mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-19 11:07:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'collaborative' of https://github.com/sleuthkit/autopsy into interim

Browse Source
This commit is contained in:
Karl Mortensen 2015-06-01 09:53:29 -04:00
commit be5eff103e
87 changed files with 1735 additions and 1067 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Core/src/org/sleuthkit/autopsy/casemodule/AddImageWizardChooseDataSourceVisual.java
View File

@ -84,7 +84,13 @@ final class AddImageWizardChooseDataSourceVisual extends JPanel {
// make a list of core DSPs
// ensure that the core DSPs are at the top and in a fixed order
coreDSPTypes.add(ImageDSProcessor.getType());
// Local disk processing is not allowed for multi-user cases
if (Case.getCurrentCase().getCaseType() != Case.CaseType.MULTI_USER_CASE){
coreDSPTypes.add(LocalDiskDSProcessor.getType());
} else {
// remove LocalDiskDSProcessor from list of DSPs
datasourceProcessorsMap.remove(LocalDiskDSProcessor.getType());
}
coreDSPTypes.add(LocalFilesDSProcessor.getType());
for (String dspType : coreDSPTypes) {

5
Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties
View File

@ -234,3 +234,8 @@ AddImageWizardIngestConfigPanel.CANCEL_BUTTON.text=Cancel
NewCaseVisualPanel1.rbSingleUserCase.text=Single-user
NewCaseVisualPanel1.rbMultiUserCase.text=Multi-user
NewCaseVisualPanel1.lbBadMultiUserSettings.text=
ImageFilePanel.errorLabel.text=Error Label
DataSourceOnCDriveError.text=Path to multi-user data source is on \"C:\" drive
NewCaseVisualPanel1.CaseFolderOnCDriveError.text=Path to multi-user case folder is on \"C:\" drive
LocalFilesPanel.errorLabel.text=Error Label
NewCaseVisualPanel1.errorLabel.text=Error Label

3
Core/src/org/sleuthkit/autopsy/casemodule/Bundle_ja.properties
View File

@ -215,3 +215,6 @@ XMLCaseManagement.open.msgDlg.notAutCase.title=\u30a8\u30e9\u30fc
ImageFilePanel.noFatOrphansCheckbox.text=FAT\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306e\u30aa\u30fc\u30d5\u30a1\u30f3\u30d5\u30a1\u30a4\u30eb\u306f\u7121\u8996
LocalDiskPanel.noFatOrphansCheckbox.text=FAT\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306e\u30aa\u30fc\u30d5\u30a1\u30f3\u30d5\u30a1\u30a4\u30eb\u306f\u7121\u8996
AddImageWizardIngestConfigPanel.CANCEL_BUTTON.text=\u30ad\u30e3\u30f3\u30bb\u30eb
ImageFilePanel.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb
LocalFilesPanel.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb
NewCaseVisualPanel1.errorLabel.text=\u30a8\u30e9\u30fc\u30e9\u30d9\u30eb

72
Core/src/org/sleuthkit/autopsy/casemodule/CaseMetadata.java Normal file
View File

@ -0,0 +1,72 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.casemodule;
import java.nio.file.Path;
/**
* Provides access to case metadata.
*/
public final class CaseMetadata {
/**
* Exception thrown by the CaseMetadata class when there is a problem
* accessing the metadata for a case.
*/
public final static class CaseMetadataException extends Exception {
private CaseMetadataException(String message) {
super(message);
}
private CaseMetadataException(String message, Throwable cause) {
super(message, cause);
}
}
private final Case.CaseType caseType;
/**
* Constructs an object that provides access to case metadata.
*
* @param metadataFilePath
*/
public CaseMetadata(Path metadataFilePath) throws CaseMetadataException {
try {
// NOTE: This class will eventually replace XMLCaseManagement.
// This constructor should parse all of the metadata. In the future,
// case metadata may be moved into the case database.
XMLCaseManagement metadata = new XMLCaseManagement();
metadata.open(metadataFilePath.toString());
this.caseType = metadata.getCaseType();
} catch (CaseActionException ex) {
throw new CaseMetadataException(ex.getLocalizedMessage(), ex);
}
}
/**
* Gets the case type.
*
* @return The case type.
*/
public Case.CaseType getCaseType(Path thePath) {
return this.caseType;
}
}

19
Core/src/org/sleuthkit/autopsy/casemodule/CaseNewAction.java
View File

@ -20,6 +20,9 @@
package org.sleuthkit.autopsy.casemodule;
import java.awt.event.ActionEvent;
import org.openide.util.HelpCtx;
import org.openide.util.NbBundle;
import org.openide.util.actions.CallableSystemAction;
import org.openide.util.actions.SystemAction;
import org.openide.util.lookup.ServiceProvider;
@ -29,7 +32,7 @@ import org.openide.util.lookup.ServiceProvider;
* @author jantonius
*/
@ServiceProvider(service = CaseNewActionInterface.class)
public final class CaseNewAction implements CaseNewActionInterface {
public final class CaseNewAction extends CallableSystemAction implements CaseNewActionInterface {
private NewCaseWizardAction wizard = SystemAction.get(NewCaseWizardAction.class);
@ -41,4 +44,18 @@ public final class CaseNewAction implements CaseNewActionInterface {
public void actionPerformed(ActionEvent e) {
wizard.performAction();
}
@Override
public void performAction() {
}
@Override
public String getName() {
return NbBundle.getMessage(CaseNewAction.class, "CTL_CaseNewAction");
}
@Override
public HelpCtx getHelpCtx() {
return HelpCtx.DEFAULT_HELP;
}
}

17
Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.form
View File

@ -43,6 +43,7 @@
<EmptySpace min="21" pref="21" max="-2" attributes="0"/>
<Component id="descLabel" min="-2" max="-2" attributes="0"/>
</Group>
<Component id="errorLabel" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="0" pref="20" max="32767" attributes="0"/>
</Group>
@ -57,7 +58,9 @@
<Component id="browseButton" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="pathTextField" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace type="separate" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="3" max="-2" attributes="0"/>
<Component id="errorLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="1" max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="timeZoneLabel" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="timeZoneComboBox" alignment="3" min="-2" max="-2" attributes="0"/>
@ -66,7 +69,7 @@
<Component id="noFatOrphansCheckbox" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="descLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace pref="13" max="32767" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
@ -131,5 +134,15 @@
</Property>
</Properties>
</Component>
<Component class="javax.swing.JLabel" name="errorLabel">
<Properties>
<Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
<Color blue="0" green="0" red="ff" type="rgb"/>
</Property>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="ImageFilePanel.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
</SubComponents>
</Form>

32
Core/src/org/sleuthkit/autopsy/casemodule/ImageFilePanel.java
View File

@ -37,6 +37,7 @@ import org.sleuthkit.autopsy.coreutils.ModuleSettings;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import java.util.logging.Level;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.PathValidator;
/**
* ImageTypePanel for adding an image file such as .img, .E0x, .00x, etc.
@ -62,6 +63,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
fc.setFileSelectionMode(JFileChooser.FILES_ONLY);
fc.setMultiSelectionEnabled(false);
errorLabel.setVisible(false);
boolean firstFilter = true;
for (FileFilter filter: fileChooserFilters ) {
if (firstFilter) { // set the first on the list as the default selection
@ -98,7 +101,6 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
}
/**
* This method is called from within the constructor to initialize the form.
* WARNING: Do NOT modify this code. The content of this method is always
@ -115,6 +117,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
timeZoneComboBox = new javax.swing.JComboBox<String>();
noFatOrphansCheckbox = new javax.swing.JCheckBox();
descLabel = new javax.swing.JLabel();
errorLabel = new javax.swing.JLabel();
setMinimumSize(new java.awt.Dimension(0, 65));
setPreferredSize(new java.awt.Dimension(403, 65));
@ -139,6 +142,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
org.openide.awt.Mnemonics.setLocalizedText(descLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.descLabel.text")); // NOI18N
errorLabel.setForeground(new java.awt.Color(255, 0, 0));
org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(ImageFilePanel.class, "ImageFilePanel.errorLabel.text")); // NOI18N
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
this.setLayout(layout);
layout.setHorizontalGroup(
@ -158,7 +164,8 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
.addComponent(noFatOrphansCheckbox)
.addGroup(layout.createSequentialGroup()
.addGap(21, 21, 21)
.addComponent(descLabel)))
.addComponent(descLabel))
.addComponent(errorLabel))
.addGap(0, 20, Short.MAX_VALUE))
);
layout.setVerticalGroup(
@ -169,7 +176,9 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(browseButton)
.addComponent(pathTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGap(18, 18, 18)
.addGap(3, 3, 3)
.addComponent(errorLabel)
.addGap(1, 1, 1)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(timeZoneLabel)
.addComponent(timeZoneComboBox, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
@ -177,7 +186,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
.addComponent(noFatOrphansCheckbox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(descLabel)
.addContainerGap(13, Short.MAX_VALUE))
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
);
}// </editor-fold>//GEN-END:initComponents
@ -211,6 +220,7 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JButton browseButton;
private javax.swing.JLabel descLabel;
private javax.swing.JLabel errorLabel;
private javax.swing.JCheckBox noFatOrphansCheckbox;
private javax.swing.JLabel pathLabel;
private javax.swing.JTextField pathTextField;
@ -255,11 +265,15 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
* @return true if a proper image has been selected, false otherwise
*/
public boolean validatePanel() {
errorLabel.setVisible(false);
String path = getContentPaths();
if (path == null || path.isEmpty()) {
return false;
}
// display warning if there is one (but don't disable "next" button)
warnIfPathIsInvalid(path);
boolean isExist = Case.pathExists(path);
boolean isPhysicalDrive = Case.isPhysicalDrive(path);
boolean isPartition = Case.isPartition(path);
@ -267,6 +281,16 @@ public class ImageFilePanel extends JPanel implements DocumentListener {
return (isExist || isPhysicalDrive || isPartition);
}
/**
* Validates path to selected data source and displays warning if it is invalid.
* @param path Absolute path to the selected data source
*/
private void warnIfPathIsInvalid(String path){
if (!PathValidator.isValid(path, Case.getCurrentCase().getCaseType())) {
errorLabel.setVisible(true);
errorLabel.setText(NbBundle.getMessage(this.getClass(), "DataSourceOnCDriveError.text"));
}
}
public void storeSettings() {
String imagePathName = getContentPaths();

2
Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.form
View File

@ -61,7 +61,7 @@
<Component id="noFatOrphansCheckbox" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="descLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace pref="21" max="32767" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>

4
Core/src/org/sleuthkit/autopsy/casemodule/LocalDiskPanel.java
View File

@ -93,9 +93,9 @@ final class LocalDiskPanel extends JPanel {
diskComboBox.setModel(model);
diskComboBox.setRenderer(model);
errorLabel.setVisible(false);
errorLabel.setText("");
diskComboBox.setEnabled(false);
}
/**
@ -167,7 +167,7 @@ final class LocalDiskPanel extends JPanel {
.addComponent(noFatOrphansCheckbox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(descLabel)
.addContainerGap(21, Short.MAX_VALUE))
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
);
}// </editor-fold>//GEN-END:initComponents
// Variables declaration - do not modify//GEN-BEGIN:variables

23
Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.form
View File

@ -60,6 +60,10 @@
</Group>
<EmptySpace min="-2" pref="2" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Component id="errorLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
@ -67,15 +71,16 @@
<Group type="102" alignment="0" attributes="0">
<Component id="infoLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="5" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="103" groupAlignment="0" max="-2" attributes="0">
<Component id="jScrollPane2" min="-2" pref="82" max="-2" attributes="0"/>
<Group type="102" attributes="0">
<Component id="selectButton" min="-2" max="-2" attributes="0"/>
<EmptySpace pref="17" max="32767" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
<Component id="clearButton" min="-2" max="-2" attributes="0"/>
</Group>
<Component id="jScrollPane2" pref="0" max="32767" attributes="0"/>
</Group>
<EmptySpace min="0" pref="0" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="errorLabel" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
@ -136,5 +141,15 @@
</Component>
</SubComponents>
</Container>
<Component class="javax.swing.JLabel" name="errorLabel">
<Properties>
<Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
<Color blue="0" green="0" red="ff" type="rgb"/>
</Property>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
</SubComponents>
</Form>

51
Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.java
View File

@ -21,6 +21,8 @@ package org.sleuthkit.autopsy.casemodule;
import java.beans.PropertyChangeListener;
import java.beans.PropertyChangeSupport;
import java.io.File;
import java.util.Arrays;
import java.util.List;
import java.util.Set;
import java.util.TreeSet;
import javax.swing.JFileChooser;
@ -30,7 +32,9 @@ import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import java.util.logging.Level;
import org.sleuthkit.autopsy.casemodule.Case.CaseType;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.PathValidator;
/**
* Add input wizard subpanel for adding local files / dirs to the case
*/
@ -42,6 +46,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
private static LocalFilesPanel instance;
public static final String FILES_SEP = ",";
private static final Logger logger = Logger.getLogger(LocalFilesPanel.class.getName());
/**
* Creates new form LocalFilesPanel
*/
@ -59,8 +64,8 @@ import org.sleuthkit.autopsy.coreutils.Logger;
private void customInit() {
localFileChooser.setMultiSelectionEnabled(true);
errorLabel.setVisible(false);
selectedPaths.setText("");
}
//@Override
@ -91,9 +96,33 @@ import org.sleuthkit.autopsy.coreutils.Logger;
//@Override
public boolean validatePanel() {
// display warning if there is one (but don't disable "next" button)
warnIfPathIsInvalid(getContentPaths());
return enableNext;
}
/**
* Validates path to selected data source and displays warning if it is invalid.
* @param path Absolute path to the selected data source
*/
private void warnIfPathIsInvalid(String path) {
errorLabel.setVisible(false);
// Path variable for "Local files" module is a coma separated string containg multiple paths
List<String> pathsList = Arrays.asList(path.split(","));
CaseType currentCaseType = Case.getCurrentCase().getCaseType();
for (String currentPath : pathsList) {
if (!PathValidator.isValid(currentPath, currentCaseType)) {
errorLabel.setVisible(true);
errorLabel.setText(NbBundle.getMessage(this.getClass(), "DataSourceOnCDriveError.text"));
return;
}
}
}
//@Override
public void select() {
reset();
@ -104,6 +133,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
currentFiles.clear();
selectedPaths.setText("");
enableNext = false;
errorLabel.setVisible(false);
//pcs.firePropertyChange(AddImageWizardChooseDataSourceVisual.EVENT.UPDATE_UI.toString(), false, true);
}
@ -149,6 +179,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
clearButton = new javax.swing.JButton();
jScrollPane2 = new javax.swing.JScrollPane();
selectedPaths = new javax.swing.JTextArea();
errorLabel = new javax.swing.JLabel();
localFileChooser.setApproveButtonText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonText")); // NOI18N
localFileChooser.setApproveButtonToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonToolTipText")); // NOI18N
@ -184,6 +215,9 @@ import org.sleuthkit.autopsy.coreutils.Logger;
selectedPaths.setToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.selectedPaths.toolTipText")); // NOI18N
jScrollPane2.setViewportView(selectedPaths);
errorLabel.setForeground(new java.awt.Color(255, 0, 0));
org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.errorLabel.text")); // NOI18N
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
this.setLayout(layout);
layout.setHorizontalGroup(
@ -198,19 +232,23 @@ import org.sleuthkit.autopsy.coreutils.Logger;
.addComponent(selectButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(clearButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addGap(2, 2, 2))
.addGroup(layout.createSequentialGroup()
.addComponent(errorLabel)
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addComponent(infoLabel)
.addGap(5, 5, 5)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
.addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 82, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGroup(layout.createSequentialGroup()
.addComponent(selectButton)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 17, Short.MAX_VALUE)
.addComponent(clearButton))
.addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE))
.addGap(0, 0, 0))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(clearButton)))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(errorLabel))
);
}// </editor-fold>//GEN-END:initComponents
@ -258,6 +296,7 @@ import org.sleuthkit.autopsy.coreutils.Logger;
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JButton clearButton;
private javax.swing.JLabel errorLabel;
private javax.swing.JLabel infoLabel;
private javax.swing.JScrollPane jScrollPane1;
private javax.swing.JScrollPane jScrollPane2;

64
Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.form
View File

@ -22,34 +22,50 @@
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jLabel2" alignment="0" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0">
<Group type="103" groupAlignment="1" max="-2" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="rbSingleUserCase" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="rbMultiUserCase" min="-2" max="-2" attributes="0"/>
<Group type="103" groupAlignment="1" attributes="0">
<Component id="caseDirTextField" alignment="0" max="32767" attributes="1"/>
<Group type="102" alignment="1" attributes="0">
<EmptySpace min="0" pref="58" max="32767" attributes="0"/>
<Component id="lbBadMultiUserSettings" min="-2" pref="372" max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Component id="jLabel1" min="-2" max="-2" attributes="0"/>
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
<Component id="jLabel1" alignment="0" min="-2" max="-2" attributes="0"/>
<Group type="102" alignment="0" attributes="0">
<Component id="caseDirLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="caseParentDirTextField" min="-2" pref="296" max="-2" attributes="0"/>
<Component id="caseParentDirTextField" max="32767" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<Group type="102" attributes="0">
<Component id="caseNameLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
<Component id="caseNameTextField" min="-2" pref="296" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="26" max="-2" attributes="0"/>
<Component id="caseNameTextField" max="32767" attributes="0"/>
</Group>
<Component id="caseDirTextField" alignment="0" max="32767" attributes="1"/>
<Component id="lbBadMultiUserSettings" alignment="1" min="-2" pref="372" max="-2" attributes="0"/>
</Group>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="caseDirBrowseButton" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
<EmptySpace max="32767" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
</Group>
<Group type="102" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<Component id="rbSingleUserCase" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="rbMultiUserCase" min="-2" max="-2" attributes="0"/>
</Group>
<Component id="errorLabel" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
</Group>
</Group>
</Group>
</DimensionLayout>
@ -73,12 +89,14 @@
<Component id="jLabel2" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="caseDirTextField" min="-2" max="-2" attributes="0"/>
<EmptySpace type="separate" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="rbSingleUserCase" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="rbMultiUserCase" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="errorLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="1" max="-2" attributes="0"/>
<Component id="lbBadMultiUserSettings" min="-2" pref="23" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
</Group>
@ -158,6 +176,9 @@
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="NewCaseVisualPanel1.rbSingleUserCase.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="rbSingleUserCaseActionPerformed"/>
</Events>
</Component>
<Component class="javax.swing.JRadioButton" name="rbMultiUserCase">
<Properties>
@ -168,6 +189,9 @@
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="NewCaseVisualPanel1.rbMultiUserCase.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="rbMultiUserCaseActionPerformed"/>
</Events>
</Component>
<Component class="javax.swing.JLabel" name="lbBadMultiUserSettings">
<Properties>
@ -182,5 +206,15 @@
</Property>
</Properties>
</Component>
<Component class="javax.swing.JLabel" name="errorLabel">
<Properties>
<Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
<Color blue="0" green="0" red="ff" type="rgb"/>
</Property>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="NewCaseVisualPanel1.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
</Component>
</SubComponents>
</Form>

