mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-19 19:14:55 +00:00
Working towards a working cancellation policy.
This commit is contained in:
parent
f5fae2c1c6
commit
c29f106d3e
@ -18,48 +18,45 @@
|
|||||||
*/
|
*/
|
||||||
package org.sleuthkit.autopsy.modules.stix;
|
package org.sleuthkit.autopsy.modules.stix;
|
||||||
|
|
||||||
import java.io.File;
|
|
||||||
import java.io.IOException;
|
|
||||||
import java.util.HashMap;
|
|
||||||
import java.util.Map;
|
|
||||||
import java.util.List;
|
|
||||||
import java.util.logging.Level;
|
|
||||||
import java.io.BufferedWriter;
|
import java.io.BufferedWriter;
|
||||||
|
import java.io.File;
|
||||||
import java.io.FileWriter;
|
import java.io.FileWriter;
|
||||||
|
import java.io.IOException;
|
||||||
import java.util.Arrays;
|
import java.util.Arrays;
|
||||||
|
import java.util.HashMap;
|
||||||
|
import java.util.List;
|
||||||
|
import java.util.Map;
|
||||||
|
import java.util.logging.Level;
|
||||||
import javax.swing.JPanel;
|
import javax.swing.JPanel;
|
||||||
import javax.xml.bind.JAXBContext;
|
import javax.xml.bind.JAXBContext;
|
||||||
import javax.xml.bind.JAXBException;
|
import javax.xml.bind.JAXBException;
|
||||||
import javax.xml.bind.Unmarshaller;
|
import javax.xml.bind.Unmarshaller;
|
||||||
import javax.xml.namespace.QName;
|
import javax.xml.namespace.QName;
|
||||||
|
|
||||||
import org.mitre.cybox.cybox_2.ObjectType;
|
import org.mitre.cybox.cybox_2.ObjectType;
|
||||||
import org.mitre.cybox.cybox_2.Observable;
|
import org.mitre.cybox.cybox_2.Observable;
|
||||||
import org.mitre.cybox.cybox_2.ObservableCompositionType;
|
import org.mitre.cybox.cybox_2.ObservableCompositionType;
|
||||||
|
import org.mitre.cybox.cybox_2.OperatorTypeEnum;
|
||||||
|
import org.mitre.cybox.objects.AccountObjectType;
|
||||||
|
import org.mitre.cybox.objects.Address;
|
||||||
|
import org.mitre.cybox.objects.DomainName;
|
||||||
|
import org.mitre.cybox.objects.EmailMessage;
|
||||||
|
import org.mitre.cybox.objects.FileObjectType;
|
||||||
|
import org.mitre.cybox.objects.SystemObjectType;
|
||||||
|
import org.mitre.cybox.objects.URIObjectType;
|
||||||
|
import org.mitre.cybox.objects.URLHistory;
|
||||||
|
import org.mitre.cybox.objects.WindowsNetworkShare;
|
||||||
|
import org.mitre.cybox.objects.WindowsRegistryKey;
|
||||||
import org.mitre.stix.common_1.IndicatorBaseType;
|
import org.mitre.stix.common_1.IndicatorBaseType;
|
||||||
import org.mitre.stix.indicator_2.Indicator;
|
import org.mitre.stix.indicator_2.Indicator;
|
||||||
import org.mitre.stix.stix_1.STIXPackage;
|
import org.mitre.stix.stix_1.STIXPackage;
|
||||||
|
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
|
||||||
import org.sleuthkit.autopsy.report.GeneralReportModule;
|
|
||||||
import org.openide.util.NbBundle;
|
import org.openide.util.NbBundle;
|
||||||
import org.sleuthkit.autopsy.report.ReportProgressPanel;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.datamodel.TskCoreException;
|
|
||||||
|
|
||||||
import org.mitre.cybox.cybox_2.OperatorTypeEnum;
|
|
||||||
import org.mitre.cybox.objects.Address;
|
|
||||||
import org.mitre.cybox.objects.FileObjectType;
|
|
||||||
import org.mitre.cybox.objects.URIObjectType;
|
|
||||||
import org.mitre.cybox.objects.EmailMessage;
|
|
||||||
import org.mitre.cybox.objects.WindowsNetworkShare;
|
|
||||||
import org.mitre.cybox.objects.AccountObjectType;
|
|
||||||
import org.mitre.cybox.objects.SystemObjectType;
|
|
||||||
import org.mitre.cybox.objects.URLHistory;
|
|
||||||
import org.mitre.cybox.objects.DomainName;
|
|
||||||
import org.mitre.cybox.objects.WindowsRegistryKey;
|
|
||||||
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
|
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
|
||||||
import org.sleuthkit.autopsy.coreutils.ModuleSettings;
|
import org.sleuthkit.autopsy.coreutils.ModuleSettings;
|
||||||
|
import org.sleuthkit.autopsy.report.GeneralReportModule;
|
||||||
|
import org.sleuthkit.autopsy.report.ReportProgressPanel;
|
||||||
import org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus;
|
import org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus;
|
||||||
