diff --git a/Core/nbproject/project.properties b/Core/nbproject/project.properties index 2406271416..58622cf7a5 100644 --- a/Core/nbproject/project.properties +++ b/Core/nbproject/project.properties @@ -15,7 +15,6 @@ file.reference.commons-pool2-2.4.2.jar=release/modules/ext/commons-pool2-2.4.2.j file.reference.dd-plist-1.20.jar=release/modules/ext/dd-plist-1.20.jar file.reference.geoapi-3.0.0.jar=release/modules/ext/geoapi-3.0.0.jar file.reference.grib-4.5.5.jar=release/modules/ext/grib-4.5.5.jar -file.reference.gson-2.8.1.jar=release/modules/ext/gson-2.8.1.jar file.reference.httpservices-4.5.5.jar=release/modules/ext/httpservices-4.5.5.jar file.reference.isoparser-1.1.18.jar=release/modules/ext/isoparser-1.1.18.jar file.reference.jackcess-2.2.0.jar=release/modules/ext/jackcess-2.2.0.jar @@ -52,7 +51,7 @@ file.reference.sis-metadata-0.6.jar=release/modules/ext/sis-metadata-0.6.jar file.reference.sis-netcdf-0.6.jar=release/modules/ext/sis-netcdf-0.6.jar file.reference.sis-utility-0.6.jar=release/modules/ext/sis-utility-0.6.jar file.reference.slf4j-api-1.7.24.jar=release/modules/ext/slf4j-api-1.7.24.jar -file.reference.sqlite-jdbc-3.8.11.jar=release/modules/ext/sqlite-jdbc-3.8.11.jar +file.reference.sqlite-jdbc-3.25.2.jar=release/modules/ext/sqlite-jdbc-3.25.2.jar file.reference.StixLib.jar=release/modules/ext/StixLib.jar file.reference.jempbox-1.8.13.jar=release/modules/ext/jempbox-1.8.13.jar file.reference.javax.ws.rs-api-2.0.1.jar=release/modules/ext/javax.ws.rs-api-2.0.1.jar diff --git a/Core/nbproject/project.xml b/Core/nbproject/project.xml index 37ea029fba..802dcfbd43 100644 --- a/Core/nbproject/project.xml +++ b/Core/nbproject/project.xml @@ -415,6 +415,10 @@ ext/StixLib.jar release/modules/ext/StixLib.jar + + ext/jackson-core-2.9.7.jar + release/modules/ext/jackson-core-2.9.7.jar + ext/pdfbox-tools-2.0.8.jar release/modules/ext/pdfbox-tools-2.0.8.jar @@ -431,10 +435,6 @@ ext/tika-parsers-1.17.jar release/modules/ext/tika-parsers-1.17.jar - - ext/sqlite-jdbc-3.25.2.jar - release/modules/ext/sqlite-jdbc-3.25.2.jar - ext/json-simple-1.1.1.jar release/modules/ext/json-simple-1.1.1.jar @@ -447,6 +447,10 @@ ext/jhighlight-1.0.2.jar release/modules/ext/jhighlight-1.0.2.jar + + ext/sleuthkit-postgresql-4.6.5.jar + release/modules/ext/sleuthkit-postgresql-4.6.5.jar + ext/jempbox-1.8.13.jar release/modules/ext/jempbox-1.8.13.jar @@ -499,10 +503,6 @@ ext/isoparser-1.1.18.jar release/modules/ext/isoparser-1.1.18.jar - - ext/sleuthkit-postgresql-4.6.5.jar - release/modules/ext/sleuthkit-postgresql-4.6.5.jar - ext/vorbis-java-core-0.8.jar release/modules/ext/vorbis-java-core-0.8.jar @@ -527,10 +527,6 @@ ext/jul-to-slf4j-1.7.24.jar release/modules/ext/jul-to-slf4j-1.7.24.jar - - ext/gson-2.8.1.jar - release/modules/ext/gson-2.8.1.jar - ext/poi-3.17.jar release/modules/ext/poi-3.17.jar @@ -608,8 +604,8 @@ release/modules/ext/curator-client-2.8.0.jar - ext/jackson-core-2.9.7.jar - release/modules/ext/jackson-core-2.9.7.jar + ext/sqlite-jdbc-3.25.2.jar + release/modules/ext/sqlite-jdbc-3.25.2.jar ext/cxf-rt-frontend-jaxrs-3.0.16.jar @@ -619,10 +615,6 @@ ext/grib-4.5.5.jar release/modules/ext/grib-4.5.5.jar - - ext/jackson-core-2.9.2.jar - release/modules/ext/jackson-core-2.9.2.jar - ext/activemq-all-5.11.1.jar release/modules/ext/activemq-all-5.11.1.jar diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/datasourceSummary/DataSourceSummaryPanel.java b/Core/src/org/sleuthkit/autopsy/casemodule/datasourceSummary/DataSourceSummaryPanel.java index 83a8147255..25f97d8937 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/datasourceSummary/DataSourceSummaryPanel.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/datasourceSummary/DataSourceSummaryPanel.java @@ -83,6 +83,7 @@ final class DataSourceSummaryPanel extends javax.swing.JPanel { SleuthkitCase skCase = Case.getCurrentCaseThrows().getSleuthkitCase(); allIngestJobs.addAll(skCase.getIngestJobs()); dataSources.addAll(skCase.getDataSources()); + //if for some reason multiple OS_INFO_ARTIFACTS were created with the same parent object id this will only return one OSInfo object for them osInfoList = OSUtility.getOSInfo(skCase); } catch (TskCoreException | NoCurrentCaseException ex) { logger.log(Level.SEVERE, "Failed to load ingest jobs.", ex); @@ -118,11 +119,10 @@ final class DataSourceSummaryPanel extends javax.swing.JPanel { //assumes only one Operating System per datasource //get the datasource id from the OSInfo's first artifact if it has artifacts if (!osInfo.getArtifacts().isEmpty() && osInfo.getArtifacts().get(0).getDataSource().getId() == selectedDataSource.getId()) { - osName = osInfo.getOSName(); - //if this OSInfo object has a name use it otherwise keep checking OSInfo objects if (!osName.isEmpty()) { - break; + osName += ", "; } + osName += osInfo.getOSName(); } } catch (TskCoreException