84
Core/src/org/sleuthkit/autopsy/casemodule/NewCaseVisualPanel1.java
View File

@ -29,6 +29,7 @@ import javax.swing.event.DocumentEvent;
import javax.swing.event.DocumentListener;
import org.sleuthkit.autopsy.casemodule.Case.CaseType;
import org.sleuthkit.autopsy.core.UserPreferences;
import org.sleuthkit.autopsy.coreutils.PathValidator;
import org.sleuthkit.datamodel.CaseDbConnectionInfo;
import org.sleuthkit.datamodel.TskData.DbType;
@ -44,6 +45,7 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
NewCaseVisualPanel1(NewCaseWizardPanel1 wizPanel) {
initComponents();
errorLabel.setVisible(false);
lbBadMultiUserSettings.setText("");
this.wizPanel = wizPanel;
caseNameTextField.getDocument().addDocumentListener(this);
@ -145,6 +147,7 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
rbSingleUserCase = new javax.swing.JRadioButton();
rbMultiUserCase = new javax.swing.JRadioButton();
lbBadMultiUserSettings = new javax.swing.JLabel();
errorLabel = new javax.swing.JLabel();
jLabel1.setFont(new java.awt.Font("Tahoma", 1, 14)); // NOI18N
org.openide.awt.Mnemonics.setLocalizedText(jLabel1, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.jLabel1.text_1")); // NOI18N
@ -171,42 +174,65 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
caseTypeButtonGroup.add(rbSingleUserCase);
org.openide.awt.Mnemonics.setLocalizedText(rbSingleUserCase, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.rbSingleUserCase.text")); // NOI18N
rbSingleUserCase.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
rbSingleUserCaseActionPerformed(evt);
}
});
caseTypeButtonGroup.add(rbMultiUserCase);
org.openide.awt.Mnemonics.setLocalizedText(rbMultiUserCase, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.rbMultiUserCase.text")); // NOI18N
rbMultiUserCase.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
rbMultiUserCaseActionPerformed(evt);
}
});
lbBadMultiUserSettings.setFont(new java.awt.Font("Tahoma", 0, 12)); // NOI18N
lbBadMultiUserSettings.setForeground(new java.awt.Color(255, 0, 0));
org.openide.awt.Mnemonics.setLocalizedText(lbBadMultiUserSettings, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.lbBadMultiUserSettings.text")); // NOI18N
errorLabel.setForeground(new java.awt.Color(255, 0, 0));
org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(NewCaseVisualPanel1.class, "NewCaseVisualPanel1.errorLabel.text")); // NOI18N
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
this.setLayout(layout);
layout.setHorizontalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(jLabel2)
.addGroup(layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING, false)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.TRAILING)
.addComponent(caseDirTextField, javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addGap(0, 58, Short.MAX_VALUE)
.addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 372, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
.addComponent(rbSingleUserCase)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(rbMultiUserCase))
.addComponent(jLabel1, javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(jLabel1)
.addGap(0, 0, Short.MAX_VALUE))
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
.addComponent(caseDirLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(caseParentDirTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 296, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGroup(javax.swing.GroupLayout.Alignment.LEADING, layout.createSequentialGroup()
.addComponent(caseParentDirTextField))
.addGroup(layout.createSequentialGroup()
.addComponent(caseNameLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(caseNameTextField, javax.swing.GroupLayout.PREFERRED_SIZE, 296, javax.swing.GroupLayout.PREFERRED_SIZE))
.addComponent(caseDirTextField, javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 372, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGap(26, 26, 26)
.addComponent(caseNameTextField)))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(caseDirBrowseButton)))
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addContainerGap())
.addGroup(layout.createSequentialGroup()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addComponent(rbSingleUserCase)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(rbMultiUserCase))
.addComponent(errorLabel))
.addGap(0, 0, Short.MAX_VALUE))))
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@ -226,11 +252,13 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
.addComponent(jLabel2)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(caseDirTextField, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGap(18, 18, 18)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(rbSingleUserCase)
.addComponent(rbMultiUserCase))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(errorLabel)
.addGap(1, 1, 1)
.addComponent(lbBadMultiUserSettings, javax.swing.GroupLayout.PREFERRED_SIZE, 23, javax.swing.GroupLayout.PREFERRED_SIZE)
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
);
@ -261,6 +289,16 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
}
}//GEN-LAST:event_caseDirBrowseButtonActionPerformed
private void rbSingleUserCaseActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_rbSingleUserCaseActionPerformed
this.wizPanel.fireChangeEvent();
updateUI(null); // DocumentEvent is not used inside updateUI
}//GEN-LAST:event_rbSingleUserCaseActionPerformed
private void rbMultiUserCaseActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_rbMultiUserCaseActionPerformed
this.wizPanel.fireChangeEvent();
updateUI(null); // DocumentEvent is not used inside updateUI
}//GEN-LAST:event_rbMultiUserCaseActionPerformed
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JButton caseDirBrowseButton;
private javax.swing.JLabel caseDirLabel;
@ -269,6 +307,7 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
private javax.swing.JTextField caseNameTextField;
private javax.swing.JTextField caseParentDirTextField;
private javax.swing.ButtonGroup caseTypeButtonGroup;
private javax.swing.JLabel errorLabel;
private javax.swing.JLabel jLabel1;
private javax.swing.JLabel jLabel2;
private javax.swing.JLabel lbBadMultiUserSettings;
@ -321,6 +360,9 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
*/
public void updateUI(DocumentEvent e) {
// Note: DocumentEvent e can be null when called from rbSingleUserCaseActionPerformed()
// and rbMultiUserCaseActionPerformed().
String caseName = getCaseName();
String parentDir = getCaseParentDir();
@ -331,5 +373,21 @@ final class NewCaseVisualPanel1 extends JPanel implements DocumentListener {
caseDirTextField.setText("");
wizPanel.setIsFinish(false);
}
// display warning if there is one (but don't disable "next" button)
warnIfPathIsInvalid(parentDir);
}
/**
* Validates path to selected case output folder. Displays warning if path is invalid.
*
* @param path Absolute path to the selected case folder
*/
private void warnIfPathIsInvalid(String path) {
errorLabel.setVisible(false);
if (!PathValidator.isValid(path, getCaseType())) {
errorLabel.setVisible(true);
errorLabel.setText(NbBundle.getMessage(this.getClass(), "NewCaseVisualPanel1.CaseFolderOnCDriveError.text"));
}
}
}

1
Core/src/org/sleuthkit/autopsy/casemodule/NewCaseWizardPanel1.java
View File

@ -35,7 +35,6 @@ import org.openide.WizardDescriptor;
import org.openide.WizardValidationException;
import org.openide.util.HelpCtx;
import org.sleuthkit.autopsy.casemodule.Case.CaseType;
import org.sleuthkit.autopsy.core.UserPreferences;
import org.sleuthkit.autopsy.coreutils.ModuleSettings;
/**

1
Core/src/org/sleuthkit/autopsy/core/layer.xml
View File

@ -44,7 +44,6 @@
<file name="org-sleuthkit-autopsy-casemodule-CaseNewAction.instance">
<attr name="delegate" newvalue="org.sleuthkit.autopsy.casemodule.CaseNewAction"/>
<attr name="displayName" bundlevalue="org.sleuthkit.autopsy.casemodule.Bundle#CTL_CaseNewAction"/>
<attr name="instanceCreate" methodvalue="org.openide.awt.Actions.alwaysEnabled"/>
<attr name="noIconInMenu" boolvalue="false"/>
</file>
<file name="org-sleuthkit-autopsy-casemodule-CasePropertiesAction.instance"/>

51
Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessor.java
View File

@ -21,69 +21,70 @@ package org.sleuthkit.autopsy.corecomponentinterfaces;
import javax.swing.JPanel;
/*
* Defines an interface used by the Add DataSource wizard to discover different
* Data SourceProcessors.
/**
* Interface used by the Add DataSource wizard to allow different
* types of data sources to be added to a case. Examples of data
* sources include disk images, local files, etc.
*
* Each data source may have its unique attributes and may need to be processed
* differently.
*
* The DataSourceProcessor interface defines a uniform mechanism for the Autopsy UI
* The interface provides a uniform mechanism for the Autopsy UI
* to:
* - collect details for the data source to be processed.
* - Process the data source in the background
* - Be notified when the processing is complete
* - Collect details from the user about the data source to be processed.
* - Process the data source in the background and add data to the database
* - Provides progress feedback to the user / UI.
*/
public interface DataSourceProcessor {
/*
/**
* The DSP Panel may fire Property change events
* The caller must enure to add itself as a listener and
* then react appropriately to the events
*/
enum DSP_PANEL_EVENT {
UPDATE_UI, // the content of JPanel has changed that MAY warrant updates to the caller UI
FOCUS_NEXT // the caller UI may move focus the the next UI element, following the panel.
UPDATE_UI, ///< the content of JPanel has changed that MAY warrant updates to the caller UI
FOCUS_NEXT ///< the caller UI may move focus the the next UI element, following the panel.
};
/**
* Returns the type of Data Source it handles.
* This name gets displayed in the drop-down listbox
**/
*/
String getDataSourceType();
/**
* Returns the picker panel to be displayed along with any other
* runtime options supported by the data source handler.
**/
* runtime options supported by the data source handler. The
* DSP is responsible for storing the settings so that a later
* call to run() will have the user-specified settings.
*
* Should be less than 544 pixels wide and 173 pixels high.
*/
JPanel getPanel();
/**
* Called to validate the input data in the panel.
* Returns true if no errors, or
* Returns false if there is an error.
**/
*/
boolean isPanelValid();
/**
* Called to invoke the handling of Data source in the background.
* Returns after starting the background thread
* @param settings wizard settings to read/store properties
* @param progressPanel progress panel to be updated while processing
* Called to invoke the handling of data source in the background.
* Returns after starting the background thread.
*
**/
* @param progressPanel progress panel to be updated while processing
* @param dspCallback Contains the callback method DataSourceProcessorCallback.done() that the DSP must call when the background thread finishes with errors and status.
*/
void run(DataSourceProcessorProgressMonitor progressPanel, DataSourceProcessorCallback dspCallback);
/**
* Called to cancel the background processing.
**/
*/
void cancel();
/**
* Called to reset/reinitialize the DSP.
**/
*/
void reset();
}

39
Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorCallback.java
View File

@ -16,7 +16,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.corecomponentinterfaces;
import java.awt.EventQueue;
@ -26,24 +25,29 @@ import org.sleuthkit.datamodel.Content;
/**
* Abstract class for a callback for a DataSourceProcessor.
*
* Ensures that DSP invokes the caller overridden method, doneEDT(),
* in the EDT thread.
* Ensures that DSP invokes the caller overridden method, doneEDT(), in the EDT
* thread.
*
*/
public abstract class DataSourceProcessorCallback {
public enum DataSourceProcessorResult
{
NO_ERRORS,
CRITICAL_ERRORS,
NONCRITICAL_ERRORS,
public enum DataSourceProcessorResult {
NO_ERRORS, ///< No errors were encountered while ading the data source
CRITICAL_ERRORS, ///< No data was added to the database. There were fundamental errors processing the data (such as no data or system failure).
NONCRITICAL_ERRORS, ///< There was data added to the database, but there were errors from data corruption or a small number of minor issues.
};
/*
* Invoke the caller supplied callback function on the EDT thread
/**
* Called by a DSP implementation when it is done adding a data source
* to the database. Users of the DSP can override this method if they do
* not want to be notified on the EDT. Otherwise, this method will call
* doneEDT() with the same arguments.
* @param result Code for status
* @param errList List of error strings
* @param newContents List of root Content objects that were added to database. Typically only one is given.
*/
public void done(DataSourceProcessorResult result, List<String> errList, List<Content> newContents)
{
public void done(DataSourceProcessorResult result, List<String> errList, List<Content> newContents) {
final DataSourceProcessorResult resultf = result;
final List<String> errListf = errList;
@ -54,13 +58,18 @@ public abstract class DataSourceProcessorCallback {
@Override
public void run() {
doneEDT(resultf, errListf, newContentsf);
}
});
}
/*
* calling code overrides to provide its own calllback
/**
* Called by done() if the default implementation is used. Users of DSPs
* that have UI updates to do after the DSP is finished adding the DS can
* implement this method to receive the updates on the EDT.
*
* @param result Code for status
* @param errList List of error strings
* @param newContents List of root Content objects that were added to database. Typically only one is given.
*/
public abstract void doneEDT(DataSourceProcessorResult result, List<String> errList, List<Content> newContents);
};

4
Core/src/org/sleuthkit/autopsy/corecomponentinterfaces/DataSourceProcessorProgressMonitor.java
View File

@ -18,10 +18,10 @@
*/
package org.sleuthkit.autopsy.corecomponentinterfaces;
/*
/**
* An GUI agnostic DataSourceProcessorProgressMonitor interface for DataSourceProcesssors to
* indicate progress.
* It models after a JProgressbar though it could use any underlying implementation
* It models after a JProgressbar though it could use any underlying implementation (or NoOps)
*/
public interface DataSourceProcessorProgressMonitor {

27
Core/src/org/sleuthkit/autopsy/corecomponents/FXVideoPanel.java
View File

@ -79,7 +79,9 @@ import org.sleuthkit.datamodel.TskData;
})
public class FXVideoPanel extends MediaViewVideoPanel {
private static final String[] EXTENSIONS = new String[]{".mov", ".m4v", ".flv", ".mp4", ".mpg", ".mpeg"}; //NON-NLS
// Refer to https://docs.oracle.com/javafx/2/api/javafx/scene/media/package-summary.html
// for Javafx supported formats
private static final String[] EXTENSIONS = new String[]{".m4v", ".fxm", ".flv", ".m3u8", ".mp4", ".aif", ".aiff", ".mp3", "m4a", ".wav"}; //NON-NLS
private static final List<String> MIMETYPES = Arrays.asList("audio/x-aiff", "video/x-javafx", "video/x-flv", "application/vnd.apple.mpegurl", " audio/mpegurl", "audio/mpeg", "video/mp4", "audio/x-m4a", "video/x-m4v", "audio/x-wav"); //NON-NLS
private static final Logger logger = Logger.getLogger(MediaViewVideoPanel.class.getName());
@ -478,6 +480,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
pauseButton.setOnAction(new EventHandler<ActionEvent>() {
@Override
public void handle(ActionEvent e) {
if (mediaPlayer == null) {
return;
}
Status status = mediaPlayer.getStatus();
switch (status) {
@ -505,6 +511,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
stopButton.setOnAction(new EventHandler<ActionEvent>() {
@Override
public void handle(ActionEvent e) {
if (mediaPlayer == null) {
return;
}
mediaPlayer.stop();
}
});
@ -512,6 +522,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
progressSlider.valueProperty().addListener(new InvalidationListener() {
@Override
public void invalidated(Observable o) {
if (mediaPlayer == null) {
return;
}
if (progressSlider.isValueChanging()) {
mediaPlayer.seek(duration.multiply(progressSlider.getValue() / 100.0));
}
@ -559,6 +573,9 @@ public class FXVideoPanel extends MediaViewVideoPanel {
* media.
*/
private void updateProgress() {
if (mediaPlayer == null) {
return;
}
Duration currentTime = mediaPlayer.getCurrentTime();
updateSlider(currentTime);
updateTime(currentTime);
@ -634,6 +651,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
@Override
public void run() {
if (mediaPlayer == null) {
return;
}
duration = mediaPlayer.getMedia().getDuration();
long durationInMillis = (long) mediaPlayer.getMedia().getDuration().toMillis();
@ -657,6 +678,10 @@ public class FXVideoPanel extends MediaViewVideoPanel {
@Override
public void run() {
if (mediaPlayer == null) {
return;
}
Duration beginning = mediaPlayer.getStartTime();
mediaPlayer.stop();
mediaPlayer.pause();