|
import org.sleuthkit.datamodel.TskCoreException;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
*
|
*
|
||||||
@ -180,6 +177,9 @@ public class STIXReportModule implements GeneralReportModule {
|
|||||||
|
|
||||||
// Process each STIX file
|
// Process each STIX file
|
||||||
for (File file : stixFiles) {
|
for (File file : stixFiles) {
|
||||||
|
if (progressPanel.getStatus() == ReportStatus.CANCELED) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
try {
|
try {
|
||||||
processFile(file.getAbsolutePath(), progressPanel);
|
processFile(file.getAbsolutePath(), progressPanel);
|
||||||
} catch (TskCoreException ex) {
|
} catch (TskCoreException ex) {
|
||||||
|
@ -223,8 +223,10 @@ class ReportGenerator {
|
|||||||
* Run the GeneralReportModules using a SwingWorker.
|
* Run the GeneralReportModules using a SwingWorker.
|
||||||
*/
|
*/
|
||||||
public void generateGeneralReports() {
|
public void generateGeneralReports() {
|
||||||
GeneralReportsWorker worker = new GeneralReportsWorker();
|
if (this.generalReportModule != null) {
|
||||||
worker.execute();
|
GeneralReportsWorker worker = new GeneralReportsWorker();
|
||||||
|
worker.execute();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -675,22 +677,21 @@ class ReportGenerator {
|
|||||||
|
|
||||||
// Tell the modules reporting on blackboard artifact tags data type is beginning.
|
// Tell the modules reporting on blackboard artifact tags data type is beginning.
|
||||||
// @@@ Using the obsolete ARTIFACT_TYPE.TSK_TAG_ARTIFACT is an expedient hack.
|
// @@@ Using the obsolete ARTIFACT_TYPE.TSK_TAG_ARTIFACT is an expedient hack.
|
||||||
progressPanel.updateStatusLabel(
|
progressPanel.updateStatusLabel(
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
|
||||||
ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
|
ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
|
||||||
StringBuilder comment = new StringBuilder();
|
StringBuilder comment = new StringBuilder();
|
||||||
if (!tagNamesFilter.isEmpty()) {
|
if (!tagNamesFilter.isEmpty()) {
|
||||||
comment.append(
|
comment.append(
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
|
||||||
comment.append(makeCommaSeparatedList(tagNamesFilter));
|
comment.append(makeCommaSeparatedList(tagNamesFilter));
|
||||||
}
|
}
|
||||||
module.startDataType(ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
|
tableReportModule.startDataType(ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
|
||||||
module.startTable(new ArrayList<>(Arrays.asList(
|
tableReportModule.startTable(new ArrayList<>(Arrays.asList(
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.resultType"),
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.resultType"),
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.tag"),
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.tag"),
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.comment"),
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.comment"),
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.srcFile"))));
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.srcFile"))));
|
||||||
|
|
||||||
|
|
||||||
// Give the modules the rows for the content tags.
|
// Give the modules the rows for the content tags.
|
||||||
for (BlackboardArtifactTag tag : tags) {
|
for (BlackboardArtifactTag tag : tags) {
|
||||||
@ -699,21 +700,17 @@ class ReportGenerator {
|
|||||||
}
|
}
|
||||||
|
|
||||||
List<String> row;
|
List<String> row;
|
||||||
for (TableReportModule module : tableModules) {
|
row = new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName(), tag.getComment(), tag.getContent().getName()));
|
||||||
row = new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName(), tag.getComment(), tag.getContent().getName()));
|
tableReportModule.addRow(row);
|
||||||
module.addRow(row);
|
|
||||||
}
|
|
||||||
|
|
||||||
// check if the tag is an image that we should later make a thumbnail for
|
// check if the tag is an image that we should later make a thumbnail for
|
||||||
checkIfTagHasImage(tag);
|
checkIfTagHasImage(tag);
|
||||||
}
|
}
|
||||||
|
|
||||||
// The the modules blackboard artifact tags reporting is ended.
