
+                        return val;
+                    }
+                }
+            }
+        }
+        return null;
+    }
+
     /**
      * maps a path segment to the child item of this item with that path segment
      */
-    private Map<String, GroupTreeItem> childMap = new HashMap<>();
+    private final Map<String, GroupTreeItem> childMap = new HashMap<>();
     /**
      * the comparator if any used to sort the children of this item
      */
@@ -68,7 +86,7 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
      * Recursive method to add a grouping at a given path.
      *
      * @param path Full path (or subset not yet added) to add
-     * @param g Group to add
+     * @param g    Group to add
      * @param tree True if it is part of a tree (versus a list)
      */
     void insert(String path, DrawableGroup g, Boolean tree) {
@@ -88,12 +106,9 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
 
                     prefixTreeItem = newTreeItem;
                     childMap.put(prefix, prefixTreeItem);
-                    Platform.runLater(new Runnable() {
+                    Platform.runLater(() -> {
-                        @Override
+                        synchronized (getChildren()) {
-                        public void run() {
+                            getChildren().add(newTreeItem);
-                            synchronized (getChildren()) {
-                                getChildren().add(newTreeItem);
-                            }
                         }
                     });
 
@@ -109,14 +124,11 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
                 newTreeItem.setExpanded(true);
                 childMap.put(path, newTreeItem);
 
-                Platform.runLater(new Runnable() {
+                Platform.runLater(() -> {
-                    @Override
+                    synchronized (getChildren()) {
-                    public void run() {
+                        getChildren().add(newTreeItem);
-                        synchronized (getChildren()) {
+                        if (comp != null) {
-                            getChildren().add(newTreeItem);
+                            FXCollections.sort(getChildren(), comp);
-                            if (comp != null) {
-                                FXCollections.sort(getChildren(), comp);
-                            }
                         }
                     }
                 });
@@ -129,7 +141,7 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
      * Recursive method to add a grouping at a given path.
      *
      * @param path Full path (or subset not yet added) to add
-     * @param g Group to add
+     * @param g    Group to add
      * @param tree True if it is part of a tree (versus a list)
      */
     void insert(List<String> path, DrawableGroup g, Boolean tree) {
@@ -147,12 +159,9 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
                     prefixTreeItem = newTreeItem;
                     childMap.put(prefix, prefixTreeItem);
 
-                    Platform.runLater(new Runnable() {
+                    Platform.runLater(() -> {
-                        @Override
+                        synchronized (getChildren()) {
-                        public void run() {
+                            getChildren().add(newTreeItem);
-                            synchronized (getChildren()) {
-                                getChildren().add(newTreeItem);
-                            }
                         }
                     });
 
@@ -169,14 +178,11 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
                 newTreeItem.setExpanded(true);
                 childMap.put(path.get(0), newTreeItem);
 
-                Platform.runLater(new Runnable() {
+                Platform.runLater(() -> {
-                    @Override
+                    synchronized (getChildren()) {
-                    public void run() {
+                        getChildren().add(newTreeItem);
-                        synchronized (getChildren()) {
+                        if (comp != null) {
-                            getChildren().add(newTreeItem);
+                            FXCollections.sort(getChildren(), comp);
-                            if (comp != null) {
-                                FXCollections.sort(getChildren(), comp);
-                            }
                         }
                     }
                 });
@@ -189,24 +195,6 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
         return comp.compare(this, o);
     }
 
-    static GroupTreeItem getTreeItemForGroup(GroupTreeItem root, DrawableGroup grouping) {
-        if (Objects.equals(root.getValue().getGroup(), grouping)) {
-            return root;
-        } else {
-            synchronized (root.getChildren()) {
-                for (TreeItem<TreeNode> child : root.getChildren()) {
-                    final GroupTreeItem childGTI = (GroupTreeItem) child;
-
-                    GroupTreeItem val = getTreeItemForGroup(childGTI, grouping);
-                    if (val != null) {
-                        return val;
-                    }
-                }
-            }
-        }
-        return null;
-    }
-
     GroupTreeItem getTreeItemForPath(List<String> path) {
         // end of recursion
         if (path.isEmpty()) {
@@ -253,4 +241,5 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
             ti.resortChildren(comp);
         }
     }
+
 }

ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/NavPanel.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2013 Basis Technology Corp.
+ * Copyright 2013-15 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.imagegallery.gui.navpanel;
 
 import java.net.URL;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.List;
 import java.util.ResourceBundle;
 import javafx.application.Platform;
@@ -41,23 +40,21 @@ import javafx.scene.control.TreeView;
 import javafx.scene.layout.Priority;
 import javafx.scene.layout.VBox;
 import org.apache.commons.lang3.StringUtils;
-import org.openide.util.Exceptions;
 import org.sleuthkit.autopsy.coreutils.ThreadConfined;
 import org.sleuthkit.autopsy.coreutils.ThreadConfined.ThreadType;
 import org.sleuthkit.autopsy.imagegallery.FXMLConstructor;
 import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
 import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute;
-import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile;
 import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
-import org.sleuthkit.autopsy.imagegallery.grouping.GroupKey;
-import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy;
 import org.sleuthkit.autopsy.imagegallery.grouping.GroupViewState;
-import org.sleuthkit.datamodel.TskCoreException;
 
 /**
  * Display two trees. one shows all folders (groups) and calls out folders with
  * images. the user can select folders with images to see them in the main
  * GroupPane The other shows folders with hash set hits.
+ *
+ * //TODO: there is too much code duplication between the navTree and the
+ * hashTree. Extract the common code to some new class.
  */
 public class NavPanel extends TabPane {
 
@@ -170,24 +167,15 @@ public class NavPanel extends TabPane {
                     removeFromNavTree(g);
                     removeFromHashTree(g);
                 }
-                if(change.wasPermutated()){
+                if (change.wasPermutated()) {
                     // Handle this afterward
                     wasPermuted = true;
                 }
             }
-            
+
-            if(wasPermuted){
+            if (wasPermuted) {
-                // Remove everything and add it again in the new order
+                rebuildTrees();
-                for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){
+
-                    removeFromNavTree(g);
-                    removeFromHashTree(g);
-                }
-                for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){
-                    insertIntoNavTree(g);
-                    if (g.getFilesWithHashSetHitsCount() > 0) {
-                        insertIntoHashTree(g);
-                    }
-                }
             }
         });
 