64
Core/src/org/sleuthkit/autopsy/coreutils/ImageUtils.java
View File

@ -33,11 +33,9 @@ import java.util.List;
import java.util.logging.Level;
import javax.imageio.ImageIO;
import javax.swing.ImageIcon;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.corelibs.ScalrWrapper;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.Content;
@ -55,7 +53,11 @@ public class ImageUtils {
private static final Logger logger = Logger.getLogger(ImageUtils.class.getName());
private static final Image DEFAULT_ICON = new ImageIcon("/org/sleuthkit/autopsy/images/file-icon.png").getImage(); //NON-NLS
private static final List<String> SUPP_EXTENSIONS = Arrays.asList(ImageIO.getReaderFileSuffixes());
private static final List<String> SUPP_MIME_TYPES = Arrays.asList(ImageIO.getReaderMIMETypes());
private static final List<String> SUPP_MIME_TYPES = new ArrayList<>(Arrays.asList(ImageIO.getReaderMIMETypes()));
static {
SUPP_MIME_TYPES.add("image/x-ms-bmp");
}
/**
* Get the default Icon, which is the icon for a file.
* @return
@ -88,14 +90,17 @@ public class ImageUtils {
return true;
}
}
// if the file type is known and we don't support it, bail
if (attributes.size() > 0) {
return false;
}
}
catch (TskCoreException ex) {
logger.log(Level.WARNING, "Error while getting file signature from blackboard.", ex); //NON-NLS
}
final String extension = f.getNameExtension();
// if we have an extension, check it
final String extension = f.getNameExtension();
if (extension.equals("") == false) {
// Note: thumbnail generator only supports JPG, GIF, and PNG for now
if (SUPP_EXTENSIONS.contains(extension)) {
@ -109,7 +114,8 @@ public class ImageUtils {
/**
* Get an icon of a specified size.
* Get a thumbnail of a specified size. Generates the image if it is
* not already cached.
*
* @param content
* @param iconSize
@ -118,6 +124,7 @@ public class ImageUtils {
public static Image getIcon(Content content, int iconSize) {
Image icon;
// If a thumbnail file is already saved locally
// @@@ Bug here in that we do not refer to size in the cache.
File file = getFile(content.getId());
if (file.exists()) {
try {
@ -125,7 +132,7 @@ public class ImageUtils {
if (bicon == null) {
icon = DEFAULT_ICON;
} else if (bicon.getWidth() != iconSize) {
icon = generateAndSaveIcon(content, iconSize);
icon = generateAndSaveIcon(content, iconSize, file);
} else {
icon = bicon;
}
@ -134,18 +141,17 @@ public class ImageUtils {
icon = DEFAULT_ICON;
}
} else { // Make a new icon
icon = generateAndSaveIcon(content, iconSize);
icon = generateAndSaveIcon(content, iconSize, file);
}
return icon;
}
/**
* Get the cached file of the icon. Generates the icon and its file if it
* doesn't already exist, so this method guarantees to return a file that
* exists.
* Get a thumbnail of a specified size. Generates the image if it is
* not already cached.
* @param content
* @param iconSize
* @return
* @return File object for cached image. Is guaranteed to exist.
*/
public static File getIconFile(Content content, int iconSize) {
if (getIcon(content, iconSize) != null) {
@ -155,13 +161,12 @@ public class ImageUtils {
}
/**
* Get the cached file of the content object with the given id.
*
* The returned file may not exist.
* Get a file object for where the cached icon should exist. The returned file may not exist.
*
* @param id
* @return
*/
// TODO: This should be private and be renamed to something like getCachedThumbnailLocation().
public static File getFile(long id) {
return new File(Case.getCurrentCase().getCacheDirectory() + File.separator + id + ".png");
}
@ -223,18 +228,24 @@ public class ImageUtils {
}
private static Image generateAndSaveIcon(Content content, int iconSize) {
/**
* Generate an icon and save it to specified location.
* @param content File to generate icon for
* @param iconSize
* @param saveFile Location to save thumbnail to
* @return Generated icon or null on error
*/
private static Image generateAndSaveIcon(Content content, int iconSize, File saveFile) {
Image icon = null;
try {
icon = generateIcon(content, iconSize);
if (icon == null) {
return DEFAULT_ICON;
} else {
File f = getFile(content.getId());
if (f.exists()) {
f.delete();
if (saveFile.exists()) {
saveFile.delete();
}
ImageIO.write((BufferedImage) icon, "png", getFile(content.getId())); //NON-NLS
ImageIO.write((BufferedImage) icon, "png", saveFile); //NON-NLS
}
} catch (IOException ex) {
logger.log(Level.WARNING, "Could not write cache thumbnail: " + content, ex); //NON-NLS
@ -243,14 +254,15 @@ public class ImageUtils {
}
/*
* Generate a scaled image
* Generate and return a scaled image
*/
private static BufferedImage generateIcon(Content content, int iconSize) {
InputStream inputStream = null;
BufferedImage bi = null;
try {
inputStream = new ReadContentInputStream(content);
BufferedImage bi = ImageIO.read(inputStream);
bi = ImageIO.read(inputStream);
if (bi == null) {
logger.log(Level.WARNING, "No image reader for file: " + content.getName()); //NON-NLS
return null;
@ -258,7 +270,13 @@ public class ImageUtils {
BufferedImage biScaled = ScalrWrapper.resizeFast(bi, iconSize);
return biScaled;
} catch (OutOfMemoryError e) {
} catch (IllegalArgumentException e) {
// if resizing does not work due to extremely small height/width ratio,
// crop the image instead.
BufferedImage biCropped = ScalrWrapper.cropImage(bi, Math.min(iconSize, bi.getWidth()), Math.min(iconSize, bi.getHeight()));
return biCropped;
}
catch (OutOfMemoryError e) {
logger.log(Level.WARNING, "Could not scale image (too large): " + content.getName(), e); //NON-NLS
return null;
} catch (Exception e) {

57
Core/src/org/sleuthkit/autopsy/coreutils/PathValidator.java Normal file
View File

@ -0,0 +1,57 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013-2014 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.coreutils;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import org.sleuthkit.autopsy.casemodule.Case;
/**
* Validates absolute path (e.g. to a data source or case output folder) depending on case type.
*/
public final class PathValidator {
private static final Pattern driveLetterPattern = Pattern.compile("^[Cc]:.*$");
public static boolean isValid(String path, Case.CaseType caseType) {
if (caseType == Case.CaseType.MULTI_USER_CASE) {
// check that path is not on "C:" drive
if (pathOnCDrive(path)) {
return false;
}
} else {
// single user case - no validation needed
}
return true;
}
/**
* Checks whether a file path contains drive letter defined by pattern.
*
* @param filePath Input file absolute path
* @return true if path matches the pattern, false otherwise.
*/
private static boolean pathOnCDrive(String filePath) {
Matcher m = driveLetterPattern.matcher(filePath);
return m.find();
}
}

13
Core/src/org/sleuthkit/autopsy/directorytree/CollapseAction.java
View File

@ -44,7 +44,14 @@ class CollapseAction extends AbstractAction {
// Collapse all
BeanTreeView tree = DirectoryTreeTopComponent.findInstance().getTree();
collapseAll(tree, selectedNode[0]);
if(selectedNode.length != 0) {
collapseSelectedNode(tree, selectedNode[0]);
} else {
// If no node is selected, all the level-2 nodes (children of the
// root node) are collapsed.
for(Node childOfRoot: em.getRootContext().getChildren().getNodes())
collapseSelectedNode(tree, childOfRoot);
}
}
/**
@ -53,13 +60,13 @@ class CollapseAction extends AbstractAction {
* @param tree the given tree
* @param currentNode the current selectedNode
*/
private void collapseAll(BeanTreeView tree, Node currentNode) {
private void collapseSelectedNode(BeanTreeView tree, Node currentNode) {
Children c = currentNode.getChildren();
for (Node next : c.getNodes()) {
if (tree.isExpanded(next)) {
this.collapseAll(tree, next);
this.collapseSelectedNode(tree, next);
}
}

24
Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterNode.java
View File

@ -39,6 +39,7 @@ import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.Directory;
import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.VirtualDirectory;
/**
* This class sets the actions for the nodes in the directory tree and creates
@ -106,14 +107,26 @@ class DirectoryTreeFilterNode extends FilterNode {
actions.add(ExtractAction.getInstance());
}
// file search action
final Image img = this.getLookup().lookup(Image.class);
if (img != null) {
actions.add(new FileSearchAction(
NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.openFileSrcByAttr.text")));
VirtualDirectory virtualDirectory = this.getLookup().lookup(VirtualDirectory.class);
// determine if the virtualDireory is at root-level (Logical File Set).
boolean isRootVD = false;
if (virtualDirectory != null) {
try {
if (virtualDirectory.getParent() == null) {
isRootVD = true;
}
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Error determining the parent of the virtual directory", ex); // NON-NLS
}
}
//ingest action
// 'run ingest' action and 'file search' action are added only if the
// selected node is img node or a root level virtual directory.
if (img != null || isRootVD) {
actions.add(new FileSearchAction(
NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.openFileSrcByAttr.text")));
actions.add(new AbstractAction(
NbBundle.getMessage(this.getClass(), "DirectoryTreeFilterNode.action.runIngestMods.text")) {
@Override
@ -123,6 +136,7 @@ class DirectoryTreeFilterNode extends FilterNode {
}
});
}
}
//check if delete actions should be added
final Node orig = getOriginal();

23
Core/src/org/sleuthkit/autopsy/directorytree/ExtractUnallocAction.java
View File

@ -165,8 +165,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
* Gets all the unallocated files in a given Content.
*
* @param c Content to get Unallocated Files from
* @return A list<LayoutFile> if it didn't crash List may be empty. Returns
* null on failure.
* @return A list<LayoutFile> if it didn't crash List may be empty.
*/
private List<LayoutFile> getUnallocFiles(Content c) {
UnallocVisitor uv = new UnallocVisitor();
@ -178,7 +177,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
} catch (TskCoreException tce) {
logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at sending out the visitor ", tce); //NON-NLS
}
return null;
return Collections.emptyList();
}
/**
@ -372,7 +371,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
* return the single instance of unallocated space.
*
* @param lf the LayoutFile the visitor encountered
* @return A list<LayoutFile> of size 1, returns null if it fails
* @return A list<LayoutFile> of size 1
*/
@Override
public List<LayoutFile> visit(final org.sleuthkit.datamodel.LayoutFile lf) {
@ -389,7 +388,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
*
* @param fs the FileSystem the visitor encountered
* @return A list<LayoutFile> containing the layout files from
* subsequent Visits(), returns null if it fails
* subsequent Visits(), or an empty list
*/
@Override
public List<LayoutFile> visit(FileSystem fs) {
@ -402,7 +401,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
} catch (TskCoreException tce) {
logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at visiting FileSystem " + fs.getId(), tce); //NON-NLS
}
return null;
return Collections.emptyList();
}
/**
@ -410,12 +409,12 @@ import org.sleuthkit.datamodel.VolumeSystem;
*
* @param vd VirtualDirectory the visitor encountered
* @return A list<LayoutFile> containing all the LayoutFile in ld,
* returns null if it fails
* or an empty list.
*/
@Override
public List<LayoutFile> visit(VirtualDirectory vd) {
try {
List<LayoutFile> lflst = new ArrayList<LayoutFile>();
List<LayoutFile> lflst = new ArrayList<>();
for (Content layout : vd.getChildren()) {
lflst.add((LayoutFile) layout);
}
@ -423,7 +422,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
} catch (TskCoreException tce) {
logger.log(Level.WARNING, "Could not get list of Layout Files, failed at visiting Layout Directory", tce); //NON-NLS
}
return null;
return Collections.emptyList();
}
/**
@ -432,7 +431,7 @@ import org.sleuthkit.datamodel.VolumeSystem;
*
* @param dir the directory this visitor encountered
* @return A list<LayoutFile> containing LayoutFiles encountered during
* subsequent Visits(), returns null if it fails
* subsequent Visits(), or an empty list.
*/
@Override
public List<LayoutFile> visit(Directory dir) {
@ -445,12 +444,12 @@ import org.sleuthkit.datamodel.VolumeSystem;
} catch (TskCoreException tce) {
logger.log(Level.WARNING, "Couldn't get a list of Unallocated Files, failed at visiting Directory " + dir.getId(), tce); //NON-NLS
}
return null;
return Collections.emptyList();
}
@Override
protected List<LayoutFile> defaultVisit(Content cntnt) {
return null;
return Collections.emptyList();
}
}

2
Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java
View File

@ -98,7 +98,7 @@ class SampleFileIngestModule implements FileIngestModule {
@Override
public IngestModule.ProcessResult process(AbstractFile file) {
if (attrId != -1) {
if (attrId == -1) {
return IngestModule.ProcessResult.ERROR;
}

6
Core/src/org/sleuthkit/autopsy/ingest/DataSourceIngestPipeline.java
View File

@ -24,6 +24,7 @@ import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.datamodel.Content;
/**
@ -110,6 +111,11 @@ final class DataSourceIngestPipeline {
logger.log(Level.INFO, "{0} analysis of {1} (jobId={2}) finished", new Object[]{module.getDisplayName(), this.job.getDataSource().getName(), this.job.getDataSource().getId()});
} catch (Throwable ex) { // Catch-all exception firewall
errors.add(new IngestModuleError(module.getDisplayName(), ex));
String msg = ex.getMessage();
// Jython run-time errors don't seem to have a message, but have details in toString.
if (msg == null)
msg = ex.toString();
MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
}
if (this.job.isCancelled()) {
break;

11
Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java
View File

@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.ingest;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.datamodel.AbstractFile;
/**
@ -119,6 +120,11 @@ final class FileIngestPipeline {
module.process(file);
} catch (Throwable ex) { // Catch-all exception firewall
errors.add(new IngestModuleError(module.getDisplayName(), ex));
String msg = ex.getMessage();
// Jython run-time errors don't seem to have a message, but have details in toString.
if (msg == null)
msg = ex.toString();
MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
}
if (this.job.isCancelled()) {
break;
@ -144,6 +150,11 @@ final class FileIngestPipeline {
module.shutDown();
} catch (Throwable ex) { // Catch-all exception firewall
errors.add(new IngestModuleError(module.getDisplayName(), ex));
String msg = ex.getMessage();
// Jython run-time errors don't seem to have a message, but have details in toString.
if (msg == null)
msg = ex.toString();
MessageNotifyUtil.Notify.error(module.getDisplayName() + " Error", msg);
}
}
this.running = false;

1
Core/src/org/sleuthkit/autopsy/modules/exif/Bundle.properties
View File

@ -6,3 +6,4 @@ OpenIDE-Module-Name=ExifParser
OpenIDE-Module-Short-Description=Exif metadata ingest module
ExifParserFileIngestModule.moduleName.text=Exif Parser
ExifParserFileIngestModule.getDesc.text=Ingests JPEG files and retrieves their EXIF metadata.
ExifParserFileIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.

21
Core/src/org/sleuthkit/autopsy/modules/exif/ExifParserFileIngestModule.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Copyright 2011-2015 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -34,13 +34,14 @@ import java.util.Collection;
import java.util.Date;
import java.util.concurrent.atomic.AtomicInteger;
import java.util.logging.Level;
import org.sleuthkit.autopsy.coreutils.ImageUtils;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.FileIngestModule;
import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
@ -59,10 +60,11 @@ public final class ExifParserFileIngestModule implements FileIngestModule {
private static final Logger logger = Logger.getLogger(ExifParserFileIngestModule.class.getName());
private final IngestServices services = IngestServices.getInstance();
private AtomicInteger filesProcessed = new AtomicInteger(0);
private final AtomicInteger filesProcessed = new AtomicInteger(0);
private volatile boolean filesToFire = false;
private long jobId;
private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
private FileTypeDetector fileTypeDetector;
ExifParserFileIngestModule() {
}
@ -71,8 +73,12 @@ public final class ExifParserFileIngestModule implements FileIngestModule {
public void startUp(IngestJobContext context) throws IngestModuleException {
jobId = context.getJobId();
refCounter.incrementAndGet(jobId);
try {
fileTypeDetector = new FileTypeDetector();
} catch (FileTypeDetector.FileTypeDetectorInitException ex) {
throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "ExifParserFileIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
}
}
@Override
public ProcessResult process(AbstractFile content) {
@ -197,7 +203,12 @@ public final class ExifParserFileIngestModule implements FileIngestModule {
* @return true if to be processed
*/
private boolean parsableFormat(AbstractFile f) {
return ImageUtils.isJpegFileHeader(f);
try {
return fileTypeDetector.getFileType(f).equals("image/jpeg");
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Failed to detect file type", ex); //NON-NLS
return false;
}
}
@Override

3
Core/src/org/sleuthkit/autopsy/modules/filetypeid/Bundle.properties
View File

@ -44,3 +44,6 @@ FileTypeIdGlobalSettingsPanel.newTypeButton.text=New
FileTypeIdGlobalSettingsPanel.jLabel1.text=Custom File Types
FileTypeIdGlobalSettingsPanel.jLabel2.text=MIME Types:
FileTypeIdGlobalSettingsPanel.jLabel3.text=Autopsy can automatically detect many file types. Add your custom file types here.
FileTypeIdGlobalSettingsPanel.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.
FileTypeIdIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.

57
Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java
View File

@ -18,6 +18,7 @@
*/
package org.sleuthkit.autopsy.modules.filetypeid;
import java.util.ArrayList;
import java.util.Map;
import java.util.SortedSet;
import org.apache.tika.Tika;
@ -27,6 +28,7 @@ import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskData;
/**
* Detects the type of a file by an inspection of its contents.
@ -94,15 +96,39 @@ public class FileTypeDetector {
}
/**
* Detect the MIME type of a file, posting it to the blackboard if detection
* succeeds.
* Look up the MIME type of a file using the blackboard. If it is not already
* posted, detect the type of the file, posting it to the blackboard if
* detection succeeds.
*
* @param file The file to test.
* @param moduleName The name of the module posting to the blackboard.
* @return The MIME type name id detection was successful, null otherwise.
* @throws TskCoreException if there is an error posting to the blackboard.
* @return The MIME type name if detection was successful, null otherwise.
* @throws TskCoreException
*/
public synchronized String detectAndPostToBlackboard(AbstractFile file) throws TskCoreException {
public String getFileType(AbstractFile file) throws TskCoreException {
String fileType;
ArrayList<BlackboardAttribute> attributes = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
for (BlackboardAttribute attribute : attributes) {
/**
* Get the first TSK_FILE_TYPE_SIG attribute.
*/
fileType = attribute.getValueString();
if (null != fileType && !fileType.isEmpty()) {
return fileType;
}
}
return detectAndPostToBlackboard(file);
}
/**
* Detect the MIME type of a file, posting it to the blackboard if detection
* succeeds. Note that this method should currently be called at most once
* per file.
*
* @param file The file to test.
* @return The MIME type name id detection was successful, null otherwise.
* @throws TskCoreException
*/
public String detectAndPostToBlackboard(AbstractFile file) throws TskCoreException {
String mimeType = detect(file);
if (null != mimeType) {
/**
@ -122,9 +148,19 @@ public class FileTypeDetector {
* Detect the MIME type of a file.
*
* @param file The file to test.
* @return The MIME type name id detection was successful, null otherwise.
* @return The MIME type name if detection was successful, null otherwise.
* @throws TskCoreException
*/
public String detect(AbstractFile file) throws TskCoreException {
// consistently mark non-regular files (refer TskData.TSK_FS_META_TYPE_ENUM),
// 0 sized files, unallocated, and unused blocks (refer TskData.TSK_DB_FILES_TYPE_ENUM)
// as octet-stream.
if (!file.isFile() || file.getSize() <= 0
|| (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
|| (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)) {
return MimeTypes.OCTET_STREAM;
}
String fileType = detectUserDefinedType(file);
if (null == fileType) {
try {
@ -164,6 +200,7 @@ public class FileTypeDetector {
*
* @param file The file to test.
* @return The file type name string or null, if no match is detected.
* @throws TskCoreException
*/
private String detectUserDefinedType(AbstractFile file) throws TskCoreException {
for (FileType fileType : userDefinedFileTypes.values()) {
@ -175,9 +212,9 @@ public class FileTypeDetector {
artifact.addAttribute(setNameAttribute);
/**
* Use the MIME type as the category, i.e., the rule
* that determined this file belongs to the interesting
* files set.
* Use the MIME type as the category, i.e., the rule that
* determined this file belongs to the interesting files
* set.
*/
BlackboardAttribute ruleNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY.getTypeID(), FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType());
artifact.addAttribute(ruleNameAttribute);

16
Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java
View File

@ -27,7 +27,6 @@ import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.autopsy.ingest.IngestMessage;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData;
import org.sleuthkit.datamodel.TskData.FileKnown;
import org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult;
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
@ -83,9 +82,7 @@ public class FileTypeIdIngestModule implements FileIngestModule {
try {
fileTypeDetector = new FileTypeDetector();
} catch (FileTypeDetector.FileTypeDetectorInitException ex) {
String errorMessage = "Failed to create file type detector"; //NON-NLS
logger.log(Level.SEVERE, errorMessage, ex);
throw new IngestModuleException(errorMessage);
throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "FileTypeIdIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
}
}
@ -95,15 +92,6 @@ public class FileTypeIdIngestModule implements FileIngestModule {
@Override
public ProcessResult process(AbstractFile file) {
/**
* Skip unallocated space and unused blocks files.
*/
if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
|| (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
|| (file.isFile() == false)) {
return ProcessResult.OK;
}
/**
* Skip known files if configured to do so.
*/
@ -118,7 +106,7 @@ public class FileTypeIdIngestModule implements FileIngestModule {
*/
try {
long startTime = System.currentTimeMillis();
fileTypeDetector.detectAndPostToBlackboard(file);
fileTypeDetector.getFileType(file);
addToTotals(jobId, (System.currentTimeMillis() - startTime));
return ProcessResult.OK;
} catch (Exception e) {

5
Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java
View File

@ -85,6 +85,11 @@ class CallLogAnalyzer {
SleuthkitCase skCase = currentCase.getSleuthkitCase();
try {
AbstractFile f = skCase.getAbstractFileById(fId);
if(f == null){
logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
return;
}
try {
resultSet = statement.executeQuery(
"SELECT number,date,duration,type, name FROM calls ORDER BY date DESC;"); //NON-NLS

5
Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java
View File

@ -101,6 +101,11 @@ class ContactAnalyzer {
SleuthkitCase skCase = currentCase.getSleuthkitCase();
try {
AbstractFile f = skCase.getAbstractFileById(fId);
if(f == null){
logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
return;
}
try {
// get display_name, mimetype(email or phone number) and data1 (phonenumber or email address depending on mimetype)
//sorted by name, so phonenumber/email would be consecutive for a person if they exist.

