mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-12 16:06:15 +00:00
Revive postArtifact from timeline-event-mgr branch
This commit is contained in:
parent
d0a3dbee31
commit
c9f1ec2799
@ -19,24 +19,22 @@
|
|||||||
package org.sleuthkit.autopsy.casemodule.services;
|
package org.sleuthkit.autopsy.casemodule.services;
|
||||||
|
|
||||||
import java.io.Closeable;
|
import java.io.Closeable;
|
||||||
import java.io.IOException;
|
|
||||||
import org.openide.util.Lookup;
|
|
||||||
import org.sleuthkit.autopsy.keywordsearchservice.KeywordSearchService;
|
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact;
|
import org.sleuthkit.datamodel.BlackboardArtifact;
|
||||||
import org.sleuthkit.datamodel.BlackboardAttribute;
|
import org.sleuthkit.datamodel.BlackboardAttribute;
|
||||||
import org.sleuthkit.datamodel.SleuthkitCase;
|
import org.sleuthkit.datamodel.SleuthkitCase;
|
||||||
import org.sleuthkit.datamodel.TskCoreException;
|
|
||||||
import org.sleuthkit.datamodel.TskDataException;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* A representation of the blackboard, a place where artifacts and their
|
* A representation of the blackboard, a place where artifacts and their
|
||||||
* attributes are posted.
|
* attributes are posted.
|
||||||
*
|
*
|
||||||
* NOTE: This API of this class is under development.
|
* NOTE: This API of this class is under development.
|
||||||
|
*
|
||||||
|
* @deprecated Use org.sleuthkit.datamodel.Blackboard instead.
|
||||||
*/
|
*/
|
||||||
|
@Deprecated
|
||||||
public final class Blackboard implements Closeable {
|
public final class Blackboard implements Closeable {
|
||||||
|
|
||||||
private SleuthkitCase caseDb;
|
private org.sleuthkit.datamodel.Blackboard delegate;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Constructs a representation of the blackboard, a place where artifacts
|
* Constructs a representation of the blackboard, a place where artifacts
|
||||||
@ -45,27 +43,24 @@ public final class Blackboard implements Closeable {
|
|||||||
* @param casedb The case database.
|
* @param casedb The case database.
|
||||||
*/
|
*/
|
||||||
Blackboard(SleuthkitCase casedb) {
|
Blackboard(SleuthkitCase casedb) {
|
||||||
this.caseDb = casedb;
|
this.delegate = casedb.getBlackboard();
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Indexes the text associated with the an artifact.
|
* Indexes the text associated with an artifact.
|
||||||
*
|
*
|
||||||
* @param artifact The artifact to be indexed.
|
* @param artifact The artifact to be indexed.
|
||||||
*
|
*
|
||||||
* @throws BlackboardException If there is a problem indexing the artifact.
|
* @throws BlackboardException If there is a problem indexing the artifact.
|
||||||
*/
|
*/
|
||||||
public synchronized void indexArtifact(BlackboardArtifact artifact) throws BlackboardException {
|
public synchronized void indexArtifact(BlackboardArtifact artifact) throws BlackboardException {
|
||||||
if (null == caseDb) {
|
if (null == delegate) {
|
||||||
throw new BlackboardException("Blackboard has been closed");
|
throw new BlackboardException("Blackboard has been closed");
|
||||||
}
|
}
|
||||||
KeywordSearchService searchService = Lookup.getDefault().lookup(KeywordSearchService.class);
|
|
||||||
if (null == searchService) {
|
|
||||||
throw new BlackboardException("Keyword search service not found");
|
|
||||||
}
|
|
||||||
try {
|
try {
|
||||||
searchService.index(artifact);
|
delegate.postArtifact(artifact, "");
|
||||||
} catch (TskCoreException ex) {
|
} catch (org.sleuthkit.datamodel.Blackboard.BlackboardException ex) {
|
||||||
throw new BlackboardException("Error indexing artifact", ex);
|
throw new BlackboardException("Error indexing artifact", ex);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -83,19 +78,14 @@ public final class Blackboard implements Closeable {
|
|||||||
* artifact type.
|
* artifact type.