ignored) { //unable to get datasource for the OSInfo Object diff --git a/CoreLibs/ivy.xml b/CoreLibs/ivy.xml index a5f7aab768..196fcc36ee 100644 --- a/CoreLibs/ivy.xml +++ b/CoreLibs/ivy.xml @@ -9,6 +9,8 @@ + + @@ -26,7 +28,6 @@ - @@ -66,5 +67,5 @@ - + diff --git a/CoreLibs/nbproject/project.properties b/CoreLibs/nbproject/project.properties index 08ccc6fea1..fee5235915 100644 --- a/CoreLibs/nbproject/project.properties +++ b/CoreLibs/nbproject/project.properties @@ -22,7 +22,7 @@ file.reference.compiler-0.9.1.jar=release/modules/ext/compiler-0.9.1.jar file.reference.controlsfx-8.40.11.jar=release/modules/ext/controlsfx-8.40.11.jar file.reference.dom4j-1.6.1.jar=release/modules/ext/dom4j-1.6.1.jar file.reference.geronimo-jms_1.1_spec-1.0.jar=release/modules/ext/geronimo-jms_1.1_spec-1.0.jar -file.reference.gson-1.4.jar=release/modules/ext/gson-1.4.jar +file.reference.gson-2.8.1.jar=release/modules/ext/gson-2.8.1.jar file.reference.gstreamer-java-1.5.jar=release/modules/ext/gstreamer-java-1.5.jar file.reference.guava-19.0.jar=release/modules/ext/guava-19.0.jar file.reference.imageio-bmp-3.2.jar=release/modules/ext/imageio-bmp-3.2.jar diff --git a/CoreLibs/nbproject/project.xml b/CoreLibs/nbproject/project.xml index 38da548a38..bb34c3281e 100644 --- a/CoreLibs/nbproject/project.xml +++ b/CoreLibs/nbproject/project.xml @@ -64,7 +64,11 @@ com.google.common.xml com.google.gson com.google.gson.annotations + com.google.gson.internal + com.google.gson.internal.bind + com.google.gson.internal.bind.util com.google.gson.reflect + com.google.gson.stream com.sun.activation.registries com.sun.activation.viewers com.sun.jna @@ -739,8 +743,8 @@ release/modules/ext/jna-3.4.0.jar - ext/gson-1.4.jar - release/modules/ext/gson-1.4.jar + ext/gson-2.8.1.jar + release/modules/ext/gson-2.8.1.jar ext/jfxtras-common-8.0-r4.jar diff --git a/KeywordSearch/nbproject/project.properties b/KeywordSearch/nbproject/project.properties index 4af4a610bf..b47080f282 100644 --- a/KeywordSearch/nbproject/project.properties +++ b/KeywordSearch/nbproject/project.properties @@ -39,7 +39,6 @@ file.reference.findstructapi-0.0.1.jar=release/modules/ext/findstructapi-0.0.1.j file.reference.fontbox-2.0.8.jar=release/modules/ext/fontbox-2.0.8.jar file.reference.geoapi-3.0.0.jar=release/modules/ext/geoapi-3.0.0.jar file.reference.grib-4.5.5.jar=release/modules/ext/grib-4.5.5.jar -file.reference.gson-2.8.1.jar=release/modules/ext/gson-2.8.1.jar file.reference.guava-17.0.jar=release/modules/ext/guava-17.0.jar file.reference.hamcrest-core-1.3.jar=release/modules/ext/hamcrest-core-1.3.jar file.reference.httpclient-4.5.4.jar=release/modules/ext/httpclient-4.5.4.jar diff --git a/KeywordSearch/nbproject/project.xml b/KeywordSearch/nbproject/project.xml index c66ad369eb..109ee0e66c 100644 --- a/KeywordSearch/nbproject/project.xml +++ b/KeywordSearch/nbproject/project.xml @@ -205,10 +205,6 @@ ext/quartz-2.2.0.jar release/modules/ext/quartz-2.2.0.jar - - ext/sqlite-jdbc-3.25.2.jar - release/modules/ext/sqlite-jdbc-3.25.2.jar - ext/guava-17.0.jar release/modules/ext/guava-17.0.jar @@ -325,10 +321,6 @@ ext/commons-codec-1.10.jar release/modules/ext/commons-codec-1.10.jar - - ext/gson-2.8.1.jar - release/modules/ext/gson-2.8.1.jar - ext/poi-ooxml-schemas-3.17.jar release/modules/ext/poi-ooxml-schemas-3.17.jar diff --git a/RecentActivity/ivy.xml b/RecentActivity/ivy.xml index 9b857153ee..290c8371ea 100644 --- a/RecentActivity/ivy.xml +++ b/RecentActivity/ivy.xml @@ -6,7 +6,4 @@ - - - diff --git a/RecentActivity/nbproject/project.properties b/RecentActivity/nbproject/project.properties index bc09675c9d..9736070e53 100644 --- a/RecentActivity/nbproject/project.properties +++ b/RecentActivity/nbproject/project.properties @@ -1,4 +1,3 @@ -file.reference.gson-2.1.jar=release/modules/ext/gson-2.1.jar javac.source=1.8 javac.compilerargs=-Xlint -Xlint:-serial license.file=../LICENSE-2.0.txt diff --git a/RecentActivity/nbproject/project.xml b/RecentActivity/nbproject/project.xml index ef1b87d6c2..87619a8356 100644 --- a/RecentActivity/nbproject/project.xml +++ b/RecentActivity/nbproject/project.xml @@ -63,12 +63,17 @@ 10.14 + + org.sleuthkit.autopsy.corelibs + + + + 3 + 1.2 + + - - ext/gson-2.1.jar - release/modules/ext/gson-2.1.jar - diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java index 99e6447b9a..9c841442a3 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java @@ -22,6 +22,7 @@ import java.util.ArrayList; import java.util.Collection; import java.util.List; import java.util.logging.Level; +import org.apache.commons.io.FilenameUtils; import org.openide.util.NbBundle.Messages; import org.sleuthkit.autopsy.casemodule.services.FileManager; import org.sleuthkit.autopsy.coreutils.Logger; @@ -38,41 +39,105 @@ import org.sleuthkit.datamodel.TskCoreException; * */ @Messages({"DataSourceUsageAnalyzer.parentModuleName=Recent