5
Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java
View File

@ -85,6 +85,11 @@ class TextMessageAnalyzer {
SleuthkitCase skCase = currentCase.getSleuthkitCase();
try {
AbstractFile f = skCase.getAbstractFileById(fId);
if(f == null){
logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
return;
}
try {
resultSet = statement.executeQuery(
"SELECT address,date,type,subject,body FROM sms;"); //NON-NLS

2
Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java
View File

@ -248,7 +248,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
*/
@Override
public void shutDown() {
if (refCounter.decrementAndGet(this.context.getJobId()) == 0) {
if (this.context != null && refCounter.decrementAndGet(this.context.getJobId()) == 0) {
try {
// The last instance of this module for an ingest job cleans out
// the working paths map entry for the job and deletes the temp dir.

1
Core/src/org/sleuthkit/autopsy/modules/sevenzip/Bundle.properties
View File

@ -29,3 +29,4 @@ SevenZipIngestModule.unpack.encrFileDetected.msg=Encrypted files in archive dete
SevenZipIngestModule.unpack.encrFileDetected.details=Some files in archive\: {0} are encrypted. {1} extractor was unable to extract all files from this archive.
SevenZipIngestModule.UnpackStream.write.exception.msg=Error writing unpacked file to\: {0}
SevenZipIngestModule.UnpackedTree.exception.msg=Error adding a derived file to db\:{0}
SevenZipIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.

31
Core/src/org/sleuthkit/autopsy/modules/sevenzip/SevenZipIngestModule.java
View File

@ -24,7 +24,6 @@ import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.nio.ByteBuffer;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
@ -62,6 +61,7 @@ import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
import net.sf.sevenzipjbinding.ArchiveFormat;
import static net.sf.sevenzipjbinding.ArchiveFormat.RAR;
import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
/**
* 7Zip ingest module extracts supported archives, adds extracted DerivedFiles,
@ -87,13 +87,10 @@ public final class SevenZipIngestModule implements FileIngestModule {
private static final long MIN_FREE_DISK_SPACE = 1 * 1000 * 1000000L; //1GB
//counts archive depth
private ArchiveDepthCountTree archiveDepthCountTree;
//buffer for checking file headers and signatures
private static final int readHeaderSize = 4;
private final byte[] fileHeaderBuffer = new byte[readHeaderSize];
private static final int ZIP_SIGNATURE_BE = 0x504B0304;
private IngestJobContext context;
private long jobId;
private final static IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
private FileTypeDetector fileTypeDetector;
SevenZipIngestModule() {
}
@ -103,6 +100,12 @@ public final class SevenZipIngestModule implements FileIngestModule {
this.context = context;
jobId = context.getJobId();
try {
fileTypeDetector = new FileTypeDetector();
} catch (FileTypeDetector.FileTypeDetectorInitException ex) {
throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "SevenZipIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
}
final Case currentCase = Case.getCurrentCase();
moduleDirRelative = currentCase.getModuleOutputDirectoryRelativePath() + File.separator + ArchiveFileExtractorModuleFactory.getModuleName();
@ -284,7 +287,7 @@ public final class SevenZipIngestModule implements FileIngestModule {
}
if (detectedFormat == null) {
logger.log(Level.WARNING, "Could not detect format for file: " + archiveFile); //NON-NLS
logger.log(Level.WARNING, "Could not detect format for file: {0}", archiveFile); //NON-NLS
// if we don't have attribute info then use file extension
String extension = archiveFile.getNameExtension();
@ -657,24 +660,12 @@ public final class SevenZipIngestModule implements FileIngestModule {
* @return true if zip file, false otherwise
*/
private boolean isZipFileHeader(AbstractFile file) {
if (file.getSize() < readHeaderSize) {
return false;
}
try {
int bytesRead = file.read(fileHeaderBuffer, 0, readHeaderSize);
if (bytesRead != readHeaderSize) {
return false;
}
return fileTypeDetector.getFileType(file).equals("application/zip"); //NON-NLS
} catch (TskCoreException ex) {
//ignore if can't read the first few bytes, not a ZIP
logger.log(Level.SEVERE, "Failed to detect file type", ex); //NON-NLS
return false;
}
ByteBuffer bytes = ByteBuffer.wrap(fileHeaderBuffer);
int signature = bytes.getInt();
return signature == ZIP_SIGNATURE_BE;
}
/**

6
Core/src/org/sleuthkit/autopsy/modules/stix/STIXReportModule.java
View File

@ -96,16 +96,16 @@ public class STIXReportModule implements GeneralReportModule {
/**
* .
*
* @param path path to save the report
* @param baseReportDir path to save the report
* @param progressPanel panel to update the report's progress
*/
@Override
public void generateReport(String path, ReportProgressPanel progressPanel) {
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
// Start the progress bar and setup the report
progressPanel.setIndeterminate(false);
progressPanel.start();
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "STIXReportModule.progress.readSTIX"));
reportPath = path + getRelativeFilePath();
reportPath = baseReportDir + getRelativeFilePath();
// Check if the user wants to display all output or just hits
reportAllResults = configPanel.getShowAllResults();

2
Core/src/org/sleuthkit/autopsy/python/Bundle.properties
View File

@ -1,2 +1,2 @@
JythonModuleLoader.errorMessages.failedToOpenModule=Failed to open {0}. See log for details.
JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0} from {1}. See log for details.
JythonModuleLoader.errorMessages.failedToLoadModule=Failed to load {0}. {1}. See log for details.

3
Core/src/org/sleuthkit/autopsy/python/JythonModuleLoader.java
View File

@ -81,8 +81,9 @@ public final class JythonModuleLoader {
objects.add( createObjectFromScript(script, className, interfaceClass));
} catch (Exception ex) {
logger.log(Level.SEVERE, String.format("Failed to load %s from %s", className, script.getAbsolutePath()), ex); //NON-NLS
// NOTE: using ex.toString() because the current version is always returning null for ex.getMessage().
DialogDisplayer.getDefault().notify(new NotifyDescriptor.Message(
NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, script.getAbsolutePath()),
NbBundle.getMessage(JythonModuleLoader.class, "JythonModuleLoader.errorMessages.failedToLoadModule", className, ex.toString()),
NotifyDescriptor.ERROR_MESSAGE));
}
}

4
Core/src/org/sleuthkit/autopsy/report/FileReportModule.java
View File

@ -29,9 +29,9 @@ import org.sleuthkit.datamodel.AbstractFile;
interface FileReportModule extends ReportModule {
/**
* Initialize the report which will be stored at the given path.
* @param path
* @param baseReportDir Base directory to store the report file in. Report should go into baseReportDir + getRelativeFilePath().
*/
public void startReport(String path);
public void startReport(String baseReportDir);
/**
* End the report.

4
Core/src/org/sleuthkit/autopsy/report/FileReportText.java
View File

@ -54,8 +54,8 @@ import org.sleuthkit.datamodel.AbstractFile;
}
@Override
public void startReport(String path) {
this.reportPath = path + FILE_NAME;
public void startReport(String baseReportDir) {
this.reportPath = baseReportDir + FILE_NAME;
try {
out = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(this.reportPath)));
} catch (IOException ex) {

4
Core/src/org/sleuthkit/autopsy/report/GeneralReportModule.java
View File

@ -26,10 +26,10 @@ public interface GeneralReportModule extends ReportModule {
* Called to generate the report. Method is responsible for saving the file at the
* path specified and updating progress via the progressPanel object.
*
* @param reportPath path to save the report
* @param baseReportDir Base directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath().
* @param progressPanel panel to update the report's progress with
*/
public void generateReport(String reportPath, ReportProgressPanel progressPanel);
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel);
/**
* Returns the configuration panel for the report, which is displayed in

2
Core/src/org/sleuthkit/autopsy/report/GeneralReportModuleAdapter.java
View File

@ -38,7 +38,7 @@ public abstract class GeneralReportModuleAdapter implements GeneralReportModule
}
@Override
public abstract void generateReport(String reportPath, ReportProgressPanel progressPanel);
public abstract void generateReport(String baseReportDir, ReportProgressPanel progressPanel);
@Override
public JPanel getConfigurationPanel() {

7
Core/src/org/sleuthkit/autopsy/report/ReportBodyFile.java
View File

@ -63,16 +63,17 @@ import org.sleuthkit.datamodel.*;
/**
* Generates a body file format report for use with the MAC time tool.
* @param path path to save the report
* @param baseReportDir path to save the report
* @param progressPanel panel to update the report's progress
*/
@Override
public void generateReport(String path, ReportProgressPanel progressPanel) {
@SuppressWarnings("deprecation")
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
// Start the progress bar and setup the report
progressPanel.setIndeterminate(false);
progressPanel.start();
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportBodyFile.progress.querying"));
reportPath = path + "BodyFile.txt"; //NON-NLS
reportPath = baseReportDir + "BodyFile.txt"; //NON-NLS
currentCase = Case.getCurrentCase();
skCase = currentCase.getSleuthkitCase();

6
Core/src/org/sleuthkit/autopsy/report/ReportExcel.java
View File

@ -58,12 +58,12 @@ import org.sleuthkit.datamodel.TskCoreException;
/**
* Start the Excel report by creating the Workbook, initializing styles,
* and writing the summary.
* @param path path to save the report
* @param baseReportDir path to save the report
*/
@Override
public void startReport(String path) {
public void startReport(String baseReportDir) {
// Set the path and save it for when the report is written to disk.
this.reportPath = path + getRelativeFilePath();
this.reportPath = baseReportDir + getRelativeFilePath();
// Make a workbook.
wb = new XSSFWorkbook();

17
Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java
View File

@ -806,8 +806,11 @@ import org.sleuthkit.datamodel.TskData;
logger.log(Level.WARNING, "Error while getting content from a blackboard artifact to report on.", ex); //NON-NLS
return;
}
if(file != null){
checkIfFileIsImage(file);
}
}
/**
* Analyze file that tag is associated with and determine if
@ -994,7 +997,10 @@ import org.sleuthkit.datamodel.TskData;
String uniquePath = "";
try {
AbstractFile f = skCase.getAbstractFileById(objId);
if(f != null){
uniquePath = skCase.getAbstractFileById(objId).getUniquePath();
}
} catch (TskCoreException ex) {
errorList.add(
NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
@ -1138,7 +1144,10 @@ import org.sleuthkit.datamodel.TskData;
String uniquePath = "";
try {
AbstractFile f = skCase.getAbstractFileById(objId);
if(f != null){
uniquePath = skCase.getAbstractFileById(objId).getUniquePath();
}
} catch (TskCoreException ex) {
errorList.add(
NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileFromID"));
@ -1801,6 +1810,7 @@ import org.sleuthkit.datamodel.TskData;
break;
case TSK_EXT_MISMATCH_DETECTED:
AbstractFile file = skCase.getAbstractFileById(getObjectID());
if(file != null){
orderedRowData.add(file.getName());
orderedRowData.add(file.getNameExtension());
List<BlackboardAttribute> attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
@ -1810,6 +1820,13 @@ import org.sleuthkit.datamodel.TskData;
orderedRowData.add("");
}
orderedRowData.add(file.getUniquePath());
} else {
// Make empty rows to make sure the formatting is correct
orderedRowData.add(null);
orderedRowData.add(null);
orderedRowData.add(null);
orderedRowData.add(null);
}
break;
case TSK_OS_INFO:
orderedRowData.add(mappedAttributes.get(ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE.getTypeID()));

6
Core/src/org/sleuthkit/autopsy/report/ReportHTML.java
View File

@ -299,14 +299,14 @@ import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
/**
* Start this report by setting the path, refreshing member variables,
* and writing the skeleton for the HTML report.
* @param path path to save the report
* @param baseReportDir path to save the report
*/
@Override
public void startReport(String path) {
public void startReport(String baseReportDir) {
// Refresh the HTML report
refresh();
// Setup the path for the HTML report
this.path = path + "HTML Report" + File.separator; //NON-NLS
this.path = baseReportDir + "HTML Report" + File.separator; //NON-NLS
this.thumbsPath = this.path + "thumbs" + File.separator; //NON-NLS
try {
FileUtil.createFolder(new File(this.path));

10
Core/src/org/sleuthkit/autopsy/report/ReportKML.java
View File

@ -70,18 +70,18 @@ class ReportKML implements GeneralReportModule {
/**
* Generates a body file format report for use with the MAC time tool.
*
* @param path path to save the report
* @param baseReportDir path to save the report
* @param progressPanel panel to update the report's progress
*/
@Override
public void generateReport(String path, ReportProgressPanel progressPanel) {
public void generateReport(String baseReportDir, ReportProgressPanel progressPanel) {
// Start the progress bar and setup the report
progressPanel.setIndeterminate(false);
progressPanel.start();
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportKML.progress.querying"));
reportPath = path + "ReportKML.kml"; //NON-NLS
String reportPath2 = path + "ReportKML.txt"; //NON-NLS
reportPath = baseReportDir + "ReportKML.kml"; //NON-NLS
String reportPath2 = baseReportDir + "ReportKML.txt"; //NON-NLS
currentCase = Case.getCurrentCase();
skCase = currentCase.getSleuthkitCase();
@ -131,12 +131,14 @@ class ReportKML implements GeneralReportModule {
if (lon != 0 && lat != 0) {
aFile = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID());
if(aFile != null){
extractedToPath = reportPath + aFile.getName();
geoPath = extractedToPath;
f = new File(extractedToPath);
f.createNewFile();
copyFileUsingStream(aFile, f);
imageName = aFile.getName();
}
out.write(String.valueOf(lat));
out.write(";");
out.write(String.valueOf(lon));

8
Core/src/org/sleuthkit/autopsy/report/ReportModule.java
View File

@ -40,11 +40,11 @@ interface ReportModule {
/**
* Gets the relative path of the report file, if any, generated by this
* module. The path should be relative to the time stamp subdirectory of
* reports directory.
* module. The path should be relative to the location that gets passed in
* to generateReport() (or similar).
*
* @return Report file path relative to the time stamp subdirectory reports
* directory, may be null if the module does not produce a report file.
* @return Relative path to where report will be stored.
* May be null if the module does not produce a report file.
*/
public String getRelativeFilePath();
}

4
Core/src/org/sleuthkit/autopsy/report/TableReportModule.java
View File

@ -35,9 +35,9 @@ import java.util.List;
* Start the report. Open any output streams, initialize member variables,
* write summary and navigation pages. Considered the "constructor" of the report.
*
* @param path String path to save the report
* @param baseReportDir Directory to save the report file into. Report should go into baseReportDir + getRelativeFilePath().
*/
public void startReport(String path);
public void startReport(String baseReportDir);
/**
* End the report. Close all output streams and write any end-of-report

15
Core/src/org/sleuthkit/autopsy/timeline/TimeLineController.java
View File

@ -362,7 +362,7 @@ public class TimeLineController {
@SuppressWarnings("deprecation")
private long getCaseLastArtifactID(final SleuthkitCase sleuthkitCase) {
long caseLastArtfId = -1;
String query = "SELECT MAX(artifact_id) AS max_id FROM blackboard_artifacts"; // NON-NLS
String query = "select Max(artifact_id) as max_id from blackboard_artifacts"; // NON-NLS
try (CaseDbQuery dbQuery = sleuthkitCase.executeQuery(query)) {
ResultSet resultSet = dbQuery.getResultSet();
while (resultSet.next()) {
@ -573,6 +573,12 @@ public class TimeLineController {
monitorTask(selectTimeAndTypeTask);
}
/**
* submit a task for execution and add it to the list of tasks whose
* progress is monitored and displayed in the progress bar
*
* @param task
*/
synchronized public void monitorTask(final Task<?> task) {
if (task != null) {
Platform.runLater(() -> {
@ -606,9 +612,16 @@ public class TimeLineController {
break;
case SCHEDULED:
case RUNNING:
case SUCCEEDED:
case CANCELLED:
case FAILED:
tasks.remove(task);
if (tasks.isEmpty() == false) {
progress.bind(tasks.get(0).progressProperty());
message.bind(tasks.get(0).messageProperty());
taskTitle.bind(tasks.get(0).titleProperty());
}
break;
}
});