|
// The the modules blackboard artifact tags reporting is ended.
|
||||||
for (TableReportModule module : tableModules) {
|
progressPanel.increment();
|
||||||
tableProgress.get(module).increment();
|
tableReportModule.endTable();
|
||||||
module.endTable();
|
tableReportModule.endDataType();
|
||||||
module.endDataType();
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -728,35 +725,35 @@ class ReportGenerator {
|
|||||||
}
|
}
|
||||||
|
|
||||||
void removeCancelledTableReportModules() {
|
void removeCancelledTableReportModules() {
|
||||||
if (progressPanel.getStatus() == ReportStatus.CANCELED) {
|
if (progressPanel.getStatus() == ReportStatus.CANCELED) {
|
||||||
tableReportModule = null;
|
tableReportModule = null;
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Make a report for the files that were previously found to be images.
|
* Make a report for the files that were previously found to be images.
|
||||||
*/
|
*/
|
||||||
private void makeThumbnailTable() {
|
private void makeThumbnailTable() {
|
||||||
for (TableReportModule module : tableModules) {
|
progressPanel.updateStatusLabel(
|
||||||
tableProgress.get(module).updateStatusLabel(
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.createdThumb.text"));
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.createdThumb.text"));
|
|
||||||
|
|
||||||
if (module instanceof ReportHTML) {
|
if (tableReportModule instanceof ReportHTML) {
|
||||||
ReportHTML htmlModule = (ReportHTML) module;
|
ReportHTML htmlModule = (ReportHTML) tableReportModule;
|
||||||
htmlModule.startDataType(
|
htmlModule.startDataType(
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.name"),
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.name"),
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.desc"));
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.desc"));
|
||||||
List<String> emptyHeaders = new ArrayList<>();
|
List<String> emptyHeaders = new ArrayList<>();
|
||||||
for (int i = 0; i < ReportHTML.THUMBNAIL_COLUMNS; i++) {
|
for (int i = 0; i < ReportHTML.THUMBNAIL_COLUMNS; i++) {
|
||||||
emptyHeaders.add("");
|
emptyHeaders.add("");
|
||||||
}
|
|
||||||
htmlModule.startTable(emptyHeaders);
|
|
||||||
|
|
||||||
htmlModule.addThumbnailRows(images);
|
|
||||||
|
|
||||||
htmlModule.endTable();
|
|
||||||
htmlModule.endDataType();
|
|
||||||
}
|
}
|
||||||
|
htmlModule.startTable(emptyHeaders);
|
||||||
|
|
||||||
|
htmlModule.addThumbnailRows(images);
|
||||||
|
|
||||||
|
htmlModule.endTable();
|
||||||
|
htmlModule.endDataType();
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -867,7 +864,7 @@ class ReportGenerator {
|
|||||||
* @param tableModules modules to report on
|
* @param tableModules modules to report on
|
||||||
*/
|
*/
|
||||||
@SuppressWarnings("deprecation")
|
@SuppressWarnings("deprecation")
|
||||||
private void writeKeywordHits(List<TableReportModule> tableModules, String comment, HashSet<String> tagNamesFilter) {
|
private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
|
||||||
|
|
||||||
// Query for keyword lists-only so that we can tell modules what lists
|
// Query for keyword lists-only so that we can tell modules what lists
|
||||||
// will exist for their index.
|
// will exist for their index.
|
||||||
@ -905,13 +902,11 @@ class ReportGenerator {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Make keyword data type and give them set index
|
// Make keyword data type and give them set index
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.startDataType(ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
|
||||||
module.startDataType(ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
|
tableModule.addSetIndex(lists);
|
||||||
module.addSetIndex(lists);
|
progressPanel.updateStatusLabel(
|
||||||
tableProgress.get(module).updateStatusLabel(
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
|
ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
|
||||||
ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
|
|
||||||
}
|
|
||||||
} catch (TskCoreException | SQLException ex) {
|
} catch (TskCoreException | SQLException ex) {
|
||||||
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWLists"));
|
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWLists"));
|
||||||
logger.log(Level.SEVERE, "Failed to query keyword lists: ", ex); //NON-NLS
|
logger.log(Level.SEVERE, "Failed to query keyword lists: ", ex); //NON-NLS
|
||||||
@ -958,16 +953,9 @@ class ReportGenerator {
|
|||||||
String currentList = "";
|
String currentList = "";
|
||||||
while (resultSet.next()) {
|
while (resultSet.next()) {
|
||||||
// Check to see if all the TableReportModules have been canceled
|
// Check to see if all the TableReportModules have been canceled
|
||||||
if (tableModules.isEmpty()) {
|
if (progressPanel.getStatus() == ReportStatus.CANCELED) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
Iterator<TableReportModule> iter = tableModules.iterator();
|
|
||||||
while (iter.hasNext()) {
|
|
||||||
TableReportModule module = iter.next();
|
|
||||||
if (tableProgress.get(module).getStatus() == ReportStatus.CANCELED) {
|
|
||||||
iter.remove();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get any tags that associated with this artifact and apply the tag filter.