Activity"}) -public class DataSourceUsageAnalyzer extends Extract { +class DataSourceUsageAnalyzer extends Extract { private static final Logger logger = Logger.getLogger(DataSourceUsageAnalyzer.class.getName()); private Content dataSource; + @Messages({ + "# {0} - OS name", + "DataSourceUsageAnalyzer.customVolume.label=OS Drive ({0})" + }) @Override void process(Content dataSource, IngestJobContext context) { - this.dataSource = dataSource; try { - checkForWindowsVolume(); + createDataSourceUsageArtifacts(); } catch (TskCoreException ex) { - logger.log(Level.WARNING, "Failed to check if datasource contained Windows volume.", ex); + logger.log(Level.WARNING, "Failed to check if datasource contained a volume with operating system specific files", ex); } } /** - * Check if the data source contains files which would indicate a windows - * volume is present in it, and create an artifact for that volume if - * detected. + * Create TSK_DATA_SOURCE_USAGE artifacts based on OS_INFO artifacts + * existing as well as other criteria such as specific paths existing. * * @throws TskCoreException */ - private void checkForWindowsVolume() throws TskCoreException { - Collection bbattributes = new ArrayList<>(); - FileManager fileManager = currentCase.getServices().getFileManager(); - List files = fileManager.findFilesByParentPath(dataSource.getId(), "/windows/system32"); - //create an artifact if any files with the windows/system32 path were found - if (!files.isEmpty()) { - bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION, - Bundle.DataSourceUsageAnalyzer_parentModuleName(), - "Windows volume")); //NON-NLS - addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource, bbattributes); + private void createDataSourceUsageArtifacts() throws TskCoreException { + boolean windowsOsDetected = false; + List osInfoArtifacts = tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO); + for (BlackboardArtifact osInfoArt : osInfoArtifacts) { + //if it is the current data source + if (osInfoArt.getDataSource().getId() == dataSource.getId()) { + BlackboardAttribute progNameAttr = osInfoArt.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)); + if (progNameAttr != null) { + if (progNameAttr.getValueString().isEmpty()) { + //skip empty Program Name text + } else if (progNameAttr.getDisplayString().toLowerCase().contains("windows")) { //non-nls + windowsOsDetected = true; + //use the program name when it appears to be windows + createDataSourceUsageArtifact(Bundle.DataSourceUsageAnalyzer_customVolume_label(progNameAttr.getDisplayString())); + } else { + ExtractOs.OS_TYPE osType = ExtractOs.OS_TYPE.fromOsInfoLabel(progNameAttr.getValueString()); + if (osType != null) { + createDataSourceUsageArtifact(osType.getDsUsageLabel()); + } else { + //unable to determine name for DATA_SOURCE_USAGE artifact using program name + createDataSourceUsageArtifact(Bundle.DataSourceUsageAnalyzer_customVolume_label(progNameAttr.getDisplayString())); + } + } + } + } + } + if (!windowsOsDetected) { //if we didn't find a windows OS_INFO artifact check if we still think it is a windows volume + checkIfOsSpecificVolume(ExtractOs.OS_TYPE.WINDOWS); } } + /** + * If a TSK_DATA_SOURCE_USAGE artifact does not exist with the given + * description create one. + * + * @param dataSourceUsageDescription the text for the description attribute + * of the TSK_DATA_SOURCE_USAGE artifact + * + * @throws TskCoreException + */ + private void createDataSourceUsageArtifact(String dataSourceUsageDescription) throws TskCoreException { + //if the data source usage description is not empty create a data source usage artifact if an Usage artifact does not already exist with the same description + List artifacts = tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource.getId()); + for (BlackboardArtifact artifact : artifacts) { + if (artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)).getValueString().equals(dataSourceUsageDescription)) { + return; //already exists don't create a duplicate + } + } + Collection bbattributes = new ArrayList<>(); + bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION, + Bundle.DataSourceUsageAnalyzer_parentModuleName(), + dataSourceUsageDescription)); //NON-NLS + addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource, bbattributes); + } + + /** + * Check if any of the specified file paths exist for the specified OS_TYPE + * exist, if they do create a TSK_DATA_SOURCE_USAGE artifact does if one + * does not exist with the given description. + * + * @param osType - the OS_TYPE to check for + * + * @return true if any specified files exist false if none exist + */ + private void checkIfOsSpecificVolume(ExtractOs.OS_TYPE osType) throws TskCoreException { + FileManager fileManager = currentCase.getServices().getFileManager(); + for (String filePath : osType.getFilePaths()) { + for (AbstractFile file : fileManager.findFiles(dataSource, FilenameUtils.getName(filePath), FilenameUtils.getPath(filePath))) { + if ((file.getParentPath() + file.getName()).equals(filePath)) { + createDataSourceUsageArtifact(osType.getDsUsageLabel()); + return; + } + } + } + } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractOs.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractOs.java new file mode 100644 index 0000000000..04976cb95b --- /dev/null +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractOs.java @@ -0,0 +1,264 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2019 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.recentactivity; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.Collection; +import java.util.Collections; +import java.util.List; +import java.util.logging.Level; +import org.apache.commons.io.FilenameUtils; +import org.openide.util.NbBundle.Messages; +import org.sleuthkit.autopsy.casemodule.services.FileManager; +import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.ingest.IngestJobContext; +import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.BlackboardArtifact; +import org.sleuthkit.datamodel.BlackboardAttribute; +import org.sleuthkit.datamodel.Content; +import org.sleuthkit.datamodel.TskCoreException; + +/** + * Create OS INFO artifacts for the Operating Systems believed to be present on + * the data source. + */ +@Messages({"ExtractOs.parentModuleName=Recent Activity"}) +class ExtractOs extends Extract { + + private static final Logger logger = Logger.getLogger(ExtractOs.class.getName()); + + private static final String WINDOWS_VOLUME_PATH = "/windows/system32"; + private static final String OSX_VOLUME_PATH = "/System/Library/CoreServices/SystemVersion.plist"; + private static final String ANDROID_VOLUME_PATH = "/data/com.android.providers.settings/databases/settings.db"; + //linux specific files reference https://www.novell.com/coolsolutions/feature/11251.html + private static final String LINUX_RED_HAT_PATHS[] = {"/etc/redhat-release", "/etc/redhat_version"}; + private static final String LINUX_NOVELL_SUSE_PATH = "/etc/SUSE-release"; + private static final String LINUX_FEDORA_PATH = "/etc/fedora-release"; + private static final String LINUX_SLACKWARE_PATHS[] = {"/etc/slackware-release", "/etc/slackware-version"}; + private static final String LINUX_DEBIAN_PATHS[] = {"/etc/debian_release", "/etc/debian_version"}; + private static final String LINUX_MANDRAKE_PATH = "/etc/mandrake-release"; + private static final String LINUX_YELLOW_DOG_PATH = "/etc/yellowdog-release"; + private static final String LINUX_SUN_JDS_PATH = "/etc/sun-release"; + private static final String LINUX_SOLARIS_SPARC_PATH = "/etc/release"; + private static final String LINUX_GENTOO_PATH = "/etc/gentoo-release"; + private static final String LINUX_UNITED_LINUX_PATH = "/etc/UnitedLinux-release"; + private static final String LINUX_UBUNTU_PATH = "/etc/lsb-release"; + + private Content dataSource; + + @Override + void process(Content dataSource, IngestJobContext context) { + this.dataSource = dataSource; + try { + for (OS_TYPE value : OS_TYPE.values()) { + checkForOSFiles(value); + } + } catch (TskCoreException ex) { + logger.log(Level.WARNING, "Failed to check if datasource contained a volume with operating system specific files", ex); + } + } + + /** + * Check if any of the specified file paths exist if they do create an OS + * Info artifact if a program name was specified. + * + * @param osType - the enumeration of OS_TYPE which represents the operating + * system being checked for + */ + private void checkForOSFiles(OS_TYPE osType) throws TskCoreException { + if (osType.getOsInfoLabel().isEmpty()) { + //shortcut out if it was called with out a specified program name so no OS INFO artifacts are created + return; + } + AbstractFile file = getFirstFileFound(osType.getFilePaths()); + if (file != null) { + //check if OS INFO artifact already created on this file + if (tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, file.getId()).isEmpty()) { + //if the os info program name is not empty create an os info artifact on the first of the files found + Collection bbattributes = new ArrayList<>(); + bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, + Bundle.ExtractOs_parentModuleName(), + osType.getOsInfoLabel())); //NON-NLS + addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, file, bbattributes); + } + } + } + + /** + * Get the first file found which matches one of the specified paths. Return + * null if no file is found. + * + * @param pathsToSearchFor the list of strings which represent the paths to + * search + * + * @return the first AbstractFile found which matched a specified path to + * search for + */ + private AbstractFile getFirstFileFound(List pathsToSearchFor) throws TskCoreException{ + FileManager fileManager = currentCase.getServices().getFileManager(); + for (String filePath : pathsToSearchFor) { + for (AbstractFile file : fileManager.findFiles(dataSource, FilenameUtils.getName(filePath), FilenameUtils.getPath(filePath))) { + if ((file.getParentPath() + file.getName()).equals(filePath)) { + return file; + } + } + } + return null; + } + + @Messages({ + "ExtractOs.osx.label=Mac OS X", + "ExtractOs.androidOs.label=Android", + "ExtractOs.redhatLinuxOs.label=Linux (Redhat)", + "ExtractOs.novellSUSEOs.label=Linux (Novell SUSE)", + "ExtractOs.fedoraLinuxOs.label=Linux (Fedora)", + "ExtractOs.slackwareLinuxOs.label=Linux (Slackware)", + "ExtractOs.debianLinuxOs.label=Linux (Debian)", + "ExtractOs.mandrakeLinuxOs.label=Linux (Mandrake)", + "ExtractOs.yellowDogLinuxOs.label=Linux (Yellow Dog)", + "ExtractOs.sunJDSLinuxOs.label=Linux (Sun JDS)", + "ExtractOs.solarisSparcOs.label=Linux (Solaris/Sparc)", + "ExtractOs.gentooLinuxOs.label=Linux (Gentoo)", + "ExtractOs.unitedLinuxOs.label=Linux (United Linux)", + "ExtractOs.ubuntuLinuxOs.label=Linux (Ubuntu)", + "ExtractOs.windowsVolume.label=OS Drive (Windows)", + "ExtractOs.osxVolume.label=OS Drive (OS X)", + "ExtractOs.androidVolume.label=OS Drive (Android)", + "ExtractOs.redhatLinuxVolume.label=OS Drive (Linux Redhat)", + "ExtractOs.novellSUSEVolume.label=OS Drive (Linux Novell SUSE)", + "ExtractOs.fedoraLinuxVolume.label=OS Drive (Linux Fedora)", + "ExtractOs.slackwareLinuxVolume.label=OS Drive (Linux Slackware)", + "ExtractOs.debianLinuxVolume.label=OS Drive (Linux Debian)", + "ExtractOs.mandrakeLinuxVolume.label=OS Drive (Linux Mandrake)", + "ExtractOs.yellowDogLinuxVolume.label=OS Drive (Linux Yellow Dog)", + "ExtractOs.sunJDSLinuxVolume.label=OS Drive (Linux Sun JDS)", + "ExtractOs.solarisSparcVolume.label=OS Drive (Linux Solaris/Sparc)", + "ExtractOs.gentooLinuxVolume.label=OS Drive (Linux Gentoo)", + "ExtractOs.unitedLinuxVolume.label=OS Drive (Linux United Linux)", + "ExtractOs.ubuntuLinuxVolume.label=OS Drive (Linux Ubuntu)"}) + /** + * Enum used for coupling the TSK_OS_INFO artifacts created in ExtractOs and + * the TSK_DATA_SOURCE_USAGE artifacts created in DataSourceUsageAnalyzer + */ + enum OS_TYPE { + WINDOWS("", Bundle.ExtractOs_windowsVolume_label(), Arrays.asList(WINDOWS_VOLUME_PATH)), //windows doesn't get OS_INFO artifacts created for it here + MAC_OS_X(Bundle.ExtractOs_osx_label(), Bundle.ExtractOs_osxVolume_label(), Arrays.asList(OSX_VOLUME_PATH)), + ANDROID(Bundle.ExtractOs_androidOs_label(), Bundle.ExtractOs_androidVolume_label(), Arrays.asList(ANDROID_VOLUME_PATH)), + LINUX_REDHAT(Bundle.ExtractOs_redhatLinuxOs_label(), Bundle.ExtractOs_redhatLinuxVolume_label(), Arrays.asList(LINUX_RED_HAT_PATHS)), + LINUX_NOVELL_SUSE(Bundle.ExtractOs_novellSUSEOs_label(), Bundle.ExtractOs_novellSUSEVolume_label(), Arrays.asList(LINUX_NOVELL_SUSE_PATH)), + LINUX_FEDORA(Bundle.ExtractOs_fedoraLinuxOs_label(), Bundle.ExtractOs_fedoraLinuxVolume_label(), Arrays.asList(LINUX_FEDORA_PATH)), + LINUX_SLACKWARE(Bundle.ExtractOs_slackwareLinuxOs_label(), Bundle.ExtractOs_slackwareLinuxVolume_label(), Arrays.asList(LINUX_SLACKWARE_PATHS)), + LINUX_DEBIAN(Bundle.ExtractOs_debianLinuxOs_label(), Bundle.ExtractOs_debianLinuxVolume_label(), Arrays.asList(LINUX_DEBIAN_PATHS)), + LINUX_MANDRAKE(Bundle.ExtractOs_mandrakeLinuxOs_label(), Bundle.ExtractOs_mandrakeLinuxVolume_label(), Arrays.asList(LINUX_MANDRAKE_PATH)), + LINUX_YELLOW_DOG(Bundle.ExtractOs_yellowDogLinuxOs_label(), Bundle.ExtractOs_yellowDogLinuxVolume_label(), Arrays.asList(LINUX_YELLOW_DOG_PATH)), + LINUX_SUN_JDS(Bundle.ExtractOs_sunJDSLinuxOs_label(), Bundle.ExtractOs_sunJDSLinuxVolume_label(), Arrays.asList(LINUX_SUN_JDS_PATH)), + LINUX_SOLARIS_SPARC(Bundle.ExtractOs_solarisSparcOs_label(), Bundle.ExtractOs_solarisSparcVolume_label(), Arrays.asList(LINUX_SOLARIS_SPARC_PATH)), + LINUX_GENTOO(Bundle.ExtractOs_gentooLinuxOs_label(), Bundle.ExtractOs_gentooLinuxVolume_label(), Arrays.asList(LINUX_GENTOO_PATH)), + LINUX_UNITED_LINUX(Bundle.ExtractOs_unitedLinuxOs_label(), Bundle.ExtractOs_unitedLinuxVolume_label(), Arrays.asList(LINUX_UNITED_LINUX_PATH)), + LINUX_UBUNTU(Bundle.ExtractOs_ubuntuLinuxOs_label(), Bundle.ExtractOs_ubuntuLinuxVolume_label(), Arrays.asList(LINUX_UBUNTU_PATH)); + + private final String osInfoLabel; + private final String dsUsageLabel; + private final List filePaths; + + /** + * Constructs a value for an OS_TYPE enum + * + * @param osInfoText - the program name to use for TSK_OS_INFO + * artifacts + * @param dsUsageText - the description to use for + * TSK_DATA_SOURCE_USAGE artifacts + * @param filePathList - the list of file paths to create these + * artifacts for + */ + private OS_TYPE(String osInfoText, String dsUsageText, List filePathList) { + this.osInfoLabel = osInfoText; + this.dsUsageLabel = dsUsageText; + this.filePaths = filePathList; + } + + /** + * Get the string to use for the PROG_NAME attribute of TSK_OS_INFO + * artifacts. + * + * @return osInfoLabel + */ + String getOsInfoLabel() { + return osInfoLabel; + } + + /** + * Get the string to use for the DESCRIPTION attribute of + * TSK_DATA_SOURCE_USAGE artifacts. + * + * @return dsUsageLabel + */ + String getDsUsageLabel() { + return dsUsageLabel; + } + + /** + * Get the list of string representations of file paths which should + * identify that this OS_TYPE is present in the data source. + * + * @return filePaths + */ + List getFilePaths() { + return Collections.unmodifiableList(filePaths); + } + + /** + * Given the Description text of a TSK_DATA_SOURCE_USAGE artifact + * determine what type OS_TYPE this is + * + * @param dsUsageLabel description text of the TSK_DATA_SOURCE_USAGE + * artifact + * + * @return the OS_TYPE which matches the specified dsUsageLabel, null if + * no types match + */ + static public OS_TYPE fromDsUsageLabel(String dsUsageLabel) { + for (OS_TYPE value : OS_TYPE.values()) { + if (value.getDsUsageLabel().equals(dsUsageLabel)) { + return value; + } + } + return null; + } + + /** + * Given the Program Name text of a TSK_OS_INFO artifact determine what + * type OS_TYPE this is + * + * @param osInfoLabel program name text of the TSK_OS_INFO artifact + * + * @return the OS_TYPE which matches the specified osInfoLabel, null if + * no types match + */ + static public OS_TYPE fromOsInfoLabel(String osInfoLabel) { + for (OS_TYPE value : OS_TYPE.values()) { + if (value.getOsInfoLabel().equals(osInfoLabel)) { + return value; + } + } + return null; + } + } +} diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 88bcb3ae8b..1d20f27cd7 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -992,7 +992,7 @@ class ExtractRegistry extends Extract { * Create a UserInfo object * * @param name - the os user account name - * @param userIdString - the SID for the user account + * @param userSidString - the SID for the user account */ private UserInfo(String name, String userSidString) { userName = name; diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java index 7d17030809..5f1c31664a 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java @@ -1,19 +1,19 @@ - /* +/* * * Autopsy Forensic Browser - * + * * Copyright 2012-2019 Basis Technology Corp. - * + * * Copyright 2012 42six Solutions. * Contact: aebadirad 42six com * Project Contact/Architect: carrier sleuthkit org - * + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -46,7 +46,7 @@ public final class RAImageIngestModule implements DataSourceIngestModule { private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName()); private final List extractors = new ArrayList<>(); - private final List browserExtracters = new ArrayList<>(); + private final List browserExtractors = new ArrayList<>(); private IngestServices services = IngestServices.getInstance(); private IngestJobContext context; private StringBuilder subCompleted = new StringBuilder(); @@ -70,22 +70,24 @@ public final class RAImageIngestModule implements DataSourceIngestModule { Extract chrome = new Chrome(); Extract firefox = new Firefox(); Extract SEUQA = new SearchEngineURLQueryAnalyzer(); - Extract dataSourceProfiler = new DataSourceUsageAnalyzer(); + Extract osExtract = new ExtractOs(); + Extract dataSourceAnalyzer = new DataSourceUsageAnalyzer(); extractors.add(chrome); extractors.add(firefox); extractors.add(iexplore); extractors.add(recentDocuments); - extractors.add(dataSourceProfiler); extractors.add(SEUQA); // this needs to run after the web browser modules - extractors.add(registry); // this runs last because it is slowest + extractors.add(registry); // this should run after quicker modules like the browser modules and needs to run before the DataSourceUsageAnalyzer + extractors.add(osExtract); // this needs to run before the DataSourceUsageAnalyzer + extractors.add(dataSourceAnalyzer); //this needs to run after ExtractRegistry and ExtractOs - browserExtracters.add(chrome); - browserExtracters.add(firefox); - browserExtracters.add(iexplore); + browserExtractors.add(chrome); + browserExtractors.add(firefox); + browserExtractors.add(iexplore); - for (Extract extracter : extractors) { - extracter.init(); + for (Extract extractor : extractors) { + extractor.init(); } } @@ -155,7 +157,7 @@ public final class RAImageIngestModule implements DataSourceIngestModule { StringBuilder historyMsg = new StringBuilder(); historyMsg.append( NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.title", dataSource.getName())); - for (Extract module : browserExtracters) { + for (Extract module : browserExtractors) { historyMsg.append("