5
Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java
View File

@ -250,6 +250,8 @@ public class EventsRepository {
} else {
try {
AbstractFile f = skCase.getAbstractFileById(fID);
if(f != null){
//TODO: This is broken for logical files? fix -jm
//TODO: logical files don't necessarily have valid timestamps, so ... -jm
final String uniquePath = f.getUniquePath();
@ -276,6 +278,9 @@ public class EventsRepository {
process(Arrays.asList(new ProgressWindow.ProgressUpdate(i, numFiles,
NbBundle.getMessage(this.getClass(),
"EventsRepository.progressWindow.msg.populateMacEventsFiles2"), f.getName())));
} else {
LOGGER.log(Level.WARNING, "failed to look up data for file : " + fID); // NON-NLS
}
} catch (TskCoreException tskCoreException) {
LOGGER.log(Level.WARNING, "failed to insert mac event for file : " + fID, tskCoreException); // NON-NLS
}

7
Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java
View File

@ -28,6 +28,7 @@ import org.apache.commons.lang3.StringUtils;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.TskCoreException;
@ -129,7 +130,11 @@ public enum MiscTypes implements EventType, ArtifactEventType {
(BlackboardArtifact t,
Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> u) -> {
try {
return t.getSleuthkitCase().getAbstractFileById(t.getObjectID()).getName();
AbstractFile f = t.getSleuthkitCase().getAbstractFileById(t.getObjectID());
if(f != null){
return f.getName();
}
return " error loading file name"; // NON-NLS
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
return " error loading file name"; // NON-NLS

11
Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java
View File

@ -101,14 +101,19 @@ public class EventRootNode extends DisplayableItemNode {
if (eventID >= 0) {
final TimeLineEvent eventById = filteredEvents.getEventById(eventID);
try {
if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) {
return new EventNode(eventById, Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID()));
} else {
AbstractFile file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID());
if(file != null){
if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) {
return new EventNode(eventById, file);
} else {
BlackboardArtifact blackboardArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(eventById.getArtifactID());
return new EventNode(eventById, file, blackboardArtifact);
}
} else {
LOGGER.log(Level.WARNING, "Failed to lookup sleuthkit object backing TimeLineEvent."); // NON-NLS
return null;
}
} catch (TskCoreException tskCoreException) {
LOGGER.log(Level.WARNING, "Failed to lookup sleuthkit object backing TimeLineEvent.", tskCoreException); // NON-NLS

5
CoreLibs/src/org/sleuthkit/autopsy/corelibs/ScalrWrapper.java
View File

@ -20,6 +20,7 @@
package org.sleuthkit.autopsy.corelibs;
import java.awt.image.BufferedImage;
import java.awt.image.BufferedImageOp;
import org.imgscalr.Scalr;
import org.imgscalr.Scalr.Method;
@ -48,4 +49,8 @@ import org.imgscalr.Scalr.Method;
public static synchronized BufferedImage resizeFast(BufferedImage input, int width, int height) {
return Scalr.resize(input, Method.SPEED, Scalr.Mode.AUTOMATIC, width, height, Scalr.OP_ANTIALIAS);
}
public static synchronized BufferedImage cropImage(BufferedImage input, int width, int height) {
return Scalr.crop(input, width, height, (BufferedImageOp) null);
}
}

18
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryController.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Copyright 2013-15 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -58,9 +58,9 @@ import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.History;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.imagegallery.datamodel.Category;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile;
import org.sleuthkit.autopsy.imagegallery.datamodel.Category;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupManager;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupViewState;
import org.sleuthkit.autopsy.imagegallery.gui.NoGroupsDialog;
@ -180,7 +180,7 @@ public final class ImageGalleryController {
stale.set(b);
});
if (Case.isCaseOpen()) {
new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.MODULE_NAME, PerCaseProperties.STALE, b.toString());
new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.getModuleName(), PerCaseProperties.STALE, b.toString());
}
}
@ -335,7 +335,7 @@ public final class ImageGalleryController {
*/
public synchronized void setCase(Case c) {
this.db = DrawableDB.getDrawableDB(c.getModuleDirectory() + File.separator + IMAGEGALLERY, this);
this.db = DrawableDB.getDrawableDB(c.getModulesOutputDirAbsPath() + File.separator + ImageGalleryModule.getModuleName(), this);
setListeningEnabled(ImageGalleryModule.isEnabledforCase(c));
setStale(ImageGalleryModule.isCaseStale(c));
@ -774,6 +774,7 @@ public final class ImageGalleryController {
* netbeans and ImageGallery progress/status
*/
class PrePopulateDataSourceFiles extends InnerTask {
private final Content dataSource;
/**
@ -787,7 +788,7 @@ public final class ImageGalleryController {
private ProgressHandle progressHandle = ProgressHandleFactory.createHandle("prepopulating image/video database");
/**
*
* @param dataSourceId Data source object ID
*/
public PrePopulateDataSourceFiles(Content dataSource) {
@ -816,16 +817,15 @@ public final class ImageGalleryController {
for (FileSystem fs : image.getFileSystems()) {
fsObjIds.add(fs.getId());
}
fsQuery = "(fs_obj_id = " + StringUtils.join(fsObjIds, " OR fs_obj_id = ") + ") ";
}
// NOTE: Logical files currently (Apr '15) have a null value for fs_obj_id in DB.
fsQuery = "(fs_obj_id = " + StringUtils.join(fsObjIds, " or fs_obj_id = ") + ") ";
} // NOTE: Logical files currently (Apr '15) have a null value for fs_obj_id in DB.
// for them, we will not specify a fs_obj_id, which means we will grab files
// from another data source, but the drawable DB is smart enough to de-dupe them.
else {
fsQuery = "(fs_obj_id IS NULL) ";
}
files = getSleuthKitCase().findAllFilesWhere(fsQuery + " AND " + DRAWABLE_QUERY);
files = getSleuthKitCase().findAllFilesWhere(fsQuery + " and " + DRAWABLE_QUERY);
progressHandle.switchToDeterminate(files.size());
//do in transaction

20
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryModule.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013-14 Basis Technology Corp.
* Copyright 2013-15 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -42,7 +42,11 @@ public class ImageGalleryModule {
private static final Logger LOGGER = Logger.getLogger(ImageGalleryModule.class.getName());
static final String MODULE_NAME = ImageGalleryModule.class.getSimpleName();
private static final String MODULE_NAME = "Image Gallery";
static String getModuleName() {
return MODULE_NAME;
}
private static final Set<String> videoExtensions
= Sets.newHashSet("aaf", "3gp", "asf", "avi", "m1v", "m2v", "m4v", "mp4",
@ -60,7 +64,7 @@ public class ImageGalleryModule {
/** mime types of files we can display */
private static final Set<String> supportedMimes = Sets.union(imageMimes, videoMimes);
public static Set<String> getSupportedMimes() {
static Set<String> getSupportedMimes() {
return Collections.unmodifiableSet(supportedMimes);
}
@ -99,8 +103,8 @@ public class ImageGalleryModule {
}
}
public static Set<String> getAllSupportedExtensions() {
return supportedExtensions;
static Set<String> getAllSupportedExtensions() {
return Collections.unmodifiableSet(supportedExtensions);
}
/** is the given file suported by image analyzer: ie, does it have a
@ -111,7 +115,7 @@ public class ImageGalleryModule {
*
* @return true if this file is supported or false if not
*/
public static Boolean isSupported(AbstractFile file) {
static Boolean isSupported(AbstractFile file) {
//if there were no file type attributes, or we failed to read it, fall back on extension and jpeg header
return Optional.ofNullable(hasSupportedMimeType(file)).orElseGet(() -> {
return supportedExtensions.contains(getFileExtension(file))
@ -127,7 +131,7 @@ public class ImageGalleryModule {
* TSK_GEN_INFO that is in the supported list. False if there was an
* unsupported attribute, null if no attributes were found
*/
public static Boolean hasSupportedMimeType(AbstractFile file) {
static Boolean hasSupportedMimeType(AbstractFile file) {
try {
ArrayList<BlackboardAttribute> fileSignatureAttrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
if (fileSignatureAttrs.isEmpty() == false) {
@ -170,7 +174,7 @@ public class ImageGalleryModule {
* @return true if the given {@link AbstractFile} is 'supported' and not
* 'known', else false
*/
static public boolean isSupportedAndNotKnown(AbstractFile abstractFile) {
public static boolean isSupportedAndNotKnown(AbstractFile abstractFile) {
return (abstractFile.getKnown() != TskData.FileKnown.KNOWN) && ImageGalleryModule.isSupported(abstractFile);
}
}

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ImageGalleryOptionsPanel.java
View File

@ -130,7 +130,7 @@ final class ImageGalleryOptionsPanel extends javax.swing.JPanel {
ImageGalleryPreferences.setEnabledByDefault(enabledByDefaultBox.isSelected());
ImageGalleryController.getDefault().setListeningEnabled(enabledForCaseBox.isSelected());
if (Case.isCaseOpen()) {
new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.MODULE_NAME, PerCaseProperties.ENABLED, Boolean.toString(enabledForCaseBox.isSelected()));
new PerCaseProperties(Case.getCurrentCase()).setConfigSetting(ImageGalleryModule.getModuleName(), PerCaseProperties.ENABLED, Boolean.toString(enabledForCaseBox.isSelected()));
}
}

53
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/PerCaseProperties.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Copyright 2013-15 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -18,11 +18,12 @@
*/
package org.sleuthkit.autopsy.imagegallery;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;
import java.util.Properties;
@ -32,7 +33,7 @@ import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
/**
* Provides access to per case module properties
* Provides access to per-case module properties/settings.
*/
class PerCaseProperties {
@ -40,13 +41,10 @@ class PerCaseProperties {
public static final String STALE = "stale";
private final Case c;
private final Case theCase;
/**
* the constructor
*/
PerCaseProperties(Case c) {
this.c = c;
this.theCase = c;
}
/**
@ -60,15 +58,17 @@ class PerCaseProperties {
*/
public synchronized boolean makeConfigFile(String moduleName) {
if (!configExists(moduleName)) {
File propPath = new File(getPropertyPath(moduleName));
File parent = new File(propPath.getParent());
if (!parent.exists()) {
parent.mkdirs();
}
Path propPath = getPropertyPath(moduleName);
Path parent = propPath.getParent();
Properties props = new Properties();
try {
propPath.createNewFile();
try (FileOutputStream fos = new FileOutputStream(propPath)) {
if (!Files.exists(parent)) {
Files.createDirectories(parent);
}
Files.createFile(propPath);
try (OutputStream fos = Files.newOutputStream(propPath)) {
props.store(fos, "");
}
} catch (IOException e) {
@ -88,8 +88,8 @@ class PerCaseProperties {
* @return true if the config exists, false otherwise.
*/
public synchronized boolean configExists(String moduleName) {
File f = new File(getPropertyPath(moduleName)); // NON-NLS
return f.exists();
Path get = Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties");
return Files.exists(get);
}
public synchronized boolean settingExists(String moduleName, String settingName) {
@ -113,8 +113,8 @@ class PerCaseProperties {
* @return The path of the given config file. Returns null if the config
* file doesn't exist.
*/
private synchronized String getPropertyPath(String moduleName) {
return c.getModuleDirectory() + File.separator + moduleName + File.separator + moduleName + ".properties"; //NON-NLS
private synchronized Path getPropertyPath(String moduleName) {
return Paths.get(theCase.getModulesOutputDirAbsPath(), moduleName, theCase.getName() + ".properties"); //NON-NLS
}
/**
@ -196,8 +196,7 @@ class PerCaseProperties {
props.setProperty(kvp.getKey(), kvp.getValue());
}
File path = new File(getPropertyPath(moduleName));
try (FileOutputStream fos = new FileOutputStream(path)) {
try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) {
props.store(fos, "Changed config settings(batch)"); //NON-NLS
}
} catch (IOException e) {
@ -223,8 +222,7 @@ class PerCaseProperties {
props.setProperty(settingName, settingVal);
File path = new File(getPropertyPath(moduleName));
try (FileOutputStream fos = new FileOutputStream(path)) {
try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) {
props.store(fos, "Changed config settings(single)"); //NON-NLS
}
} catch (IOException e) {
@ -249,8 +247,7 @@ class PerCaseProperties {
Properties props = fetchProperties(moduleName);
props.remove(key);
File path = new File(getPropertyPath(moduleName));
try (FileOutputStream fos = new FileOutputStream(path)) {
try (OutputStream fos = Files.newOutputStream(getPropertyPath(moduleName))) {
props.store(fos, "Removed " + key); //NON-NLS
}
}
@ -274,7 +271,7 @@ class PerCaseProperties {
Logger.getLogger(PerCaseProperties.class.getName()).log(Level.INFO, "File did not exist. Created file [" + moduleName + ".properties]"); //NON-NLS NON-NLS
}
Properties props;
try (InputStream inputStream = new FileInputStream(getPropertyPath(moduleName))) {
try (InputStream inputStream = Files.newInputStream(getPropertyPath(moduleName))) {
props = new Properties();
props.load(inputStream);
}

1
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/ThumbnailCache.java
View File

@ -153,6 +153,7 @@ public enum ThumbnailCache {
}
private static File getCacheFile(long id) {
// @@@ should use ImageUtils.getFile();
return new File(Case.getCurrentCase().getCacheDirectory() + File.separator + id + ".png");
}

9
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/actions/CategorizeAction.java
View File

@ -95,23 +95,16 @@ public class CategorizeAction extends AddTagAction {
//remove old category tag if necessary
List<ContentTag> allContentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByContent(file);
boolean hadExistingCategory = false;
for (ContentTag ct : allContentTags) {
//this is bad: treating tags as categories as long as their names start with prefix
//TODO: abandon using tags for categories and instead add a new column to DrawableDB
if (ct.getName().getDisplayName().startsWith(Category.CATEGORY_PREFIX)) {
LOGGER.log(Level.INFO, "removing old category from {0}", file.getName());
//LOGGER.log(Level.INFO, "removing old category from {0}", file.getName());
Case.getCurrentCase().getServices().getTagsManager().deleteContentTag(ct);
controller.getDatabase().decrementCategoryCount(Category.fromDisplayName(ct.getName().getDisplayName()));
hadExistingCategory = true;
}
}
// If the image was uncategorized, decrement the uncategorized count
if(! hadExistingCategory){
controller.getDatabase().decrementCategoryCount(Category.ZERO);
}
controller.getDatabase().incrementCategoryCount(Category.fromDisplayName(tagName.getDisplayName()));
if (tagName != Category.ZERO.getTagName()) { // no tags for cat-0
Case.getCurrentCase().getServices().getTagsManager().addContentTag(file, tagName, comment);

2
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/Category.java
View File

@ -66,7 +66,7 @@ public enum Category implements Comparable<Category> {
private final static Set<CategoryListener> listeners = new HashSet<>();
public static void fireChange(Collection<Long> ids) {
Set<CategoryListener> listenersCopy = new HashSet<CategoryListener>(listeners);
Set<CategoryListener> listenersCopy = new HashSet<>();
synchronized (listeners) {
listenersCopy.addAll(listeners);
}

95
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableDB.java
View File

@ -50,6 +50,8 @@ import org.sleuthkit.autopsy.imagegallery.grouping.GroupManager;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy;
import static org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy.GROUP_BY_VALUE;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.ContentTag;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TagName;
@ -1123,6 +1125,56 @@ public class DrawableDB {
}
}
/*
* The following groups of functions are used to store information in memory instead
* of in the database. Due to the change listeners in the GUI, this data is requested
* many, many times when browsing the images, and especially when making any
* changes to things like categories.
*
* I don't like having multiple copies of the data, but these were causing major
* bottlenecks when they were all database lookups.
*/
@GuardedBy("hashSetMap")
private final Map<Long, Set<String>> hashSetMap = new HashMap<>();
@GuardedBy("hashSetMap")
public boolean isInHashSet(Long id){
if(! hashSetMap.containsKey(id)){
updateHashSetsForFile(id);
}
return (! hashSetMap.get(id).isEmpty());
}
@GuardedBy("hashSetMap")
public Set<String> getHashSetsForFile(Long id){
if(! isInHashSet(id)){
updateHashSetsForFile(id);
}
return hashSetMap.get(id);
}
@GuardedBy("hashSetMap")
public void updateHashSetsForFile(Long id){
try {
List<BlackboardArtifact> arts = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, id);
Set<String> hashNames = new HashSet<>();
for(BlackboardArtifact a:arts){
List<BlackboardAttribute> attrs = a.getAttributes();
for(BlackboardAttribute attr:attrs){
if(attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()){
hashNames.add(attr.getValueString());
}
}
}
hashSetMap.put(id, hashNames);
} catch (IllegalStateException | TskCoreException ex) {
LOGGER.log(Level.WARNING, "could not access case during updateHashSetsForFile()", ex);
}
}
/**
* For performance reasons, keep a list of all file IDs currently in the image database.
* Otherwise the database is queried many times to retrieve the same data.
@ -1148,6 +1200,12 @@ public class DrawableDB {
}
}
public int getNumberOfImageFilesInList(){
synchronized (fileIDlist){
return fileIDlist.size();
}
}
public void initializeImageList(){
synchronized (fileIDlist){
dbReadLock();
@ -1173,50 +1231,40 @@ public class DrawableDB {
private final Map<Category, Integer> categoryCounts = new HashMap<>();
public void incrementCategoryCount(Category cat) throws TskCoreException{
if(cat != Category.ZERO){
synchronized(categoryCounts){
int count = getCategoryCount(cat);
count++;
categoryCounts.put(cat, count);
}
}
}
public void decrementCategoryCount(Category cat) throws TskCoreException{
if(cat != Category.ZERO){
synchronized(categoryCounts){
int count = getCategoryCount(cat);
count--;
categoryCounts.put(cat, count);
}
}
}
public int getCategoryCount(Category cat) throws TskCoreException{
synchronized(categoryCounts){
if(categoryCounts.containsKey(cat)){
if(cat == Category.ZERO){
// Keeping track of the uncategorized files is a bit tricky while ingest
// is going on, so always use the list of file IDs we already have along with the
// other category counts instead of trying to track it separately.
int allOtherCatCount = getCategoryCount(Category.ONE) + getCategoryCount(Category.TWO) + getCategoryCount(Category.THREE) +
getCategoryCount(Category.FOUR) + getCategoryCount(Category.FIVE);
return getNumberOfImageFilesInList() - allOtherCatCount;
}
else if(categoryCounts.containsKey(cat)){
return categoryCounts.get(cat);
}
else{
try {
if (cat == Category.ZERO) {
// Category Zero (Uncategorized) files will not be tagged as such -
// this is really just the default setting. So we count the number of files
// tagged with the other categories and subtract from the total.
int allOtherCatCount = 0;
TagName[] tns = {Category.FOUR.getTagName(), Category.THREE.getTagName(), Category.TWO.getTagName(), Category.ONE.getTagName(), Category.FIVE.getTagName()};
for (TagName tn : tns) {
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn);
for (ContentTag ct : contentTags) {
if(ct.getContent() instanceof AbstractFile){
AbstractFile f = (AbstractFile)ct.getContent();
if(this.isImageFile(f.getId())){
allOtherCatCount++;
}
}
}
}
categoryCounts.put(cat, this.countAllFiles() - allOtherCatCount);
return categoryCounts.get(cat);
} else {
int fileCount = 0;
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(cat.getTagName());
for (ContentTag ct : contentTags) {
@ -1229,7 +1277,6 @@ public class DrawableDB {
}
categoryCounts.put(cat, fileCount);
return fileCount;
}
} catch(IllegalStateException ex){
throw new TskCoreException("Case closed while getting files");
}

