From aa48b1f6016d467727b5d60462d4993aee6aeaca Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 13 Jan 2022 09:35:23 -0500 Subject: [PATCH 01/17] 8170 interesting file annotations --- .../annotations/AnnotationUtils.java | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java index efa329f843..f17eb3597a 100755 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java @@ -219,7 +219,9 @@ public class AnnotationUtils { // if artifact is a hashset hit or interesting file and has a non-blank comment if ((BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == bba.getArtifactTypeID() - || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == bba.getArtifactTypeID() || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() == bba.getArtifactTypeID()) + || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == bba.getArtifactTypeID() + || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == bba.getArtifactTypeID() + || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() == bba.getArtifactTypeID()) && (hasTskComment(bba))) { boolean filesetRendered = appendEntries(parent, ARTIFACT_COMMENT_CONFIG, Arrays.asList(bba), false, !contentRendered); @@ -339,7 +341,7 @@ public class AnnotationUtils { try { SleuthkitCase tskCase = Case.getCurrentCaseThrows().getSleuthkitCase(); return tskCase.getBlackboardArtifacts(type, sourceFile.getId()).stream() - .filter((bba) -> hasTskComment(bba)) + .filter((bba) -> hasTskComment(bba) || hasTskSet(bba)) .collect(Collectors.toList()); } catch (NoCurrentCaseException ex) { logger.log(Level.SEVERE, "Exception while getting open case.", ex); // NON-NLS @@ -359,6 +361,17 @@ public class AnnotationUtils { private static boolean hasTskComment(BlackboardArtifact artifact) { return StringUtils.isNotBlank(tryGetAttribute(artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)); } + + /** + * Returns true if the artifact contains a non-blank TSK_SET_NAME attribute. + * + * @param artifact The artifact to check. + * + * @return True if it has a non-blank TSK_SET_NAME. + */ + private static boolean hasTskSet(BlackboardArtifact artifact) { + return StringUtils.isNotBlank(tryGetAttribute(artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)); + } /** * Attempts to retrieve the attribute of a particular type from a blackboard From 57c39a3135d93719c2948805aadd655f3d8a0734 Mon Sep 17 00:00:00 2001 From: apriestman Date: Tue, 18 Jan 2022 11:31:00 -0500 Subject: [PATCH 02/17] Add screenshot to project setup section. --- docs/doxygen/images/projectProperties.png | Bin 0 -> 24556 bytes docs/doxygen/modDev.dox | 2 ++ 2 files changed, 2 insertions(+) create mode 100644 docs/doxygen/images/projectProperties.png diff --git a/docs/doxygen/images/projectProperties.png b/docs/doxygen/images/projectProperties.png new file mode 100644 index 0000000000000000000000000000000000000000..7a438ac83447557617011c024f2d4b6bc6e2e080 GIT binary patch literal 24556 zcmagF1ymegm+sv-!7WJeK!5~?1PLB21P>P6-QC@t06~H~1b2cp4#5fT7Tg+##=h$O z-*@JlnLGD(R@Q>*Zt7IkIs5GAx1SxZASa25_5uwA0%1yh6#EPU!9zhHxOG%y;0WdR z3mo8=U~^GX1u0QcDmw>T6LTwL5QyQc_g8_B-3kQ3@=66SnP0l#*bgXVFoi|z(y1^7 z1pihwo9_Hm;5(jAEoE;{poNb0$fQcHmG10p_Z+d45=WArUYzLlX?y^sF8kfv-Bl9kuPpC29LCgSD-9k7aT3 z+$3xG;X5fdUwTM;CexBe-LrUxKgECWlH)fSM+&F>$H5Qf5_uYZbkV;z^1V#(QZrr67Ssm|JI= zpYn0SeYjib&rQOg_+Ki>H2v^D6sUQ9AVN0+nzd}a>vTwl!q<`3zEL25?QHeNqZ7kL zn@rH7>DnjDyHZTO?Su;t%}6ph@5PQ@XU&9bzaerxh*UDhudnxYK_B4Ugz{_$;Sd^y zPrmat&hW}n`eBS%+#>VvAWB3gwjG}yXO8}SSe*R6ifs*cD6nNVUj&{DvVpXu80ZQ1 zFT1TM0XXu^?xVUR2!xIg`ws{Do=yxLL~)Xm6-U{I!^0ur3Vh{h0URQ6693{PYHMw6 zY~utHbuiXgwF&$Y}W}LW3Ic@iv^Teo^D| z7^Jtb{d5#C-(}j-(cmD)Yo-^ub|@F(x)_%UpEWXRwx-8*;Ye`n8*zLpj%Ro#MMZ7p z56*IQ5-upp^w<|se%M!&SCNvHm4z2;?D9N;yIvjhp?dl9WiyfkT*r}1Eqxg5)qon> z?N8={fD61PX1ay5{vP!gg#C`oK28sO;pIzYs2J>(Nb+-Ul%WUD$63HH>uLEZro~sO z3*q{~_GZxbVJwc8f)5AwE$czyC#dO(=v-06JpnA>e+O0wJkqV( z$ZUB+@=SuA%d8d=n)Tp_TC3)*zykI^$ZAKSPO_WT{u!4~=H+sZfGETttLt-*<>ECF z;d>e^Fqf3pPeBJ8RWs%c|ES4TvQ8B86QcjEi`JbJ96bEBPX)*re9b^{Gf304a|{oH z&$^$4r}MciB7SNS>b#c}J=BMNJ6Gjne2_3z9OPUWcy94rbmLFHPeYMS(9sqgX>gzI zqlDn&TKh@omkRDibZwv!fM2(hoKgHHEi?Qd935~g+owd1M8b+9)I z_TG9JLtpWy9Jfjt7kiWHch984uF)n`I+>;OX04*B(}xPj@3d39$!YI*A0o7?B`Cef z;j|b172A>9ivsW+C1lan_xT4V5xr+wLl0;XU^fu9*WR{VAhSQAekp-Cyt+9zqR4GUoF+L6=y{xN{eFg|2PKcht)}K(Hx={N}-n!3R%n z*beyx1RIw{`lNTbKJf+W`&PD;f1h%>p09w2kA=S=h#GDHH!i;gk_P@7y4rjlYlhO!4td5yh=A3i63yh=X^YY`;GInQ(UMAA!ia&~ZQ#4ZQ zY zM~{H}M1+Sgu3J{3$J*{UyHMM;Nm2_Jp+d{q{g^qM{GN#auGUQ>^w#+q>GRubCcax z@2+qBf^0m`JEYL#s8;M~dX|+czJXJOyq##`0<+S_`!-e-SR+pKQoQ3t@rZwR^W2}| z48gVMx6McleU`?vwSVFDkYN{Cl(EkRm0DsmzkARJ#VrG_@!7+^fEstP50H5%Q4FDa}k1rr5CA#ZbBz zdeB2!3#RsO2URh16J0+(yj!}btn~|{_>PZtyi);388NnAv7}Wd=wW(mp!SY4^BI?0 zaF|g|Z}aDQ(usC+2B9%0&&?^td!7|sc!A=badOziktO_-oSaPGD$Kp<|9IlPj((G@ z3w`0^N*#32kPN|Qz0%*a74l0=2uvqi+b`;feUj*sPIj<+wS#`sb+R1lc_x&VTF;Vn zis_UiL{=sT4%%sUBDqL$80$5ujs!=aq;1HIC8{iPhfoGrZcLA|d>N5iNb9S?pH{rT z;X}=Qx4whMc?SzTX|D#bHRY?o+rm%2d-wQW)5^$u6=Y1>>ODd(_p41;Vd#`kS$V`6 zkMFdebg>>Q&7Vbb`?Wau*%Gcs5Um{y-w zju8~1`d3dkNSpU8LKZPfnKL5om8`R#t)`UC3R-q?x2})j)w>!$gfFIMV`T}Pt&Cqp zzYSrAErE&h8poZ{AflC!z=sSz*Fxo@si`U2C7bK-Xsq5B>^Aq;>|RhJ+l^UAaKOcZ z?&cX07(-H<=J7GpYYE9e;J!sc?Mkzl`BwIiFUt<0QzW)a3FS-_X8C;Bl|blksuNFn z*u^)7bgv8Byy5)gb$WiYMDwnxWnXt=66}Wmbidk9_4uqKz9ZR}52fC>3Uih9j(I7| zb(T3Q?{32QO)vhvCmw8|;(rP`C$)pG*E0?8PRG9ahP8P5gq*E{NuO-4i4;!nz_{L` znbB__@F?EC)yDv$i${kM@82tYkKp}oVXV`Z|HgR$+lQQWDJF?XD8{vCGc7xE1cJKK zlleEkm6N%^!9I_R;0;WimoE*n{|;RY<02gPe%OEAPyYRGni>m8tHmW+Km>N3b-`?T zf4|l9uT6+}7ytkAH~;VN?h+zG4Vs?0ySoon7OwxUivY7_q;qmnI0N;kMs*@c<{1*1*x7^z;+>f7e zU+^s|C{Bb3GX!<^@$w8lCz~Ec4T4v_;C3Iv|v!ei2;! zgq2>c(8%`a&-}sOx5Byu(aWY|A+d67b#8I1h_DM=`22ZvH#z3o(2h$nZWY^->OBqR zlb*=PacJ!mYaBpsXO^GPAn7}!q%4KN2KhzWIBekFrbyj7F z&;_UL2`lwu(3*2E<$xC6(B%vV82+7*X40SBcjYEJsSy>T&+hNH!ZE$Sygdw2{vLXE zZvqk)7Zs(=V|`BEGZDgnICLT*t_ceC=bB2~p<(6s6(@xcjJCVRqyqC(jx_JZ*O49< zpJDEztH9NMTDmG{s+@7$3xG3Yk<@W?`wS8l$LqlWBmSM=mmh&-Y@;U}UwxL1eJSYP zUxO)gc?A4-hAE=SrSp94>un-6YkG}+*W7(lH!SdX_7^af!appV5>>k;`4YfxOz!2N zKGEMq>%XOEPJH?N5>H*h=!freHT9kzADUc_Uho9~lifx(n-WVn%xtsu5qfZl2t;;0 zBcq@U;YKkPm3`N|VdF+z+~pTUl8+G?!il{U70|r8?Zuyt^n9^gQw7q=zrV)<3wVNA zx%wP?{+XD%+5PX9L&OCKH+B}-5GM$GqJX!p?VcX4Yw^Qo_S&vj4C!%Rbpl7r(|~8- z?2KX(^wGL~o$k-p7Bwp?wrqC*d8%`OT^j927hR~z&0!qvvv^wS0*e5f6d4=D%^A}G zz5y`SMAB;Ga7On^+YVdue!KAnF&Y}0f`WpdVV>(%yRi}?v}m+$v+m9~{rzNn%)>WQ zI%`uJDLk1a>2cLXst6J%?5;W~SU<+J2*{AVMOnVIOLC`7*3sGs+{ zj1=`xhTTG?dUyqKu1h7p>WyV=y(4kUWHyBlBmG_6}WGKB?u z8#%Fn8J7aGE%kca`54L7FCF)0LwyaUtw?$27IuQG2vfc%D#HbiGVDT_NE{L9x0i!Z z;isuo7apv4@E{i5pAoSis1KntEd2I|dv7f!PppO^LDzALsmy#{>*i3alq;PHpXQ_H z8b~Ka+SaEyW+m5-ArgL*JhQwJC*^~hlj+?QTn$wpUVPRbw(oV{oR%Kyg;BNmgK(L+M%gzMwskWb23Grx(XVDcY0eg$%3pa;_Qt7 z{YQ7VchZ4Uu=f?)(Yez^?;)cWgENZ8qX z%NeX)dglz`T4~NfepwzG)S66R<#$Gprj37IZ!D#U8C8vuGk#&`f2DH^ffG~i(;D)V zl-Feee-AqPZM+do+{=FCo$K=IVw{2uRmM=i-Z+A{)uZXTzcAw)baefPT5wOow{p}q z{(W?G#j0yE6VuCs;s*L=?AZ14dB?eyYvPzA%zC49LYmEQ|KYvEUwCFP#+u^T_f=|bQH7A}(?w^yNX zhv8Kxi+s+j_}d?%wrw793MWi~YH7#JY4BsO$0Zow^T761<~yB;?PN)+zwy)tBPi>X zgTwDQMB^|iziBHW^@u#66O|wursBe@@*~}DyA@Z(yomS^~2Gxey36c8Pq}07vpV}xTsG)KO99v7?)S{z=+0=kcM2M z%TmN!%QAwPYC@S`8Xe5nxfT8Xb8iBb@Y!ajyQ)4d284k}(7P~VHv-tb==6sDL&*)l zS{Fc)I)8>Fwjv^s2@G9EnKRllybjDVH8DqLaQlPvM-^LQXEaCK++X`zCjTh5-9I=O ziFt@QZ~9#6GEkVY@H(h=6~(UoL1p+EZeuG>o?A`LbB9<}ouT2<$s&7(baBf14$qtE zcSu#INi^2J1ff{z{Yd5EH+x9wLRBc=;uGBj@KSv1$#;e#6{{9F3Xa_V$e<6_*TOvr z-CVorJKa9q$3{+E+9u6<*NKZfBvgC5;eEsN^9$JEJh$+jp+xQiH-aPP=N);L-sDLh zlv40Qss6-ZTx7X#rzZOJ)z;DCq-XSY-JNVs$_sTzlXBagZ_6?ju*-BDPPnkl_&D#F zT$dDmi)INLlOeS@&^z1@$evO^hO@ z2vDT_^v=U9q*TfRSCXbEv(X^_upk{T7l+ayB$#=Yy)nOK&`=cwV*l2IDk3teVm{xE zjuJUz3^9R>YMqEBvdh#L#R&nw^;dAag$STGWySMwdM#0C4=3v#Rl8IngrRm-W|7fD z7YNQ3!%?!=^WD$TkXZ73W#L>ugg3a`5AAb2C9&ukSln8P4~CE95z`mCnIvv_Tray$ zLJzOpP(88ICB2Oq|A@wBD}XU)jhE05#t;VU-lrF|B3*@cNuu?BrG95WG$t!LksK>F z$*ItldJ+InpxW>f=ZhwY6s!%8eZ=c`u95#ViH@dG7fkntQhaETh=3sbw`J#UEM=#Q z`K2+PkU^Nvb=Mp8!7<$qGb>7X;h#t2th*P&>JTL$F1uwQkqm2x0_7uEtjSBI&cF!6GKuL6EKn4Ph_^w7TrW z$fKrSh$JeizBt$?1!qD6>2{L5`1MJsO3U0ki$kAjL$frpjw<55j{Fx)k*Ty>mrjNk zM4?!@9~-Nsn`J(+hH)ij6N93hi=ExFr!GI}jA`2i*wo1d;S(V9^bs`CX()jsWtA6I zZO(^J1H2yUKbK&zMwoh_J=Wk6-!SJ8XL+4H)A2ldhk=P%eq&{3hFaNn^+NFWPr@PE z8cMfM2v z2w;>y9W6Dny){?d2o^8zk_hfzPSTd((GwA}34u|F(9o5dzqkz{Lw~{FDDyuZ+PCuF z6NZFJK(-;8ZjbYC_c4LZ?1Z?Rk3sa=;QbJh6B3HYdZW5N97tQ@4bM2bZ>tApeQ{(P z6;q*{H|gOq6^N7ngZ~f@92RQp8*9SOZYms63R4XVMm~ zSm@3AX!Jw|jf$Oc7f>}FHcKFefL*CX`m|;n#1>ndq~f;NpA;9T>#b}JNAVDg==7Lg zZ$I&s+l>iauicz(Ho2V|C|3!+eH#=>#JT}Hu#@Ro^JC=qmE@^JD-~b5Ix?HkhAdeX zJ>!!CCKh7rI19oT)h~#=;}I$n6HJqoY_w*{wAPZ}#5;rOS%s^WnNbc(D*82MnVBY1 z!@4$#ozp2#U)t$me{RE#P4Rr*KRO~3|K_yooqxy+d1mh-dHRxml&p}+bV|G7+G zz=N|fq#N!wC~E78l16Kg*a$??i63X(sqBjXd4$5_T5>F;sjxbUbLWQ4e7Bksm0*=R}_$$ zux>G0ib})b>JW?6LWX^m-D`>gI|Lv4KM)Cci6(-an11X&E7!i(lz5|*Y_YyF*8U5+ z0l9a|Nw12UWg{X&N7xq`oIRUfBG@)`nV9zqkHewFHCZ$6D>b?gei?4^4Mboz{+u5J zaZ%ymQC(emL1tDhRrOJOzhM#%;{vKU(-qC|3j6A^JFxcMfIQi~P=Kfd^&51}X`bs2 z|9tgBv8`7nc&rx~xm7hd*h}!to<&mx?BsR2* zK3A>XMg5aXzXh$7NkOB?-mIO?0VkpC-sA2=8&@{yGI&REg(HGeZSR`7`oIk&aE=Xk z{#s{M=?h|=YHs$sCD}YT!xlvL#%Jx4|56*4nd^Wim;?I?HNF%h-MyUE?SFi@vp-sR z=h8>$VE?C50Z8lNtYYXlk(cQPl$dccnObrOOhczMYR>cmj(JK2NUjs)1;Y{VN|A0i zlUI7XReTd2NF^jBssQ>SJ85bFB<8G#on5~^`S^2v1xRPkj~{Oe+yO!3zqEHPxDbbI z%mGvOjhUSj2+2|*M%O0tRVTHgH8LFqZp42ke{`ijKu%nL04Z~^5T#F%as6IQ++F=0 zxQY5X=K%f7PgeCZMlN$9Cl6cj?a8u74^X8qUqF7>Rj-@lYF^HPCsi`FI=ZBMh>pcb zeLQ7h8tG;8CD);WmI;qeQa51Z1}}Ujq+B7nX-WM`E`wYRk4OJY-Y;r1KO-7TN2l~9`O%5+u=1|2@)JjoZ@4&+TAtQxsO z|MCK4sAYV3)ME+fksX-@B1o&<;W=gShq=pgZMTiN$pc$GWeH!>Ocz1W>4#@M=!@%* z-^09)AF*HIu->!yP$5QP+s+QsvRv3QIry@wcIg4RlP{rOMPKgvG}Jj%qcfq78& ze!aeQenkHM<9K>om&H}i@;gpezdXfi2vKawe_W2>_%`&XH$|wDz7**3tsuJ9WoKF_)=#1KuK(tn*7taZ4Jy{cauOEXHWBVe}JL% z6*M<0%s0T5k3C>(^LmFocC>Yd_E8`=2Z25^V2cAbye96sDe8(()p&SPmr?Q#*Ww}!#hhdRXZ zDi=efs6LmBZctwh_YO!x=m~Ou?CFtVEsv)$=_lV%T`}0y9xRhRHCl=?f`FmVqcZLz zuD0L%*j-87k5vEzawfmYV3izuD#bqC_!j^1=h|2$O^T6y`~`da!*3OaSRoMZ=)LYw zw9Qn~j!izQ$MW~DZ?>8K=(4B%ow%v5-o1Mlj!!RF<{pAh!~%l|X_l{EJ>vnE#>89# zwlIW+-?epC*O&b6`lP?!a(0dcm^g_wz&DJZy#IlH49;mAznWn4Ni6ZZEV~4(qQpQN z9TioDznfJ2d!b!h1$L;0=C@zSr+JWS`k-vxEs zEi@d^)~0V^HR8RaLPo%ca!#dBYVgg5)`|aO#$4tw7|*c@ygLDBWeC^FowQw3@cA=5 z1J*r5X?QA@vYM+NT`#rUKO}HqXh?LDE%XFn9W&OqOT356o>-10HbauJIoa7DBqSsr zu0d<}8APZiR1hk{Ekoz}8(8Vf7SrzT#m6a9uZ3rlaXHD0XW%y%aj7b`eDFhNn?%F3 z)u=<(=eWZggaPOl$}8s>(0n z8y*;O9&gu_BhPnVhEJ|Vw-1N{dnnt@8KJaNRd>X7lY~kWe!m|joQBH`MRfsk_z^Qk z)SpWxb6>LYlO&7PKXC;I7Wt%@v`G*VfYIyrez_f*z5cGN<1W9mYvum#y$NDaiioKpXJ3DsVrEwC{?lgQZt6Bc zRPrE0e16k8LI(`TB2-S78qe~5SIr~|djnpuOaGzqHi|K2QZ}NcHRaOn=9^GxUMtDw zZeRPo*B=#Ez4tc}6%YHV0lO|->jseL%4*y>CGVHE0dgeSsCyK;e@QMQ-h107yo~#0 z=zbSd5?cKW<)|&--@1O?%2gRpbSM#JnJx9ODovG+Yl=!MjiO>QU)rk!rNtzq07>(T>nobFr+$0AXd4^-uliH%k!F|ySi=tGQIm}o74=i^k|S(v#=08$%B&V z!aC0sDyYe8>y02bLkV00^1teMd&*^2ub(wkHxL}yqRkJs#qKAjHv5i;!nB+wV2a1^DV zc%Gtg82-fy5Gwfwh+z_cbeKE)PMN+iurj;)CxN$yfOo-!h*#PCsM2mlT(veg^U4`* z34?{e|A7^3A;VBO?&4_eTm}u?WbIBs0sP3n}lqK;gd1c4;U>LVlb zXjtv;&u*Vz<_*ojhw5*+R8R;IJLae1rFJMQP$pcA^ZeTj&~dOz&yV(jbzfnK31b2c zDV8i?X}@!KiMNiCx#}P@ukK-jyQ-=x+j!Er&co-24~|*yMW$WS185Ww@x0Ud)z+?OYI=YbI`x2~vwUv@5htk|~zccYZYF_Oew zo`8q$fu(rBf|LK?fvFs>=hkjat()^KdGMeJqr_a&yEAfPLioS6mDk(8>aN*}E4Jc# zRk-5KPuERDn#`aq6}A$~v6vT(Z<5#Z|c`p))1`BG7C37b0LlSfui%f-Nk0 z`x`ksG<*r77&8((QET!j?T7uVU&ZKgBdT+3{;w4SH~?H{{5V2^J-j~F0$oQ~J2(ko zj`x_QjJsKP9klo$Iy3sF%zYq_grWee&4GvdW%nMdsMPPH9Bh}LM9u>Ii=Xz~|I!7k z^Z!a0uEPa4b-wsgC=^cXb8azL2@wc>W{APK4A=Crc@fd>MQf4ek2hLHM37xo1CYCP zVfFvU5$d@rYM8TPZItxCA#Lrj>b-SY24yb={P z)OB3=4__uIofXSSR5gj9-hvmddm(d7wq)zX_(RVy#raC(2IC|H5eya2le2l$<5=r+ z#YhYtf_|UKBv76X^Y2C0DBK%SM9Xz6Dw2R zMCy$gUedoH!|63}1=(e+=Y4r|6{|@_bA7|M=#2Ib`f%sxo_0A^Yz2|QB)k2%6kW9o zV{S1Nf;W(`^|UyIJ<{G>K5{i zPq8CNEnvDb_%%dGG1R`U_)@d=N+Xth;s~f`^}C6dzgMOgPbJF}8b1gfDMin2+lP=N zft*Z90}h7V+n%T?rJnlT*?6*JN=q=Xs1pp2a zt4001AX9`i?GjA4mNb4U*%h4PdRYcAoNZ!t0oypCBi91|l`0GXM%+gpW&_C28$yQXdxj<#x9-3{P-fBn3xcpD8Y(f!94oH*d>$Mm|B2N}4+>w}`da8xT z&FA;E{incI@-=}*-(1RwZXlGEqd_Hv53g8L>Sd-WWqt1d#byg3+UK|v`qw)JDjQXy94>-S-KnC^4Q ztI@Xa)8qQI8OCg9(B5UUPK6mr0b9+)@B5Fp5g{ReNUmOz+?ep5eeYI5WJ~PAAuhSm z>)MiPzAQFF*Q=r{WX)Yz^=nsn&Q`iK16E|!