|
||||||
*/
|
*/
|
||||||
public synchronized BlackboardArtifact.Type getOrAddArtifactType(String typeName, String displayName) throws BlackboardException {
|
public synchronized BlackboardArtifact.Type getOrAddArtifactType(String typeName, String displayName) throws BlackboardException {
|
||||||
if (null == caseDb) {
|
if (null == delegate) {
|
||||||
throw new BlackboardException("Blackboard has been closed");
|
throw new BlackboardException("Blackboard has been closed");
|
||||||
}
|
}
|
||||||
|
|
||||||
try {
|
try {
|
||||||
return caseDb.addBlackboardArtifactType(typeName, displayName);
|
return delegate.getOrAddArtifactType(typeName, displayName);
|
||||||
} catch (TskDataException typeExistsEx) {
|
} catch (org.sleuthkit.datamodel.Blackboard.BlackboardException ex) {
|
||||||
try {
|
throw new BlackboardException("Delegate org.sleuthkit.datamodel.Blackboard threw exception.", ex);
|
||||||
return caseDb.getArtifactType(typeName);
|
|
||||||
} catch (TskCoreException ex) {
|
|
||||||
throw new BlackboardException("Failed to get or add artifact type", ex);
|
|
||||||
}
|
|
||||||
} catch (TskCoreException ex) {
|
|
||||||
throw new BlackboardException("Failed to get or add artifact type", ex);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -113,30 +103,23 @@ public final class Blackboard implements Closeable {
|
|||||||
* attribute type.
|
* attribute type.
|
||||||
*/
|
*/
|
||||||
public synchronized BlackboardAttribute.Type getOrAddAttributeType(String typeName, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName) throws BlackboardException {
|
public synchronized BlackboardAttribute.Type getOrAddAttributeType(String typeName, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName) throws BlackboardException {
|
||||||
if (null == caseDb) {
|
if (null == delegate) {
|
||||||
throw new BlackboardException("Blackboard has been closed");
|
throw new BlackboardException("Blackboard has been closed");
|
||||||
}
|
}
|
||||||
try {
|
try {
|
||||||
return caseDb.addArtifactAttributeType(typeName, valueType, displayName);
|
return delegate.getOrAddAttributeType(typeName, valueType, displayName);
|
||||||
} catch (TskDataException typeExistsEx) {
|
} catch (org.sleuthkit.datamodel.Blackboard.BlackboardException ex) {
|
||||||
try {
|
throw new BlackboardException("Delegate org.sleuthkit.datamodel.Blackboard threw exception.", ex);
|
||||||
return caseDb.getAttributeType(typeName);
|
|
||||||
} catch (TskCoreException ex) {
|
|
||||||
throw new BlackboardException("Failed to get or add attribute type", ex);
|
|
||||||
}
|
|
||||||
} catch (TskCoreException ex) {
|
|
||||||
throw new BlackboardException("Failed to get or add attribute type", ex);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Closes the blackboard.
|
* Closes the blackboard.
|
||||||
*
|
*
|
||||||
* @throws IOException If there is a problem closing the blackboard.
|
|
||||||
*/
|
*/
|
||||||
@Override
|
@Override
|
||||||
public synchronized void close() throws IOException {
|
public synchronized void close() {
|
||||||
caseDb = null;
|
delegate = null;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -1,8 +1,8 @@
|
|||||||
/*
|
/*
|
||||||
*
|
*
|
||||||
* Autopsy Forensic Browser
|
* Autopsy Forensic Browser
|
||||||
*
|
*
|
||||||
* Copyright 2012 Basis Technology Corp.
|
* Copyright 2012-2018 Basis Technology Corp.
|
||||||
*
|
*
|
||||||
* Copyright 2012 42six Solutions.
|
* Copyright 2012 42six Solutions.
|
||||||
* Contact: aebadirad <at> 42six <dot> com
|
* Contact: aebadirad <at> 42six <dot> com
|
||||||
@ -27,12 +27,12 @@ import java.sql.DriverManager;
|
|||||||
import java.sql.ResultSet;
|
import java.sql.ResultSet;
|
||||||
import java.sql.SQLException;
|
import java.sql.SQLException;
|
||||||
import java.sql.Statement;
|
import java.sql.Statement;
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import java.util.logging.Level;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Database connection class & utilities *
|
* Database connection class & utilities.
|
||||||
*/
|
*/
|
||||||
public class SQLiteDBConnect {
|
public class SQLiteDBConnect implements AutoCloseable {
|
||||||
|
|
||||||
public String sDriver = "";
|
public String sDriver = "";
|
||||||
public String sUrl = null;
|
public String sUrl = null;
|
||||||
@ -104,9 +104,13 @@ public class SQLiteDBConnect {
|
|||||||
statement.executeUpdate(instruction);
|
statement.executeUpdate(instruction);
|
||||||
}
|
}
|
||||||
|
|
||||||
// processes an array of instructions e.g. a set of SQL command strings passed from a file
|
/** processes an array of instructions e.g. a set of SQL command strings
|
||||||
//NB you should ensure you either handle empty lines in files by either removing them or parsing them out
|
* passed from a file
|
||||||
// since they will generate spurious SQLExceptions when they are encountered during the iteration....
|
*
|
||||||
|
* NB you should ensure you either handle empty lines in files by either
|
||||||
|
* removing them or parsing them out since they will generate spurious
|
||||||
|
* SQLExceptions when they are encountered during the iteration....