12
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java
View File

@ -35,6 +35,7 @@ import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.text.WordUtils;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryModule;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
@ -97,8 +98,6 @@ public abstract class DrawableFile<T extends AbstractFile> extends AbstractFile
private final SimpleObjectProperty<Category> category = new SimpleObjectProperty<>(null);
private Collection<String> hashHitSetNames;
private String make;
private String model;
@ -116,16 +115,11 @@ public abstract class DrawableFile<T extends AbstractFile> extends AbstractFile
public abstract boolean isVideo();
public Collection<String> getHashHitSetNames() {
updateHashSets();
synchronized public Collection<String> getHashHitSetNames() {
Collection<String> hashHitSetNames = ImageGalleryController.getDefault().getDatabase().getHashSetsForFile(getId());
return hashHitSetNames;
}
@SuppressWarnings("unchecked")
private void updateHashSets() {
hashHitSetNames = (Collection<String>) getValuesOfBBAttribute(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME);
}
@Override
public boolean isRoot() {
return false;

20
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/DrawableGroup.java
View File

@ -25,8 +25,6 @@ import javafx.collections.FXCollections;
import javafx.collections.ObservableList;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Represents a set of image/video files in a group. The UI listens to changes
@ -65,18 +63,26 @@ public class DrawableGroup implements Comparable<DrawableGroup>{
return getFilesWithHashSetHitsCount() / (double) getSize();
}
/**
* Call to indicate that an image has been added or removed from the group,
* so the hash counts may not longer be accurate.
*/
synchronized public void invalidateHashSetHitsCount() {
filesWithHashSetHitsCount = -1;
}
synchronized public int getFilesWithHashSetHitsCount() {
//TODO: use the drawable db for this ? -jm
if (filesWithHashSetHitsCount < 0) {
filesWithHashSetHitsCount = 0;
for (Long fileID : fileIds()) {
try {
long artcount = ImageGalleryController.getDefault().getSleuthKitCase().getBlackboardArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, fileID);
if (artcount > 0) {
if (ImageGalleryController.getDefault().getDatabase().isInHashSet(fileID)) {
filesWithHashSetHitsCount++;
}
} catch (IllegalStateException | TskCoreException ex) {
LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()", ex);
} catch (IllegalStateException | NullPointerException ex) {
LOGGER.log(Level.WARNING, "could not access case during getFilesWithHashSetHitsCount()");
break;
}
}
@ -109,12 +115,14 @@ public class DrawableGroup implements Comparable<DrawableGroup>{
}
synchronized public void addFile(Long f) {
invalidateHashSetHitsCount();
if (fileIDs.contains(f) == false) {
fileIDs.add(f);
}
}
synchronized public void removeFile(Long f) {
invalidateHashSetHitsCount();
fileIDs.removeAll(f);
}

32
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/grouping/GroupManager.java
View File

@ -281,6 +281,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
final DrawableGroup group = getGroupForKey(groupKey);
if (group != null) {
group.removeFile(fileID);
// If we're grouping by category, we don't want to remove empty groups.
if (group.groupKey.getValueDisplayName().startsWith("CAT-")) {
return;
} else {
if (group.fileIds().isEmpty()) {
synchronized (groupMap) {
groupMap.remove(groupKey, group);
@ -292,7 +297,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
}
});
}
}
}
}
@ -487,7 +492,7 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
for (TagName tn : tns) {
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tn);
for (ContentTag ct : contentTags) {
if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
files.add(ct.getContent().getId());
}
}
@ -499,7 +504,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
List<Long> files = new ArrayList<>();
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(category.getTagName());
for (ContentTag ct : contentTags) {
if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
files.add(ct.getContent().getId());
}
}
@ -516,8 +522,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
* Count the number of files with the given category.
* This is faster than getFileIDsWithCategory and should be used if only the
* counts are needed and not the file IDs.
*
* @param category Category to match against
*
* @return Number of files with the given category
*
* @throws TskCoreException
*/
public int countFilesWithCategory(Category category) throws TskCoreException {
@ -529,7 +538,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
List<Long> files = new ArrayList<>();
List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByTagName(tagName);
for (ContentTag ct : contentTags) {
if (ct.getContent() instanceof AbstractFile && ImageGalleryModule.isSupportedAndNotKnown((AbstractFile) ct.getContent())) {
if (ct.getContent() instanceof AbstractFile && db.isImageFile(((AbstractFile) ct.getContent()).getId())) {
files.add(ct.getContent().getId());
}
}
@ -608,15 +618,11 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
}
}
/**
* an executor to submit async ui related background tasks to.
*/
final ExecutorService regroupExecutor = Executors.newSingleThreadExecutor(new BasicThreadFactory.Builder().namingPattern("ui task -%d").build());
public ReadOnlyDoubleProperty regroupProgress() {
return regroupProgress.getReadOnlyProperty();
}
@ -625,6 +631,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
* handle {@link FileUpdateEvent} sent from Db when files are
* inserted/updated
*
* TODO: why isn't this just two methods!
*
* @param evt
*/
@Override
@ -649,6 +657,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
if (checkAnalyzed != null) { // => the group is analyzed, so add it to the ui
populateAnalyzedGroup(gk, checkAnalyzed);
}
} else {
g.invalidateHashSetHitsCount();
}
}
}
@ -669,6 +679,8 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
*/
for (final long fileId : fileIDs) {
db.updateHashSetsForFile(fileId);
//get grouping(s) this file would be in
Set<GroupKey<?>> groupsForFile = getGroupKeysForFileID(fileId);
@ -688,13 +700,13 @@ public class GroupManager implements FileUpdateEvent.FileUpdateListener {
}
}
}
if (evt.getChangedAttribute() == DrawableAttribute.CATEGORY) {
Category.fireChange(fileIDs);
}
if (evt.getChangedAttribute() == DrawableAttribute.TAGS) {
TagUtils.fireChange(fileIDs);
}
break;
}
}

9
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/DrawableView.java
View File

@ -1,6 +1,7 @@
package org.sleuthkit.autopsy.imagegallery.gui;
import java.util.Collection;
import java.util.logging.Level;
import javafx.application.Platform;
import javafx.scene.layout.Border;
import javafx.scene.layout.BorderStroke;
@ -9,6 +10,7 @@ import javafx.scene.layout.BorderWidths;
import javafx.scene.layout.CornerRadii;
import javafx.scene.layout.Region;
import javafx.scene.paint.Color;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.ThreadConfined;
import org.sleuthkit.autopsy.imagegallery.TagUtils;
import org.sleuthkit.autopsy.imagegallery.datamodel.Category;
@ -56,7 +58,14 @@ public interface DrawableView extends Category.CategoryListener, TagUtils.TagLis
void handleTagsChanged(Collection<Long> ids);
default boolean hasHashHit() {
try{
return getFile().getHashHitSetNames().isEmpty() == false;
} catch (NullPointerException ex){
// I think this happens when we're in the process of removing images from the view while
// also trying to update it?
Logger.getLogger(DrawableView.class.getName()).log(Level.WARNING, "Error looking up hash set hits");
return false;
}
}
static Border getCategoryBorder(Category category) {

122
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeCell.java
View File

@ -1,8 +1,28 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013-15 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.imagegallery.gui.navpanel;
import static java.util.Objects.isNull;
import java.util.Optional;
import javafx.application.Platform;
import javafx.beans.InvalidationListener;
import javafx.beans.Observable;
import javafx.scene.Node;
import javafx.scene.control.OverrunStyle;
import javafx.scene.control.Tooltip;
import javafx.scene.control.TreeCell;
@ -13,93 +33,95 @@ import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute;
import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
/**
* A {@link Node} in the tree that listens to its associated group. Manages
* visual representation of TreeNode in Tree. Listens to properties of group
* that don't impact hierarchy and updates ui to reflect them
* A cell in the NavPanel tree that listens to its associated group's fileids.
* Manages visual representation of TreeNode in Tree. Listens to properties of
* group that don't impact hierarchy and updates ui to reflect them
*/
class GroupTreeCell extends TreeCell<TreeNode> {
/**
* icon to use if this cell's TreeNode doesn't represent a group but just a
* folder(with no DrawableFiles) in the hierarchy.
* folder(with no DrawableFiles) in the file system hierarchy.
*/
private static final Image EMPTY_FOLDER_ICON = new Image("org/sleuthkit/autopsy/imagegallery/images/folder.png");
/**
* reference to listener that allows us to remove it from a group when a new
* group is assigned to this Cell
*/
private InvalidationListener listener;
public GroupTreeCell() {
//TODO: move this to .css file
//adjust indent, default is 10 which uses up a lot of space.
setStyle("-fx-indent:5;");
//since end of path is probably more interesting put ellipsis at front
setTextOverrun(OverrunStyle.LEADING_ELLIPSIS);
Platform.runLater(() -> {
prefWidthProperty().bind(getTreeView().widthProperty().subtract(15));
});
}
@Override
synchronized protected void updateItem(final TreeNode tNode, boolean empty) {
super.updateItem(tNode, empty);
prefWidthProperty().bind(getTreeView().widthProperty().subtract(15));
protected synchronized void updateItem(final TreeNode tNode, boolean empty) {
//if there was a previous group, remove the listener
Optional.ofNullable(getItem())
.map(TreeNode::getGroup)
.ifPresent((DrawableGroup t) -> {
t.fileIds().removeListener(listener);
});
if (tNode == null || empty) {
super.updateItem(tNode, empty);
if (isNull(tNode) || empty) {
Platform.runLater(() -> {
setTooltip(null);
setText(null);
setGraphic(null);
});
} else {
final String name = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN);
Platform.runLater(() -> {
setTooltip(new Tooltip(name));
});
final String groupName = StringUtils.defaultIfBlank(tNode.getPath(), DrawableGroup.UNKNOWN);
if (tNode.getGroup() == null) {
if (isNull(tNode.getGroup())) {
//"dummy" group in file system tree <=> a folder with no drawables
Platform.runLater(() -> {
setText(name);
setTooltip(new Tooltip(groupName));
setText(groupName);
setGraphic(new ImageView(EMPTY_FOLDER_ICON));
});
} else {
//if number of files in this group changes (eg file is recategorized), update counts
tNode.getGroup().fileIds().addListener((Observable o) -> {
listener = (Observable o) -> {
final String countsText = getCountsText();
Platform.runLater(() -> {
setText(name + " (" + getNumerator() + getDenominator() + ")");
});
setText(groupName + countsText);
});
};
//if number of files in this group changes (eg file is recategorized), update counts via listener
tNode.getGroup().fileIds().addListener(listener);
Platform.runLater(() -> {
//this TreeNode has a group so append counts to name ...
setText(name + " (" + getNumerator() + getDenominator() + ")");
//... and use icon corresponding to group type
setGraphic(new ImageView(tNode.getGroup().groupKey.getAttribute().getIcon()));
final Image icon = tNode.getGroup().groupKey.getAttribute().getIcon();
final String countsText = getCountsText();
Platform.runLater(() -> {
setTooltip(new Tooltip(groupName));
setGraphic(new ImageView(icon));
setText(groupName + countsText);
});
}
}
}
/**
* @return the Numerator of the count to append to the group name = number
* of hashset hits + "/"
*/
synchronized private String getNumerator() {
try {
final String numerator = (getItem().getGroup().groupKey.getAttribute() != DrawableAttribute.HASHSET)
? getItem().getGroup().getFilesWithHashSetHitsCount() + "/"
: "";
return numerator;
} catch (NullPointerException e) {
//instead of this try catch block, remove the listener when assigned a null treeitem / group
return "";
}
}
private synchronized String getCountsText() {
final String counts = Optional.ofNullable(getItem())
.map(TreeNode::getGroup)
.map((DrawableGroup t) -> {
return " (" + ((t.groupKey.getAttribute() == DrawableAttribute.HASHSET)
? Integer.toString(t.getSize())
: t.getFilesWithHashSetHitsCount() + "/" + t.getSize()) + ")";
}).orElse(""); //if item is null or group is null
/**
* @return the Denominator of the count to append to the group name = number
* of files in group
*/
synchronized private Integer getDenominator() {
try {
return getItem().getGroup().getSize();
} catch (NullPointerException ex) {
return 0;
}
return counts;
}
}

59
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java
View File

@ -37,10 +37,28 @@ import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
*/
class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeItem> {
static GroupTreeItem getTreeItemForGroup(GroupTreeItem root, DrawableGroup grouping) {
if (Objects.equals(root.getValue().getGroup(), grouping)) {
return root;
} else {
synchronized (root.getChildren()) {
for (TreeItem<TreeNode> child : root.getChildren()) {
final GroupTreeItem childGTI = (GroupTreeItem) child;
GroupTreeItem val = getTreeItemForGroup(childGTI, grouping);
if (val != null) {
return val;
}
}
}
}
return null;
}
/**
* maps a path segment to the child item of this item with that path segment
*/
private Map<String, GroupTreeItem> childMap = new HashMap<>();
private final Map<String, GroupTreeItem> childMap = new HashMap<>();
/**
* the comparator if any used to sort the children of this item
*/
@ -88,13 +106,10 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
prefixTreeItem = newTreeItem;
childMap.put(prefix, prefixTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
}
}
});
}
@ -109,16 +124,13 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
newTreeItem.setExpanded(true);
childMap.put(path, newTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
if (comp != null) {
FXCollections.sort(getChildren(), comp);
}
}
}
});
}
@ -147,13 +159,10 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
prefixTreeItem = newTreeItem;
childMap.put(prefix, prefixTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
}
}
});
}
@ -169,16 +178,13 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
newTreeItem.setExpanded(true);
childMap.put(path.get(0), newTreeItem);
Platform.runLater(new Runnable() {
@Override
public void run() {
Platform.runLater(() -> {
synchronized (getChildren()) {
getChildren().add(newTreeItem);
if (comp != null) {
FXCollections.sort(getChildren(), comp);
}
}
}
});
}
}
@ -189,24 +195,6 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
return comp.compare(this, o);
}
static GroupTreeItem getTreeItemForGroup(GroupTreeItem root, DrawableGroup grouping) {
if (Objects.equals(root.getValue().getGroup(), grouping)) {
return root;
} else {
synchronized (root.getChildren()) {
for (TreeItem<TreeNode> child : root.getChildren()) {
final GroupTreeItem childGTI = (GroupTreeItem) child;
GroupTreeItem val = getTreeItemForGroup(childGTI, grouping);
if (val != null) {
return val;
}
}
}
}
return null;
}
GroupTreeItem getTreeItemForPath(List<String> path) {
// end of recursion
if (path.isEmpty()) {
@ -253,4 +241,5 @@ class GroupTreeItem extends TreeItem<TreeNode> implements Comparable<GroupTreeIt
ti.resortChildren(comp);
}
}
}