+MSS`Hes|%QoTns+_g`ovgEVPlXXo7 z9uPCvGr|&diR1wGzet4HJWwsge~nA_J(ZqUoVH z9dZwl8w|)@j*BIwSGgncSCyLbcMr+p^p-9v2;J8N*&QT&qt{@bn~i-j_esQOW9F$LRvkuF<1r*~>Q=^fiv6}0b(~}eTzBD1Pyz5fnUH7OJ?zv z*&QpfHJ4s4qQF4WA2$9eAcF+n zz3fl&G1pJ0J-i=3etiDE1C&?ivnIw+fsoSm^`@5nQY{u|BK4YTYSE$Z_}=N9m>>S7 zV)KgY3%Mzg^~{8@nv_Z~dIMo6RaQf~or%yrU-|NGHT+Z-Hh8jTr*6;cOLmqDiT5#o zIKxm`Qn<`w!^t}96JCesiGI2C4O9vJ=KV^y#Jlia7nHli=D`H?FFe0|^s=)$l2Ff_ zQ}3Ko1mIhdlVJ+CK{Y|B9?IGjwEV>hNyX z`^lKe<7E4NnY;IvXkFIvRH;j-5_CWH<7q#BO(t)DK3Q)Lb-!??LT&to=xQe*8(Hoc zxI+W`v&hiB0cDBR<(2TfQ0(=vP4>fwV^_!&_N=0<-M>`AE{$OxdIS#62Vpn3$Y0Uf zuyhb9Zvsi&Etk^ExL7=+J!TE$p%}Vw$qzrf)-jhtb6K=o$oJPX#y&1DNyh;z+jiR* zvmuHl^}^_b7|091;#WEDIj6ukFm;+@4ol~(@+0T9NJ z7Zpw6>zKev&aR8eV_1mGgo_@#Jd6-qI-(0N46{5+H+Iy5^MifPh?{KR5|8 z4+mrdmo^NbHCKbdH-MLHJDc=!l*6swVWnmZ0UZuj1T@yU^%H>pV z;T+ogz~3yG)1>$3`mb9CkV5c})BkHNhB^H0hSxIWMeTDgu+47t>NE8rm!URig&7Wl zKC9sJQc6KY_ILV$(->4d!OxsJ@kY~!Y8gZ7;;Mjt^SmhvKjpjR()$2lGh8gQ z$0D3r8rZERf*}Sc$${nK2v~J13h8do2$F|z0C&+9OyMX4vNG@O@Y3$mTcYJ#N1>8d zg7mGp(`%uCEdL;I@<*W4sekzM20jnncM_j7D+keTFfM)lC0ZXE$~cO!hGHnDjy`gL zl6iSEA}9Zf&&L|Xq6%5q3G3=%o?4iV<3GWwr%mnIJoTj}H9uKh*2sT}bHE%_90X8k zC;jFMNp;)t%y+_$Au1RXF&kQ}%Hd1(;$SI{ou{GVKMXBDKHC~P3}W7GzdHsD6u62m zNKharkQcM08RFp6M^_{W&JY$8n*p*gdb{6VsF#$4vMYt=F7oJ97y<8iQ=gXcF&SCNv|!{2&1RIwIJD zxaWe@w9d7sPLKAXne2xoNQCxF$8tYgrzM-1*QEV$STtBl> z;iwUVHoAh0(Gl;EQTqDG*p}9HxdBhn{yx?)s=elco-aNw!UM)n9{zxW3Cw6$!vsP?+DTutK=ShqGU27E;a zX^7r9PH9Pv;^wp%Ju)ai&d=hA+*R@n>1yG03K1j$|CVC8?fF@0v!Tf(;<&{s>vbbe zx7na&mt7L_oZ>@;ZY<>D`9VYVD&xzA9{)#Hx~CV>DA;sf4+dwIlRswvN4T8iSHejX zu#&9_oUUY$SdDXCrxsXgIS#M7oQZivp%qO-lKtFf;3O|dI2U#)9PCBl~lEFRk;%p4__$!NBB;d+)q|A1 z;uwt`<?-aBzp$EANb%AASBnP`^~{!Ub@n=8W({`UlU7 zJg_Os9o&IoF*CWOuX29Yjc0wP4=u2@o{}d253dCt7~jFI$THQBF?d%zKXsmVuvy_L z3|(SQ@0~3q;KFnq2&*)T9`==5zv9WAC9_gHfJ8E=*(qmzvp(#(_>7bB?#{1$+(Fg5{4$nXv;tlTYUCoq+KF+-rH#C zG#Bd_saaZ&V5m*;jurh>A$G3480gYj`c_XyCazts#O&dd9&_dm46KVT z+uAMzKs(*LIf>5(xEdFd?_~e!a4`{?LJN<2MTv~5kt~-IwcK@3X$(= z8M2BivVq+P$B%>}r^7hCL;1ZLa1-*-@GvjfIt&~IO|5_!lf`u4u`)-;7c!xzv zY=x~=UJU&(>o#1!#hVt&)BCK;^1OE9{J6L}H`h}b-6u^^2Y_OLSyF12wJ>AR_#K2f zUNOSva7ZmQ`%thHdA(##(NLv-e;6y5lEX!h&xj$Vn<-IBJFBnESGmtymz%Am7=`w^ z>XcbOa`6vw1iGAi<_-C$J&B8JDrgRK=?_B8&E|E!@OCx6nblaaIwW{+(9O9LcBR{1 zux$&;9cLzx*yXg`z4IbQTOUMGI|XF#zsnr&1IeA4Aa9=@#o_>iLCZljK&vy1As)jP zZ2QcCN~%S(^4~g9g*kY}H@}BrNI#R8SJv%{l)E&Y&sR-kfT!S`+UiTy4bSL@ck3sM zOZX;V*M2&~xaEOicOjPC`0&=9k|6}IsDXPIST6Gm;ZAw|-7rg8EKXI5k6w z^WNSB#^wPV#JjjYl0?ko6F_@MS;BeyJPJCAa(mHtUcaGv_$ZbpH2&1@d;fNwQF~0t zlgt(i9K4=`3v(1?`f?#$?_6KzG4hL1shc>|V^B?)#O)@?=2 zNB2NOt6nEweQ)@eF1OWLk=46?+@tp#IGkh>v!iZXhO?Saf}I`(TJkct6_N?p{$wQ0 zdCZH|?WFdf#8KGiLO&L&w7J!huvRwxns*s^zDykEdS06nDci4x?y)%y7L_Pr;cT@K zklIiGiw3M|Qs0di!N}JBB25U^#jnRCb!gYDL;-deoxxZn-HS3YuNruE@8$ei zRP^_7E$xxq7jTO$=yvPYOh;7U*MZgF627)z^5?DNZebr@3!DzU^etTvaZnh(9nr52 z?xC-XK1Nd7zJ=d;-UWx~f(8htI72X9d0f-I(L;nehOJEn3Sr zhKPW>;}+J<%ZOC0skiVM>+Ex`O+(47wjYHm>sPt&RyS2IDRB$7fy{AWMA;boq#^?C z4=i!b-#q#2k~iD@W24*)(|k1vP+_Jk(S{4YCknATMXp0Z=r5ZzDOma`Mj8pEdbvz4 zz8%x5n?;>7dmfks5h!LXp`P7+f}O09Z+vX#Z?T!@$cF^bZIzWT zv&iFVnZbwcnCOu1WIa^md)Nn^S`Z$rhId;Q`RoBF6PZ1KNZaZIRwh*6;}UQcd?f5( zL=3t*%cUg2zQn|eisr>>KMBciiKDxK=7Z=}1yv6VK8u}A;tG%A#je%eikbQhC-)d-g z=g-HlR8I^2v(?s%Tz|H=B?>DAMk$3W!5FXXC-(*CjOhnkEs}I$^gpKK0iR(H7e|M* zndwsa=313G4%?Td%lHsNXBoO0{<^fntCaN9@LBLiz}Hp#f9agWy(k}^Io%`Em(tSk zo%8BUtxtl24;P$EP4)=fwktiq<3F~E^x+Zo3!tWS1x*CgX#7}J&_pp*1HY&uJy5U& zDQLmxJzjszSa=I!`~CmhEn`*Y{1s!Cl!*Vhs-&E8|Jg4!Q!FOSs*DdrP?uGK z3h995iv-f80>3iZ=`a$_$D19!B(>_xV4} zguDN|b{Y=*DC}WT1OL3SUe+2l=))H+pnqUIE>#3=_$n`eN}By2 zRed=sI@t+-))(Tyza$$cB_ocMnLX~w12dbXuNs5cnzLzB*NxRsGmo}a!0!T36Se^R`wM!!B_|*S=nC`o;6bM!Z ztKaj+++Eq}=q-qp8Uzx;>2E^Q;d=#<_OsHo+BU5o0lQ`MC}x*`ZSjGhe+#BywFmTV zf4(rEyn}U)lmY>Wl-4!x&B{K>Llg%O8&^{5k6{Y9^>w1Ojgk-6-GYaVC@-KN=KSTH z&wwIO1ecSl`Ke3v^XDT7#E*ueQy1^j6xqUUoOWCf=(zN-geRJ}xj{fKbBJ0g$Na($ zZBQOlYOry=+U~A#Xy5{yLCXSu0S06Ik*vd1qLQT5T@SpeOS{o-o)$n5 z6%!)d-YRzI1A3fG76#}Puf77ahks9BottMB}9*`FB`!gRe@8Y7I|nI#}T{kCbUZ&?BQBXU}Sa_8|IXAj-i--o96 zqCdTU1NsQtL%G7eZzm@4r;EV5ZwK8t2kYOToy&`01=+bYCc61pmw6dwdJC`W(L^{> z$Y}{qK>IW+jfSE%<=J2GxSXv9eg^uptVhnZ+Pz3>n2O$xnY=W4uP}+~gvE7s1-PV~ z`kTCNIgVRS+7oy9>^BhqjU;hTnnlIZ0-$Vfu7J+s2@Uo?{CKxO&pVDl{}P{Z-d3tDQ)ZEyqe>nA!FMG)LJhrjQo!yDu#3SQX-Yy~$Sv*l=s$nDu5XX% zZXRW|MH9&jCVLoObb2ettwg>T*Bj1mtCZIXZLA<7Y{Bj_l;eN8Ah>6cYKz_*mDE%n zs_q9`hQ#Vv%IS3t=&cHcpRy{vTB)C#Znm9d`Cjp4@?5=jaG+&k4!;Pv&qo0{7f^M#xUkAT60%rkcOQJpv z4b5Q?v5JZcDdq0dm6{M3ILG_Etk)#i$K4oMb%|16sRbm`FeN~EfF5bmi+>eViG0(U z^)qSHK9=Yq9s{4CF7cQBHh1^tQ7EmnodgzxRw)<#@-6I{aCMDl@XbH_4tN`vTI$K~Mzw@*nXmLGDE$5IGPzMU)4S z9rMW*k0u&fN4;c@SNDJ}3L_p|(;M}rjeVS&%tdELH6XPru)J*>DaCRI5N)oCbwtbY z(wSdSdT88%a|Uh&#znIA zeAJ`0-W3zd`wza!nV8>W8ywPC(Wl7$>xW}k?D8q^61O0nFK~idR-SNE)DhJh-k_^;Rh z!&Xsq7H|rb5gv>g!ufOtlJm*eO+UHmg5S5GNF9@;Q1v1I*@M zfo|-fj-KcWcAHv?;lTWm^_pvo1jse=Kkd`4Cm{d~x!P`LXyOPoXfwQcE<>Jn3 z_oSxt1=gIie8^Sf1Mc8GNmGn4A89AGm6(|3@I7iPj~@cWz$kOseh9%Eu&~t(30G2b zRkG|}{^)ik0F4_rPn+`W1_^QgLpQQ2(nrvw4*`q*F2~IJqFwhf)`zy*MEGQTcqNTB z8$lqW>J4}{`xVi@kwj9FQ zfQ0}Ds`U##IDl?Dg%XoGmSF@16H@W@;oKF6ek>{85$$oOL(Inds%~HD?Yt}3Dk<9W zx7Me=wS6BVb`)`K72!741lZ$Q0Y|USISr&MfHN3`cD*L-%_p%<*-4WU@_8kI6T3Gl zD_rOSs{<(6EjzS7vdn3adHIpz;uhfUc;ceg<meTJLV-54+~Wdr$CIPzq&14IPPZ&vYY6}%eD-pvn5XI30lF;}e@yA~!I6!JtTQn& z>9tFewks(h@>Y4-AK!+UUBmyDrMJ;fCP} zz9Z+q?0$PN($`{}k4ptpcgxk=l567VhfsYU?4wS9KO$Qe<&9tplJalC3=9k%>*gd| zAllcD7knbBrm(?=ZYt1#*3Q0_-Y^h!RoEVN;rC~bYKhK5f@E!n6NHWgFZVK^Wr1F} z!<$|th)4f_yYC@Jnk{HWTDce+JXJnhKgGm_7D3w!+5VFin zXiUl$*_ly78e{CT4%r%O7|WRLedxEG-gC}h@8|RWWj>z!x}NWSU)S}$uKT%{{OGp% zw6replM9NK_b?&k?AnzYAvPZkp;f_U!YCHooI@WZt z_ijg-?n4a`v&^fn5hbg;nd&JY|7J2qJcqH`tN3y?f8nPz5hqp?{y&p1^>5vD0sHS; zjht~Or-F1OxjdkFeic5om^6LOxet7>XL0cIAEiGFT?c5h&;B;ryOs=W?MO=6cBi=5 zI+!0Gw$6Z;`;Q9x4pl!O5Kc8*su!ztv6((_`t~>&Ba&SElJ6jsd(Kz+^L7&xf=Kz- zWYK($?C^8b`$Dk~!;dOmeIWW4T&Z-P?a=n{!L?6$d_6s_1EQf+lWMP^FIWcfQeZVj z@xL312L}sA>MrlJ(kXuk9O$X$7MCr2X__p0b>KX(1_K->JXV*o%E}_O;Oq{eh^31-a6iu_>RxJf481k8Y&n2=^8lH`kDnL2P z5I*ww*yY{FPSo+~L)?b$K$#UOo}<1`M2yKgu!6Spo?FzaZD@u`(c?_l`g70Pe|42Q zccoU$7k0ux+cW$(+KWMxcbVs6u702#*}trEs#CJ_gUT<0b_V*^MmsalJ=nJYmlxL0 zU?wAkW3O)in&UfJ>DoFj9I$eS-(+kPe=NE>Oj@rnIC!o`TX#qS(^5f3`a;hdHTkvS zS9rV^eaXs`)-j1Oisc>okHGU(WD)AOf-V$iacEq3x~N~sO$94<0xUOgYSkFG`&v~8 zq)ec*IP4LqJPW8*;CrWzG4bImy+p@r`=ZrJ_ld;$M6c6_#sPGa=ilhKewBf^9aj=v;|{5p(L zDFjt37~AmwA(>(?7j%?Giu&TN!VXaJI5NP?MWH<=4cU^@`ir>{kL^CT3v3v0pLEUzb?6bPUxhRtGb=)y=*4GxbAsZH7?p z(4?Pwc%HFRmkl7}@y_iOT-m?kMg_%jYc1p_u2$eV@;pnI2FIgSX*c=o8TMG?5}xD- zr^}s4tWx`8{@aN3E#76pj>PL?hI1+4^N*FnAYD_OcQ25KLzOK9TwkWn&50LeuhcN6 z&fpe4cPw}nvp#Ws8&1#eS`Y>i{|=#?mAD!zElm3T`iTzv`;+AZWdUzGK&%OnV` zIon^^?(ce{Yi?YtrHgb_v%5V7&S?jA=QcE4h*WV22v~%Kr0)r0Z*eDntM0&fvBs67 zEtDNTCCc#6@R?A)vM!eaU5bWrj*vNS{?oc2-+O@0$2sR}D5`gdxR?H(TBgWH$3HD| z3ymSTxTF0-$qa$qD_zkcKJSnu&JDP2j1=vg5d|LfOaX9G_iXChn-gul&Io#1esxl` zF?9b+APm%|OXf{`zTRPIWkGV9n;Q#u-$G6923Z<^rAbrCz5MRQULw9ZTA3Hi;o2d_ z5&Svo=8qZSmZ3KuT4h8C_k3LD=d@9?ovt+=465I}7vqc{9JdSv_M?{V;f678ry`39 zWWP!KF@f4Cz(dEOWM+NXsurCRL<*Oub6ZvyiLgq;o=KUSXA819E8}{wz~gI;?fq9r zPaMnLKJL@2)0a?ywcb1E5ZdvkeK93XJt)@ojFiXhYbCT#bH3g58#77Tn|p?9#GaOa z(MHGVfyB0V8IM@ApxUZZe?`ud)s>y-_<$gxz{K_|XOrlVb^1~UQ6U98M{n0k+7~5m zvr7a^R1Lr5!?#A*DiEGdB$+}#=2TRp{O9uf*ip!8i%VV&s;yejj66`(r2KrA90E9f z-gJdE1q4&t?R&_GzSZp4qZjWVKkJ34yOVHNfe=lB?iY-Zt#?(2E6Zx#QYXH#uq_)c z^mp)ftI#@nR6*Hpoo-v^F^|{0q;Uy_yGZWY>(zYmN+;Uq;GjlXSeutK>gWDu2)x(9 zf<44~Xi?&r>;dIBw_KpjPflPQLEX?=e2%-PezoX%gHJwHSAFfJnf1Ds$O%kxk&6{l zJiDRCfrDT^-2!r=-Z%;GF>OFGxZ`h2Obe`X>oWGQ*J7=fZa_c-5aZYt(LGe8A(LM} z&$Y~ly>$0{^|Tn=*wI?8;4{8X9w4^v06EP*%bl2MT42>8ZnWgny*^IEUwH(-g!q^e zDm2%NjR>p65JSx#lff;Zh-aKmsz}!3u=V|A8l2{#brT_<|r3r`LE(^ZFG3M?5t1tdbbDX(J zo#b`~y*XMyjb5-q2*fOY`IyC;7N6ep=q9mxSfDUIi5c_wMOC^5+ZJF$2kE)!vltbI zRRedF*I>NO%~tggwzeoW%Y$NE4RVO_^dZeSfy8J{i-U3xkJMYk1y`Za zV}0~uNSzubstne=Rur1&enW*3_BMT`#z9O<@|EVHmwiF9jkcwP-hy2bffv6DtX^1l zcBH(y+1!FHV7lI9IyX@Iiy)2dzo{jYYRI}2p;n71)n_f*wk^yn?6!BisYyJ5Wz|+~ z#Ad1&h)Y`|T6dK1a*tUQMPk-F;#QcV=N~#FVha2gy#sHkWFhtGaV}!iVQ+?VH8f5b zXgoEza?h{^?h?W-m5A~S>DQwBzU}Tz6;H~y8cLeYg0T9E9?ny4lRV=AT`mlt5Jgc@ z*b3MnGK(SZSQx3I4GD)g7l;8)maD;a!HVTJ!%#)4pHtrORv5-mOO$)e6J-c$h_pBx z|6%}Z;Ly>5u;qQBO3bL7gcUpmYKP^Cl9=tub>6cS>&^1Q#^2*x7S4GdS zBbZAktF+;v>(PwGc^21>E(n?ZF6uf!UcDVUjdU_aCy0KFV zC^ZcJEFTg2zNs7p$~D@cC7OlWHF;Bv!>Jbor3&K>@$dElmzL&wJRYCv>q>99>T#T- z{NhcxVXBcc48U<&MqIq(Nlt~bsPqCJ(nn8UNUu>zyl+n}$+?<(YtG1E*`$GJ`@4hs!Dx%wB8*HTy=qx;KPfmUPc#nr! zwgIQv;?wMG$8{YWYVWSmUS`ITlyoBlyHK5#gk72ob-UzfyqdE(VVNs4<9@^Lv@F^_{xx5~8N}a0RJwfe_n^u=0dQ3P7ZVY9aOHnF7XbH0C4Ul~k z*$XD_@>WYzOs< zo(%|KFBN0m^AZ`jqF;z92xM7v)kU*P+6W!|<@fwU^~^9XAW%S` zimCh3Z|YE$)I?3|u#hKMc$%1ZSmZmFr{-j5GYZLrjW*jQ+W~*q?kfqJOrs=Z;Yfh=6zVBD&hCc46Lfj4W+{V>4(AjfPA0nsZbJ&*D3Evny)B*Q;P(ho8EPipT2+Wr!{|BTRjHG|(E zf%s)R5Vl7V)e9F+Z@l~B#<=$uxkYc#!{yiweLrx+CVHa`{wIZkP06xWdKm(L1?Vhl zSGWOyU<3AMBgjwT;L)vsw)><6|1F^BLI!l;X5zns&)vIT0IPI9xY7G+G{fk0*tgs4 zM}T!YttcW7bncf>1B#hWb=Xx?fe{U#t}&ZXXB;Og;U#SnjP&m&Eq@Ef|ho09bSCVQroxR7~n80>A9qN1Qk)RI( z`RX$1Xtqxla4Yre^o^n3RP`4yfAOwOm>Gzje@aL{^y?o4{*}a>miuq)1Vw~0dhk`1 zzGYk)Az#OZP@)+YD2I#SH0jZR=+Pt0EfLokFw9pjs{|&O_u2=&!0DeaZ#f#PT{MT= z1!Olhr7}$=0IGE$de+KFvwh|Dw0o#9mX!iK8-&&T6D!pMTW8U~vR7)JP|jbsyQc%H z4IK@@grch$8WX&kS@J0j6RrXr;-ho$kwnNo zU)8>8H{yAKm;z;3GQ4i^V&rSYL}L$634>f7*Iuiqr$lor%Bz^mVT-XmC`o0}owtN5 z3E%#lqC7+C<~G%SIG1l<5wBpC?|K-FL`g~d7y`LEW18(|4l09fV;?Ko|X z#qlvaI!@O)v_co}&2{HFxt`&#+-?`APf#?~(!%pnbQ7xV!O=zdf9-veGgvP%bip*Vn1V5=f zPRLVMv|bC&e-W}LwkIQ<_nOwsor|U@kC{WkDZyN9+44xtOv+%+`p3q_U>t4jToIcW zO16ms46;1U3y{`crG`x|#*ZhzX0;tn^frw*)QO9|B}En1;ZeiZpropmvJfw%{A3i; z)0yy5#;lRid$cnuJCb+neegRDU%?8n3ySMBs$QK3xadnez^I%mc!DydR~O@k{bC_h ziq>JRk!^1>(Ox|mil~xK>5S}PNg1^YIea<5b@hv!EKyjxnQtCas$@B`tTd0Vo02RdJwk5WpoFPD?hdoD9UinO4Gh}1SB6K^K!!o( z>IwI5bM$a)-4ro8N2@oDpE$Zh+PbQr^Fcuq8{S(JsPC_%^F%>-#w;fQb_)TCmkn84 zXhZ~`BU@DJ;x$nx@O?FbzVfZ30tZ;181Ui84IBn77=i%H9bBI66s`M#f^!l!w#@nqki-8cK(_ z4nkyr&yvZI(3RW={wY`rhFLI&9w2v=pA204cHKM(NITNN91f`4GH&t@gp4P4v6nPA zKB8?*NPz4G%y&T6hlGIG*WVz;&II5UK6^dS1kI)Et88*an(xgAP0KTuN`xEsFYCX5 vdHcIW_ZRB(^D=@$mMyLW7r#FzaWLD^)48ux?zaO;6m;pl*}44Ro$mY(_^E?> literal 0 HcmV?d00001 diff --git a/docs/doxygen/modDev.dox b/docs/doxygen/modDev.dox index 53eb6bc416..d220d94623 100644 --- a/docs/doxygen/modDev.dox +++ b/docs/doxygen/modDev.dox @@ -53,11 +53,13 @@ To make a NetBeans module: After the module is created, you will need to do some further configuration.
  • Right click on the newly created module and choose "Properties". +
  • Verify that the Netbeans Platform is set to the Autopsy Platform.
  • You will need to configure the module to be dependent on modules from within the Autopsy platform. Go to the "Libraries" area and choose "Add" in the "Module Dependencies" section. Choose the:
    • "Autopsy-Core" library to get access to the Autopsy services.
    • NetBeans "Lookup API" library so that your module can be discovered by Autopsy.
    +\image html projectProperties.png
  • If you later determine that you need to pull in external JAR files, then you will use the "Wrapped Jar" section to add them in.
  • Note, you will also need to come back to this section if you update the platform. You may need to add a new dependency for the version of the Autopsy-Core that comes with the updated platform.