@@ -205,6 +193,27 @@ public class NavPanel extends TabPane {
         });
     }
 
+    private void rebuildTrees() {
+        navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
+        hashTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
+
+        ObservableList<DrawableGroup> groups = controller.getGroupManager().getAnalyzedGroups();
+
+        for (DrawableGroup g : groups) {
+            insertIntoNavTree(g);
+            if (g.getFilesWithHashSetHitsCount() > 0) {
+                insertIntoHashTree(g);
+            }
+        }
+
+        Platform.runLater(() -> {
+            navTree.setRoot(navTreeRoot);
+            navTreeRoot.setExpanded(true);
+            hashTree.setRoot(hashTreeRoot);
+            hashTreeRoot.setExpanded(true);
+        });
+    }
+
     private void updateControllersGroup() {
         final TreeItem<TreeNode> selectedItem = activeTreeProperty.get().getSelectionModel().getSelectedItem();
         if (selectedItem != null && selectedItem.getValue() != null && selectedItem.getValue().getGroup() != null) {
@@ -216,11 +225,6 @@ public class NavPanel extends TabPane {
         hashTreeRoot.resortChildren(sortByBox.getSelectionModel().getSelectedItem());
     }
 
-    private void insertIntoHashTree(DrawableGroup g) {
-        initHashTree();
-        hashTreeRoot.insert(g.groupKey.getValueDisplayName(), g, false);
-    }
-
     /**
      * Set the tree to the passed in group
      *
@@ -234,27 +238,29 @@ public class NavPanel extends TabPane {
         final GroupTreeItem treeItemForGroup = ((GroupTreeItem) activeTreeProperty.get().getRoot()).getTreeItemForPath(path);
 
         if (treeItemForGroup != null) {
-            /* When we used to run the below code on the FX thread, it would 
+            /* When we used to run the below code on the FX thread, it would
-             * get into infinite loops when the next group button was pressed quickly
+             * get into infinite loops when the next group button was pressed
-             * because the udpates became out of order and History could not keep
+             * quickly because the udpates became out of order and History could
-             * track of what was current.  Currently (4/2/15), this method is 
+             * not
-             * already on the FX thread, so it is OK. */
+             * keep track of what was current.
+             *
+             * Currently (4/2/15), this method is already on the FX thread, so
+             * it is OK. */
             //Platform.runLater(() -> {
-                TreeItem<TreeNode> ti = treeItemForGroup;
+            TreeItem<TreeNode> ti = treeItemForGroup;
-                while (ti != null) {
+            while (ti != null) {
-                    ti.setExpanded(true);
+                ti.setExpanded(true);
-                    ti = ti.getParent();
+                ti = ti.getParent();
-                }
+            }
-                int row = activeTreeProperty.get().getRow(treeItemForGroup);
+            int row = activeTreeProperty.get().getRow(treeItemForGroup);
-                if (row != -1) {
+            if (row != -1) {
-                    activeTreeProperty.get().getSelectionModel().select(treeItemForGroup);
+                activeTreeProperty.get().getSelectionModel().select(treeItemForGroup);
-                    activeTreeProperty.get().scrollTo(row);
+                activeTreeProperty.get().scrollTo(row);
-                }
+            }
-            //});
+            //});   //end Platform.runLater
         }
     }
 
-    @SuppressWarnings("fallthrough")
     private static List<String> groupingToPath(DrawableGroup g) {
 
         if (g.groupKey.getAttribute() == DrawableAttribute.PATH) {
@@ -269,11 +275,14 @@ public class NavPanel extends TabPane {
         }
     }
 
+    private void insertIntoHashTree(DrawableGroup g) {
+        initHashTree();
+        hashTreeRoot.insert(groupingToPath(g), g, false);
+    }
+
     private void insertIntoNavTree(DrawableGroup g) {
         initNavTree();
-        List<String> path = groupingToPath(g);
+        navTreeRoot.insert(groupingToPath(g), g, true);
-
-        navTreeRoot.insert(path, g, true);
     }
 
     private void removeFromNavTree(DrawableGroup g) {
@@ -313,22 +322,4 @@ public class NavPanel extends TabPane {
             });
         }
     }
-
-    //these are not used anymore, but could be usefull at some point
-    //TODO: remove them or find a use and undeprecate
-    @Deprecated
-    private void rebuildNavTree() {
-        navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
-
-        ObservableList<DrawableGroup> groups = controller.getGroupManager().getAnalyzedGroups();
-
-        for (DrawableGroup g : groups) {
-            insertIntoNavTree(g);
-        }
-
-        Platform.runLater(() -> {
-            navTree.setRoot(navTreeRoot);
-            navTreeRoot.setExpanded(true);
-        });
-    }
 }

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties

@@ -283,3 +283,4 @@ KeywordSearchModuleFactory.createFileIngestModule.exception.msg=Expected setting
 SearchRunner.Searcher.done.err.msg=Error performing keyword search
 KeywordSearchGlobalSearchSettingsPanel.timeRadioButton5.toolTipText=Fastest overall, but no results until the end
 KeywordSearchGlobalSearchSettingsPanel.timeRadioButton5.text=No periodic searches
+KeywordSearchIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java

@@ -37,7 +37,6 @@ import org.sleuthkit.autopsy.ingest.IngestServices;
 import org.sleuthkit.autopsy.keywordsearch.Ingester.IngesterException;
 import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
 import org.sleuthkit.datamodel.AbstractFile;
-import org.sleuthkit.datamodel.BlackboardAttribute;
 import org.sleuthkit.datamodel.TskCoreException;
 import org.sleuthkit.datamodel.TskData;
 import org.sleuthkit.datamodel.TskData.FileKnown;
@@ -74,7 +73,8 @@ public final class KeywordSearchIngestModule implements FileIngestModule {
     private final IngestServices services = IngestServices.getInstance();
     private Ingester ingester = null;
     private Indexer indexer;
-    //only search images from current ingest, not images previously ingested/indexed
+    private FileTypeDetector fileTypeDetector;
+//only search images from current ingest, not images previously ingested/indexed
     //accessed read-only by searcher thread
 
     private boolean startedSearching = false;
@@ -130,6 +130,11 @@ public final class KeywordSearchIngestModule implements FileIngestModule {
         jobId = context.getJobId();  
         dataSourceId = context.getDataSource().getId();
         
+        try {
+            fileTypeDetector = new FileTypeDetector();
+        } catch (FileTypeDetector.FileTypeDetectorInitException ex) {
+            throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
+        }
         ingester = Server.getIngester();
         this.context = context;
 
@@ -470,30 +475,12 @@ public final class KeywordSearchIngestModule implements FileIngestModule {
                 return;
             }
 