91
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/NavPanel.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013 Basis Technology Corp.
* Copyright 2013-15 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -20,7 +20,6 @@ package org.sleuthkit.autopsy.imagegallery.gui.navpanel;
import java.net.URL;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import java.util.ResourceBundle;
import javafx.application.Platform;
@ -41,23 +40,21 @@ import javafx.scene.control.TreeView;
import javafx.scene.layout.Priority;
import javafx.scene.layout.VBox;
import org.apache.commons.lang3.StringUtils;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.coreutils.ThreadConfined;
import org.sleuthkit.autopsy.coreutils.ThreadConfined.ThreadType;
import org.sleuthkit.autopsy.imagegallery.FXMLConstructor;
import org.sleuthkit.autopsy.imagegallery.ImageGalleryController;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableAttribute;
import org.sleuthkit.autopsy.imagegallery.datamodel.DrawableFile;
import org.sleuthkit.autopsy.imagegallery.grouping.DrawableGroup;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupKey;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupSortBy;
import org.sleuthkit.autopsy.imagegallery.grouping.GroupViewState;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Display two trees. one shows all folders (groups) and calls out folders with
* images. the user can select folders with images to see them in the main
* GroupPane The other shows folders with hash set hits.
*
* //TODO: there is too much code duplication between the navTree and the
* hashTree. Extract the common code to some new class.
*/
public class NavPanel extends TabPane {
@ -177,17 +174,8 @@ public class NavPanel extends TabPane {
}
if (wasPermuted) {
// Remove everything and add it again in the new order
for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){
removeFromNavTree(g);
removeFromHashTree(g);
}
for(DrawableGroup g:controller.getGroupManager().getAnalyzedGroups()){
insertIntoNavTree(g);
if (g.getFilesWithHashSetHitsCount() > 0) {
insertIntoHashTree(g);
}
}
rebuildTrees();
}
});
@ -205,6 +193,27 @@ public class NavPanel extends TabPane {
});
}
private void rebuildTrees() {
navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
hashTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
ObservableList<DrawableGroup> groups = controller.getGroupManager().getAnalyzedGroups();
for (DrawableGroup g : groups) {
insertIntoNavTree(g);
if (g.getFilesWithHashSetHitsCount() > 0) {
insertIntoHashTree(g);
}
}
Platform.runLater(() -> {
navTree.setRoot(navTreeRoot);
navTreeRoot.setExpanded(true);
hashTree.setRoot(hashTreeRoot);
hashTreeRoot.setExpanded(true);
});
}
private void updateControllersGroup() {
final TreeItem<TreeNode> selectedItem = activeTreeProperty.get().getSelectionModel().getSelectedItem();
if (selectedItem != null && selectedItem.getValue() != null && selectedItem.getValue().getGroup() != null) {
@ -216,11 +225,6 @@ public class NavPanel extends TabPane {
hashTreeRoot.resortChildren(sortByBox.getSelectionModel().getSelectedItem());
}
private void insertIntoHashTree(DrawableGroup g) {
initHashTree();
hashTreeRoot.insert(g.groupKey.getValueDisplayName(), g, false);
}
/**
* Set the tree to the passed in group
*
@ -235,10 +239,13 @@ public class NavPanel extends TabPane {
if (treeItemForGroup != null) {
/* When we used to run the below code on the FX thread, it would
* get into infinite loops when the next group button was pressed quickly
* because the udpates became out of order and History could not keep
* track of what was current. Currently (4/2/15), this method is
* already on the FX thread, so it is OK. */
* get into infinite loops when the next group button was pressed
* quickly because the udpates became out of order and History could
* not
* keep track of what was current.
*
* Currently (4/2/15), this method is already on the FX thread, so
* it is OK. */
//Platform.runLater(() -> {
TreeItem<TreeNode> ti = treeItemForGroup;
while (ti != null) {
@ -250,11 +257,10 @@ public class NavPanel extends TabPane {
activeTreeProperty.get().getSelectionModel().select(treeItemForGroup);
activeTreeProperty.get().scrollTo(row);
}
//});
//}); //end Platform.runLater
}
}
@SuppressWarnings("fallthrough")
private static List<String> groupingToPath(DrawableGroup g) {
if (g.groupKey.getAttribute() == DrawableAttribute.PATH) {
@ -269,11 +275,14 @@ public class NavPanel extends TabPane {
}
}
private void insertIntoHashTree(DrawableGroup g) {
initHashTree();
hashTreeRoot.insert(groupingToPath(g), g, false);
}
private void insertIntoNavTree(DrawableGroup g) {
initNavTree();
List<String> path = groupingToPath(g);
navTreeRoot.insert(path, g, true);
navTreeRoot.insert(groupingToPath(g), g, true);
}
private void removeFromNavTree(DrawableGroup g) {
@ -313,22 +322,4 @@ public class NavPanel extends TabPane {
});
}
}
//these are not used anymore, but could be usefull at some point
//TODO: remove them or find a use and undeprecate
@Deprecated
private void rebuildNavTree() {
navTreeRoot = new GroupTreeItem("", null, sortByBox.getSelectionModel().selectedItemProperty().get());
ObservableList<DrawableGroup> groups = controller.getGroupManager().getAnalyzedGroups();
for (DrawableGroup g : groups) {
insertIntoNavTree(g);
}
Platform.runLater(() -> {
navTree.setRoot(navTreeRoot);
navTreeRoot.setExpanded(true);
});
}
}

1
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
View File

@ -283,3 +283,4 @@ KeywordSearchModuleFactory.createFileIngestModule.exception.msg=Expected setting
SearchRunner.Searcher.done.err.msg=Error performing keyword search
KeywordSearchGlobalSearchSettingsPanel.timeRadioButton5.toolTipText=Fastest overall, but no results until the end
KeywordSearchGlobalSearchSettingsPanel.timeRadioButton5.text=No periodic searches
KeywordSearchIngestModule.startUp.fileTypeDetectorInitializationException.msg=Error initializing the file type detector.

31
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java
View File

@ -37,7 +37,6 @@ import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.keywordsearch.Ingester.IngesterException;
import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskData;
import org.sleuthkit.datamodel.TskData.FileKnown;
@ -74,6 +73,7 @@ public final class KeywordSearchIngestModule implements FileIngestModule {
private final IngestServices services = IngestServices.getInstance();
private Ingester ingester = null;
private Indexer indexer;
private FileTypeDetector fileTypeDetector;
//only search images from current ingest, not images previously ingested/indexed
//accessed read-only by searcher thread
@ -130,6 +130,11 @@ public final class KeywordSearchIngestModule implements FileIngestModule {
jobId = context.getJobId();
dataSourceId = context.getDataSource().getId();
try {
fileTypeDetector = new FileTypeDetector();
} catch (FileTypeDetector.FileTypeDetectorInitException ex) {
throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "KeywordSearchIngestModule.startUp.fileTypeDetectorInitializationException.msg"));
}
ingester = Server.getIngester();
this.context = context;
@ -470,31 +475,13 @@ public final class KeywordSearchIngestModule implements FileIngestModule {
return;
}
// try to get the file type from the BB
String detectedFormat = null;
String detectedFormat;
try {
ArrayList<BlackboardAttribute> attributes = aFile.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
for (BlackboardAttribute attribute : attributes) {
detectedFormat = attribute.getValueString();
break;
}
detectedFormat = fileTypeDetector.getFileType(aFile);
} catch (TskCoreException ex) {
}
// else, use FileType module to detect the format
if (detectedFormat == null) {
try {
detectedFormat = new FileTypeDetector().detectAndPostToBlackboard(aFile);
} catch (FileTypeDetector.FileTypeDetectorInitException | TskCoreException ex) {
logger.log(Level.WARNING, "Could not detect format using file type detector for file: {0}", aFile); //NON-NLS
logger.log(Level.SEVERE, String.format("Could not detect format using fileTypeDetector for file: %s", aFile), ex); //NON-NLS
return;
}
if (detectedFormat == null) {
logger.log(Level.WARNING, "Could not detect format using file type detector for file: {0}", aFile); //NON-NLS
return;
}
}
// we skip archive formats that are opened by the archive module.
// @@@ We could have a check here to see if the archive module was enabled though...

4
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java
View File

@ -340,7 +340,6 @@ class LuceneQuery implements KeywordSearchQuery {
List<String> snippetList = highlightResponse.get(docId).get(Server.Schema.TEXT.toString());
// list is null if there wasn't a snippet
if (snippetList != null) {
snippetList.sort(null);
snippet = EscapeUtil.unEscapeHtml(snippetList.get(0)).trim();
}
}
@ -440,7 +439,6 @@ class LuceneQuery implements KeywordSearchQuery {
//docs says makes sense for the original Highlighter only, but not really
//analyze all content SLOW! consider lowering
q.setParam("hl.maxAnalyzedChars", Server.HL_ANALYZE_CHARS_UNLIMITED); //NON-NLS
q.setParam("hl.preserveMulti", true); //NON-NLS
try {
QueryResponse response = solrServer.query(q, METHOD.POST);
@ -453,8 +451,6 @@ class LuceneQuery implements KeywordSearchQuery {
if (contentHighlights == null) {
return "";
} else {
// Sort contentHighlights in order to get consistently same snippet.
contentHighlights.sort(null);
// extracted content is HTML-escaped, but snippet goes in a plain text field
return EscapeUtil.unEscapeHtml(contentHighlights.get(0)).trim();
}

3
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java
View File

@ -1097,8 +1097,7 @@ public class Server {
filterQuery = filterQuery + Server.ID_CHUNK_SEP + chunkID;
}
q.addFilterQuery(filterQuery);
// sort the TEXT field
q.setSortField(Schema.TEXT.toString(), SolrQuery.ORDER.asc);
q.setFields(Schema.TEXT.toString());
try {
// Get the first result.
SolrDocument solrDocument = solrCore.query(q).getResults().get(0);

2
docs/doxygen/Doxyfile
View File

@ -133,7 +133,7 @@ ALWAYS_DETAILED_SEC = NO
# operators of the base classes will not be shown.
# The default value is: NO.
INLINE_INHERITED_MEMB = NO
INLINE_INHERITED_MEMB = YES
# If the FULL_PATH_NAMES tag is set to YES, doxygen will prepend the full path
# before files name in the file list and in the header files. If set to NO the

2
docs/doxygen/modDevPython.dox
View File

@ -60,7 +60,7 @@ To distribute and share your Python module, ZIP up the folder and send it around
Jython allows you to access all of the Java classes. So, you should read the following sections of this document. All you should ignore is the Java environment setup sections.
There are only two types of modules that you can make with Python. Those (along with a sample file) are listed below:
- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/ingestmodule.py
- Ingest Modules (both file-level and data source-level): https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/
- Report Modules: https://github.com/sleuthkit/autopsy/blob/develop/pythonExamples/reportmodule.py
*/

32
docs/doxygen/modIngest.dox
View File

@ -100,10 +100,12 @@ Before we cover the specific interfaces of the two different types of modules, l
To create a data source ingest module:
-# Create the ingest module class by either:
- Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE
- Copy and paste the sample modules from:
- Java: Core/src/org/sleuthkit/autopsy/examples/SampleDataSourceIngestModule.java
- Python: pythonExamples/dataSourceIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
- Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.DataSourceIngestModule. If you are using Java, the NetBeans IDE
will complain that you have not implemented one or more of the required methods.
You can use its "hints" to automatically generate stubs for the missing methods.
- Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py.
-# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isDataSourceIngestModuleFactory() method to return true and have the createDataSourceIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code:
\code
@ -119,8 +121,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
\endcode
-# Use this page, the sample, and the documentation for the
org.sleuthkit.autopsy.ingest.DataSourceIngestModule interfaces to implement the startUp() and process() methods.
The process() method is where all of the work of a data source ingest module is
- org.sleuthkit.autopsy.ingest.DataSourceIngestModule.startUp() is where any initialiation occurs. If your module has a critical failure and will not be able to run, your startUp method should throw an IngestModuleException to stop ingest.
- org.sleuthkit.autopsy.ingest.DataSourceIngestModule.process() is where all of the work of a data source ingest module is
done. It will be called exactly once. The
process() method receives a reference to an org.sleuthkit.datamodel.Content object
and an org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress object.
@ -140,10 +142,12 @@ org.sleuthkit.autopsy.casemodule.services.FileManager class. See
To create a file ingest module:
To create a data source ingest module:
-# Create the ingest module class by either:
- Define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE
- Copy and paste the sample modules from:
- Java: Core/src/org/sleuthkit/autopsy/examples/SampleFileIngestModule.java
- Python: pythonExamples/fileIngestModule.py (https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples)
- Or the manual approach is to define a new class that implements (Java) or inherits (Jython) org.sleuthkit.autopsy.ingest.FileIngestModule. If you are using Java, the NetBeans IDE
will complain that you have not implemented one or more of the required methods.
You can use its "hints" to automatically generate stubs for the missing methods.
- Copy and paste the sample modules from org.sleuthkit.autopsy.examples.SampleDataSourceIngestModule or org.sleuthkit.autopsy.examples.ingestmodule.py.
-# Configure your factory class to create instances of the new ingest module class. To do this, you will need to change the isFileIngestModuleFactory() method to return true and have the createFileIngestModule() method return a new instance of your ingest module. Both of these methods have default "no-op" implementations in the IngestModuleFactoryAdapter that we used. Your factory should have code similar to this Java code:
\code
@ -160,9 +164,8 @@ You can use its "hints" to automatically generate stubs for the missing methods.
-# Use this page, the sample, and the documentation for the
org.sleuthkit.autopsy.ingest.FileIngestModule interface to implement the startUp(), and process(), and shutDown() methods.
The process() method is where all of the work of a file ingest module is
- org.sleuthkit.autopsy.ingest.FileIngestModule.startUp() should have any code that you need to initialize your module. If you have any startup errors, be sure to throw a IngestModuleException exception to stop ingest.
- org.sleuthkit.autopsy.ingest.FileIngestModule.process() is where all of the work of a file ingest module is
done. It will be called repeatedly between startUp() and shutDown(), once for
each file Autopsy feeds into the pipeline of which the module instance is a part. The
process() method receives a reference to a org.sleuthkit.datamodel.AbstractFile
@ -271,17 +274,22 @@ that the samples do not do anything particularly useful.
Autopsy allows you to provide a graphical panel that will be displayed when the user decides to enable the ingest module. This panel is supposed to be for settings that the user may turn on or off for different data sources.
To provide options for each ingest job:
- Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.hasIngestJobSettingsPanel() in your factory class to return true.
- Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.getIngestJobSettingsPanel() in your factory class to return a IngestModuleIngestJobSettingsPanel that displays the needed configuration options and returns a IngestModuleIngestJobSettings object based on the settings. This will get passed in the last configuration setting that was used, so that you can populate the panel accordlingly and the user doesn't have to choose new settings.
- Create a class based on org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings to store the settings.
- Update org.sleuthkit.autopsy.ingest.IngestModuleFactory.getIngestJobSettingsPanel() in your factory class to return a IngestModuleIngestJobSettingsPanel that displays the needed configuration options. The org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel.getSettings() method should return an instance of a org.sleutkit.autopsy.ingest.IngestModuleIngestJobSettings object based on the user-specified settings (see next bullet).
- Create a class that implements org.sleutkit.autopsy.ingest.IngestModuleIngestJobSettings. Your IngestModuleIngestJobSettingsPanel should store settings in here. This class needs to be Serializable, so keep all data types simple or mark them as transient with some custom deserialization code. You should also set the serialVersionUID (see http://stackoverflow.com/questions/285793/what-is-a-serialversionuid-and-why-should-i-use-it).
- If you decide to store settings internal to the module (NOT RECOMMENDED), the getSettings() method can return an instance of NoIngestModuleIngestJobSettings.
- Your instance of IngestModuleIngestJobSettings will be saved and passed to your panel the next time so that you can pre-populate it accordingly.
Your panel should create the IngestModuleIngestJobSettings class to store the settings and that will be passed back into your factory with each call to createDataSourceIngestModule() or createFileIngestModule(). The way that we have implemented this in Autopsy modules is that the factory casts the IngestModuleINgestJobSettings object to the module-specific implementation and then passes it into the constructor of the ingest module. The ingest module can then call whatever getter methods that were defined based on the panel settings.
Your panel should create the IngestModuleIngestJobSettings class to store the settings and that will be passed back into your factory with each call to createDataSourceIngestModule() or createFileIngestModule(). The factory should cast it to its internal class that implements IngestModuleIngestJobSettings and pass that object into the constructor of its ingest module so that it can use the settings when it runs.
You can also implement the getDefaultIngestJobSettings() method to return an instance of your IngestModuleIngestJobSettings class with default settings. Autopsy will call this when the module has not been run before.
NOTE: We recommend storing simple data in the IngestModuleIngestJobSettings-based class. In the case of our hash lookup module, we store the string names of the hash databases to do lookups in. We then get the hash database handles in the call to startUp() using the global module settings.
NOTE: The main benefit of using the IngestModuleIngestJobSettings-based class to store settings (versus some static variables in your package) are:
- When multiple jobs are running at the same time, each can have their own settings.
- Autopsy persists them so that the last used settings get passed into the call to getIngestJobSettingsPanel() and you don't need to save them yoursevles to provide the user the benefit of re-using the last settings.

6
docs/doxygen/platformConcepts.dox
View File

@ -44,12 +44,10 @@ The blackboard allows modules to communicate with each other and the UI. It has
The blackboard is not unique to Autopsy. It is part of The Sleuth Kit datamodel and The Sleuth Kit Framework. In the name of reducing the amount of documentation that we need to maintain, we provide links here to those documentation sources.
- Details on the blackboard concepts (artifacts versus attributes) can be found at http://sleuthkit.org/sleuthkit/docs/framework-docs/mod_bbpage.html. These documents are about the C++ implementation of the blackboard, but it is the same concepts.
- Details of the Java classes can be found in \ref jni_blackboard section of the The Sleuth Kit JNI documents (http://sleuthkit.org/sleuthkit/docs/jni-docs/).
- \ref mod_bbpage (http://sleuthkit.org/sleuthkit/docs/jni-docs/mod_bbpage.html)
\subsection mod_dev_other_services Framework Services and Utilities
\section mod_dev_other_services Framework Services and Utilities
The following are basic services that are available to any module. They are provided here to be used as a reference. When you are developing your module and feel like something should be provided by the framework, then refer to this list to find out where it could be. If you don't find it, let us know and we'll talk about adding it for other writers to benefit.

18
pythonExamples/README.txt
View File

@ -1,7 +1,13 @@
reportmodule.py -> Report module which implements GeneralReportModuleAdapter.
simpleingestmodule -> Data source ingest module without any GUI example code.
ingestmodule.py -> Both data source ingest module as well as file ingest module WITH an example of GUI code.
This folder contains sample python module files. They are public
domain, so you are free to copy and paste them and modify them to
your needs.
See the developer guide for more details and how to use and load
the modules.
http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html
Each module in this folder should have a brief description about what they
can do.
NOTE: The Python modules must be inside folder inside the folder opened by Tools > Plugins.
For example, place the ingestmodule.py inside folder ingest. Move that ingest folder inside opened by Tools > Plugins
The directory opened by Tools > Plugins is cleared every time the project is cleaned.