  • ").append(module.getName()); //NON-NLS historyMsg.append(": ").append((module.foundData()) ? NbBundle .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.found") : NbBundle diff --git a/nbproject/platform.properties b/nbproject/platform.properties index 898ac95983..b03c3b5199 100644 --- a/nbproject/platform.properties +++ b/nbproject/platform.properties @@ -11,125 +11,126 @@ autoupdate.catalog.url=https://updates.netbeans.org/netbeans/updates/${netbeans- cluster.path=\ ${nbplatform.active.dir}/harness:\ ${nbplatform.active.dir}/java:\ - ${nbplatform.active.dir}/platform + ${nbplatform.active.dir}/platform:\ + ${nbplatform.active.dir}/cluster disabled.modules=\ -org.apache.tools.ant.module,\ - org.netbeans.api.debugger.jpda,\ - org.netbeans.modules.debugger.jpda.jsui,\ - org.netbeans.api.java,\ - org.netbeans.api.maven,\ - org.netbeans.lib.nbjavac,\ - org.netbeans.libs.cglib,\ - org.netbeans.libs.javacapi,\ - org.netbeans.libs.javacimpl,\ - org.netbeans.libs.springframework,\ - org.netbeans.modules.ant.browsetask,\ - org.netbeans.modules.ant.debugger,\ - org.netbeans.modules.ant.freeform,\ - org.netbeans.modules.ant.grammar,\ - org.netbeans.modules.ant.kit,\ - org.netbeans.modules.beans,\ - org.netbeans.modules.classfile,\ - org.netbeans.modules.dbschema,\ - org.netbeans.modules.debugger.jpda,\ - org.netbeans.modules.debugger.jpda.ant,\ - org.netbeans.modules.debugger.jpda.js,\ - org.netbeans.modules.debugger.jpda.kit,\ - org.netbeans.modules.debugger.jpda.projects,\ - org.netbeans.modules.debugger.jpda.ui,\ - org.netbeans.modules.debugger.jpda.visual,\ - org.netbeans.modules.findbugs.installer,\ - org.netbeans.modules.form,\ - org.netbeans.modules.form.binding,\ - org.netbeans.modules.form.j2ee,\ - org.netbeans.modules.form.kit,\ - org.netbeans.modules.form.nb,\ - org.netbeans.modules.form.refactoring,\ - org.netbeans.modules.hibernate,\ - org.netbeans.modules.hibernate4lib,\ - org.netbeans.modules.hibernatelib,\ org.netbeans.modules.hudson.ant,\ - org.netbeans.modules.hudson.maven,\ - org.netbeans.modules.i18n,\ - org.netbeans.modules.i18n.form,\ - org.netbeans.modules.j2ee.core.utilities,\ - org.netbeans.modules.j2ee.eclipselink,\ - org.netbeans.modules.j2ee.eclipselinkmodelgen,\ - org.netbeans.modules.j2ee.jpa.refactoring,\ - org.netbeans.modules.j2ee.jpa.verification,\ - org.netbeans.modules.j2ee.metadata,\ - org.netbeans.modules.j2ee.metadata.model.support,\ - org.netbeans.modules.j2ee.persistence,\ - org.netbeans.modules.j2ee.persistence.kit,\ - org.netbeans.modules.j2ee.persistenceapi,\ - org.netbeans.modules.java.api.common,\ - org.netbeans.modules.java.debug,\ - org.netbeans.modules.java.editor,\ - org.netbeans.modules.java.editor.lib,\ - org.netbeans.modules.java.examples,\ - org.netbeans.modules.java.freeform,\ - org.netbeans.modules.java.guards,\ - org.netbeans.modules.java.helpset,\ - org.netbeans.modules.java.hints,\ - org.netbeans.modules.java.hints.declarative,\ - org.netbeans.modules.java.hints.declarative.test,\ - org.netbeans.modules.java.hints.legacy.spi,\ - org.netbeans.modules.java.hints.test,\ - org.netbeans.modules.java.hints.ui,\ - org.netbeans.modules.java.j2sedeploy,\ - org.netbeans.modules.java.j2seembedded,\ - org.netbeans.modules.java.j2seplatform,\ - org.netbeans.modules.java.j2seprofiles,\ - org.netbeans.modules.java.j2seproject,\ - org.netbeans.modules.java.kit,\ - org.netbeans.modules.java.lexer,\ - org.netbeans.modules.java.metrics,\ - org.netbeans.modules.java.navigation,\ - org.netbeans.modules.java.platform,\ - org.netbeans.modules.java.preprocessorbridge,\ - org.netbeans.modules.java.project,\ - org.netbeans.modules.java.source,\ - org.netbeans.modules.java.source.ant,\ - org.netbeans.modules.java.source.queries,\ - org.netbeans.modules.java.source.queriesimpl,\ - org.netbeans.modules.java.sourceui,\ - org.netbeans.modules.java.testrunner,\ - org.netbeans.modules.javadoc,\ - org.netbeans.modules.javaee.injection,\ - org.netbeans.modules.javawebstart,\ - org.netbeans.modules.junit,\ - org.netbeans.modules.maven,\ - org.netbeans.modules.maven.checkstyle,\ - org.netbeans.modules.maven.coverage,\ - org.netbeans.modules.maven.embedder,\ - org.netbeans.modules.maven.grammar,\ + org.netbeans.libs.cglib,\ org.netbeans.modules.maven.graph,\ - org.netbeans.modules.maven.hints,\ - org.netbeans.modules.maven.indexer,\ - org.netbeans.modules.maven.junit,\ - org.netbeans.modules.maven.kit,\ - org.netbeans.modules.maven.model,\ - org.netbeans.modules.maven.osgi,\ - org.netbeans.modules.maven.persistence,\ - org.netbeans.modules.maven.refactoring,\ - org.netbeans.modules.maven.repository,\ - org.netbeans.modules.maven.search,\ - org.netbeans.modules.maven.spring,\ + org.netbeans.modules.java.hints.declarative.test,\ + org.netbeans.libs.javacapi,\ org.netbeans.modules.nashorn.execution,\ + org.netbeans.modules.java.metrics,\ + org.netbeans.modules.debugger.jpda.js,\ + org.netbeans.api.java,\ + org.netbeans.modules.debugger.jpda.ant,\ + org.netbeans.modules.java.source.ant,\ + org.netbeans.modules.maven.refactoring,\ + org.netbeans.modules.ant.debugger,\ + org.netbeans.modules.hibernatelib,\ + org.netbeans.modules.hibernate,\ + org.netbeans.lib.nbjavac,\ + org.netbeans.modules.debugger.jpda.kit,\ + org.netbeans.modules.maven.persistence,\ + org.netbeans.modules.javaee.injection,\ + org.netbeans.modules.maven,\ org.netbeans.modules.performance,\ - org.netbeans.modules.performance.java,\ - org.netbeans.modules.projectimport.eclipse.core,\ - org.netbeans.modules.projectimport.eclipse.j2se,\ - org.netbeans.modules.refactoring.java,\ + org.netbeans.spi.java.hints,\ org.netbeans.modules.spellchecker.bindings.java,\ - org.netbeans.modules.spring.beans,\ - org.netbeans.modules.testng,\ - org.netbeans.modules.testng.ant,\ - org.netbeans.modules.testng.maven,\ - org.netbeans.modules.websvc.jaxws21,\ - org.netbeans.modules.websvc.jaxws21api,\ - org.netbeans.modules.websvc.saas.codegen.java,\ - org.netbeans.modules.whitelist,\ + org.netbeans.modules.java.j2seproject,\ + org.netbeans.modules.javawebstart,\ + org.netbeans.modules.debugger.jpda,\ + org.netbeans.modules.ant.grammar,\ + org.netbeans.modules.maven.checkstyle,\ + org.netbeans.modules.java.source.queries,\ + org.netbeans.modules.refactoring.java,\ + org.netbeans.modules.java.examples,\ + org.netbeans.modules.j2ee.jpa.verification,\ + org.netbeans.modules.j2ee.jpa.refactoring,\ + org.netbeans.modules.j2ee.metadata.model.support,\ + org.netbeans.modules.classfile,\ + org.netbeans.modules.maven.coverage,\ + org.netbeans.modules.debugger.jpda.ui,\ + org.netbeans.modules.java.guards,\ org.netbeans.modules.xml.jaxb,\ + org.netbeans.modules.java.preprocessorbridge,\ + org.netbeans.modules.debugger.jpda.jsui,\ + org.netbeans.api.debugger.jpda,\ + org.netbeans.modules.ant.freeform,\ + org.netbeans.modules.java.sourceui,\ + org.netbeans.modules.projectimport.eclipse.j2se,\ + org.netbeans.modules.form,\ + org.netbeans.modules.junit,\ + org.netbeans.modules.j2ee.persistence.kit,\ + org.netbeans.modules.j2ee.metadata,\ + org.netbeans.modules.java.j2seplatform,\ + org.netbeans.modules.javadoc,\ + org.netbeans.modules.debugger.jpda.projects,\ + org.netbeans.modules.java.source,\ + org.netbeans.modules.maven.spring,\ + org.netbeans.modules.maven.search,\ + org.netbeans.modules.java.debug,\ + org.netbeans.modules.maven.grammar,\ + org.netbeans.modules.java.kit,\ + org.netbeans.modules.testng,\ + org.netbeans.modules.spring.beans,\ + org.netbeans.modules.websvc.saas.codegen.java,\ + org.netbeans.modules.java.editor.lib,\ + org.netbeans.modules.java.testrunner,\ + org.netbeans.modules.java.source.queriesimpl,\ + org.netbeans.modules.maven.junit,\ + org.netbeans.modules.maven.hints,\ org.netbeans.modules.xml.tools.java,\ - org.netbeans.spi.java.hints + org.netbeans.modules.j2ee.persistenceapi,\ + org.netbeans.modules.java.j2seprofiles,\ + org.netbeans.modules.form.kit,\ + org.netbeans.modules.projectimport.eclipse.core,\ + org.netbeans.modules.form.refactoring,\ + org.apache.tools.ant.module,\ + org.netbeans.modules.testng.maven,\ + org.netbeans.modules.java.hints.test,\ + org.netbeans.modules.i18n.form,\ + org.netbeans.modules.maven.kit,\ + org.netbeans.modules.beans,\ + org.netbeans.modules.java.platform,\ + org.netbeans.modules.java.hints.legacy.spi,\ + org.netbeans.modules.java.lexer,\ + org.netbeans.modules.java.hints,\ + org.netbeans.modules.java.j2seembedded,\ + org.netbeans.modules.java.hints.ui,\ + org.netbeans.modules.java.editor,\ + org.netbeans.modules.websvc.jaxws21,\ + org.netbeans.modules.hudson.maven,\ + org.netbeans.modules.java.j2sedeploy,\ + org.netbeans.libs.javacimpl,\ + org.netbeans.modules.java.helpset,\ + org.netbeans.modules.i18n,\ + org.netbeans.modules.dbschema,\ + org.netbeans.api.maven,\ + org.netbeans.modules.findbugs.installer,\ + org.netbeans.modules.j2ee.eclipselinkmodelgen,\ + org.netbeans.modules.form.nb,\ + org.netbeans.modules.debugger.jpda.visual,\ + org.netbeans.modules.form.j2ee,\ + org.netbeans.modules.java.project,\ + org.netbeans.modules.java.api.common,\ + org.netbeans.modules.j2ee.persistence,\ + org.netbeans.modules.java.freeform,\ + org.netbeans.modules.whitelist,\ + org.netbeans.libs.springframework,\ + org.netbeans.modules.maven.embedder,\ + org.netbeans.modules.ant.kit,\ + org.netbeans.modules.java.hints.declarative,\ + org.netbeans.modules.testng.ant,\ + org.netbeans.modules.form.binding,\ + org.netbeans.modules.ant.browsetask,\ + org.netbeans.modules.j2ee.core.utilities,\ + org.netbeans.modules.performance.java,\ + org.netbeans.modules.websvc.jaxws21api,\ + org.netbeans.modules.maven.repository,\ + org.netbeans.modules.j2ee.eclipselink,\ + org.netbeans.modules.maven.model,\ + org.netbeans.modules.hibernate4lib,\ + org.netbeans.modules.java.navigation,\ + org.netbeans.modules.maven.indexer,\ + org.netbeans.modules.maven.osgi