|
||||||
|
*/
|
||||||
public void executeStmt(String[] instructionSet) throws SQLException {
|
public void executeStmt(String[] instructionSet) throws SQLException {
|
||||||
for (int i = 0; i < instructionSet.length; i++) {
|
for (int i = 0; i < instructionSet.length; i++) {
|
||||||
executeStmt(instructionSet[i]);
|
executeStmt(instructionSet[i]);
|
||||||
@ -120,7 +124,14 @@ public class SQLiteDBConnect {
|
|||||||
public void closeConnection() {
|
public void closeConnection() {
|
||||||
try {
|
try {
|
||||||
conn.close();
|
conn.close();
|
||||||
} catch (Exception ignore) {
|
} catch (SQLException ex) {
|
||||||
|
logger.log(Level.WARNING, "Unable to close connection to SQLite DB at " + sUrl, ex);
|
||||||
}
|
}
|
||||||
|
//Implementing Autoclosable.close() allows this class to be used in try-with-resources.
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void close() {
|
||||||
|
closeConnection();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -34,13 +34,10 @@ import java.util.logging.Level;
|
|||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
import org.sleuthkit.autopsy.casemodule.Case;
|
||||||
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
||||||
import org.sleuthkit.autopsy.casemodule.services.FileManager;
|
import org.sleuthkit.autopsy.casemodule.services.FileManager;
|
||||||
import org.sleuthkit.autopsy.casemodule.services.Services;
|
|
||||||
import org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress;
|
import org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestModule;
|
import org.sleuthkit.autopsy.ingest.IngestModule;
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
import org.sleuthkit.datamodel.Content;
|
import org.sleuthkit.datamodel.Content;
|
||||||
import org.sleuthkit.datamodel.FsContent;
|
|
||||||
import org.sleuthkit.datamodel.SleuthkitCase;
|
|
||||||
import org.sleuthkit.datamodel.TskCoreException;
|
import org.sleuthkit.datamodel.TskCoreException;
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.autopsy.ingest.DataSourceIngestModule;
|
import org.sleuthkit.autopsy.ingest.DataSourceIngestModule;
|
||||||
|
@ -31,21 +31,18 @@ package org.sleuthkit.autopsy.examples;
|
|||||||
|
|
||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestModule;
|
|
||||||
import org.sleuthkit.autopsy.ingest.IngestJobContext;
|
import org.sleuthkit.autopsy.ingest.IngestJobContext;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestServices;
|
import org.sleuthkit.autopsy.ingest.IngestModule;
|
||||||
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
|
|
||||||
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
||||||
|
import org.sleuthkit.autopsy.ingest.IngestServices;
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
|
import org.sleuthkit.datamodel.Blackboard;
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact;
|
import org.sleuthkit.datamodel.BlackboardArtifact;
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
|
|
||||||
import org.sleuthkit.datamodel.BlackboardAttribute;
|
import org.sleuthkit.datamodel.BlackboardAttribute;
|
||||||
import org.sleuthkit.datamodel.TskCoreException;
|
import org.sleuthkit.datamodel.TskCoreException;
|
||||||
import org.sleuthkit.datamodel.SleuthkitCase;
|
|
||||||
import org.sleuthkit.datamodel.TskData;
|
import org.sleuthkit.datamodel.TskData;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -56,7 +53,7 @@ import org.sleuthkit.datamodel.TskData;
|
|||||||
class SampleFileIngestModule implements FileIngestModule {
|
class SampleFileIngestModule implements FileIngestModule {
|
||||||
|
|
||||||
private static final HashMap<Long, Long> artifactCountsForIngestJobs = new HashMap<>();
|
private static final HashMap<Long, Long> artifactCountsForIngestJobs = new HashMap<>();
|
||||||
private static BlackboardAttribute.ATTRIBUTE_TYPE attrType = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT;
|
private static final BlackboardAttribute.ATTRIBUTE_TYPE ATTR_TYPE = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT;
|
||||||
private final boolean skipKnownFiles;
|
private final boolean skipKnownFiles;
|
||||||
private IngestJobContext context = null;
|
private IngestJobContext context = null;
|
||||||
private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
|
private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
|
||||||
@ -101,7 +98,7 @@ class SampleFileIngestModule implements FileIngestModule {
|
|||||||
|
|
||||||
// Make an attribute using the ID for the attribute attrType that
|
// Make an attribute using the ID for the attribute attrType that
|
||||||
// was previously created.
|
// was previously created.