-            
+            String detectedFormat;
-            
-            // try to get the file type from the BB
-            String detectedFormat = null;
             try {
-                ArrayList<BlackboardAttribute> attributes = aFile.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
+                detectedFormat = fileTypeDetector.getFileType(aFile);
-                for (BlackboardAttribute attribute : attributes) {
-                    detectedFormat = attribute.getValueString();
-                    break;
-                }
             } catch (TskCoreException ex) {
-            }
+                logger.log(Level.SEVERE, String.format("Could not detect format using fileTypeDetector for file: %s", aFile), ex); //NON-NLS
-            // else, use FileType module to detect the format
+                return;
-            if (detectedFormat == null) {
-                try {
-                    detectedFormat = new FileTypeDetector().detectAndPostToBlackboard(aFile);
-                } catch (FileTypeDetector.FileTypeDetectorInitException | TskCoreException ex) {
-                    logger.log(Level.WARNING, "Could not detect format using file type detector for file: {0}", aFile); //NON-NLS
-                    return;
-                }
-                if (detectedFormat == null) {
-                    logger.log(Level.WARNING, "Could not detect format using file type detector for file: {0}", aFile); //NON-NLS
-                    return;
-                } 
             }
 
             // we skip archive formats that are opened by the archive module. 

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java

@@ -340,7 +340,6 @@ class LuceneQuery implements KeywordSearchQuery {
             List<String> snippetList = highlightResponse.get(docId).get(Server.Schema.TEXT.toString());
             // list is null if there wasn't a snippet
             if (snippetList != null) {
-                snippetList.sort(null);
                 snippet = EscapeUtil.unEscapeHtml(snippetList.get(0)).trim();
             }
         }
@@ -440,7 +439,6 @@ class LuceneQuery implements KeywordSearchQuery {
         //docs says makes sense for the original Highlighter only, but not really
         //analyze all content SLOW! consider lowering
         q.setParam("hl.maxAnalyzedChars", Server.HL_ANALYZE_CHARS_UNLIMITED);  //NON-NLS
-        q.setParam("hl.preserveMulti", true); //NON-NLS
 
         try {
             QueryResponse response = solrServer.query(q, METHOD.POST);
@@ -453,8 +451,6 @@ class LuceneQuery implements KeywordSearchQuery {
             if (contentHighlights == null) {
                 return "";
             } else {
-                // Sort contentHighlights in order to get consistently same snippet.
-                contentHighlights.sort(null);
                 // extracted content is HTML-escaped, but snippet goes in a plain text field
                 return EscapeUtil.unEscapeHtml(contentHighlights.get(0)).trim();
             }

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java

@@ -1097,8 +1097,7 @@ public class Server {
                 filterQuery = filterQuery + Server.ID_CHUNK_SEP + chunkID;
             }
             q.addFilterQuery(filterQuery);
-            // sort the TEXT field
+            q.setFields(Schema.TEXT.toString());
-            q.setSortField(Schema.TEXT.toString(), SolrQuery.ORDER.asc);
             try {
                 // Get the first result. 
                 SolrDocument solrDocument = solrCore.query(q).getResults().get(0);

docs/doxygen/Doxyfile

@@ -133,7 +133,7 @@ ALWAYS_DETAILED_SEC    = NO
 # operators of the base classes will not be shown.
 # The default value is: NO.
 
-INLINE_INHERITED_MEMB  = NO
+INLINE_INHERITED_MEMB  = YES
 
 # If the FULL_PATH_NAMES tag is set to YES, doxygen will prepend the full path
 # before files name in the file list and in the header files. If set to NO the

docs/doxygen/modDevPython.dox

@@ -60,7 +60,7 @@ To distribute and share your Python module, ZIP up the folder and send it around
 Jython allows you to access all of the Java classes.  So, you should read the following sections of this document.  All you should ignore is the Java environment setup sections.
 
 There are only two types of modules that you can make with Python.  Those (along with a sample file) are listed below:
-- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/ingestmodule.py
+- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/
 - Report Modules: https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/reportmodule.py
 
 */

docs/doxygen/modIngest.dox

@@ -100,10 +100,12 @@ Before we cover the specific interfaces of the two different types of modules, l
 
 To create a data source ingest module:
 -# Create the ingest module class by either:
- - Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule.  If you are using Java, the NetBeans IDE 
+ - Copy and paste the sample modules from:
+  - Java: Core/src/org/sleuthkit/autopsy/examples/SampleDataSourceIngestModule.java
+  - Python: pythonExamples/dataSourceIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
+ - Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule.  If you are using Java, the NetBeans IDE 
 will complain that you have not implemented one or more of the required methods.
 You can use its "hints" to automatically generate stubs for the missing methods.  
- - Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py. 
 -# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isDataSourceIngestModuleFactory() method to return true and have the createDataSourceIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used.  Your factory should have code similar to this Java code:
 
 \code
@@ -119,8 +121,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
 \endcode
 -# Use this page, the sample, and the documentation for the 
 org.sleuthkit.autopsy.ingest.DataSourceIngestModule interfaces to implement the startUp() and process() methods. 
-
+ - org.sleuthkit.autopsy.ingest.DataSourceIngestModule.startUp() is where any initialiation occurs.  If your module has a critical failure and will not be able to run, your startUp method should throw an IngestModuleException to stop ingest. 
-The process() method is where all of the work of a data source ingest module is
+ - org.sleuthkit.autopsy.ingest.DataSourceIngestModule.process() is where all of the work of a data source ingest module is
 done. It will be called exactly once. The 
 process() method receives a reference to an org.sleuthkit.datamodel.Content object
 and an org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress object.
@@ -140,10 +142,12 @@ org.sleuthkit.autopsy.casemodule.services.FileManager class.  See
 To create a file ingest module:
 To create a data source ingest module:
 -# Create the ingest module class by either:
- - Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule.  If you are using Java, the NetBeans IDE 
+ - Copy and paste the sample modules from:
+  - Java: Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java
+  - Python: pythonExamples/fileIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
+ - Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule.  If you are using Java, the NetBeans IDE 
 will complain that you have not implemented one or more of the required methods.
 You can use its "hints" to automatically generate stubs for the missing methods.  
- - Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py. 
 -# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isFileIngestModuleFactory() method to return true and have the createFileIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used.  Your factory should have code similar to this Java code:
 
 \code
@@ -160,9 +164,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
 
 -# Use this page, the sample, and the documentation for the 
 org.sleuthkit.autopsy.ingest.FileIngestModule interface to implement the startUp(), and process(), and shutDown() methods. 
-
+ - org.sleuthkit.autopsy.ingest.FileIngestModule.startUp() should have any code that you need to initialize your module.  If you have any startup errors, be sure to throw a IngestModuleException exception to stop ingest. 
-
+ - org.sleuthkit.autopsy.ingest.FileIngestModule.process() is where all of the work of a file ingest module is
-The process() method is where all of the work of a file ingest module is
 done. It will be called repeatedly between startUp() and shutDown(), once for 
 each file Autopsy feeds into the pipeline of which the module instance is a part. The 
 process() method receives a reference to a org.sleuthkit.datamodel.AbstractFile 
@@ -271,17 +274,22 @@ that the samples do not do anything particularly useful.
 