|
// Get any tags that associated with this artifact and apply the tag filter.
|
||||||
HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
|
HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
|
||||||
@ -997,49 +985,37 @@ class ReportGenerator {
|
|||||||
if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
|
if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs")))) {
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs")))) {
|
||||||
if (!currentList.isEmpty()) {
|
if (!currentList.isEmpty()) {
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.endTable();
|
||||||
module.endTable();
|
tableModule.endSet();
|
||||||
module.endSet();
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
currentList = list.isEmpty() ? NbBundle
|
currentList = list.isEmpty() ? NbBundle
|
||||||
.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs") : list;
|
.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs") : list;
|
||||||
currentKeyword = ""; // reset the current keyword because it's a new list
|
currentKeyword = ""; // reset the current keyword because it's a new list
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.startSet(currentList);
|
||||||
module.startSet(currentList);
|
progressPanel.updateStatusLabel(
|
||||||
tableProgress.get(module).updateStatusLabel(
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
|
ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
|
||||||
ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
if (!keyword.equals(currentKeyword)) {
|
if (!keyword.equals(currentKeyword)) {
|
||||||
if (!currentKeyword.equals("")) {
|
if (!currentKeyword.equals("")) {
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.endTable();
|
||||||
module.endTable();
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
currentKeyword = keyword;
|
currentKeyword = keyword;
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.addSetElement(currentKeyword);
|
||||||
module.addSetElement(currentKeyword);
|
List<String> columnHeaderNames = new ArrayList<>();
|
||||||
List<String> columnHeaderNames = new ArrayList<>();
|
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview"));
|
||||||
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview"));
|
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile"));
|
||||||
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile"));
|
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
|
||||||
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
|
tableModule.startTable(columnHeaderNames);
|
||||||
module.startTable(columnHeaderNames);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
String previewreplace = EscapeUtil.escapeHtml(preview);
|
String previewreplace = EscapeUtil.escapeHtml(preview);
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.addRow(Arrays.asList(new String[]{previewreplace.replaceAll("<!", ""), uniquePath, tagsList}));
|
||||||
module.addRow(Arrays.asList(new String[]{previewreplace.replaceAll("<!", ""), uniquePath, tagsList}));
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Finish the current data type
|
// Finish the current data type
|
||||||
for (TableReportModule module : tableModules) {
|
progressPanel.increment();
|
||||||
tableProgress.get(module).increment();
|
tableModule.endDataType();
|
||||||
module.endDataType();
|
|
||||||
}
|
|
||||||
} catch (TskCoreException | SQLException ex) {
|
} catch (TskCoreException | SQLException ex) {
|
||||||
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWs"));
|
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWs"));
|
||||||
logger.log(Level.SEVERE, "Failed to query keywords: ", ex); //NON-NLS
|
logger.log(Level.SEVERE, "Failed to query keywords: ", ex); //NON-NLS
|
||||||
@ -1052,7 +1028,7 @@ class ReportGenerator {
|
|||||||
* @param tableModules modules to report on
|
* @param tableModules modules to report on
|
||||||
*/
|
*/
|
||||||
@SuppressWarnings("deprecation")
|
@SuppressWarnings("deprecation")
|
||||||
private void writeHashsetHits(List<TableReportModule> tableModules, String comment, HashSet<String> tagNamesFilter) {
|
private void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
|
||||||
String orderByClause;
|
String orderByClause;
|
||||||
if (currentCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
|
if (currentCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
|
||||||
orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
|
orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
|
||||||
@ -1080,13 +1056,11 @@ class ReportGenerator {
|
|||||||
lists.add(listsRs.getString("list")); //NON-NLS
|
lists.add(listsRs.getString("list")); //NON-NLS
|
||||||
}
|
}
|
||||||
|
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.startDataType(ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
|
||||||
module.startDataType(ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
|
tableModule.addSetIndex(lists);
|
||||||
module.addSetIndex(lists);
|
progressPanel.updateStatusLabel(
|
||||||
tableProgress.get(module).updateStatusLabel(
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
|
ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
|
||||||
ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
|
|
||||||
}
|
|
||||||
} catch (TskCoreException | SQLException ex) {
|
} catch (TskCoreException | SQLException ex) {
|
||||||
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetLists"));
|
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetLists"));
|
||||||
logger.log(Level.SEVERE, "Failed to query hashset lists: ", ex); //NON-NLS
|