|
||||||
BlackboardAttribute attr = new BlackboardAttribute(attrType, SampleIngestModuleFactory.getModuleName(), count);
|
BlackboardAttribute attr = new BlackboardAttribute(ATTR_TYPE, SampleIngestModuleFactory.getModuleName(), count);
|
||||||
|
|
||||||
// Add the to the general info artifact for the file. In a
|
// Add the to the general info artifact for the file. In a
|
||||||
// real module, you would likely have more complex data types
|
// real module, you would likely have more complex data types
|
||||||
@ -113,13 +110,15 @@ class SampleFileIngestModule implements FileIngestModule {
|
|||||||
// management of shared data.
|
// management of shared data.
|
||||||
addToBlackboardPostCount(context.getJobId(), 1L);
|
addToBlackboardPostCount(context.getJobId(), 1L);
|
||||||
|
|
||||||
// Fire an event to notify any listeners for blackboard postings.
|
/*
|
||||||
ModuleDataEvent event = new ModuleDataEvent(SampleIngestModuleFactory.getModuleName(), ARTIFACT_TYPE.TSK_GEN_INFO);
|
* post the artifact which will index the artifact for keyword
|
||||||
IngestServices.getInstance().fireModuleDataEvent(event);
|
* search, and fire an event to notify UI of this new artifact
|
||||||
|
*/
|
||||||
|
file.getSleuthkitCase().getBlackboard().postArtifact(art, SampleIngestModuleFactory.getModuleName());
|
||||||
|
|
||||||
return IngestModule.ProcessResult.OK;
|
return IngestModule.ProcessResult.OK;
|
||||||
|
|
||||||
} catch (TskCoreException ex) {
|
} catch (TskCoreException | Blackboard.BlackboardException ex) {
|
||||||
IngestServices ingestServices = IngestServices.getInstance();
|
IngestServices ingestServices = IngestServices.getInstance();
|
||||||
Logger logger = ingestServices.getLogger(SampleIngestModuleFactory.getModuleName());
|
Logger logger = ingestServices.getLogger(SampleIngestModuleFactory.getModuleName());
|
||||||
logger.log(Level.SEVERE, "Error processing file (id = " + file.getId() + ")", ex);
|
logger.log(Level.SEVERE, "Error processing file (id = " + file.getId() + ")", ex);
|
||||||
|
@ -104,9 +104,13 @@ public final class IngestServices {
|
|||||||
*
|
*
|
||||||
* @param moduleDataEvent A module data event, i.e., an event that
|
* @param moduleDataEvent A module data event, i.e., an event that
|
||||||
* encapsulates artifact data.
|
* encapsulates artifact data.
|
||||||
|
*
|
||||||
|
* @deprecated use org.sleuthkit.datamodel.Blackboard.postArtifact instead.
|
||||||
*/
|
*/
|
||||||
|
@Deprecated
|
||||||
public void fireModuleDataEvent(ModuleDataEvent moduleDataEvent) {
|
public void fireModuleDataEvent(ModuleDataEvent moduleDataEvent) {
|
||||||
IngestManager.getInstance().fireIngestModuleDataEvent(moduleDataEvent);
|
IngestManager.getInstance().fireIngestModuleDataEvent(moduleDataEvent);
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -170,10 +174,7 @@ public final class IngestServices {
|
|||||||
* Sets all of the global configuration settings for an ingest module.
|
* Sets all of the global configuration settings for an ingest module.
|
||||||
*
|
*
|
||||||
* @param moduleName A unique identifier for the module.
|
* @param moduleName A unique identifier for the module.
|
||||||
*
|
|
||||||
* @param moduleName moduleName identifier unique to that module
|
|
||||||
* @param settings A mapping of setting names to setting values.
|
* @param settings A mapping of setting names to setting values.