 Autopsy allows you to provide a graphical panel that will be displayed when the user decides to enable the ingest module.  This panel is supposed to be for settings that the user may turn on or off for different data sources. 
 
+
 To provide options for each ingest job:
 - Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.hasIngestJobSettingsPanel() in your factory class to return true.
-- Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.getIngestJobSettingsPanel() in your factory class to return a IngestModuleIngestJobSettingsPanel that displays the needed configuration options and returns a IngestModuleIngestJobSettings object based on the settings.  This will get passed in the last configuration setting that was used, so that you can populate the panel accordlingly and the user doesn't have to choose new settings. 
+- Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.getIngestJobSettingsPanel() in your factory class to return a IngestModuleIngestJobSettingsPanel that displays the needed configuration options.  The org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel.getSettings() method should return an instance of a org.sleutkit.autopsy.ingest.IngestModuleIngestJobSettings object based on the user-specified settings (see next bullet).
-- Create a class based on org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings to store the settings.
+- Create a class that implements org.sleutkit.autopsy.ingest.IngestModuleIngestJobSettings. Your IngestModuleIngestJobSettingsPanel should store settings in here.  This class needs to be Serializable, so keep all data types simple or mark them as transient with some custom deserialization code. You should also set the serialVersionUID (see http://stackoverflow.com/questions/285793/what-is-a-serialversionuid-and-why-should-i-use-it). 
+- If you decide to store settings internal to the module (NOT RECOMMENDED), the getSettings() method can return an instance of NoIngestModuleIngestJobSettings.  
+- Your instance of IngestModuleIngestJobSettings will be saved and passed to your panel the next time so that you can pre-populate it accordingly. 
+
+Your panel should create the IngestModuleIngestJobSettings class to store the settings and that will be passed back into your factory with each call to createDataSourceIngestModule() or createFileIngestModule().  The way that we have implemented this in Autopsy modules is that the factory casts the IngestModuleINgestJobSettings object to the module-specific implementation and then passes it into the constructor of the ingest module.  The ingest module can then call whatever getter methods that were defined based on the panel settings. 
 
-Your panel should create the IngestModuleIngestJobSettings class to store the settings and that will be passed back into your factory with each call to createDataSourceIngestModule() or createFileIngestModule().  The factory should cast it to its internal class that implements IngestModuleIngestJobSettings and pass that object into the constructor of its ingest module so that it can use the settings when it runs. 
 
 You can also implement the getDefaultIngestJobSettings() method to return an instance of your IngestModuleIngestJobSettings class with default settings.  Autopsy will call this when the module has not been run before. 
 
 NOTE: We recommend storing simple data in the IngestModuleIngestJobSettings-based class.  In the case of our hash lookup module, we store the string names of the hash databases to do lookups in.  We then get the hash database handles in the call to startUp() using the global module settings. 
 
+
 NOTE: The main benefit of using the IngestModuleIngestJobSettings-based class to store settings (versus some static variables in your package) are:
 - When multiple jobs are running at the same time, each can have their own settings.
 - Autopsy persists them so that the last used settings get passed into the call to getIngestJobSettingsPanel() and you don't need to save them yoursevles to provide the user the benefit of re-using the last settings.

docs/doxygen/platformConcepts.dox

@@ -44,12 +44,10 @@ The blackboard allows modules to communicate with each other and the UI. It has
 
 The blackboard is not unique to Autopsy.  It is part of The Sleuth Kit datamodel and The Sleuth Kit Framework.  In the name of reducing the amount of documentation that we need to maintain, we provide links here to those documentation sources. 
 
-- Details on the blackboard concepts (artifacts versus attributes) can be found at http://sleuthkit.org/sleuthkit/docs/framework-docs/mod_bbpage.html. These documents are about the C++ implementation of the blackboard, but it is the same concepts.  
+- \ref mod_bbpage (http://sleuthkit.org/sleuthkit/docs/jni-docs/mod_bbpage.html)
-- Details of the Java classes can be found in \ref jni_blackboard section of the The Sleuth Kit JNI documents (http://sleuthkit.org/sleuthkit/docs/jni-docs/). 
 
 
-
+\section mod_dev_other_services Framework Services and Utilities
-\subsection mod_dev_other_services Framework Services and Utilities
 
 The following are basic services that are available to any module.  They are provided here to be used as a reference.  When you are developing your module and feel like something should be provided by the framework, then refer to this list to find out where it could be.  If you don't find it, let us know and we'll talk about adding it for other writers to benefit. 
 

pythonExamples/README.txt

@@ -1,7 +1,13 @@
-reportmodule.py -> Report module which implements GeneralReportModuleAdapter.
+This folder contains sample python module files.  They are public
-simpleingestmodule -> Data source ingest module without any GUI example code.
+domain, so you are free to copy and paste them and modify them to
-ingestmodule.py -> Both data source ingest module as well as file ingest module WITH an example of GUI code.
+your needs.
+
+See the developer guide for more details and how to use and load
+the modules.
+
+    http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html
+
+Each module in this folder should have a brief description about what they 
+can do. 
+
 
-NOTE: The Python modules must be inside folder inside the folder opened by Tools > Plugins.
-For example, place the ingestmodule.py inside folder ingest. Move that ingest folder inside opened by Tools > Plugins
-The directory opened by Tools > Plugins is cleared every time the project is cleaned.

pythonExamples/dataSourceIngestModule.py

@@ -27,95 +27,125 @@
 # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 # OTHER DEALINGS IN THE SOFTWARE.
 