  • Autopsy requires that all modules restart Autopsy after they are installed. Configure your module this way under Build -> Packaging. Check the box that says Needs Restart on Install. From 1f1a0cc5f3fe37f25e3a756db10fbbf726788df3 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Tue, 18 Jan 2022 16:19:20 -0500 Subject: [PATCH 03/17] OOviewer should not show the current case --- .../contentviewer/OtherOccurrencesNodeWorker.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesNodeWorker.java b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesNodeWorker.java index dcc3375d4d..8f0ed3b13b 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesNodeWorker.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/contentviewer/OtherOccurrencesNodeWorker.java @@ -117,11 +117,14 @@ class OtherOccurrencesNodeWorker extends SwingWorker } int totalCount = 0; Set dataSources = new HashSet<>(); + String currentCaseName = Case.getCurrentCase().getName(); for (CorrelationAttributeInstance corAttr : correlationAttributes) { for (NodeData nodeData : OtherOccurrences.getCorrelatedInstances(deviceId, dataSourceName, corAttr).values()) { try { - dataSources.add(OtherOccurrences.makeDataSourceString(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getDeviceID(), nodeData.getDataSourceName())); - caseNames.put(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getCorrelationAttributeInstance().getCorrelationCase()); + if(!currentCaseName.equals(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID())) { + dataSources.add(OtherOccurrences.makeDataSourceString(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getDeviceID(), nodeData.getDataSourceName())); + caseNames.put(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getCorrelationAttributeInstance().getCorrelationCase()); + } } catch (CentralRepoException ex) { logger.log(Level.WARNING, "Unable to get correlation case for displaying other occurrence for case: " + nodeData.getCaseName(), ex); } From 049c16f0e5203fab9a3aa1a32295d6b60a8ba7dc Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Wed, 26 Jan 2022 14:57:23 -0500 Subject: [PATCH 04/17] Added check for empty string --- .../org/sleuthkit/autopsy/recentactivity/Firefox.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java index c3ff5017fe..163feec22d 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java @@ -449,9 +449,12 @@ class Firefox extends Extract { NbBundle.getMessage(this.getClass(), "Firefox.moduleName"))); if (checkColumn == true) { - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, - RecentActivityExtracterModuleFactory.getModuleName(), - (Long.valueOf(result.get("creationTime").toString())))); //NON-NLS + String value = result.get("creationTime").toString(); + if(value != null && !value.isEmpty()) { + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, + RecentActivityExtracterModuleFactory.getModuleName(), + (Long.valueOf(result.get("creationTime").toString())))); //NON-NLS + } } String domain = extractDomain(host); if (domain != null && domain.isEmpty() == false) { From a140409611e343d6c499420c5d87cf4a540b7b7a Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 27 Jan 2022 09:45:03 -0500 Subject: [PATCH 05/17] data source summary renaming --- .../autopsy/datasourcesummary/ui/Bundle.properties | 3 ++- .../autopsy/datasourcesummary/ui/Bundle.properties-MERGED | 7 +++---- .../autopsy/datasourcesummary/ui/Bundle_ja.properties | 3 +-- .../datasourcesummary/ui/DataSourceSummaryNode.java | 2 +- .../autopsy/datasourcesummary/ui/PastCasesPanel.java | 4 +--- 5 files changed, 8 insertions(+), 11 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties index 0833ef9b2d..0620b98619 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties @@ -39,7 +39,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.attachmentLabel.text=Recent Attachments -PastCasesPanel.notableFileLabel.text=Cases with Common Items That Were Tagged as Notable PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. TimelinePanel.activityRangeLabel.text=Activity Range @@ -62,3 +61,5 @@ ExportPanel.xlsxExportMessage.text=Export Data from Data Source Summary to an Ex ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK +PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable +PastCasesPanel.notableFileLabel.text=Cases with Common Items at Time Of Ingest diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED index 06ca641cf7..18e2bfd6ba 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED @@ -42,7 +42,7 @@ ContainerPanel.unallocatedSizeValue.text= DataSourceSummaryDialog.window.title=Data Sources Summary DataSourceSummaryNode.column.dataSourceName.header=Data Source Name DataSourceSummaryNode.column.files.header=Files -DataSourceSummaryNode.column.results.header=Results +DataSourceSummaryNode.column.results.header=Artifacts DataSourceSummaryNode.column.status.header=Ingest Status DataSourceSummaryNode.column.tags.header=Tags DataSourceSummaryNode.column.type.header=Type @@ -66,9 +66,7 @@ GeolocationPanel_onNoCrIngest_message=No results will be shown because the GPX P GeolocationPanel_unknownRow_title=Unknown PastCasesPanel_caseColumn_title=Case PastCasesPanel_countColumn_title=Count -PastCasesPanel_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest PastCasesPanel_onNoCrIngest_message=No results will be shown because the Central Repository module was not run. -PastCasesPanel_sameIdsTable_tabName=Past Cases with the Same Devices RecentFilesPanel_attachmentsTable_tabName=Recent Attachments RecentFilesPanel_col_head_date=Date RecentFilesPanel_col_header_domain=Domain @@ -118,7 +116,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.attachmentLabel.text=Recent Attachments -PastCasesPanel.notableFileLabel.text=Cases with Common Items That Were Tagged as Notable PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. TimelinePanel.activityRangeLabel.text=Activity Range @@ -141,6 +138,8 @@ ExportPanel.xlsxExportMessage.text=Export Data from Data Source Summary to an Ex ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK +PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable +PastCasesPanel.notableFileLabel.text=Cases with Common Items at Time Of Ingest UserActivityPanel_noDataExists=No communication data exists UserActivityPanel_tab_title=User Activity UserActivityPanel_TopAccountTableModel_accountType_header=Account Type diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties index ad0869c524..36de499d45 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties @@ -121,11 +121,10 @@ IngestJobExcelExport_moduleNameTimeColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u540d IngestJobExcelExport_sheetName=\u53d6\u8fbc\u307f\u6b74\u53f2 IngestJobExcelExport_startTimeColumn=\u30b9\u30bf\u30fc\u30c8\u6642\u9593 IngestJobExcelExport_versionColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3 -PastCasesPanel.notableFileLabel.text=\u300c\u6ce8\u76ee\u300d\u3068\u30bf\u30b0\u4ed8\u3051\u3055\u308c\u305f\u4e00\u822c\u7684\u306a\u30b1\u30fc\u30b9 PastCasesPanel.sameIdLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 PastCasesPanel_caseColumn_title=\u30b1\u30fc\u30b9 PastCasesPanel_countColumn_title=\u30ab\u30a6\u30f3\u30c8 -PastCasesPanel_notableFileTable_tabName=\u30b1\u30fc\u30b9\u3067\u306e\u5171\u901a\u306a\u6ce8\u76ee\u3059\u3079\u304d\u4e8b\u4f8b +PastCasesPanel_notableFileTable_tabName=\u300c\u6ce8\u76ee\u300d\u3068\u30bf\u30b0\u4ed8\u3051\u3055\u308c\u305f\u4e00\u822c\u7684\u306a\u30b1\u30fc\u30b9 PastCasesPanel_onNoCrIngest_message=\u30bb\u30f3\u30c8\u30e9\u30eb\u30fb\u30ea\u30dd\u30b8\u30c8\u30ea\u30e2\u30b8\u30e5\u30fc\u30eb\u304c\u5b9f\u884c\u3055\u308c\u306a\u304b\u3063\u305f\u305f\u3081\u3001\u7d50\u679c\u306f\u8868\u793a\u3055\u308c\u307e\u305b\u3093\u3002 PastCasesPanel_sameIdsTable_tabName=\u540c\u3058\u30c7\u30d0\u30a4\u30b9\u3067\u306e\u904e\u53bb\u306e\u30b1\u30fc\u30b9 RecentFilesPanel.attachmentLabel.text=\u6700\u8fd1\u306e\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/DataSourceSummaryNode.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/DataSourceSummaryNode.java index 4aa3cf1be3..d17ef6f000 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/DataSourceSummaryNode.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/DataSourceSummaryNode.java @@ -148,7 +148,7 @@ final class DataSourceSummaryNode extends AbstractNode { "DataSourceSummaryNode.column.status.header=Ingest Status", "DataSourceSummaryNode.column.type.header=Type", "DataSourceSummaryNode.column.files.header=Files", - "DataSourceSummaryNode.column.results.header=Results", + "DataSourceSummaryNode.column.results.header=Artifacts", "DataSourceSummaryNode.column.tags.header=Tags"}) @Override protected Sheet createSheet() { diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java index f4b4d6e956..ebb5fa2de8 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java @@ -40,9 +40,7 @@ import org.sleuthkit.datamodel.DataSource; @Messages({ "PastCasesPanel_caseColumn_title=Case", "PastCasesPanel_countColumn_title=Count", - "PastCasesPanel_onNoCrIngest_message=No results will be shown because the Central Repository module was not run.", - "PastCasesPanel_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest", - "PastCasesPanel_sameIdsTable_tabName=Past Cases with the Same Devices",}) + "PastCasesPanel_onNoCrIngest_message=No results will be shown because the Central Repository module was not run.",}) public class PastCasesPanel extends BaseDataSourceSummaryPanel { private static final long serialVersionUID = 1L; From 989fbd0c848555246a17931b824bbafdd75f488e Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 27 Jan 2022 10:28:21 -0500 Subject: [PATCH 06/17] text update --- .../sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties | 2 +- .../autopsy/datasourcesummary/ui/Bundle.properties-MERGED | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties index 0620b98619..8f2a48ffc7 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties @@ -62,4 +62,4 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases with Common Items at Time Of Ingest +PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED index 18e2bfd6ba..93f335a294 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED @@ -139,7 +139,7 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases with Common Items at Time Of Ingest +PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest UserActivityPanel_noDataExists=No communication data exists UserActivityPanel_tab_title=User Activity UserActivityPanel_TopAccountTableModel_accountType_header=Account Type From f9b3bed6ad358d5b9d52ff4cdb15eb2c0c7f83ce Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Thu, 27 Jan 2022 12:19:33 -0500 Subject: [PATCH 07/17] Added the object id to the os account content pane --- .../autopsy/contentviewers/osaccount/OsAccountDataPanel.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/osaccount/OsAccountDataPanel.java b/Core/src/org/sleuthkit/autopsy/contentviewers/osaccount/OsAccountDataPanel.java index 4a63631d54..d97df57861 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/osaccount/OsAccountDataPanel.