|
||||||
*
|
|
||||||
*/
|
*/
|
||||||
public void setConfigSettings(String moduleName, Map<String, String> settings) {
|
public void setConfigSettings(String moduleName, Map<String, String> settings) {
|
||||||
ModuleSettings.setConfigSettings(moduleName, settings);
|
ModuleSettings.setConfigSettings(moduleName, settings);
|
||||||
|
@ -76,8 +76,8 @@ public class ModuleDataEvent extends ChangeEvent {
|
|||||||
/**
|
/**
|
||||||
* @param moduleName Module name
|
* @param moduleName Module name
|
||||||
* @param blackboardArtifactType Type of artifact posted to the blackboard
|
* @param blackboardArtifactType Type of artifact posted to the blackboard
|
||||||
* @param artifacts List of specific artifact ID values that were added to
|
* @param artifacts List of specific artifact ID values that
|
||||||
* blackboard
|
* were added to blackboard
|
||||||
*/
|
*/
|
||||||
public ModuleDataEvent(String moduleName, BlackboardArtifact.Type blackboardArtifactType, Collection<BlackboardArtifact> artifacts) {
|
public ModuleDataEvent(String moduleName, BlackboardArtifact.Type blackboardArtifactType, Collection<BlackboardArtifact> artifacts) {
|
||||||
this(moduleName, blackboardArtifactType);
|
this(moduleName, blackboardArtifactType);
|
||||||
|
@ -18,7 +18,6 @@
|
|||||||
*/
|
*/
|
||||||
package org.sleuthkit.autopsy.modules.fileextmismatch;
|
package org.sleuthkit.autopsy.modules.fileextmismatch;
|
||||||
|
|
||||||
import java.util.Collections;
|
|
||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
import java.util.Set;
|
import java.util.Set;
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
@ -26,7 +25,6 @@ import org.openide.util.NbBundle;
|
|||||||
import org.openide.util.NbBundle.Messages;
|
import org.openide.util.NbBundle.Messages;
|
||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
import org.sleuthkit.autopsy.casemodule.Case;
|
||||||
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
||||||
import org.sleuthkit.autopsy.casemodule.services.Blackboard;
|
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
|
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
|
||||||
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
||||||
@ -34,10 +32,10 @@ import org.sleuthkit.autopsy.ingest.IngestJobContext;
|
|||||||
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestServices;
|
import org.sleuthkit.autopsy.ingest.IngestServices;
|
||||||
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
|
|
||||||
import org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleSettings.CHECK_TYPE;
|
import org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleSettings.CHECK_TYPE;
|
||||||
import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
|
import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
|
import org.sleuthkit.datamodel.Blackboard;
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact;
|
import org.sleuthkit.datamodel.BlackboardArtifact;
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
|
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
|
||||||
import org.sleuthkit.datamodel.TskData;
|
import org.sleuthkit.datamodel.TskData;
|
||||||
@ -110,7 +108,7 @@ public class FileExtMismatchIngestModule implements FileIngestModule {
|
|||||||
@Messages({"FileExtMismatchIngestModule.indexError.message=Failed to index file extension mismatch artifact for keyword search."})
|
@Messages({"FileExtMismatchIngestModule.indexError.message=Failed to index file extension mismatch artifact for keyword search."})
|
||||||
public ProcessResult process(AbstractFile abstractFile) {
|
public ProcessResult process(AbstractFile abstractFile) {
|
||||||
try {
|
try {
|
||||||
blackboard = Case.getCurrentCaseThrows().getServices().getBlackboard();
|
blackboard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();
|
||||||
} catch (NoCurrentCaseException ex) {
|
} catch (NoCurrentCaseException ex) {
|
||||||
logger.log(Level.WARNING, "Exception while getting open case.", ex); //NON-NLS
|
logger.log(Level.WARNING, "Exception while getting open case.", ex); //NON-NLS
|
||||||
return ProcessResult.ERROR;
|
return ProcessResult.ERROR;
|
||||||
@ -145,14 +143,17 @@ public class FileExtMismatchIngestModule implements FileIngestModule {
|
|||||||
BlackboardArtifact bart = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED);
|
BlackboardArtifact bart = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED);
|
||||||
|
|
||||||
try {
|
try {
|
||||||
// index the artifact for keyword search
|
/*
|
||||||
blackboard.indexArtifact(bart);
|
* post the artifact which will index the artifact for
|
||||||
|
* keyword search, and fire an event to notify UI of this
|
||||||
|
* new artifact
|
||||||
|
*/
|
||||||
|
blackboard.postArtifact(bart, FileExtMismatchDetectorModuleFactory.getModuleName());
|
||||||
} catch (Blackboard.BlackboardException ex) {
|
} catch (Blackboard.BlackboardException ex) {
|
||||||
logger.log(Level.SEVERE, "Unable to index blackboard artifact " + bart.getArtifactID(), ex); //NON-NLS
|
logger.log(Level.SEVERE, "Unable to index blackboard artifact " + bart.getArtifactID(), ex); //NON-NLS
|
||||||
MessageNotifyUtil.Notify.error(FileExtMismatchDetectorModuleFactory.getModuleName(), Bundle.FileExtMismatchIngestModule_indexError_message());
|
MessageNotifyUtil.Notify.error(FileExtMismatchDetectorModuleFactory.getModuleName(), Bundle.FileExtMismatchIngestModule_indexError_message());
|
||||||
}
|
}
|
||||||
|
|
||||||