+# Simple data source-level ingest module for Autopsy.
+# Search for TODO for the things that you need to change
+# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
+
 import jarray
 from java.lang import System
+from java.util.logging import Level
 from org.sleuthkit.datamodel import SleuthkitCase
 from org.sleuthkit.datamodel import AbstractFile
 from org.sleuthkit.datamodel import ReadContentInputStream
 from org.sleuthkit.datamodel import BlackboardArtifact
 from org.sleuthkit.datamodel import BlackboardAttribute
 from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
 from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
 from org.sleuthkit.autopsy.ingest import FileIngestModule
 from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
 from org.sleuthkit.autopsy.ingest import IngestMessage
 from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.coreutils import Logger
 from org.sleuthkit.autopsy.casemodule import Case
 from org.sleuthkit.autopsy.casemodule.services import Services
 from org.sleuthkit.autopsy.casemodule.services import FileManager
 
-# Sample factory that defines basic functionality and features of the module
-class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
 
+# Factory that defines the name and details of the module and allows Autopsy
+# to create instances of the modules that will do the analysis.
+# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
+class SampleJythonDataSourceIngestModuleFactory(IngestModuleFactoryAdapter):
+
+    # TODO: give it a unique name.  Will be shown in module list, logs, etc.
+    moduleName = "Sample Data Source Module" 
+	
     def getModuleDisplayName(self):
-        return "Sample Jython ingest module"
+        return self.moduleName
-
+    
+    # TODO: Give it a description
     def getModuleDescription(self):
-        return "Sample Jython Ingest Module without GUI example code"
+        return "Sample module that does X, Y, and Z."
 
     def getModuleVersionNumber(self):
         return "1.0"
 
-    # Return true if module wants to get passed in a data source
     def isDataSourceIngestModuleFactory(self):
         return True
 
-    # can return null if isDataSourceIngestModuleFactory returns false
     def createDataSourceIngestModule(self, ingestOptions):
+        # TODO: Change the class name to the name you'll make below
         return SampleJythonDataSourceIngestModule()
 
-    # Return true if module wants to get called for each file
-    def isFileIngestModuleFactory(self):
-        return True
-
-    # can return null if isFileIngestModuleFactory returns false
-    def createFileIngestModule(self, ingestOptions):
-        return SampleJythonFileIngestModule()
-
 
 # Data Source-level ingest module.  One gets created per data source.
-# Queries for various files.
+# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
-# If you don't need a data source-level module, delete this class.
 class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
 
     def __init__(self):
         self.context = None
 
+    # Where any setup and configuration is done
+    # TODO: Add any setup code that you need here.
     def startUp(self, context):
         self.context = context
-
+        # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
+		# raise IngestModuleException(IngestModule(), "Oh No!")
+        
+    # Where the analysis is done.
+    # TODO: Add your analysis code in here.
     def process(self, dataSource, progressBar):
         if self.context.isJobCancelled():
             return IngestModule.ProcessResult.OK
+			
+        logger = Logger.getLogger(SampleJythonDataSourceIngestModuleFactory.moduleName)	
 
-        # Configure progress bar for 2 tasks
+        # we don't know how much work there is yet
-        progressBar.switchToDeterminate(2)
+        progressBar.switchToIndeterminate()
 
         autopsyCase = Case.getCurrentCase()
         sleuthkitCase = autopsyCase.getSleuthkitCase()
         services = Services(sleuthkitCase)
         fileManager = services.getFileManager()
 
-        # Get count of files with "test" in name.
+        # For our example, we will use FileManager to get all 
-        fileCount = 0;
+        # files with the word "test"
+        # in the name and then count and read them
         files = fileManager.findFiles(dataSource, "%test%")
+
+        numFiles = len(files)
+        logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "found " + str(numFiles) + " files")
+        progressBar.switchToDeterminate(numFiles)
+        fileCount = 0;
         for file in files:
+
+            # Check if the user pressed cancel while we were busy
+            if self.context.isJobCancelled():
+                return IngestModule.ProcessResult.OK
+
+            logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "Processing file: " + file.getName())
             fileCount += 1
-        progressBar.progress(1)
 
-        if self.context.isJobCancelled():
+            # Make an artifact on the blackboard.  TSK_INTERESTING_FILE_HIT is a generic type of
-            return IngestModule.ProcessResult.OK
+            # artfiact.  Refer to the developer docs for other examples.
+            art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
+            att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonDataSourceIngestModuleFactory.moduleName, "Test file")
+            art.addAttribute(att)
 
-        # Get files by creation time.
+            
-        currentTime = System.currentTimeMillis() / 1000
+            # To further the example, this code will read the contents of the file and count the number of bytes
-        minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
+            inputStream = ReadContentInputStream(file)
-        otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
+            buffer = jarray.zeros(1024, "b")
-        for otherFile in otherFiles:
+            totLen = 0
-            fileCount += 1
+            readLen = inputStream.read(buffer)
-        progressBar.progress(1);
+            while (readLen != -1):
+                totLen = totLen + readLen
+                readLen = inputStream.read(buffer)
+
+
+            # Update the progress bar
+            progressBar.progress(fileCount)
 
-        if self.context.isJobCancelled():
-            return IngestModule.ProcessResult.OK;
 
         #Post a message to the ingest messages in box.
         message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
@@ -123,38 +153,3 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
         IngestServices.getInstance().postMessage(message)
 
         return IngestModule.ProcessResult.OK;
-
-
-# File-level ingest module.  One gets created per thread.
-# Looks at the attributes of the passed in file.
-# if you don't need a file-level module, delete this class.
-class SampleJythonFileIngestModule(FileIngestModule):
-
-    def startUp(self, context):
-        pass
-
-    def process(self, file):
-        # If the file has a txt extension, post an artifact to the blackboard.
-        if file.getName().find("test") != -1:
-            art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
-            att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), "Sample Jython File Ingest Module", "Text Files")
-            art.addAttribute(att)
-
-            # Read the contents of the file.
-            inputStream = ReadContentInputStream(file)
-            buffer = jarray.zeros(1024, "b")
-            totLen = 0
-            len = inputStream.read(buffer)
-            while (len != -1):
-                    totLen = totLen + len
-                    len = inputStream.read(buffer)
-
-            # Send the size of the file to the ingest messages in box.
-            msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
-            message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule", msgText)
-            ingestServices = IngestServices.getInstance().postMessage(message)
-
-        return IngestModule.ProcessResult.OK
-
-    def shutDown(self):
-        pass