logger.log(Level.SEVERE, "Failed to query hashset lists: ", ex); //NON-NLS
|
||||||
@ -1122,16 +1096,9 @@ class ReportGenerator {
|
|||||||
String currentSet = "";
|
String currentSet = "";
|
||||||
while (resultSet.next()) {
|
while (resultSet.next()) {
|
||||||
// Check to see if all the TableReportModules have been canceled
|
// Check to see if all the TableReportModules have been canceled
|
||||||
if (tableModules.isEmpty()) {
|
if (progressPanel.getStatus() == ReportStatus.CANCELED) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
Iterator<TableReportModule> iter = tableModules.iterator();
|
|
||||||
while (iter.hasNext()) {
|
|
||||||
TableReportModule module = iter.next();
|
|
||||||
if (tableProgress.get(module).getStatus() == ReportStatus.CANCELED) {
|
|
||||||
iter.remove();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get any tags that associated with this artifact and apply the tag filter.
|
// Get any tags that associated with this artifact and apply the tag filter.
|
||||||
HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
|
HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
|
||||||
@ -1160,36 +1127,28 @@ class ReportGenerator {
|
|||||||
// If the sets aren't the same, we've started a new set
|
// If the sets aren't the same, we've started a new set
|
||||||
if (!set.equals(currentSet)) {
|
if (!set.equals(currentSet)) {
|
||||||
if (!currentSet.isEmpty()) {
|
if (!currentSet.isEmpty()) {
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.endTable();
|
||||||
module.endTable();
|
tableModule.endSet();
|
||||||
module.endSet();
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
currentSet = set;
|
currentSet = set;
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.startSet(currentSet);
|
||||||
module.startSet(currentSet);
|
List<String> columnHeaderNames = new ArrayList<>();
|
||||||
List<String> columnHeaderNames = new ArrayList<>();
|
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file"));
|
||||||
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file"));
|
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size"));
|
||||||
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size"));
|
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
|
||||||
columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
|
tableModule.startTable(columnHeaderNames);
|
||||||
module.startTable(columnHeaderNames);
|
progressPanel.updateStatusLabel(
|
||||||
tableProgress.get(module).updateStatusLabel(
|
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
|
||||||
NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
|
ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
|
||||||
ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Add a row for this hit to every module
|
// Add a row for this hit to every module
|
||||||
for (TableReportModule module : tableModules) {
|
tableModule.addRow(Arrays.asList(new String[]{uniquePath, size, tagsList}));
|
||||||
module.addRow(Arrays.asList(new String[]{uniquePath, size, tagsList}));
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Finish the current data type
|
// Finish the current data type
|
||||||
for (TableReportModule module : tableModules) {
|
progressPanel.increment();
|
||||||
tableProgress.get(module).increment();
|
tableModule.endDataType();
|
||||||
module.endDataType();
|
|
||||||
}
|
|
||||||
} catch (TskCoreException | SQLException ex) {
|
} catch (TskCoreException | SQLException ex) {
|
||||||
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetHits"));
|
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetHits"));
|
||||||
logger.log(Level.SEVERE, "Failed to query hashsets hits: ", ex); //NON-NLS
|
logger.log(Level.SEVERE, "Failed to query hashsets hits: ", ex); //NON-NLS
|
||||||
|
@ -19,14 +19,6 @@
|
|||||||
*/
|
*/
|
||||||
package org.sleuthkit.autopsy.report;
|
package org.sleuthkit.autopsy.report;
|
||||||
|
|
||||||
import javax.swing.JPanel;
|
|
||||||
|
|
||||||
import org.openide.util.NbBundle;
|
|
||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
|
||||||
import org.sleuthkit.datamodel.*;
|
|
||||||
import org.sleuthkit.autopsy.ingest.IngestManager;
|
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact;
|
|
||||||
import java.io.BufferedReader;
|
import java.io.BufferedReader;
|
||||||
import java.io.BufferedWriter;
|
import java.io.BufferedWriter;
|
||||||
import java.io.File;
|
import java.io.File;
|
||||||
@ -37,12 +29,18 @@ import java.io.IOException;
|
|||||||
import java.io.InputStream;
|
import java.io.InputStream;
|
||||||
import java.io.OutputStream;
|
import java.io.OutputStream;
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
|
import javax.swing.JPanel;
|
||||||
|
import org.apache.commons.lang.StringEscapeUtils;
|
||||||
import org.jdom2.Document;
|
import org.jdom2.Document;
|
||||||
import org.jdom2.Element;
|
import org.jdom2.Element;
|
||||||
import org.jdom2.Namespace;
|
import org.jdom2.Namespace;
|
||||||
import org.jdom2.output.Format;
|
import org.jdom2.output.Format;
|
||||||
import org.jdom2.output.XMLOutputter;
|
import org.jdom2.output.XMLOutputter;
|
||||||
import org.apache.commons.lang.StringEscapeUtils;
|
import org.openide.util.NbBundle;
|
||||||
|
import org.sleuthkit.autopsy.casemodule.Case;
|
||||||
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
|
import org.sleuthkit.autopsy.ingest.IngestManager;
|
||||||
|
import org.sleuthkit.datamodel.*;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Generates a KML file based on geo coordinates store in blackboard.