services.fireModuleDataEvent(new ModuleDataEvent(FileExtMismatchDetectorModuleFactory.getModuleName(), ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED, Collections.singletonList(bart)));
|
|
||||||
}
|
}
|
||||||
return ProcessResult.OK;
|
return ProcessResult.OK;
|
||||||
} catch (TskException ex) {
|
} catch (TskException ex) {
|
||||||
|
@ -18,40 +18,42 @@
|
|||||||
*/
|
*/
|
||||||
package org.sleuthkit.autopsy.modules.filetypeid;
|
package org.sleuthkit.autopsy.modules.filetypeid;
|
||||||
|
|
||||||
import java.util.ArrayList;
|
import java.util.Arrays;
|
||||||
import java.util.Collection;
|
|
||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
import org.openide.util.NbBundle;
|
import org.openide.util.NbBundle;
|
||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
import org.sleuthkit.autopsy.casemodule.Case;
|
||||||
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
||||||
import org.sleuthkit.autopsy.casemodule.services.Blackboard;
|
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestJobContext;
|
import org.sleuthkit.autopsy.ingest.IngestJobContext;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestServices;
|
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
|
||||||
import org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult;
|
import org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
||||||
|
import org.sleuthkit.autopsy.ingest.IngestServices;
|
||||||
|
import org.sleuthkit.autopsy.modules.filetypeid.CustomFileTypesManager.CustomFileTypesException;
|
||||||
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
|
import org.sleuthkit.datamodel.Blackboard;
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact;
|
import org.sleuthkit.datamodel.BlackboardArtifact;
|
||||||
|
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT;
|
||||||
import org.sleuthkit.datamodel.BlackboardAttribute;
|
import org.sleuthkit.datamodel.BlackboardAttribute;
|
||||||
|
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY;
|
||||||
|
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME;
|
||||||
import org.sleuthkit.datamodel.TskCoreException;
|
import org.sleuthkit.datamodel.TskCoreException;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Detects the type of a file based on signature (magic) values. Posts results
|
* Detects the type of a file based on signature (magic) values. Posts results
|
||||||
* to the blackboard.
|
* to the blackboard.
|
||||||
*/
|
*/
|
||||||
@NbBundle.Messages({
|
@NbBundle.Messages({"CannotRunFileTypeDetection=Unable to run file type detection."})
|
||||||
"CannotRunFileTypeDetection=Unable to run file type detection."
|
|
||||||
})
|
|
||||||
public class FileTypeIdIngestModule implements FileIngestModule {
|
public class FileTypeIdIngestModule implements FileIngestModule {
|
||||||
|
|
||||||
private static final Logger logger = Logger.getLogger(FileTypeIdIngestModule.class.getName());
|
private static final Logger logger = Logger.getLogger(FileTypeIdIngestModule.class.getName());
|
||||||
private long jobId;
|
|
||||||
private static final HashMap<Long, IngestJobTotals> totalsForIngestJobs = new HashMap<>();
|
private static final HashMap<Long, IngestJobTotals> totalsForIngestJobs = new HashMap<>();
|
||||||
private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
|
private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
|
||||||
|
|
||||||
|
private long jobId;
|
||||||
private FileTypeDetector fileTypeDetector;
|
private FileTypeDetector fileTypeDetector;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -146,26 +148,34 @@ public class FileTypeIdIngestModule implements FileIngestModule {
|
|||||||
* @param fileType The file type rule for categorizing the hit.
|
* @param fileType The file type rule for categorizing the hit.
|
||||||
*/
|
*/
|
||||||
private void createInterestingFileHit(AbstractFile file, FileType fileType) {
|
private void createInterestingFileHit(AbstractFile file, FileType fileType) {
|
||||||
try {
|
|
||||||
Collection<BlackboardAttribute> attributes = new ArrayList<>();
|
|
||||||
attributes.add(new BlackboardAttribute(
|
|
||||||
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, FileTypeIdModuleFactory.getModuleName(), fileType.getInterestingFilesSetName()));
|
|
||||||
attributes.add(new BlackboardAttribute(
|
|
||||||
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType()));
|
|
||||||
|
|
||||||
|
List<BlackboardAttribute> attributes = Arrays.asList(
|
||||||
|
new BlackboardAttribute(
|
||||||
|
TSK_SET_NAME, FileTypeIdModuleFactory.getModuleName(),
|
||||||
|
fileType.getInterestingFilesSetName()),
|
||||||
|
new BlackboardAttribute(
|
||||||
|
TSK_CATEGORY, FileTypeIdModuleFactory.getModuleName(),
|
||||||
|
fileType.getMimeType()));
|
||||||
|
try {
|
||||||
Case currentCase = Case.getCurrentCaseThrows();
|
Case currentCase = Case.getCurrentCaseThrows();
|
||||||
org.sleuthkit.datamodel.Blackboard tskBlackboard = currentCase.getSleuthkitCase().getBlackboard();
|
|
||||||
// Create artifact if it doesn't already exist.
|
|
||||||
if (!tskBlackboard.artifactExists(file, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, attributes)) {
|
|
||||||
BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
|
|
||||||
artifact.addAttributes(attributes);
|
|
||||||
|
|
||||||
|
Blackboard tskBlackboard = currentCase.getSleuthkitCase().getBlackboard();
|
||||||
|
// Create artifact if it doesn't already exist.