pythonExamples/fileIngestModule.py

@@ -0,0 +1,129 @@
+# Sample module in the public domain. Feel free to use this as a template
+# for your modules (and you can remove this header and take complete credit
+# and liability)
+#
+# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+
+# Simple file-level ingest module for Autopsy.
+# Search for TODO for the things that you need to change
+# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
+
+import jarray
+from java.lang import System
+from java.util.logging import Level
+from org.sleuthkit.datamodel import SleuthkitCase
+from org.sleuthkit.datamodel import AbstractFile
+from org.sleuthkit.datamodel import ReadContentInputStream
+from org.sleuthkit.datamodel import BlackboardArtifact
+from org.sleuthkit.datamodel import BlackboardAttribute
+from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
+from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
+from org.sleuthkit.autopsy.ingest import FileIngestModule
+from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
+from org.sleuthkit.autopsy.ingest import IngestMessage
+from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.coreutils import Logger
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.casemodule.services import Services
+from org.sleuthkit.autopsy.casemodule.services import FileManager
+
+# Factory that defines the name and details of the module and allows Autopsy
+# to create instances of the modules that will do the anlaysis.
+# TODO: Rename this to something more specific.  Search and replace for it because it is used a few times
+class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter):
+
+    # TODO: give it a unique name.  Will be shown in module list, logs, etc.
+    moduleName = "Sample file ingest Module"
+	
+    def getModuleDisplayName(self):
+        return self.moduleName
+
+    # TODO: Give it a description
+    def getModuleDescription(self):
+        return "Sample module that does X, Y, and Z."
+
+    def getModuleVersionNumber(self):
+        return "1.0"
+
+    # Return true if module wants to get called for each file
+    def isFileIngestModuleFactory(self):
+        return True
+
+    # can return null if isFileIngestModuleFactory returns false
+    def createFileIngestModule(self, ingestOptions):
+        return SampleJythonFileIngestModule()
+
+
+# File-level ingest module.  One gets created per thread.
+# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
+# Looks at the attributes of the passed in file.
+class SampleJythonFileIngestModule(FileIngestModule):
+
+    # Where any setup and configuration is done
+    # TODO: Add any setup code that you need here.
+    def startUp(self, context):
+        self.logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName)
+        self.filesFound = 0		
+
+        # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
+        # raise IngestModuleException(IngestModule(), "Oh No!")
+        pass
+
+    # Where the analysis is done.  Each file will be passed into here.
+    # TODO: Add your analysis code in here.
+    def process(self, file):
+        
+        # For an example, we will flag files with .txt in the name and make a blackboard artifact.
+        if file.getName().find(".txt") != -1:
+            
+            self.logger.logp(Level.INFO, SampleJythonFileIngestModule.__name__, "process", "Found a text file: " + file.getName())
+            self.filesFound+=1
+			
+            # Make an artifact on the blackboard.  TSK_INTERESTING_FILE_HIT is a generic type of
+            # artfiact.  Refer to the developer docs for other examples.
+            art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
+            att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonFileIngestModuleFactory.moduleName, "Text Files")
+            art.addAttribute(att)
+
+
+            # To further the example, this code will read the contents of the file and count the number of bytes
+            inputStream = ReadContentInputStream(file)
+            buffer = jarray.zeros(1024, "b")
+            totLen = 0
+            len = inputStream.read(buffer)
+            while (len != -1):
+                    totLen = totLen + len
+                    len = inputStream.read(buffer)
+            
+        return IngestModule.ProcessResult.OK
+
+    # Where any shutdown code is run and resources are freed.
+    # TODO: Add any shutdown code that you need here.
+    def shutDown(self):
+        # As a final part of this example, we'll send a message to the ingest inbox with the number of files found (in this thread)
+        message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName, str(self.filesFound) + " files found")
+        ingestServices = IngestServices.getInstance().postMessage(message)

pythonExamples/fileIngestModuleWithGui.py

@@ -0,0 +1,204 @@
+# Sample module in the public domain. Feel free to use this as a template
+# for your modules (and you can remove this header and take complete credit
+# and liability)
+#
+# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+
+
+# Ingest module for Autopsy with GUI
+#
+# Difference between other modules in this folder is that it has a GUI
+# for user options.  This is not needed for very basic modules. If you
+# don't need a configuration UI, start with the other sample module.
+#
+# Search for TODO for the things that you need to change
+# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
+
+
+import jarray
+from java.lang import System
+from java.util.logging import Level
+from javax.swing import JCheckBox
+from javax.swing import BoxLayout
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.casemodule.services import Services
+from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
+from org.sleuthkit.autopsy.ingest import FileIngestModule
+from org.sleuthkit.autopsy.ingest import IngestMessage
+from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
+from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
+from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
+from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
+from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
+from org.sleuthkit.datamodel import BlackboardArtifact
+from org.sleuthkit.datamodel import BlackboardAttribute
+from org.sleuthkit.datamodel import ReadContentInputStream
+from org.sleuthkit.autopsy.coreutils import Logger
+from java.lang import IllegalArgumentException
+
+# TODO: Rename this to something more specific
+class SampleFileIngestModuleWithUIFactory(IngestModuleFactoryAdapter):
+    def __init__(self):
+        self.settings = None
+
+    # TODO: give it a unique name.  Will be shown in module list, logs, etc.
+    moduleName = "Sample Data Source Module with UI"
+    
+    def getModuleDisplayName(self):
+        return self.moduleName
+    
+    # TODO: Give it a description
+    def getModuleDescription(self):
+        return "Sample module that does X, Y, and Z."
+
+    def getModuleVersionNumber(self):
+        return "1.0"
+
+    # TODO: Update class name to one that you create below
+    def getDefaultIngestJobSettings(self):
+        return SampleFileIngestModuleWithUISettings()
+
+    # TODO: Keep enabled only if you need ingest job-specific settings UI
+    def hasIngestJobSettingsPanel(self):
+        return True
+
+    # TODO: Update class names to ones that you create below
+    def getIngestJobSettingsPanel(self, settings):
+        if not isinstance(settings, SampleFileIngestModuleWithUISettings):
+            raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
+        self.settings = settings
+        return SampleFileIngestModuleWithUISettingsPanel(self.settings)
+
+
+    def isFileIngestModuleFactory(self):
+        return True
+
+
+    # TODO: Update class name to one that you create below
+    def createFileIngestModule(self, ingestOptions):
+        return SampleFileIngestModuleWithUI(self.settings)
+
+
+# File-level ingest module.  One gets created per thread.
+# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
+# Looks at the attributes of the passed in file.
+class SampleFileIngestModuleWithUI(FileIngestModule):
+
+    # Autopsy will pass in the settings from the UI panel
+    def __init__(self, settings):
+        self.local_settings = settings
+
+
+    # Where any setup and configuration is done
+    # TODO: Add any setup code that you need here.
+    def startUp(self, context):
+        self.logger = Logger.getLogger(SampleFileIngestModuleWithUIFactory.moduleName)
+
+        # As an example, determine if user configured a flag in UI
+        if self.local_settings.getFlag():
+            self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is set")
+        else:
+            self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is not set")
+        
+        # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
+        # raise IngestModuleException(IngestModule(), "Oh No!")
+        pass
+
+    # Where the analysis is done.  Each file will be passed into here.
+    # TODO: Add your analysis code in here.
+    def process(self, file):
+        # See code in pythonExamples/fileIngestModule.py for example code
+        return IngestModule.ProcessResult.OK
+
+    # Where any shutdown code is run and resources are freed.
+    # TODO: Add any shutdown code that you need here.
+    def shutDown(self):
+        pass
+
+# Stores the settings that can be changed for each ingest job
+# All fields in here must be serializable.  It will be written to disk.
+# TODO: Rename this class
+class SampleFileIngestModuleWithUISettings(IngestModuleIngestJobSettings):
+    serialVersionUID = 1L
+
+    def __init__(self):
+        self.flag = False
+
+    def getVersionNumber(self):
+        return serialVersionUID
+
+    # TODO: Define getters and settings for data you want to store from UI
+    def getFlag(self):
+        return self.flag
+
+    def setFlag(self, flag):
+        self.flag = flag
+
+
+# UI that is shown to user for each ingest job so they can configure the job.
+# TODO: Rename this
+class SampleFileIngestModuleWithUISettingsPanel(IngestModuleIngestJobSettingsPanel):
+    # Note, we can't use a self.settings instance variable.
+    # Rather, self.local_settings is used.
+    # https://wiki.python.org/jython/UserGuide#javabean-properties
+    # Jython Introspector generates a property - 'settings' on the basis
+    # of getSettings() defined in this class. Since only getter function
+    # is present, it creates a read-only 'settings' property. This auto-
+    # generated read-only property overshadows the instance-variable -
+    # 'settings'
+    
+    # We get passed in a previous version of the settings so that we can
+    # prepopulate the UI
+    # TODO: Update this for your UI
+    def __init__(self, settings):
+        self.local_settings = settings
+        self.initComponents()
+        self.customizeComponents()
+    
+    # TODO: Update this for your UI
+    def checkBoxEvent(self, event):
+        if self.checkbox.isSelected():
+            self.local_settings.setFlag(True)
+        else:
+            self.local_settings.setFlag(False)
+
+    # TODO: Update this for your UI
+    def initComponents(self):
+        self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
+        self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
+        self.add(self.checkbox)
+
+    # TODO: Update this for your UI
+    def customizeComponents(self):
+        self.checkbox.setSelected(self.local_settings.getFlag())
+
+    # Return the settings used
+    def getSettings(self):
+        return self.local_settings
+
+