|
* Generates a KML file based on geo coordinates store in blackboard.
|
||||||
@ -85,6 +83,9 @@ class ReportKML implements GeneralReportModule {
|
|||||||
currentCase = Case.getCurrentCase();
|
currentCase = Case.getCurrentCase();
|
||||||
skCase = currentCase.getSleuthkitCase();
|
skCase = currentCase.getSleuthkitCase();
|
||||||
|
|
||||||
|
if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportKML.progress.loading"));
|
progressPanel.updateStatusLabel(NbBundle.getMessage(this.getClass(), "ReportKML.progress.loading"));
|
||||||
// Check if ingest has finished
|
// Check if ingest has finished
|
||||||
String ingestwarning = "";
|
String ingestwarning = "";
|
||||||
@ -98,6 +99,9 @@ class ReportKML implements GeneralReportModule {
|
|||||||
// Why not just print the coordinates as we find them and make some utility methods to do the printing?
|
// Why not just print the coordinates as we find them and make some utility methods to do the printing?
|
||||||
// Should pull out time values for all of these points and store in TimeSpan element
|
// Should pull out time values for all of these points and store in TimeSpan element
|
||||||
try {
|
try {
|
||||||
|
if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
try (BufferedWriter out = new BufferedWriter(new FileWriter(reportPath2))) {
|
try (BufferedWriter out = new BufferedWriter(new FileWriter(reportPath2))) {
|
||||||
|
|
||||||
double lat = 0; // temp latitude
|
double lat = 0; // temp latitude
|
||||||
@ -108,6 +112,9 @@ class ReportKML implements GeneralReportModule {
|
|||||||
|
|
||||||
File f;
|
File f;
|
||||||
for (BlackboardArtifact artifact : skCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF)) {
|
for (BlackboardArtifact artifact : skCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF)) {
|
||||||
|
if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
lat = 0;
|
lat = 0;
|
||||||
lon = 0;
|
lon = 0;
|
||||||
geoPath = "";
|
geoPath = "";
|
||||||
|
@ -24,9 +24,7 @@ import java.util.ArrayList;
|
|||||||
import java.util.Collections;
|
import java.util.Collections;
|
||||||
import static java.util.Collections.swap;
|
import static java.util.Collections.swap;
|
||||||
import java.util.Comparator;
|
import java.util.Comparator;
|
||||||
import java.util.LinkedHashMap;
|
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
import java.util.Map;
|
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
import javax.swing.JList;
|
import javax.swing.JList;
|
||||||
import javax.swing.JPanel;
|
import javax.swing.JPanel;
|
||||||
@ -164,7 +162,6 @@ final class ReportVisualPanel1 extends JPanel implements ListSelectionListener {
|
|||||||
* @return
|
* @return
|
||||||
*/
|
*/
|
||||||
TableReportModule getTableModule() {
|
TableReportModule getTableModule() {
|
||||||
Map<TableReportModule, Boolean> reportModuleStates = new LinkedHashMap<>();
|
|
||||||
ReportModule mod = getSelectedModule();
|
ReportModule mod = getSelectedModule();
|
||||||
if (tableModules.contains(mod)) {
|
if (tableModules.contains(mod)) {
|
||||||
return (TableReportModule) mod;
|
return (TableReportModule) mod;
|
||||||
|
Loading…
x
Reference in New Issue
Block a user