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/osaccount/OsAccountDataPanel.java @@ -181,7 +181,8 @@ public class OsAccountDataPanel extends JPanel { "OsAccountDataPanel_basic_address=Address", "OsAccountDataPanel_basic_admin=Administrator", "OsAccountDataPanel_basic_type=Type", - "OsAccountDataPanel_basic_creationDate=Creation Date",}) + "OsAccountDataPanel_basic_creationDate=Creation Date", + "OsAccountDataPanel_basic_objId=Object ID"}) /** * Returns the data for the Basic Properties section of the panel. @@ -211,6 +212,8 @@ public class OsAccountDataPanel extends JPanel { Optional crTime = account.getCreationTime(); data.addData(Bundle.OsAccountDataPanel_basic_creationDate(), crTime.isPresent() ? TimeZoneUtils.getFormattedTime(crTime.get()) : ""); + + data.addData(Bundle.OsAccountDataPanel_basic_objId(), Long.toString(account.getId())); section.addSectionData(data); return section; From 58ff53dbfa91e759dfc5dd6211d5200a49814bbe Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 27 Jan 2022 15:21:58 -0500 Subject: [PATCH 08/17] gather different data --- .../datamodel/PastCasesSummary.java | 118 ++++++++++++------ .../datasourcesummary/ui/Bundle.properties | 6 +- .../ui/Bundle.properties-MERGED | 6 +- .../datasourcesummary/ui/Bundle_ja.properties | 4 +- .../datasourcesummary/ui/PastCasesPanel.form | 103 +++++++++++++-- .../datasourcesummary/ui/PastCasesPanel.java | 57 ++++++--- .../Bundle.properties-MERGED | 5 +- .../ExportPastCases.java | 12 +- 8 files changed, 238 insertions(+), 73 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java index 07918f1f88..c49d5e6d8d 100755 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java @@ -24,14 +24,15 @@ import java.util.Collection; import java.util.Collections; import java.util.HashSet; import java.util.List; +import java.util.Map; import java.util.Set; import java.util.stream.Collectors; import java.util.stream.Stream; import org.apache.commons.lang3.tuple.Pair; -import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory; import org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException; +import org.sleuthkit.datamodel.Blackboard; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardAttribute; @@ -70,42 +71,51 @@ public class PastCasesSummary { */ public static class PastCasesResult { - private final List> sameIdsResults; - private final List> taggedNotable; + private final List> previouslyNotable; + private final List> previouslySeenDevices; + private final List> previouslySeenResults; /** * Main constructor. * - * @param sameIdsResults Data for the cases with same id table. - * @param taggedNotable Data for the tagged notable table. + * @param previouslyNotable TSK_PREVIOUSLY_NOTABLE results. + * @param previouslySeenDevices TSK_PREVIOUSLY_SEEN device results. + * @param previouslySeenResults TSK_PREVIOUSLY_SEEN non-device results. */ - public PastCasesResult(List> sameIdsResults, List> taggedNotable) { - this.sameIdsResults = sameIdsResults; - this.taggedNotable = taggedNotable; + public PastCasesResult(List> previouslyNotable, List> previouslySeenDevices, List> previouslySeenResults) { + this.previouslyNotable = Collections.unmodifiableList(previouslyNotable); + this.previouslySeenDevices = Collections.unmodifiableList(previouslySeenDevices); + this.previouslySeenResults = Collections.unmodifiableList(previouslySeenResults); } /** - * @return Data for the cases with same id table. + * @return TSK_PREVIOUSLY_NOTABLE results. */ - public List> getSameIdsResults() { - return Collections.unmodifiableList(sameIdsResults); + public List> getPreviouslyNotable() { + return previouslyNotable; } /** - * @return Data for the tagged notable table. + * @return TSK_PREVIOUSLY_SEEN device results. */ - public List> getTaggedNotable() { - return Collections.unmodifiableList(taggedNotable); + public List> getPreviouslySeenDevices() { + return previouslySeenDevices; + } + + /** + * @return TSK_PREVIOUSLY_SEEN non-device results. + */ + public List> getPreviouslySeenResults() { + return previouslySeenResults; } } private static final Set ARTIFACT_UPDATE_TYPE_IDS = new HashSet<>(Arrays.asList( - ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID(), + ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID(), ARTIFACT_TYPE.TSK_PREVIOUSLY_NOTABLE.getTypeID() )); private static final String CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim(); - private static final BlackboardAttribute.Type TYPE_COMMENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_OTHER_CASES); private static final Set CR_DEVICE_TYPE_IDS = new HashSet<>(Arrays.asList( ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID(), @@ -180,11 +190,24 @@ public class PastCasesSummary { BlackboardAttribute commentAttr = null; try { - commentAttr = artifact.getAttribute(TYPE_COMMENT); + commentAttr = artifact.getAttribute(BlackboardAttribute.Type.TSK_OTHER_CASES); } catch (TskCoreException ignored) { // ignore if no attribute can be found } + return getCasesFromAttr(commentAttr); + + } + + /** + * Gets a list of cases from the TSK_OTHER_CASES attribute. The cases + * string is expected to be of a form of "case1,case2...caseN". + * + * @param artifact The attribute. + * + * @return The list of cases if found or empty list if not. + */ + private static List getCasesFromAttr(BlackboardAttribute commentAttr) { if (commentAttr == null) { return Collections.emptyList(); } @@ -197,7 +220,6 @@ public class PastCasesSummary { return Stream.of(justCasesStr.split(CASE_SEPARATOR)) .map(String::trim) .collect(Collectors.toList()); - } /** @@ -226,9 +248,28 @@ public class PastCasesSummary { .sorted((a, b) -> -Long.compare(a.getValue(), b.getValue())) .collect(Collectors.toList()); } + + + /** + * Determines a list of counts for most populated cases based on comment + * attribute. + * + * @param artifacts The list of artifacts. + * + * @return The key value pairs mapping case to counts. + */ + private static List> getCaseCountsFromArtifacts(List artifacts) { + List cases = new ArrayList<>(); + for (BlackboardArtifact art : artifacts) { + cases.addAll(getCasesFromArtifact(art)); + } + + return getCaseCounts(cases.stream()); + } /** - * Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves it's parent artifact. + * Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves + * it's parent artifact. * * @param artifact The input artifact. * @@ -241,7 +282,7 @@ public class PastCasesSummary { BlackboardArtifact sourceArtifact = null; SleuthkitCase skCase = caseProvider.get(); - Content content = skCase.getContentById(artifact.getObjectID()); + Content content = skCase.getContentById(artifact.getObjectID()); if (content instanceof BlackboardArtifact) { sourceArtifact = (BlackboardArtifact) content; } @@ -285,28 +326,31 @@ public class PastCasesSummary { return null; } - SleuthkitCase skCase = caseProvider.get(); + long dataSourceId = dataSource.getId(); - List deviceArtifactCases = new ArrayList<>(); - List nonDeviceArtifactCases = new ArrayList<>(); - for (Integer typeId : ARTIFACT_UPDATE_TYPE_IDS) { - for (BlackboardArtifact artifact : skCase.getBlackboard().getArtifacts(typeId, dataSource.getId())) { - List cases = getCasesFromArtifact(artifact); - if (cases == null || cases.isEmpty()) { - continue; - } + Blackboard blackboard = caseProvider.get().getBlackboard(); - if (hasDeviceAssociatedArtifact(artifact)) { - deviceArtifactCases.addAll(cases); - } else { - nonDeviceArtifactCases.addAll(cases); - } + List previouslyNotableArtifacts + = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_NOTABLE.getTypeID(), dataSourceId); + + List previouslySeenArtifacts + = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_SEEN.getTypeID(), dataSourceId); + + List previouslySeenDevice = new ArrayList<>(); + List previouslySeenNoDevice = new ArrayList<>(); + + for (BlackboardArtifact art : previouslySeenArtifacts) { + if (hasDeviceAssociatedArtifact(art)) { + previouslySeenDevice.add(art); + } else { + previouslySeenNoDevice.add(art); } - } + } return new PastCasesResult( - getCaseCounts(deviceArtifactCases.stream()), - getCaseCounts(nonDeviceArtifactCases.stream()) + getCaseCountsFromArtifacts(previouslyNotableArtifacts), + getCaseCountsFromArtifacts(previouslySeenDevice), + getCaseCountsFromArtifacts(previouslySeenNoDevice) ); } } diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties index 8f2a48ffc7..b4f6ebcf70 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties @@ -39,7 +39,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.attachmentLabel.text=Recent Attachments -PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. TimelinePanel.activityRangeLabel.text=Activity Range GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown' @@ -62,4 +61,7 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest +PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable +PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.) +PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.) +PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates. diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED index 93f335a294..8f4ac61f86 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED @@ -116,7 +116,6 @@ AnalysisPanel.interestingItemLabel.text=Interesting Item Hits RecentFilesPanel.openDocsLabel.text=Recently Opened Documents RecentFilesPanel.downloadLabel.text=Recent Downloads RecentFilesPanel.attachmentLabel.text=Recent Attachments -PastCasesPanel.sameIdLabel.text=Past Cases with the Same Device IDs DataSourceSummaryTabbedPane.noDataSourceLabel.text=No data source has been selected. TimelinePanel.activityRangeLabel.text=Activity Range GeolocationPanel.withinDistanceLabel.text=Locations further than 150km from a city will be listed as 'Unknown' @@ -139,7 +138,10 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases with Notable or Rare Items at Time of Ingest +PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable +PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.) +PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.) +PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates. UserActivityPanel_noDataExists=No communication data exists UserActivityPanel_tab_title=User Activity UserActivityPanel_TopAccountTableModel_accountType_header=Account Type diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties index 36de499d45..3e93a0ddfc 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle_ja.properties @@ -121,7 +121,6 @@ IngestJobExcelExport_moduleNameTimeColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u540d IngestJobExcelExport_sheetName=\u53d6\u8fbc\u307f\u6b74\u53f2 IngestJobExcelExport_startTimeColumn=\u30b9\u30bf\u30fc\u30c8\u6642\u9593 IngestJobExcelExport_versionColumn=\u30e2\u30b8\u30e5\u30fc\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3 -PastCasesPanel.sameIdLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 PastCasesPanel_caseColumn_title=\u30b1\u30fc\u30b9 PastCasesPanel_countColumn_title=\u30ab\u30a6\u30f3\u30c8 PastCasesPanel_notableFileTable_tabName=\u300c\u6ce8\u76ee\u300d\u3068\u30bf\u30b0\u4ed8\u3051\u3055\u308c\u305f\u4e00\u822c\u7684\u306a\u30b1\u30fc\u30b9 @@ -212,3 +211,6 @@ UserActivityPanel_TopWebSearchTableModel_translatedResult_header=\u7ffb\u8a33\u6 UserActivityPanel_noDataExists=\u901a\u4fe1\u30c7\u30fc\u30bf\u304c\u3042\u308a\u307e\u305b\u3093 UserActivityPanel_tab_title=\u30e6\u30fc\u30b6\u30fc\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3 ViewSummaryInformationAction.name.text=\u6982\u8981\u60c5\u5831\u3092\u8868\u793a +PastCasesPanel.seenDeviceLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 +PastCasesPanel.seenResultLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 +PastCasesPanel.warningLabel.text=\u540c\u3058\u30c7\u30d0\u30a4\u30b9ID\u3092\u6301\u3064\u904e\u53bb\u306e\u30b1\u30fc\u30b9 diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form index 7c84d44660..9ae72f4b83 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.form @@ -21,7 +21,7 @@ - + @@ -147,10 +147,10 @@ - + - + @@ -177,7 +177,7 @@ - + @@ -191,24 +191,111 @@ - + - + - + + + + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java index ebb5fa2de8..04ccf08686 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesPanel.java @@ -64,12 +64,13 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { = Arrays.asList(CASE_COL, COUNT_COL); private final JTablePanel> notableFileTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); - - private final JTablePanel> sameIdTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); + private final JTablePanel> seenDeviceTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); + private final JTablePanel> seenResultTable = JTablePanel.getJTablePanel(DEFAULT_TEMPLATE); private final List> tables = Arrays.asList( notableFileTable, - sameIdTable + seenResultTable, + seenDeviceTable ); private final List> dataFetchComponents; @@ -107,8 +108,9 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { * @param result The result. */ private void handleResult(DataFetchResult result) { - notableFileTable.showDataFetchResult(DataFetchResult.getSubResult(result, (res) -> res.getTaggedNotable())); - sameIdTable.showDataFetchResult(DataFetchResult.getSubResult(result, (res) -> res.getSameIdsResults())); + notableFileTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslyNotable())); + seenResultTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslySeenResults())); + seenDeviceTable.showDataFetchResult(DataFetchResult.getSubResult(result, res -> res.getPreviouslySeenDevices())); } @Override @@ -143,10 +145,15 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { javax.swing.Box.Filler filler1 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); javax.swing.JPanel notableFilePanel = notableFileTable; javax.swing.Box.Filler filler2 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20)); - javax.swing.JLabel sameIdLabel = new javax.swing.JLabel(); + javax.swing.JLabel seenResultLabel = new javax.swing.JLabel(); javax.swing.Box.Filler filler3 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); - javax.swing.JPanel sameIdPanel = sameIdTable; - javax.swing.Box.Filler filler5 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 0), new java.awt.Dimension(0, 0), new java.awt.Dimension(0, 32767)); + javax.swing.JPanel seenResultPanel = seenResultTable; + javax.swing.Box.Filler filler4 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20)); + javax.swing.JLabel seenDeviceLabel = new javax.swing.JLabel(); + javax.swing.Box.Filler filler5 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2), new java.awt.Dimension(0, 2)); + javax.swing.JPanel seenDevicePanel = seenDeviceTable; + javax.swing.Box.Filler filler6 = new javax.swing.Box.Filler(new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20), new java.awt.Dimension(0, 20)); + javax.swing.JLabel warningLabel = new javax.swing.JLabel(); mainContentPanel.setBorder(javax.swing.BorderFactory.createEmptyBorder(10, 10, 10, 10)); mainContentPanel.setLayout(new javax.swing.BoxLayout(mainContentPanel, javax.swing.BoxLayout.PAGE_AXIS)); @@ -173,21 +180,39 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { filler2.setAlignmentX(0.0F); mainContentPanel.add(filler2); - org.openide.awt.Mnemonics.setLocalizedText(sameIdLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.sameIdLabel.text")); // NOI18N - mainContentPanel.add(sameIdLabel); + org.openide.awt.Mnemonics.setLocalizedText(seenResultLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.seenResultLabel.text")); // NOI18N + mainContentPanel.add(seenResultLabel); filler3.setAlignmentX(0.0F); mainContentPanel.add(filler3); - sameIdPanel.setAlignmentX(0.0F); - sameIdPanel.setMaximumSize(new java.awt.Dimension(32767, 106)); - sameIdPanel.setMinimumSize(new java.awt.Dimension(100, 106)); - sameIdPanel.setPreferredSize(new java.awt.Dimension(100, 106)); - mainContentPanel.add(sameIdPanel); + seenResultPanel.setAlignmentX(0.0F); + seenResultPanel.setMaximumSize(new java.awt.Dimension(32767, 106)); + seenResultPanel.setMinimumSize(new java.awt.Dimension(100, 106)); + seenResultPanel.setPreferredSize(new java.awt.Dimension(100, 106)); + mainContentPanel.add(seenResultPanel); + + filler4.setAlignmentX(0.0F); + mainContentPanel.add(filler4); + + org.openide.awt.Mnemonics.setLocalizedText(seenDeviceLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.seenDeviceLabel.text")); // NOI18N + mainContentPanel.add(seenDeviceLabel); filler5.setAlignmentX(0.0F); mainContentPanel.add(filler5); + seenDevicePanel.setAlignmentX(0.0F); + seenDevicePanel.setMaximumSize(new java.awt.Dimension(32767, 106)); + seenDevicePanel.setMinimumSize(new java.awt.Dimension(100, 106)); + seenDevicePanel.setPreferredSize(new java.awt.Dimension(100, 106)); + mainContentPanel.add(seenDevicePanel); + + filler6.setAlignmentX(0.0F); + mainContentPanel.add(filler6); + + org.openide.awt.Mnemonics.setLocalizedText(warningLabel, org.openide.util.NbBundle.getMessage(PastCasesPanel.class, "PastCasesPanel.warningLabel.text")); // NOI18N + mainContentPanel.add(warningLabel); + mainScrollPane.setViewportView(mainContentPanel); javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); @@ -198,7 +223,7 @@ public class PastCasesPanel extends BaseDataSourceSummaryPanel { ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(mainScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 300, Short.MAX_VALUE) + .addComponent(mainScrollPane) ); }// //GEN-END:initComponents diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED index 58f4dcb10e..07bad183cf 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED @@ -54,8 +54,9 @@ ExportIngestHistory_startTimeColumn=Start Time ExportIngestHistory_versionColumn=Module Version ExportPastCases_caseColumn_title=Case ExportPastCases_countColumn_title=Count -ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest -ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices +ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items +ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs +ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses ExportRecentFiles_attachmentsTable_tabName=Recent Attachments ExportRecentFiles_col_head_date=Date ExportRecentFiles_col_header_domain=Domain diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java index 96aefebaff..ae7c4522b4 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java @@ -37,10 +37,11 @@ import org.sleuthkit.datamodel.DataSource; @Messages({ "ExportPastCases_caseColumn_title=Case", "ExportPastCases_countColumn_title=Count", - "ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items at Time Of Ingest", - "ExportPastCases_sameIdsTable_tabName=Past Cases with the Same Devices",}) + "ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items", + "ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses", + "ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs",}) class ExportPastCases { - + private final PastCasesSummary pastSummary; // model for column indicating the case @@ -73,8 +74,9 @@ class ExportPastCases { } return Arrays.asList( - getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_notableFileTable_tabName(), result.getTaggedNotable()), - getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_sameIdsTable_tabName(), result.getSameIdsResults()) + getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_notableFileTable_tabName(), result.getPreviouslyNotable()), + getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_seenResultsTable_tabName(), result.getPreviouslySeenResults()), + getTableExport(DEFAULT_TEMPLATE, Bundle.ExportPastCases_seenDevicesTable_tabName(), result.getPreviouslySeenDevices()) ); } } From cd02f636793eb465f5e101f086fc4aaaecc9db3f Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 27 Jan 2022 17:16:49 -0500 Subject: [PATCH 09/17] text updates --- .../datamodel/PastCasesSummary.java | 19 ++++++++----------- .../datasourcesummary/ui/Bundle.properties | 4 ++-- .../ui/Bundle.properties-MERGED | 4 ++-- .../Bundle.properties-MERGED | 6 +++--- .../ExportPastCases.java | 6 +++--- 5 files changed, 18 insertions(+), 21 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java index c49d5e6d8d..f113bce296 100755 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/PastCasesSummary.java @@ -24,7 +24,6 @@ import java.util.Collection; import java.util.Collections; import java.util.HashSet; import java.util.List; -import java.util.Map; import java.util.Set; import java.util.stream.Collectors; import java.util.stream.Stream; @@ -36,7 +35,6 @@ import org.sleuthkit.datamodel.Blackboard; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardAttribute; -import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.DataSource; import org.sleuthkit.datamodel.SleuthkitCase; @@ -200,8 +198,8 @@ public class PastCasesSummary { } /** - * Gets a list of cases from the TSK_OTHER_CASES attribute. The cases - * string is expected to be of a form of "case1,case2...caseN". + * Gets a list of cases from the TSK_OTHER_CASES attribute. The cases string + * is expected to be of a form of "case1,case2...caseN". * * @param artifact The attribute. * @@ -248,8 +246,7 @@ public class PastCasesSummary { .sorted((a, b) -> -Long.compare(a.getValue(), b.getValue())) .collect(Collectors.toList()); } - - + /** * Determines a list of counts for most populated cases based on comment * attribute. @@ -263,7 +260,7 @@ public class PastCasesSummary { for (BlackboardArtifact art : artifacts) { cases.addAll(getCasesFromArtifact(art)); } - + return getCaseCounts(cases.stream()); } @@ -332,13 +329,13 @@ public class PastCasesSummary { List previouslyNotableArtifacts = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_NOTABLE.getTypeID(), dataSourceId); - + List previouslySeenArtifacts = blackboard.getArtifacts(BlackboardArtifact.Type.TSK_PREVIOUSLY_SEEN.getTypeID(), dataSourceId); - + List previouslySeenDevice = new ArrayList<>(); List previouslySeenNoDevice = new ArrayList<>(); - + for (BlackboardArtifact art : previouslySeenArtifacts) { if (hasDeviceAssociatedArtifact(art)) { previouslySeenDevice.add(art); @@ -346,7 +343,7 @@ public class PastCasesSummary { previouslySeenNoDevice.add(art); } } - + return new PastCasesResult( getCaseCountsFromArtifacts(previouslyNotableArtifacts), getCaseCountsFromArtifacts(previouslySeenDevice), diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties index b4f6ebcf70..99ce601968 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties @@ -61,7 +61,7 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable +PastCasesPanel.notableFileLabel.text=Cases with common items that were marked as notable PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.) -PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.) +PastCasesPanel.seenResultLabel.text=Cases with the same addresses (Email, Phone, etc.) PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates. diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED index 8f4ac61f86..ebd74379d0 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/Bundle.properties-MERGED @@ -138,9 +138,9 @@ ExportPanel.xlsxExportButton.text=Export Summary Data ExcelExportDialog.titleLabel.text=Data Source Summary has been exported to: ExcelExportDialog.okButton.text=OK PastCasesPanel_notableFileTable_tabName=Cases with Common Items That Were Tagged as Notable -PastCasesPanel.notableFileLabel.text=Cases With Common Items That Were Marked As Notable +PastCasesPanel.notableFileLabel.text=Cases with common items that were marked as notable PastCasesPanel.seenDeviceLabel.text=Cases with the same device IDs (USB, Wifi, SIM, etc.) -PastCasesPanel.seenResultLabel.text=Cases With The Same Addresses (Email, Phone, etc.) +PastCasesPanel.seenResultLabel.text=Cases with the same addresses (Email, Phone, etc.) PastCasesPanel.warningLabel.text=NOTE: These results are from the time of ingest. They are not real-time updates. UserActivityPanel_noDataExists=No communication data exists UserActivityPanel_tab_title=User Activity diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED index 07bad183cf..03d1661133 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/Bundle.properties-MERGED @@ -54,9 +54,9 @@ ExportIngestHistory_startTimeColumn=Start Time ExportIngestHistory_versionColumn=Module Version ExportPastCases_caseColumn_title=Case ExportPastCases_countColumn_title=Count -ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items -ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs -ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses +ExportPastCases_notableFileTable_tabName=Cases with common notable items +ExportPastCases_seenDevicesTable_tabName=Cases with the same device IDs +ExportPastCases_seenResultsTable_tabName=Cases with the same addresses ExportRecentFiles_attachmentsTable_tabName=Recent Attachments ExportRecentFiles_col_head_date=Date ExportRecentFiles_col_header_domain=Domain diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java index ae7c4522b4..6e97be600d 100755 --- a/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java +++ b/Core/src/org/sleuthkit/autopsy/report/modules/datasourcesummaryexport/ExportPastCases.java @@ -37,9 +37,9 @@ import org.sleuthkit.datamodel.DataSource; @Messages({ "ExportPastCases_caseColumn_title=Case", "ExportPastCases_countColumn_title=Count", - "ExportPastCases_notableFileTable_tabName=Cases with Common Notable Items", - "ExportPastCases_seenResultsTable_tabName=Cases With The Same Addresses", - "ExportPastCases_seenDevicesTable_tabName=Cases With The Same Device IDs",}) + "ExportPastCases_notableFileTable_tabName=Cases with common notable items", + "ExportPastCases_seenResultsTable_tabName=Cases with the same addresses", + "ExportPastCases_seenDevicesTable_tabName=Cases with the same device IDs",}) class ExportPastCases { private final PastCasesSummary pastSummary; From 5b3865cbfdc54bb899334491f582849eaf472733 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 27 Jan 2022 18:34:45 -0500 Subject: [PATCH 10/17] fix to make equivalent to changes in TSK --- .../org/sleuthkit/autopsy/ingest/IngestJobSettingsPanel.java | 2 -- 1 file changed, 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettingsPanel.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettingsPanel.java index 1f3d3ee4fd..bb958b14f6 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettingsPanel.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettingsPanel.java @@ -644,7 +644,6 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel { if (factory.isDataSourceIngestModuleFactory()) { String uniqueName = FactoryClassNameNormalizer.normalize(factory.getClass().getCanonicalName()) + "-" + factory.getModuleDisplayName() + "-" - + IngestModuleInfo.IngestModuleType.DATA_SOURCE_LEVEL.toString() + "-" + factory.getModuleVersionNumber(); for (IngestModuleInfo ingestModuleInfo : ingestJob.getIngestModuleInfo()) { boolean sameModule = ingestModuleInfo.getUniqueName().equals(uniqueName); @@ -659,7 +658,6 @@ public final class IngestJobSettingsPanel extends javax.swing.JPanel { if (factory.isFileIngestModuleFactory()) { String uniqueName = FactoryClassNameNormalizer.normalize(factory.getClass().getCanonicalName()) + "-" + factory.getModuleDisplayName() + "-" - + IngestModuleInfo.IngestModuleType.FILE_LEVEL.toString() + "-" + factory.getModuleVersionNumber(); for (IngestModuleInfo ingestModuleInfo : ingestJob.getIngestModuleInfo()) { boolean sameModule = ingestModuleInfo.getUniqueName().equals(uniqueName); From 0e77b008dd6edcf6879b7b9fee85a424d5cd24ef Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Fri, 28 Jan 2022 10:00:03 -0500 Subject: [PATCH 11/17] adding host to data artifact viewers --- .../artifactviewers/Bundle.properties-MERGED | 3 ++ .../CallLogArtifactViewer.java | 22 +++++++++--- .../artifactviewers/CallLogViewData.java | 9 +++++ .../ContactArtifactViewer.java | 20 ++++++++--- .../GeneralPurposeArtifactViewer.java | 34 ++++++++++++------- 5 files changed, 66 insertions(+), 22 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/Bundle.properties-MERGED index c529a8aa9d..23afce19fb 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/Bundle.properties-MERGED @@ -8,6 +8,7 @@ CallLogArtifactViewer_label_date=Date CallLogArtifactViewer_label_direction=Direction CallLogArtifactViewer_label_duration=Duration CallLogArtifactViewer_label_from=From +CallLogArtifactViewer_label_hostName=Host CallLogArtifactViewer_label_to=To CallLogArtifactViewer_suffix_local=(Local) CallLogArtifactViewer_value_unknown=Unknown @@ -29,6 +30,7 @@ ContactArtifactViewer_heading_Source=Source # {0} - accountIdentifer ContactArtifactViewer_id_not_found_in_cr=Unable to find account(s) associated with contact {0} in the Central Repository. ContactArtifactViewer_label_datasource=Data Source +ContactArtifactViewer_label_host=Host ContactArtifactViewer_missing_account_label=Missing contact account ContactArtifactViewer_others_header=Other ContactArtifactViewer_persona_account_justification=Account found in Contact artifact @@ -65,6 +67,7 @@ GeneralPurposeArtifactViewer.details.sourceHeader=Source GeneralPurposeArtifactViewer.noFile.text=\ (no longer exists) GeneralPurposeArtifactViewer.term.label=Term GeneralPurposeArtifactViewer.unknown.text=Unknown +GeneralPurposeArtifactViewer_details_host=Host GeneralPurposeArtifactViewer_menuitem_copy=Copy MessageAccountPanel.account.justification=Account found in Message artifact MessageAccountPanel_button_create_label=Create diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java index 0830e8e6ef..33bb8d9644 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java @@ -28,6 +28,7 @@ import java.util.HashMap; import java.util.HashSet; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.Set; import java.util.logging.Level; import javax.swing.JScrollPane; @@ -36,6 +37,8 @@ import org.apache.commons.lang3.ObjectUtils; import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; import org.openide.util.lookup.ServiceProvider; +import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository; import org.sleuthkit.autopsy.contentviewers.layout.ContentViewerDefaults; import org.sleuthkit.autopsy.coreutils.Logger; @@ -100,7 +103,7 @@ public class CallLogArtifactViewer extends javax.swing.JPanel implements Artifac CallLogViewData callLogViewData = null; try { callLogViewData = getCallLogViewData(artifact); - } catch (TskCoreException ex) { + } catch (NoCurrentCaseException | TskCoreException ex) { logger.log(Level.SEVERE, String.format("Error getting attributes for Calllog artifact (artifact_id=%d, obj_id=%d)", artifact.getArtifactID(), artifact.getObjectID()), ex); } List personaSearchDataList = new ArrayList<>(); @@ -115,7 +118,7 @@ public class CallLogArtifactViewer extends javax.swing.JPanel implements Artifac } else { currentAccountFetcher = null; } - + // repaint this.revalidate(); this.repaint(); @@ -130,7 +133,7 @@ public class CallLogArtifactViewer extends javax.swing.JPanel implements Artifac * * @throws TskCoreException */ - private CallLogViewData getCallLogViewData(BlackboardArtifact artifact) throws TskCoreException { + private CallLogViewData getCallLogViewData(BlackboardArtifact artifact) throws NoCurrentCaseException, TskCoreException { if (artifact == null) { return null; @@ -241,6 +244,12 @@ public class CallLogArtifactViewer extends javax.swing.JPanel implements Artifac callLogViewData.setToContactNameList(toContactNames); } + String hostName = Optional.ofNullable(Case.getCurrentCaseThrows().getSleuthkitCase().getHostManager().getHostByDataSource((DataSource) dataSource)) + .map(h -> h.getName()) + .orElse(null); + + callLogViewData.setHostName(hostName); + return callLogViewData; } @@ -413,11 +422,16 @@ public class CallLogArtifactViewer extends javax.swing.JPanel implements Artifac */ @NbBundle.Messages({ "CallLogArtifactViewer_heading_Source=Source", - "CallLogArtifactViewer_label_datasource=Data Source",}) + "CallLogArtifactViewer_label_datasource=Data Source", + "CallLogArtifactViewer_label_hostName=Host"}) private void updateSourceView(CallLogViewData callLogViewData) { CommunicationArtifactViewerHelper.addHeader(this, m_gridBagLayout, this.m_constraints, ContentViewerDefaults.getSectionSpacing(), Bundle.CallLogArtifactViewer_heading_Source()); + CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, this.m_constraints, Bundle.CallLogArtifactViewer_label_datasource()); CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, this.m_constraints, callLogViewData.getDataSourceName()); + + CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, this.m_constraints, Bundle.CallLogArtifactViewer_label_hostName()); + CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, this.m_constraints, StringUtils.defaultString(callLogViewData.getHostName())); } /** diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogViewData.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogViewData.java index f7888ed7ec..16c42927be 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogViewData.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogViewData.java @@ -32,6 +32,8 @@ final class CallLogViewData { private String fromAccount = null; private String toAccount = null; + + private String hostName = null; // account identifier of the device owner, if known. // will be one of the to or from account. @@ -174,4 +176,11 @@ final class CallLogViewData { return Collections.unmodifiableList(this.fromContactNameList); } + public String getHostName() { + return hostName; + } + + public void setHostName(String hostName) { + this.hostName = hostName; + } } diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java index c65b92b8d3..449fdd9ff5 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java @@ -48,6 +48,7 @@ import org.apache.commons.lang.StringUtils; import org.openide.util.NbBundle; import org.openide.util.lookup.ServiceProvider; import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepoAccount; import org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepoException; import org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository; @@ -65,6 +66,7 @@ import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.CommunicationsManager; import org.sleuthkit.datamodel.Content; +import org.sleuthkit.datamodel.DataSource; import org.sleuthkit.datamodel.InvalidAccountIDException; import org.sleuthkit.datamodel.TskCoreException; @@ -85,6 +87,7 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac private BlackboardArtifact contactArtifact; private String contactName; private String datasourceName; + private String hostName; private List phoneNumList = new ArrayList<>(); private List emailList = new ArrayList<>(); @@ -134,7 +137,7 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac if (artifact != null) { try { extractArtifactData(artifact); - } catch (TskCoreException ex) { + } catch (NoCurrentCaseException | TskCoreException ex) { logger.log(Level.SEVERE, String.format("Error getting attributes for artifact (artifact_id=%d, obj_id=%d)", artifact.getArtifactID(), artifact.getObjectID()), ex); return; } @@ -164,7 +167,7 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac * * @throws TskCoreException */ - private void extractArtifactData(BlackboardArtifact artifact) throws TskCoreException { + private void extractArtifactData(BlackboardArtifact artifact) throws NoCurrentCaseException, TskCoreException { this.contactArtifact = artifact; @@ -193,6 +196,10 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac } datasourceName = contactArtifact.getDataSource().getName(); + + hostName = Optional.ofNullable(Case.getCurrentCaseThrows().getSleuthkitCase().getHostManager().getHostByDataSource((DataSource) contactArtifact.getDataSource())) + .map(h -> h.getName()) + .orElse(null); } /** @@ -248,7 +255,7 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac int prevGridWidth = contactPanelConstraints.gridwidth; contactPanelConstraints.gridwidth = 3; contactPanelConstraints.anchor = GridBagConstraints.LINE_START; - + javax.swing.JLabel contactImage = new javax.swing.JLabel(); contactImage.setIcon(getImageFromArtifact(contactArtifact)); contactImage.setText(Bundle.ContactArtifactViewer_contactImage_text()); @@ -317,11 +324,14 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac */ @NbBundle.Messages({ "ContactArtifactViewer_heading_Source=Source", - "ContactArtifactViewer_label_datasource=Data Source",}) + "ContactArtifactViewer_label_datasource=Data Source", + "ContactArtifactViewer_label_host=Host",}) private void updateSource() { CommunicationArtifactViewerHelper.addHeader(this, this.m_gridBagLayout, m_constraints, ContentViewerDefaults.getSectionSpacing(), Bundle.ContactArtifactViewer_heading_Source()); CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, m_constraints, Bundle.ContactArtifactViewer_label_datasource()); CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, datasourceName); + CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, m_constraints, Bundle.ContactArtifactViewer_label_host()); + CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, hostName); } /** @@ -350,7 +360,7 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac this.personaSearchStatusLabel = new javax.swing.JLabel(); personaSearchStatusLabel.setText(personaStatusLabelText); personaSearchStatusLabel.setFont(ContentViewerDefaults.getMessageFont()); - + m_constraints.gridx = 0; m_constraints.anchor = GridBagConstraints.LINE_START; diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java index e81b6705c6..35b565da50 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java @@ -18,7 +18,6 @@ */ package org.sleuthkit.autopsy.contentviewers.artifactviewers; -import java.awt.Color; import java.awt.Component; import java.awt.Dimension; import java.awt.GridBagConstraints; @@ -30,13 +29,11 @@ import java.awt.event.ActionEvent; import java.awt.event.ActionListener; import java.util.ArrayList; import java.util.Arrays; -import java.util.Collections; import java.util.HashMap; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.logging.Level; -import java.util.stream.Collectors; -import java.util.stream.Stream; import javax.swing.JLabel; import javax.swing.JMenuItem; import javax.swing.JPopupMenu; @@ -44,9 +41,10 @@ import javax.swing.JTextPane; import javax.swing.SwingUtilities; import javax.swing.border.EmptyBorder; import org.apache.commons.lang.StringUtils; -import org.apache.commons.lang3.tuple.Pair; import org.openide.util.NbBundle; import org.openide.util.lookup.ServiceProvider; +import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.contentviewers.layout.ContentViewerDefaults; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.ThreadConfined; @@ -54,6 +52,7 @@ import org.sleuthkit.autopsy.coreutils.TimeZoneUtils; import org.sleuthkit.autopsy.discovery.ui.AbstractArtifactDetailsPanel; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; +import org.sleuthkit.datamodel.DataSource; import org.sleuthkit.datamodel.TskCoreException; /** @@ -146,7 +145,7 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE.getTypeID(), BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID()}); } - + @ThreadConfined(type = ThreadConfined.ThreadType.AWT) @NbBundle.Messages({"GeneralPurposeArtifactViewer.unknown.text=Unknown"}) @Override @@ -154,6 +153,7 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i resetComponent(); if (artifact != null) { String dataSourceName = Bundle.GeneralPurposeArtifactViewer_unknown_text(); + String hostName = Bundle.GeneralPurposeArtifactViewer_unknown_text(); String sourceFileName = Bundle.GeneralPurposeArtifactViewer_unknown_text(); Map> attributeMap = new HashMap<>(); try { @@ -167,11 +167,16 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i attributeMap.put(bba.getAttributeType().getTypeID(), attrList); } dataSourceName = artifact.getDataSource().getName(); + + hostName = Optional.ofNullable(Case.getCurrentCaseThrows().getSleuthkitCase().getHostManager().getHostByDataSource((DataSource) artifact.getDataSource())) + .map(h -> h.getName()) + .orElse(null); + sourceFileName = artifact.getParent().getUniquePath(); - } catch (TskCoreException ex) { + } catch (NoCurrentCaseException | TskCoreException ex) { logger.log(Level.WARNING, "Unable to get attributes for artifact " + artifact.getArtifactID(), ex); } - updateView(artifact, attributeMap, dataSourceName, sourceFileName); + updateView(artifact, attributeMap, dataSourceName, hostName, sourceFileName); } detailsScrollPane.setViewportView(detailsPanel); detailsScrollPane.revalidate(); @@ -194,7 +199,7 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i gridBagConstraints.fill = GridBagConstraints.NONE; gridBagConstraints.insets = ZERO_INSETS; } - + @ThreadConfined(type = ThreadConfined.ThreadType.AWT) @Override public boolean isSupported(BlackboardArtifact artifact) { @@ -209,10 +214,11 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i || artifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_FORM_ADDRESS.getTypeID() || artifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_FORM_AUTOFILL.getTypeID()); } - + @NbBundle.Messages({"GeneralPurposeArtifactViewer.details.attrHeader=Details", "GeneralPurposeArtifactViewer.details.sourceHeader=Source", "GeneralPurposeArtifactViewer.details.dataSource=Data Source", + "GeneralPurposeArtifactViewer_details_host=Host", "GeneralPurposeArtifactViewer.details.file=File", "GeneralPurposeArtifactViewer.details.datesHeader=Dates"}) /** @@ -249,6 +255,7 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i * @param attributeMap The map of attributes that exist for the artifact. * @param dataSourceName The name of the datasource that caused the creation * of the artifact. + * @param hostName The host name. * @param sourceFilePath The path of the file that caused the creation of * the artifact. */ @@ -260,7 +267,7 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i "GeneralPurposeArtifactViewer.details.otherHeader=Other", "GeneralPurposeArtifactViewer.noFile.text= (no longer exists)"}) @ThreadConfined(type = ThreadConfined.ThreadType.AWT) - private void updateView(BlackboardArtifact artifact, Map> attributeMap, String dataSourceName, String sourceFilePath) { + private void updateView(BlackboardArtifact artifact, Map> attributeMap, String dataSourceName, String hostName, String sourceFilePath) { final Integer artifactTypeId = artifact.getArtifactTypeID(); if (!(artifactTypeId < 1 || artifactTypeId >= Integer.MAX_VALUE)) { JTextPane firstTextPane = addDetailsHeader(artifactTypeId); @@ -313,6 +320,7 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i } addHeader(Bundle.GeneralPurposeArtifactViewer_details_sourceHeader()); addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_dataSource(), dataSourceName); + addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_host(), hostName); addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_file(), sourceFilePath); // add veritcal glue at the end addPageEndGlue(); @@ -398,10 +406,10 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i headingLabel.setEditable(false); // add a blank line before the start of new section, unless it's // the first section - gridBagConstraints.insets = (gridBagConstraints.gridy == 0) + gridBagConstraints.insets = (gridBagConstraints.gridy == 0) ? FIRST_HEADER_INSETS : HEADER_INSETS; - + gridBagConstraints.gridy++; gridBagConstraints.gridx = LABEL_COLUMN;; // let the header span all of the row From 76847a03997fe9195b09c1df168cf68329254a69 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Fri, 28 Jan 2022 10:31:04 -0500 Subject: [PATCH 12/17] put host above --- .../artifactviewers/CallLogArtifactViewer.java | 6 +++--- .../artifactviewers/ContactArtifactViewer.java | 4 ++-- .../artifactviewers/GeneralPurposeArtifactViewer.java | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java index 33bb8d9644..98ef09121e 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java @@ -427,11 +427,11 @@ public class CallLogArtifactViewer extends javax.swing.JPanel implements Artifac private void updateSourceView(CallLogViewData callLogViewData) { CommunicationArtifactViewerHelper.addHeader(this, m_gridBagLayout, this.m_constraints, ContentViewerDefaults.getSectionSpacing(), Bundle.CallLogArtifactViewer_heading_Source()); - CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, this.m_constraints, Bundle.CallLogArtifactViewer_label_datasource()); - CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, this.m_constraints, callLogViewData.getDataSourceName()); - CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, this.m_constraints, Bundle.CallLogArtifactViewer_label_hostName()); CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, this.m_constraints, StringUtils.defaultString(callLogViewData.getHostName())); + + CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, this.m_constraints, Bundle.CallLogArtifactViewer_label_datasource()); + CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, this.m_constraints, callLogViewData.getDataSourceName()); } /** diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java index 449fdd9ff5..0a1254e84d 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java @@ -328,10 +328,10 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac "ContactArtifactViewer_label_host=Host",}) private void updateSource() { CommunicationArtifactViewerHelper.addHeader(this, this.m_gridBagLayout, m_constraints, ContentViewerDefaults.getSectionSpacing(), Bundle.ContactArtifactViewer_heading_Source()); - CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, m_constraints, Bundle.ContactArtifactViewer_label_datasource()); - CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, datasourceName); CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, m_constraints, Bundle.ContactArtifactViewer_label_host()); CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, hostName); + CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, m_constraints, Bundle.ContactArtifactViewer_label_datasource()); + CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, datasourceName); } /** diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java index 35b565da50..284f5464d2 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java @@ -319,8 +319,8 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i } } addHeader(Bundle.GeneralPurposeArtifactViewer_details_sourceHeader()); - addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_dataSource(), dataSourceName); addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_host(), hostName); + addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_dataSource(), dataSourceName); addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_file(), sourceFilePath); // add veritcal glue at the end addPageEndGlue(); From 1c79829546522e87de0e3470750de3ba8a29fa45 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Mon, 31 Jan 2022 15:03:16 -0500 Subject: [PATCH 13/17] create one instance of waiting icon --- .../corecomponents/ThumbnailViewChildren.java | 28 +++++++++++++++++-- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/ThumbnailViewChildren.java b/Core/src/org/sleuthkit/autopsy/corecomponents/ThumbnailViewChildren.java index 5ded426270..cd4a75fff1 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/ThumbnailViewChildren.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/ThumbnailViewChildren.java @@ -22,6 +22,8 @@ import com.google.common.collect.Lists; import com.google.common.util.concurrent.ThreadFactoryBuilder; import java.awt.Image; import java.awt.Toolkit; +import java.awt.image.BufferedImage; +import java.io.IOException; import java.lang.ref.SoftReference; import java.lang.reflect.InvocationTargetException; import java.util.ArrayList; @@ -38,6 +40,7 @@ import java.util.logging.Level; import java.util.stream.Collectors; import java.util.stream.IntStream; import java.util.stream.Stream; +import javax.imageio.ImageIO; import javax.swing.SwingUtilities; import javax.swing.Timer; import org.apache.commons.lang3.StringUtils; @@ -71,6 +74,9 @@ class ThumbnailViewChildren extends Children.Keys { @NbBundle.Messages("ThumbnailViewChildren.progress.cancelling=(Cancelling)") private static final String CANCELLING_POSTIX = Bundle.ThumbnailViewChildren_progress_cancelling(); + + private static Image waitingIcon; + static final int IMAGES_PER_PAGE = 200; private final ExecutorService executor = Executors.newFixedThreadPool(3, @@ -80,6 +86,23 @@ class ThumbnailViewChildren extends Children.Keys { private final Node parent; private final List> pages = new ArrayList<>(); private int thumbSize; + + + /** + * @return The thumbnail to show while waiting to load the thumbnail. + */ + private static Image getWaitingIcon() { + if (waitingIcon == null) { + String imgPath = "/org/sleuthkit/autopsy/images/working_spinner.gif"; + try { + waitingIcon = ImageIO.read(ThumbnailViewNode.class.getResource(imgPath)); + } catch (IOException ex) { + logger.log(Level.WARNING, "There was an error loading image: " + imgPath, ex); + } + } + + return waitingIcon; + } /** * The constructor @@ -260,8 +283,6 @@ class ThumbnailViewChildren extends Children.Keys { private final Logger logger = Logger.getLogger(ThumbnailViewNode.class.getName()); - private final Image waitingIcon = Toolkit.getDefaultToolkit().createImage(ThumbnailViewNode.class.getResource("/org/sleuthkit/autopsy/images/working_spinner.gif")); //NOI18N - private SoftReference thumbCache = null; private int thumbSize; private final Content content; @@ -309,7 +330,8 @@ class ThumbnailViewChildren extends Children.Keys { waitSpinnerTimer = new Timer(1, actionEvent -> fireIconChange()); waitSpinnerTimer.start(); } - return waitingIcon; + + return getWaitingIcon(); } synchronized void setThumbSize(int iconSize) { From b9ac7a9d7f0cba9a6ecb203dc78664e7ab67cb9e Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Tue, 1 Feb 2022 09:48:02 -0500 Subject: [PATCH 14/17] shutdown thread executor and catch throwable --- .../src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java b/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java index 3e44c4718a..7a75e13517 100644 --- a/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java +++ b/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java @@ -30,6 +30,7 @@ import java.util.concurrent.ScheduledFuture; import java.util.concurrent.ScheduledThreadPoolExecutor; import java.util.concurrent.TimeUnit; import java.util.concurrent.ExecutionException; +import java.util.concurrent.ExecutorService; import java.util.logging.Level; import org.netbeans.api.progress.ProgressHandle; import org.openide.util.NbBundle.Messages; @@ -143,6 +144,7 @@ class ImageWriter implements PropertyChangeListener { }) private void startFinishImage(String dataSourceName) { + ExecutorService executor = Executors.newSingleThreadExecutor(); synchronized (currentTasksLock) { if (isCancelled) { return; @@ -186,7 +188,7 @@ class ImageWriter implements PropertyChangeListener { // The added complexity here with the Future is because we absolutely need to make sure // the call to finishImageWriter returns before allowing the TSK data structures to be freed // during case close. - finishTask = Executors.newSingleThreadExecutor().submit(new Callable() { + finishTask = executor.submit(new Callable() { @Override public Integer call() throws TskCoreException { try { @@ -199,7 +201,7 @@ class ImageWriter implements PropertyChangeListener { caseDb.updateImagePath(settings.getPath(), dataSourceId); } return result; - } catch (TskCoreException ex) { + } catch (Throwable ex) { logger.log(Level.SEVERE, "Error finishing VHD image", ex); //NON-NLS return -1; } @@ -215,6 +217,7 @@ class ImageWriter implements PropertyChangeListener { try { // The call to get() can happen multiple times if the user closes the case, which is ok result = finishTask.get(); + executor.shutdownNow(); } catch (InterruptedException | ExecutionException ex) { logger.log(Level.SEVERE, "Error finishing VHD image", ex); //NON-NLS } From 9b47e9fb0d86459b1db09757d5b10a2ce31e8716 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Tue, 1 Feb 2022 15:09:03 -0500 Subject: [PATCH 15/17] updates for thread pool naming --- .../uiutils/SwingWorkerSequentialExecutor.java | 3 ++- .../autopsy/imagewriter/ImageWriter.java | 2 +- .../ImportCentralRepoDbProgressDialog.java | 15 ++++++--------- .../gui/drawableviews/DrawableUIBase.java | 3 ++- .../imagegallery/gui/navpanel/GroupTreeItem.java | 3 ++- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datasourcesummary/uiutils/SwingWorkerSequentialExecutor.java b/Core/src/org/sleuthkit/autopsy/datasourcesummary/uiutils/SwingWorkerSequentialExecutor.java index 37c46df31c..b0a4ea679f 100644 --- a/Core/src/org/sleuthkit/autopsy/datasourcesummary/uiutils/SwingWorkerSequentialExecutor.java +++ b/Core/src/org/sleuthkit/autopsy/datasourcesummary/uiutils/SwingWorkerSequentialExecutor.java @@ -18,6 +18,7 @@ */ package org.sleuthkit.autopsy.datasourcesummary.uiutils; +import com.google.common.util.concurrent.ThreadFactoryBuilder; import java.util.ArrayList; import java.util.Collections; import java.util.List; @@ -36,7 +37,7 @@ import javax.swing.SwingWorker; */ public class SwingWorkerSequentialExecutor { - private final ExecutorService executorService = Executors.newFixedThreadPool(1); + private final ExecutorService executorService = Executors.newFixedThreadPool(1, new ThreadFactoryBuilder().setNameFormat("SwingWorkerSequentialExecutor-%d").build()); private List> workers = Collections.emptyList(); private List> futures = Collections.emptyList(); diff --git a/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java b/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java index 7a75e13517..9a07b9fd7c 100644 --- a/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java +++ b/Core/src/org/sleuthkit/autopsy/imagewriter/ImageWriter.java @@ -144,7 +144,7 @@ class ImageWriter implements PropertyChangeListener { }) private void startFinishImage(String dataSourceName) { - ExecutorService executor = Executors.newSingleThreadExecutor(); + ExecutorService executor = Executors.newSingleThreadExecutor(new ThreadFactoryBuilder().setNameFormat("ImageWriter-startFinishImage-%d").build()); synchronized (currentTasksLock) { if (isCancelled) { return; diff --git a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java index d868b39189..0b685977c5 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java +++ b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java @@ -291,16 +291,13 @@ class ImportCentralRepoDbProgressDialog extends javax.swing.JDialog implements P if (referenceSetID.get() >= 0) { // This can be slow on large reference sets - Executors.newSingleThreadExecutor().execute(new Runnable() { - @Override - public void run() { - try { - CentralRepository.getInstance().deleteReferenceSet(referenceSetID.get()); - } catch (CentralRepoException ex2) { - Logger.getLogger(ImportCentralRepoDbProgressDialog.class.getName()).log(Level.SEVERE, "Error deleting incomplete hash set from central repository", ex2); - } + new Thread(() -> { + try { + CentralRepository.getInstance().deleteReferenceSet(referenceSetID.get()); + } catch (CentralRepoException ex2) { + Logger.getLogger(ImportCentralRepoDbProgressDialog.class.getName()).log(Level.SEVERE, "Error deleting incomplete hash set from central repository", ex2); } - }); + }).start(); } } diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/DrawableUIBase.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/DrawableUIBase.java index 6f0b1d1c2a..e2fde8d03a 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/DrawableUIBase.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/drawableviews/DrawableUIBase.java @@ -18,6 +18,7 @@ */ package org.sleuthkit.autopsy.imagegallery.gui.drawableviews; +import com.google.common.util.concurrent.ThreadFactoryBuilder; import java.util.Objects; import static java.util.Objects.nonNull; import java.util.Optional; @@ -55,7 +56,7 @@ abstract public class DrawableUIBase extends AnchorPane implements DrawableView /** The use of SingleThreadExecutor means we can only load a single image at * a time */ - static final Executor exec = Executors.newSingleThreadExecutor(); + static final Executor exec = Executors.newSingleThreadExecutor(new ThreadFactoryBuilder().setNameFormat("DrawableUIBase-%d").build()); @FXML BorderPane imageBorder; diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java index 234e834149..ee82989908 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/gui/navpanel/GroupTreeItem.java @@ -18,6 +18,7 @@ */ package org.sleuthkit.autopsy.imagegallery.gui.navpanel; +import com.google.common.util.concurrent.ThreadFactoryBuilder; import java.util.Comparator; import java.util.HashMap; import java.util.List; @@ -39,7 +40,7 @@ import org.sleuthkit.autopsy.imagegallery.datamodel.grouping.DrawableGroup; */ class GroupTreeItem extends TreeItem { - static final Executor treeInsertTread = Executors.newSingleThreadExecutor(); + static final Executor treeInsertTread = Executors.newSingleThreadExecutor(new ThreadFactoryBuilder().setNameFormat("GroupTreeItem-%d").build()); GroupTreeItem getTreeItemForGroup(DrawableGroup grouping) { if (Objects.equals(getValue().getGroup(), grouping)) { From 0677af661cd02409f81b8f9e6213e77beacbf7ff Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Tue, 1 Feb 2022 15:40:56 -0500 Subject: [PATCH 16/17] import cleanup --- .../modules/hashdatabase/ImportCentralRepoDbProgressDialog.java | 1 - 1 file changed, 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java index 0b685977c5..364f337a78 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java +++ b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/ImportCentralRepoDbProgressDialog.java @@ -30,7 +30,6 @@ import javax.swing.WindowConstants; import java.util.concurrent.atomic.AtomicLong; import java.util.concurrent.atomic.AtomicBoolean; import java.util.concurrent.atomic.AtomicInteger; -import java.util.concurrent.Executors; import org.openide.util.NbBundle; import org.openide.windows.WindowManager; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance; From 238e9159aacf880ba6d6b2de9a2f51a1d854dcea Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Thu, 3 Feb 2022 10:17:06 -0500 Subject: [PATCH 17/17] fixes --- .../artifactviewers/CallLogArtifactViewer.java | 12 ++++++------ .../artifactviewers/ContactArtifactViewer.java | 2 +- .../GeneralPurposeArtifactViewer.java | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java index 98ef09121e..096a25040e 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/CallLogArtifactViewer.java @@ -242,14 +242,14 @@ public class CallLogArtifactViewer extends javax.swing.JPanel implements Artifac callLogViewData.setFromContactNameList(fromContactNames); callLogViewData.setToContactNameList(toContactNames); + + String hostName = Optional.ofNullable(Case.getCurrentCaseThrows().getSleuthkitCase().getHostManager().getHostByDataSource((DataSource) dataSource)) + .map(h -> h.getName()) + .orElse(null); + + callLogViewData.setHostName(hostName); } - String hostName = Optional.ofNullable(Case.getCurrentCaseThrows().getSleuthkitCase().getHostManager().getHostByDataSource((DataSource) dataSource)) - .map(h -> h.getName()) - .orElse(null); - - callLogViewData.setHostName(hostName); - return callLogViewData; } diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java index 0a1254e84d..9c05f98114 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/ContactArtifactViewer.java @@ -329,7 +329,7 @@ public class ContactArtifactViewer extends javax.swing.JPanel implements Artifac private void updateSource() { CommunicationArtifactViewerHelper.addHeader(this, this.m_gridBagLayout, m_constraints, ContentViewerDefaults.getSectionSpacing(), Bundle.ContactArtifactViewer_heading_Source()); CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, m_constraints, Bundle.ContactArtifactViewer_label_host()); - CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, hostName); + CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, StringUtils.defaultString(hostName)); CommunicationArtifactViewerHelper.addKey(this, m_gridBagLayout, m_constraints, Bundle.ContactArtifactViewer_label_datasource()); CommunicationArtifactViewerHelper.addValue(this, m_gridBagLayout, m_constraints, datasourceName); } diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java index 284f5464d2..273120086a 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/artifactviewers/GeneralPurposeArtifactViewer.java @@ -319,7 +319,7 @@ public class GeneralPurposeArtifactViewer extends AbstractArtifactDetailsPanel i } } addHeader(Bundle.GeneralPurposeArtifactViewer_details_sourceHeader()); - addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_host(), hostName); + addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_host(), StringUtils.defaultString(hostName)); addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_dataSource(), dataSourceName); addNameValueRow(Bundle.GeneralPurposeArtifactViewer_details_file(), sourceFilePath); // add veritcal glue at the end