pythonExamples/ingestmodule.py

@@ -1,266 +0,0 @@
-# Sample module in the public domain. Feel free to use this as a template
-# for your modules (and you can remove this header and take complete credit
-# and liability)
-#
-# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
-#
-# This is free and unencumbered software released into the public domain.
-#
-# Anyone is free to copy, modify, publish, use, compile, sell, or
-# distribute this software, either in source code form or as a compiled
-# binary, for any purpose, commercial or non-commercial, and by any
-# means.
-#
-# In jurisdictions that recognize copyright laws, the author or authors
-# of this software dedicate any and all copyright interest in the
-# software to the public domain. We make this dedication for the benefit
-# of the public at large and to the detriment of our heirs and
-# successors. We intend this dedication to be an overt act of
-# relinquishment in perpetuity of all present and future rights to this
-# software under copyright law.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
-# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-# OTHER DEALINGS IN THE SOFTWARE.
-
-import jarray
-from java.lang import System
-from javax.swing import JCheckBox
-from javax.swing import BoxLayout
-from org.sleuthkit.autopsy.casemodule import Case
-from org.sleuthkit.autopsy.casemodule.services import Services
-from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
-from org.sleuthkit.autopsy.ingest import FileIngestModule
-from org.sleuthkit.autopsy.ingest import IngestMessage
-from org.sleuthkit.autopsy.ingest import IngestModule
-from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
-from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
-from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
-from org.sleuthkit.autopsy.ingest import IngestServices
-from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
-from org.sleuthkit.datamodel import BlackboardArtifact
-from org.sleuthkit.datamodel import BlackboardAttribute
-from org.sleuthkit.datamodel import ReadContentInputStream
-from org.sleuthkit.autopsy.coreutils import Logger
-from java.lang import IllegalArgumentException
-
-# Sample factory that defines basic functionality and features of the module
-# It implements IngestModuleFactoryAdapter which is a no-op implementation of
-# IngestModuleFactory.
-class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
-    def __init__(self):
-        self.settings = None
-
-    def getModuleDisplayName(self):
-        return "Sample Jython(GUI) ingest module"
-
-    def getModuleDescription(self):
-        return "Sample Jython Ingest Module with GUI example code"
-
-    def getModuleVersionNumber(self):
-        return "1.0"
-
-    def getDefaultIngestJobSettings(self):
-        return SampleIngestModuleSettings()
-
-    def hasIngestJobSettingsPanel(self):
-        return True
-
-    def getIngestJobSettingsPanel(self, settings):
-        if not isinstance(settings, SampleIngestModuleSettings):
-            raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
-        self.settings = settings
-        return SampleIngestModuleSettingsPanel(self.settings)
-
-    # Return true if module wants to get passed in a data source
-    def isDataSourceIngestModuleFactory(self):
-        return True
-
-    # can return null if isDataSourceIngestModuleFactory returns false
-    def createDataSourceIngestModule(self, ingestOptions):
-        return SampleJythonDataSourceIngestModule(self.settings)
-
-    # Return true if module wants to get called for each file
-
-    def isFileIngestModuleFactory(self):
-        return True
-
-    # can return null if isFileIngestModuleFactory returns false
-    def createFileIngestModule(self, ingestOptions):
-        return SampleJythonFileIngestModule(self.settings)
-
-    def hasGlobalSettingsPanel(self):
-        return True
-
-    def getGlobalSettingsPanel(self):
-        globalSettingsPanel = SampleIngestModuleGlobalSettingsPanel();
-        return globalSettingsPanel
-
-
-class SampleIngestModuleGlobalSettingsPanel(IngestModuleGlobalSettingsPanel):
-    def __init__(self):
-        self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
-        checkbox = JCheckBox("Flag inside the Global Settings Panel")
-        self.add(checkbox)
-
-
-class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
-    '''
-        Data Source-level ingest module.  One gets created per data source. 
-        Queries for various files. If you don't need a data source-level module,
-        delete this class.
-    '''
-
-    def __init__(self, settings):
-        self.local_settings = settings
-        self.context = None
-
-    def startUp(self, context):
-        # Used to verify if the GUI checkbox event been recorded or not.
-        logger = Logger.getLogger("SampleJythonFileIngestModule")
-        if self.local_settings.getFlag():
-            logger.info("flag is set")
-        else:
-            logger.info("flag is not set")
-
-        self.context = context
-
-    def process(self, dataSource, progressBar):
-        if self.context.isJobCancelled():
-            return IngestModule.ProcessResult.OK
-
-        # Configure progress bar for 2 tasks
-        progressBar.switchToDeterminate(2)
-
-        autopsyCase = Case.getCurrentCase()
-        sleuthkitCase = autopsyCase.getSleuthkitCase()
-        services = Services(sleuthkitCase)
-        fileManager = services.getFileManager()
-
-        # Get count of files with "test" in name.
-        fileCount = 0;
-        files = fileManager.findFiles(dataSource, "%test%")
-        for file in files:
-            fileCount += 1
-        progressBar.progress(1)
-
-        if self.context.isJobCancelled():
-            return IngestModule.ProcessResult.OK
-
-        # Get files by creation time.
-        currentTime = System.currentTimeMillis() / 1000
-        minTime = currentTime - (14 * 24 * 60 * 60)  # Go back two weeks.
-        otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
-        for otherFile in otherFiles:
-            fileCount += 1