|
||||||
|
if (!tskBlackboard.artifactExists(file, TSK_INTERESTING_FILE_HIT, attributes)) {
|
||||||
|
BlackboardArtifact artifact = file.newArtifact(TSK_INTERESTING_FILE_HIT);
|
||||||
|
artifact.addAttributes(attributes);
|
||||||
try {
|
try {
|
||||||
currentCase.getServices().getBlackboard().indexArtifact(artifact);
|
/*
|
||||||
|
* post the artifact which will index the artifact for
|
||||||
|
* keyword search, and fire an event to notify UI of this
|
||||||
|
* new artifact
|
||||||
|
*/
|
||||||
|
tskBlackboard.postArtifact(artifact, FileTypeIdModuleFactory.getModuleName());
|
||||||
} catch (Blackboard.BlackboardException ex) {
|
} catch (Blackboard.BlackboardException ex) {
|
||||||
logger.log(Level.SEVERE, String.format("Unable to index TSK_INTERESTING_FILE_HIT blackboard artifact %d (file obj_id=%d)", artifact.getArtifactID(), file.getId()), ex); //NON-NLS
|
logger.log(Level.SEVERE, String.format("Unable to index TSK_INTERESTING_FILE_HIT blackboard artifact %d (file obj_id=%d)", artifact.getArtifactID(), file.getId()), ex); //NON-NLS
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
} catch (TskCoreException ex) {
|
} catch (TskCoreException ex) {
|
||||||
logger.log(Level.SEVERE, String.format("Unable to create TSK_INTERESTING_FILE_HIT artifact for file (obj_id=%d)", file.getId()), ex); //NON-NLS
|
logger.log(Level.SEVERE, String.format("Unable to create TSK_INTERESTING_FILE_HIT artifact for file (obj_id=%d)", file.getId()), ex); //NON-NLS
|
||||||
} catch (NoCurrentCaseException ex) {
|
} catch (NoCurrentCaseException ex) {
|
||||||
@ -227,5 +237,4 @@ public class FileTypeIdIngestModule implements FileIngestModule {
|
|||||||
long matchTime = 0;
|
long matchTime = 0;
|
||||||
long numFiles = 0;
|
long numFiles = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
@ -21,7 +21,6 @@ package org.sleuthkit.autopsy.modules.hashdatabase;
|
|||||||
import java.io.IOException;
|
import java.io.IOException;
|
||||||
import java.util.ArrayList;
|
import java.util.ArrayList;
|
||||||
import java.util.Collection;
|
import java.util.Collection;
|
||||||
import java.util.Collections;
|
|
||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
import java.util.concurrent.atomic.AtomicLong;
|
import java.util.concurrent.atomic.AtomicLong;
|
||||||
@ -30,7 +29,6 @@ import org.openide.util.NbBundle;
|
|||||||
import org.openide.util.NbBundle.Messages;
|
import org.openide.util.NbBundle.Messages;
|
||||||
import org.sleuthkit.autopsy.casemodule.Case;
|
import org.sleuthkit.autopsy.casemodule.Case;
|
||||||
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
|
||||||
import org.sleuthkit.autopsy.casemodule.services.Blackboard;
|
|
||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
|
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
|
||||||
import org.sleuthkit.autopsy.healthmonitor.HealthMonitor;
|
import org.sleuthkit.autopsy.healthmonitor.HealthMonitor;
|
||||||
@ -39,9 +37,9 @@ import org.sleuthkit.autopsy.ingest.FileIngestModule;
|
|||||||
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
import org.sleuthkit.autopsy.ingest.IngestMessage;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
import org.sleuthkit.autopsy.ingest.IngestModuleReferenceCounter;
|
||||||
import org.sleuthkit.autopsy.ingest.IngestServices;
|
import org.sleuthkit.autopsy.ingest.IngestServices;
|
||||||
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
|
|
||||||
import org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.HashDb;
|
import org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.HashDb;
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
|
import org.sleuthkit.datamodel.Blackboard;
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact;
|
import org.sleuthkit.datamodel.BlackboardArtifact;
|
||||||
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
|
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
|
||||||
import org.sleuthkit.datamodel.BlackboardAttribute;
|
import org.sleuthkit.datamodel.BlackboardAttribute;
|
||||||
@ -170,7 +168,7 @@ public class HashDbIngestModule implements FileIngestModule {