127
pythonExamples/simpleingestmodule.py → pythonExamples/dataSourceIngestModule.py
View File

@ -27,95 +27,125 @@
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Simple data source-level ingest module for Autopsy.
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
import jarray
from java.lang import System
from java.util.logging import Level
from org.sleuthkit.datamodel import SleuthkitCase
from org.sleuthkit.datamodel import AbstractFile
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.coreutils import Logger
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.casemodule.services import FileManager
# Sample factory that defines basic functionality and features of the module
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
# Factory that defines the name and details of the module and allows Autopsy
# to create instances of the modules that will do the analysis.
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
class SampleJythonDataSourceIngestModuleFactory(IngestModuleFactoryAdapter):
# TODO: give it a unique name. Will be shown in module list, logs, etc.
moduleName = "Sample Data Source Module"
def getModuleDisplayName(self):
return "Sample Jython ingest module"
return self.moduleName
# TODO: Give it a description
def getModuleDescription(self):
return "Sample Jython Ingest Module without GUI example code"
return "Sample module that does X, Y, and Z."
def getModuleVersionNumber(self):
return "1.0"
# Return true if module wants to get passed in a data source
def isDataSourceIngestModuleFactory(self):
return True
# can return null if isDataSourceIngestModuleFactory returns false
def createDataSourceIngestModule(self, ingestOptions):
# TODO: Change the class name to the name you'll make below
return SampleJythonDataSourceIngestModule()
# Return true if module wants to get called for each file
def isFileIngestModuleFactory(self):
return True
# can return null if isFileIngestModuleFactory returns false
def createFileIngestModule(self, ingestOptions):
return SampleJythonFileIngestModule()
# Data Source-level ingest module. One gets created per data source.
# Queries for various files.
# If you don't need a data source-level module, delete this class.
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
def __init__(self):
self.context = None
# Where any setup and configuration is done
# TODO: Add any setup code that you need here.
def startUp(self, context):
self.context = context
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
# raise IngestModuleException(IngestModule(), "Oh No!")
# Where the analysis is done.
# TODO: Add your analysis code in here.
def process(self, dataSource, progressBar):
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Configure progress bar for 2 tasks
progressBar.switchToDeterminate(2)
logger = Logger.getLogger(SampleJythonDataSourceIngestModuleFactory.moduleName)
# we don't know how much work there is yet
progressBar.switchToIndeterminate()
autopsyCase = Case.getCurrentCase()
sleuthkitCase = autopsyCase.getSleuthkitCase()
services = Services(sleuthkitCase)
fileManager = services.getFileManager()
# Get count of files with "test" in name.
fileCount = 0;
# For our example, we will use FileManager to get all
# files with the word "test"
# in the name and then count and read them
files = fileManager.findFiles(dataSource, "%test%")
for file in files:
fileCount += 1
progressBar.progress(1)
numFiles = len(files)
logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "found " + str(numFiles) + " files")
progressBar.switchToDeterminate(numFiles)
fileCount = 0;
for file in files:
# Check if the user pressed cancel while we were busy
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Get files by creation time.
currentTime = System.currentTimeMillis() / 1000
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
for otherFile in otherFiles:
logger.logp(Level.INFO, SampleJythonDataSourceIngestModule.__name__, "process", "Processing file: " + file.getName())
fileCount += 1
progressBar.progress(1);
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK;
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
# artfiact. Refer to the developer docs for other examples.
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonDataSourceIngestModuleFactory.moduleName, "Test file")
art.addAttribute(att)
# To further the example, this code will read the contents of the file and count the number of bytes
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
readLen = inputStream.read(buffer)
while (readLen != -1):
totLen = totLen + readLen
readLen = inputStream.read(buffer)
# Update the progress bar
progressBar.progress(fileCount)
#Post a message to the ingest messages in box.
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
@ -123,38 +153,3 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK;
# File-level ingest module. One gets created per thread.
# Looks at the attributes of the passed in file.
# if you don't need a file-level module, delete this class.
class SampleJythonFileIngestModule(FileIngestModule):
def startUp(self, context):
pass
def process(self, file):
# If the file has a txt extension, post an artifact to the blackboard.
if file.getName().find("test") != -1:
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), "Sample Jython File Ingest Module", "Text Files")
art.addAttribute(att)
# Read the contents of the file.
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
len = inputStream.read(buffer)
while (len != -1):
totLen = totLen + len
len = inputStream.read(buffer)
# Send the size of the file to the ingest messages in box.
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule", msgText)
ingestServices = IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK
def shutDown(self):
pass

129
pythonExamples/fileIngestModule.py Executable file
View File

@ -0,0 +1,129 @@
# Sample module in the public domain. Feel free to use this as a template
# for your modules (and you can remove this header and take complete credit
# and liability)
#
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
# binary, for any purpose, commercial or non-commercial, and by any
# means.
#
# In jurisdictions that recognize copyright laws, the author or authors
# of this software dedicate any and all copyright interest in the
# software to the public domain. We make this dedication for the benefit
# of the public at large and to the detriment of our heirs and
# successors. We intend this dedication to be an overt act of
# relinquishment in perpetuity of all present and future rights to this
# software under copyright law.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Simple file-level ingest module for Autopsy.
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
import jarray
from java.lang import System
from java.util.logging import Level
from org.sleuthkit.datamodel import SleuthkitCase
from org.sleuthkit.datamodel import AbstractFile
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.coreutils import Logger
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.casemodule.services import FileManager
# Factory that defines the name and details of the module and allows Autopsy
# to create instances of the modules that will do the anlaysis.
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter):
# TODO: give it a unique name. Will be shown in module list, logs, etc.
moduleName = "Sample file ingest Module"
def getModuleDisplayName(self):
return self.moduleName
# TODO: Give it a description
def getModuleDescription(self):
return "Sample module that does X, Y, and Z."
def getModuleVersionNumber(self):
return "1.0"
# Return true if module wants to get called for each file
def isFileIngestModuleFactory(self):
return True
# can return null if isFileIngestModuleFactory returns false
def createFileIngestModule(self, ingestOptions):
return SampleJythonFileIngestModule()
# File-level ingest module. One gets created per thread.
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
# Looks at the attributes of the passed in file.
class SampleJythonFileIngestModule(FileIngestModule):
# Where any setup and configuration is done
# TODO: Add any setup code that you need here.
def startUp(self, context):
self.logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName)
self.filesFound = 0
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
# raise IngestModuleException(IngestModule(), "Oh No!")
pass
# Where the analysis is done. Each file will be passed into here.
# TODO: Add your analysis code in here.
def process(self, file):
# For an example, we will flag files with .txt in the name and make a blackboard artifact.
if file.getName().find(".txt") != -1:
self.logger.logp(Level.INFO, SampleJythonFileIngestModule.__name__, "process", "Found a text file: " + file.getName())
self.filesFound+=1
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
# artfiact. Refer to the developer docs for other examples.
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonFileIngestModuleFactory.moduleName, "Text Files")
art.addAttribute(att)
# To further the example, this code will read the contents of the file and count the number of bytes
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
len = inputStream.read(buffer)
while (len != -1):
totLen = totLen + len
len = inputStream.read(buffer)
return IngestModule.ProcessResult.OK
# Where any shutdown code is run and resources are freed.
# TODO: Add any shutdown code that you need here.
def shutDown(self):
# As a final part of this example, we'll send a message to the ingest inbox with the number of files found (in this thread)
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName, str(self.filesFound) + " files found")
ingestServices = IngestServices.getInstance().postMessage(message)

204
pythonExamples/fileIngestModuleWithGui.py Executable file
View File

@ -0,0 +1,204 @@
# Sample module in the public domain. Feel free to use this as a template
# for your modules (and you can remove this header and take complete credit
# and liability)
#
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
# binary, for any purpose, commercial or non-commercial, and by any
# means.
#
# In jurisdictions that recognize copyright laws, the author or authors
# of this software dedicate any and all copyright interest in the
# software to the public domain. We make this dedication for the benefit
# of the public at large and to the detriment of our heirs and
# successors. We intend this dedication to be an overt act of
# relinquishment in perpetuity of all present and future rights to this
# software under copyright law.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Ingest module for Autopsy with GUI
#
# Difference between other modules in this folder is that it has a GUI
# for user options. This is not needed for very basic modules. If you
# don't need a configuration UI, start with the other sample module.
#
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
import jarray
from java.lang import System
from java.util.logging import Level
from javax.swing import JCheckBox
from javax.swing import BoxLayout
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.autopsy.coreutils import Logger
from java.lang import IllegalArgumentException
# TODO: Rename this to something more specific
class SampleFileIngestModuleWithUIFactory(IngestModuleFactoryAdapter):
def __init__(self):
self.settings = None
# TODO: give it a unique name. Will be shown in module list, logs, etc.
moduleName = "Sample Data Source Module with UI"
def getModuleDisplayName(self):
return self.moduleName
# TODO: Give it a description
def getModuleDescription(self):
return "Sample module that does X, Y, and Z."
def getModuleVersionNumber(self):
return "1.0"
# TODO: Update class name to one that you create below
def getDefaultIngestJobSettings(self):
return SampleFileIngestModuleWithUISettings()
# TODO: Keep enabled only if you need ingest job-specific settings UI
def hasIngestJobSettingsPanel(self):
return True
# TODO: Update class names to ones that you create below
def getIngestJobSettingsPanel(self, settings):
if not isinstance(settings, SampleFileIngestModuleWithUISettings):
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
self.settings = settings
return SampleFileIngestModuleWithUISettingsPanel(self.settings)
def isFileIngestModuleFactory(self):
return True
# TODO: Update class name to one that you create below
def createFileIngestModule(self, ingestOptions):
return SampleFileIngestModuleWithUI(self.settings)
# File-level ingest module. One gets created per thread.
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
# Looks at the attributes of the passed in file.
class SampleFileIngestModuleWithUI(FileIngestModule):
# Autopsy will pass in the settings from the UI panel
def __init__(self, settings):
self.local_settings = settings
# Where any setup and configuration is done
# TODO: Add any setup code that you need here.
def startUp(self, context):
self.logger = Logger.getLogger(SampleFileIngestModuleWithUIFactory.moduleName)
# As an example, determine if user configured a flag in UI
if self.local_settings.getFlag():
self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is set")
else:
self.logger.logp(Level.INFO, SampleFileIngestModuleWithUI.__name__, "startUp", "flag is not set")
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
# raise IngestModuleException(IngestModule(), "Oh No!")
pass
# Where the analysis is done. Each file will be passed into here.
# TODO: Add your analysis code in here.
def process(self, file):
# See code in pythonExamples/fileIngestModule.py for example code
return IngestModule.ProcessResult.OK
# Where any shutdown code is run and resources are freed.
# TODO: Add any shutdown code that you need here.
def shutDown(self):
pass
# Stores the settings that can be changed for each ingest job
# All fields in here must be serializable. It will be written to disk.
# TODO: Rename this class
class SampleFileIngestModuleWithUISettings(IngestModuleIngestJobSettings):
serialVersionUID = 1L
def __init__(self):
self.flag = False
def getVersionNumber(self):
return serialVersionUID
# TODO: Define getters and settings for data you want to store from UI
def getFlag(self):
return self.flag
def setFlag(self, flag):
self.flag = flag
# UI that is shown to user for each ingest job so they can configure the job.
# TODO: Rename this
class SampleFileIngestModuleWithUISettingsPanel(IngestModuleIngestJobSettingsPanel):
# Note, we can't use a self.settings instance variable.
# Rather, self.local_settings is used.
# https://wiki.python.org/jython/UserGuide#javabean-properties
# Jython Introspector generates a property - 'settings' on the basis
# of getSettings() defined in this class. Since only getter function
# is present, it creates a read-only 'settings' property. This auto-
# generated read-only property overshadows the instance-variable -
# 'settings'
# We get passed in a previous version of the settings so that we can
# prepopulate the UI
# TODO: Update this for your UI
def __init__(self, settings):
self.local_settings = settings
self.initComponents()
self.customizeComponents()
# TODO: Update this for your UI
def checkBoxEvent(self, event):
if self.checkbox.isSelected():
self.local_settings.setFlag(True)
else:
self.local_settings.setFlag(False)
# TODO: Update this for your UI
def initComponents(self):
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
self.add(self.checkbox)
# TODO: Update this for your UI
def customizeComponents(self):
self.checkbox.setSelected(self.local_settings.getFlag())
# Return the settings used
def getSettings(self):
return self.local_settings

266
pythonExamples/ingestmodule.py
View File

@ -1,266 +0,0 @@
# Sample module in the public domain. Feel free to use this as a template
# for your modules (and you can remove this header and take complete credit
# and liability)
#
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
# binary, for any purpose, commercial or non-commercial, and by any
# means.
#
# In jurisdictions that recognize copyright laws, the author or authors
# of this software dedicate any and all copyright interest in the
# software to the public domain. We make this dedication for the benefit
# of the public at large and to the detriment of our heirs and
# successors. We intend this dedication to be an overt act of
# relinquishment in perpetuity of all present and future rights to this
# software under copyright law.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
import jarray
from java.lang import System
from javax.swing import JCheckBox
from javax.swing import BoxLayout
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
from org.sleuthkit.autopsy.ingest import FileIngestModule
from org.sleuthkit.autopsy.ingest import IngestMessage
from org.sleuthkit.autopsy.ingest import IngestModule
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
from org.sleuthkit.autopsy.ingest import IngestServices
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.datamodel import ReadContentInputStream
from org.sleuthkit.autopsy.coreutils import Logger
from java.lang import IllegalArgumentException
# Sample factory that defines basic functionality and features of the module
# It implements IngestModuleFactoryAdapter which is a no-op implementation of
# IngestModuleFactory.
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
def __init__(self):
self.settings = None
def getModuleDisplayName(self):
return "Sample Jython(GUI) ingest module"
def getModuleDescription(self):
return "Sample Jython Ingest Module with GUI example code"
def getModuleVersionNumber(self):
return "1.0"
def getDefaultIngestJobSettings(self):
return SampleIngestModuleSettings()
def hasIngestJobSettingsPanel(self):
return True
def getIngestJobSettingsPanel(self, settings):
if not isinstance(settings, SampleIngestModuleSettings):
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
self.settings = settings
return SampleIngestModuleSettingsPanel(self.settings)
# Return true if module wants to get passed in a data source
def isDataSourceIngestModuleFactory(self):
return True
# can return null if isDataSourceIngestModuleFactory returns false
def createDataSourceIngestModule(self, ingestOptions):
return SampleJythonDataSourceIngestModule(self.settings)
# Return true if module wants to get called for each file
def isFileIngestModuleFactory(self):
return True
# can return null if isFileIngestModuleFactory returns false
def createFileIngestModule(self, ingestOptions):
return SampleJythonFileIngestModule(self.settings)
def hasGlobalSettingsPanel(self):
return True
def getGlobalSettingsPanel(self):
globalSettingsPanel = SampleIngestModuleGlobalSettingsPanel();
return globalSettingsPanel
class SampleIngestModuleGlobalSettingsPanel(IngestModuleGlobalSettingsPanel):
def __init__(self):
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
checkbox = JCheckBox("Flag inside the Global Settings Panel")
self.add(checkbox)
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
'''
Data Source-level ingest module. One gets created per data source.
Queries for various files. If you don't need a data source-level module,
delete this class.
'''
def __init__(self, settings):
self.local_settings = settings
self.context = None
def startUp(self, context):
# Used to verify if the GUI checkbox event been recorded or not.
logger = Logger.getLogger("SampleJythonFileIngestModule")
if self.local_settings.getFlag():
logger.info("flag is set")
else:
logger.info("flag is not set")
self.context = context
def process(self, dataSource, progressBar):
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Configure progress bar for 2 tasks
progressBar.switchToDeterminate(2)
autopsyCase = Case.getCurrentCase()
sleuthkitCase = autopsyCase.getSleuthkitCase()
services = Services(sleuthkitCase)
fileManager = services.getFileManager()
# Get count of files with "test" in name.
fileCount = 0;
files = fileManager.findFiles(dataSource, "%test%")
for file in files:
fileCount += 1
progressBar.progress(1)
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK
# Get files by creation time.
currentTime = System.currentTimeMillis() / 1000
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
for otherFile in otherFiles:
fileCount += 1
progressBar.progress(1);
if self.context.isJobCancelled():
return IngestModule.ProcessResult.OK;
# Post a message to the ingest messages in box.
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
"Sample Jython Data Source Ingest Module", "Found %d files" % fileCount)
IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK;
class SampleJythonFileIngestModule(FileIngestModule):
'''
File-level ingest module. One gets created per thread. Looks at the
attributes of the passed in file. if you don't need a file-level module,
delete this class.
'''
def __init__(self, settings):
self.local_settings = settings
def startUp(self, context):
# Used to verify if the GUI checkbox event been recorded or not.
logger = Logger.getLogger("SampleJythonFileIngestModule")
if self.local_settings.getFlag():
logger.info("flag is set")
else:
logger.info("flag is not set")
pass
def process(self, file):
# If the file has a txt extension, post an artifact to the blackboard.
if file.getName().find("test") != -1:
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(),
"Sample Jython File Ingest Module", "Text Files")
art.addAttribute(att)
# Read the contents of the file.
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
totLen = 0
len = inputStream.read(buffer)
while (len != -1):
totLen = totLen + len
len = inputStream.read(buffer)
# Send the size of the file to the ingest messages in box.
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule",
msgText)
ingestServices = IngestServices.getInstance().postMessage(message)
return IngestModule.ProcessResult.OK
def shutDown(self):
pass
class SampleIngestModuleSettings(IngestModuleIngestJobSettings):
serialVersionUID = 1L
def __init__(self):
self.flag = False
def getVersionNumber(self):
return serialVersionUID
def getFlag(self):
return self.flag
def setFlag(self, flag):
self.flag = flag
class SampleIngestModuleSettingsPanel(IngestModuleIngestJobSettingsPanel):
# self.settings instance variable not used. Rather, self.local_settings is used.
# https://wiki.python.org/jython/UserGuide#javabean-properties
# Jython Introspector generates a property - 'settings' on the basis
# of getSettings() defined in this class. Since only getter function
# is present, it creates a read-only 'settings' property. This auto-
# generated read-only property overshadows the instance-variable -
# 'settings'
def checkBoxEvent(self, event):
if self.checkbox.isSelected():
self.local_settings.setFlag(True)
else:
self.local_settings.setFlag(False)
def initComponents(self):
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
self.add(self.checkbox)
def customizeComponents(self):
self.checkbox.setSelected(self.local_settings.getFlag())
def __init__(self, settings):
self.local_settings = settings
self.initComponents()
self.customizeComponents()
def getSettings(self):
return self.local_settings

20
pythonExamples/reportmodule.py
View File

@ -27,24 +27,35 @@
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.
# Report module for Autopsy.
#
# Search for TODO for the things that you need to change
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
from java.lang import System
from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
# Sample module that writes a file with the number of files
# created in the last 2 weeks.
# TODO: Rename this to something more specific
class SampleGeneralReportModule(GeneralReportModuleAdapter):
# TODO: Rename this. Will be shown to users when making a report
def getName(self):
return "Sample Jython Report Module"
# TODO: rewrite this
def getDescription(self):
return "A sample Jython report module"
# TODO: Update this to reflect where the report file will be written to
def getRelativeFilePath(self):
return "sampleReport.txt"
def generateReport(self, reportPath, progressBar):
# TODO: Update this method to make a report
def generateReport(self, baseReportDir, progressBar):
# For an example, we write a file with the number of files created in the past 2 weeks
# Configure progress bar for 2 tasks
progressBar.setIndeterminate(False)
progressBar.start()
@ -62,9 +73,10 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
progressBar.increment()
# Write the result to the report file.
report = open(reportPath + '\\' + self.getRelativeFilePath(), 'w')
report = open(baseReportDir + '\\' + self.getRelativeFilePath(), 'w')
report.write("file count = %d" % fileCount)
Case.getCurrentCase().addReport(report.name, "SampleGeneralReportModule", "Sample Python Report");
report.close()
progressBar.increment()
progressBar.complete()