-        progressBar.progress(1);
-
-        if self.context.isJobCancelled():
-            return IngestModule.ProcessResult.OK;
-
-        # Post a message to the ingest messages in box.
-        message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
-                                              "Sample Jython Data Source Ingest Module", "Found %d files" % fileCount)
-        IngestServices.getInstance().postMessage(message)
-
-        return IngestModule.ProcessResult.OK;
-
-
-class SampleJythonFileIngestModule(FileIngestModule):
-    '''
-        File-level ingest module.  One gets created per thread. Looks at the 
-        attributes of the passed in file. if you don't need a file-level module,
-        delete this class.
-    '''
-
-    def __init__(self, settings):
-        self.local_settings = settings
-
-    def startUp(self, context):
-        # Used to verify if the GUI checkbox event been recorded or not.
-        logger = Logger.getLogger("SampleJythonFileIngestModule")
-        if self.local_settings.getFlag():
-            logger.info("flag is set")
-        else:
-            logger.info("flag is not set")
-        pass
-
-    def process(self, file):
-        # If the file has a txt extension, post an artifact to the blackboard.
-        if file.getName().find("test") != -1:
-            art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
-            att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(),
-                                      "Sample Jython File Ingest Module", "Text Files")
-            art.addAttribute(att)
-
-            # Read the contents of the file.
-            inputStream = ReadContentInputStream(file)
-            buffer = jarray.zeros(1024, "b")
-            totLen = 0
-            len = inputStream.read(buffer)
-            while (len != -1):
-                totLen = totLen + len
-                len = inputStream.read(buffer)
-
-            # Send the size of the file to the ingest messages in box. 
-            msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
-            message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule",
-                                                  msgText)
-            ingestServices = IngestServices.getInstance().postMessage(message)
-
-        return IngestModule.ProcessResult.OK
-
-    def shutDown(self):
-        pass
-
-
-class SampleIngestModuleSettings(IngestModuleIngestJobSettings):
-    serialVersionUID = 1L
-
-    def __init__(self):
-        self.flag = False
-
-    def getVersionNumber(self):
-        return serialVersionUID
-
-    def getFlag(self):
-        return self.flag
-
-    def setFlag(self, flag):
-        self.flag = flag
-
-
-class SampleIngestModuleSettingsPanel(IngestModuleIngestJobSettingsPanel):
-    # self.settings instance variable not used. Rather, self.local_settings is used.
-    # https://wiki.python.org/jython/UserGuide#javabean-properties
-    # Jython Introspector generates a property - 'settings' on the basis
-    # of getSettings() defined in this class. Since only getter function
-    # is present, it creates a read-only 'settings' property. This auto-
-    # generated read-only property overshadows the instance-variable -
-    # 'settings'
-
-    def checkBoxEvent(self, event):
-        if self.checkbox.isSelected():
-            self.local_settings.setFlag(True)
-        else:
-            self.local_settings.setFlag(False)
-
-    def initComponents(self):
-        self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
-        self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
-        self.add(self.checkbox)
-
-    def customizeComponents(self):
-        self.checkbox.setSelected(self.local_settings.getFlag())
-
-    def __init__(self, settings):
-        self.local_settings = settings
-        self.initComponents()
-        self.customizeComponents()
-
-    def getSettings(self):
-        return self.local_settings

pythonExamples/reportmodule.py

@@ -27,25 +27,36 @@
 # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 # OTHER DEALINGS IN THE SOFTWARE.
 
+
+# Report module for Autopsy.
+#
+# Search for TODO for the things that you need to change
+# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
+
 from java.lang import System
 from org.sleuthkit.autopsy.casemodule import Case
 from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
 
-# Sample module that writes a file with the number of files
+# TODO: Rename this to something more specific
-# created in the last 2 weeks.
 class SampleGeneralReportModule(GeneralReportModuleAdapter):
 
+    # TODO: Rename this.  Will be shown to users when making a report
     def getName(self):
         return "Sample Jython Report Module"
 
+    # TODO: rewrite this
     def getDescription(self):
         return "A sample Jython report module"
 
+    # TODO: Update this to reflect where the report file will be written to
     def getRelativeFilePath(self):
         return "sampleReport.txt"
 
-    def generateReport(self, reportPath, progressBar):
+    # TODO: Update this method to make a report
-            # Configure progress bar for 2 tasks 
+    def generateReport(self, baseReportDir, progressBar):
+        
+            # For an example, we write a file with the number of files created in the past 2 weeks
+            # Configure progress bar for 2 tasks
             progressBar.setIndeterminate(False)
             progressBar.start()
             progressBar.setMaximumProgress(2)
@@ -62,9 +73,10 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
             progressBar.increment()
             
             # Write the result to the report file.
-            report = open(reportPath + '\\' + self.getRelativeFilePath(), 'w')
+            report = open(baseReportDir + '\\' + self.getRelativeFilePath(), 'w')
             report.write("file count = %d" % fileCount)
             Case.getCurrentCase().addReport(report.name, "SampleGeneralReportModule", "Sample Python Report");
             report.close()
+            
             progressBar.increment()
             progressBar.complete()