|
|||||||
@Override
|
@Override
|
||||||
public ProcessResult process(AbstractFile file) {
|
public ProcessResult process(AbstractFile file) {
|
||||||
try {
|
try {
|
||||||
blackboard = Case.getCurrentCaseThrows().getServices().getBlackboard();
|
blackboard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();
|
||||||
} catch (NoCurrentCaseException ex) {
|
} catch (NoCurrentCaseException ex) {
|
||||||
logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
|
logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
|
||||||
return ProcessResult.ERROR;
|
return ProcessResult.ERROR;
|
||||||
@ -356,8 +354,11 @@ public class HashDbIngestModule implements FileIngestModule {
|
|||||||
badFile.addAttributes(attributes);
|
badFile.addAttributes(attributes);
|
||||||
|
|
||||||
try {
|
try {
|
||||||
// index the artifact for keyword search
|
/*
|
||||||
blackboard.indexArtifact(badFile);
|
* post the artifact which will index the artifact for keyword
|
||||||
|
* search, and fire an event to notify UI of this new artifact
|
||||||
|
*/
|
||||||
|
blackboard.postArtifact(badFile, moduleName);
|
||||||
} catch (Blackboard.BlackboardException ex) {
|
} catch (Blackboard.BlackboardException ex) {
|
||||||
logger.log(Level.SEVERE, "Unable to index blackboard artifact " + badFile.getArtifactID(), ex); //NON-NLS
|
logger.log(Level.SEVERE, "Unable to index blackboard artifact " + badFile.getArtifactID(), ex); //NON-NLS
|
||||||
MessageNotifyUtil.Notify.error(
|
MessageNotifyUtil.Notify.error(
|
||||||
@ -400,7 +401,6 @@ public class HashDbIngestModule implements FileIngestModule {
|
|||||||
abstractFile.getName() + md5Hash,
|
abstractFile.getName() + md5Hash,
|
||||||
badFile));
|
badFile));
|
||||||
}
|
}
|
||||||
services.fireModuleDataEvent(new ModuleDataEvent(moduleName, ARTIFACT_TYPE.TSK_HASHSET_HIT, Collections.singletonList(badFile)));
|
|
||||||
} catch (TskException ex) {
|
} catch (TskException ex) {
|
||||||
logger.log(Level.WARNING, "Error creating blackboard artifact", ex); //NON-NLS
|
logger.log(Level.WARNING, "Error creating blackboard artifact", ex); //NON-NLS
|
||||||
}
|
}
|
||||||
|
@ -281,11 +281,9 @@ public class PlasoIngestModule implements DataSourceIngestModule {
|
|||||||
+ " 'WEBHIST') " // bad dates and duplicates with what we have.
|
+ " 'WEBHIST') " // bad dates and duplicates with what we have.
|
||||||
+ " AND sourcetype NOT IN ('UNKNOWN', "
|
+ " AND sourcetype NOT IN ('UNKNOWN', "
|
||||||
+ " 'PE Import Time');"; // lots of bad dates //NON-NLS
|
+ " 'PE Import Time');"; // lots of bad dates //NON-NLS
|
||||||
SQLiteDBConnect tempdbconnect = null;
|
|
||||||
ResultSet resultSet = null;
|
try (SQLiteDBConnect tempdbconnect = new SQLiteDBConnect("org.sqlite.JDBC", "jdbc:sqlite:" + plasoDb); //NON-NLS
|
||||||
try {
|
ResultSet resultSet = tempdbconnect.executeQry(sqlStatement)) {
|
||||||
tempdbconnect = new SQLiteDBConnect("org.sqlite.JDBC", "jdbc:sqlite:" + plasoDb); //NON-NLS
|
|
||||||
resultSet = tempdbconnect.executeQry(sqlStatement);
|
|
||||||
while (resultSet.next()) {
|
while (resultSet.next()) {
|
||||||
if (context.dataSourceIngestIsCancelled()) {
|
if (context.dataSourceIngestIsCancelled()) {
|
||||||
logger.log(Level.INFO, "Cancelled Plaso Artifact Creation."); //NON-NLS
|
logger.log(Level.INFO, "Cancelled Plaso Artifact Creation."); //NON-NLS
|
||||||
@ -328,18 +326,6 @@ public class PlasoIngestModule implements DataSourceIngestModule {
|
|||||||
}
|
}
|
||||||
} catch (SQLException ex) {
|
} catch (SQLException ex) {
|
||||||
logger.log(Level.SEVERE, "Error while trying to read into a sqlite db.", ex);//NON-NLS
|
logger.log(Level.SEVERE, "Error while trying to read into a sqlite db.", ex);//NON-NLS
|
||||||
} finally {
|
|
||||||
if(resultSet != null) {
|
|
||||||
try {
|
|
||||||
resultSet.close();
|
|
||||||
} catch (SQLException ex) {
|
|
||||||
logger.log(Level.WARNING, "Unable to close ResultSet", ex);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if(tempdbconnect != null) {
|
|
||||||
tempdbconnect.closeConnection();
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user