Merge pull request #4490 from wschaeferB/4632-4630-4629-DetectOsSpecificFiles

4632 4630 4629 detect os specific files
This commit is contained in:
Richard Cordovano 2019-02-10 07:09:28 -05:00 committed by GitHub
commit d0d5370984
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
16 changed files with 513 additions and 193 deletions

View File

@ -15,7 +15,6 @@ file.reference.commons-pool2-2.4.2.jar=release/modules/ext/commons-pool2-2.4.2.j
file.reference.dd-plist-1.20.jar=release/modules/ext/dd-plist-1.20.jar
file.reference.geoapi-3.0.0.jar=release/modules/ext/geoapi-3.0.0.jar
file.reference.grib-4.5.5.jar=release/modules/ext/grib-4.5.5.jar
file.reference.gson-2.8.1.jar=release/modules/ext/gson-2.8.1.jar
file.reference.httpservices-4.5.5.jar=release/modules/ext/httpservices-4.5.5.jar
file.reference.isoparser-1.1.18.jar=release/modules/ext/isoparser-1.1.18.jar
file.reference.jackcess-2.2.0.jar=release/modules/ext/jackcess-2.2.0.jar
@ -52,7 +51,7 @@ file.reference.sis-metadata-0.6.jar=release/modules/ext/sis-metadata-0.6.jar
file.reference.sis-netcdf-0.6.jar=release/modules/ext/sis-netcdf-0.6.jar
file.reference.sis-utility-0.6.jar=release/modules/ext/sis-utility-0.6.jar
file.reference.slf4j-api-1.7.24.jar=release/modules/ext/slf4j-api-1.7.24.jar
file.reference.sqlite-jdbc-3.8.11.jar=release/modules/ext/sqlite-jdbc-3.8.11.jar
file.reference.sqlite-jdbc-3.25.2.jar=release/modules/ext/sqlite-jdbc-3.25.2.jar
file.reference.StixLib.jar=release/modules/ext/StixLib.jar
file.reference.jempbox-1.8.13.jar=release/modules/ext/jempbox-1.8.13.jar
file.reference.javax.ws.rs-api-2.0.1.jar=release/modules/ext/javax.ws.rs-api-2.0.1.jar

View File

@ -415,6 +415,10 @@
<runtime-relative-path>ext/StixLib.jar</runtime-relative-path>
<binary-origin>release/modules/ext/StixLib.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/jackson-core-2.9.7.jar</runtime-relative-path>
<binary-origin>release/modules/ext/jackson-core-2.9.7.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/pdfbox-tools-2.0.8.jar</runtime-relative-path>
<binary-origin>release/modules/ext/pdfbox-tools-2.0.8.jar</binary-origin>
@ -431,10 +435,6 @@
<runtime-relative-path>ext/tika-parsers-1.17.jar</runtime-relative-path>
<binary-origin>release/modules/ext/tika-parsers-1.17.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/sqlite-jdbc-3.25.2.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sqlite-jdbc-3.25.2.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/json-simple-1.1.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/json-simple-1.1.1.jar</binary-origin>
@ -447,6 +447,10 @@
<runtime-relative-path>ext/jhighlight-1.0.2.jar</runtime-relative-path>
<binary-origin>release/modules/ext/jhighlight-1.0.2.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/sleuthkit-postgresql-4.6.5.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sleuthkit-postgresql-4.6.5.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/jempbox-1.8.13.jar</runtime-relative-path>
<binary-origin>release/modules/ext/jempbox-1.8.13.jar</binary-origin>
@ -499,10 +503,6 @@
<runtime-relative-path>ext/isoparser-1.1.18.jar</runtime-relative-path>
<binary-origin>release/modules/ext/isoparser-1.1.18.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/sleuthkit-postgresql-4.6.5.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sleuthkit-postgresql-4.6.5.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/vorbis-java-core-0.8.jar</runtime-relative-path>
<binary-origin>release/modules/ext/vorbis-java-core-0.8.jar</binary-origin>
@ -527,10 +527,6 @@
<runtime-relative-path>ext/jul-to-slf4j-1.7.24.jar</runtime-relative-path>
<binary-origin>release/modules/ext/jul-to-slf4j-1.7.24.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/gson-2.8.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/gson-2.8.1.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/poi-3.17.jar</runtime-relative-path>
<binary-origin>release/modules/ext/poi-3.17.jar</binary-origin>
@ -608,8 +604,8 @@
<binary-origin>release/modules/ext/curator-client-2.8.0.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/jackson-core-2.9.7.jar</runtime-relative-path>
<binary-origin>release/modules/ext/jackson-core-2.9.7.jar</binary-origin>
<runtime-relative-path>ext/sqlite-jdbc-3.25.2.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sqlite-jdbc-3.25.2.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/cxf-rt-frontend-jaxrs-3.0.16.jar</runtime-relative-path>
@ -619,10 +615,6 @@
<runtime-relative-path>ext/grib-4.5.5.jar</runtime-relative-path>
<binary-origin>release/modules/ext/grib-4.5.5.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/jackson-core-2.9.2.jar</runtime-relative-path>
<binary-origin>release/modules/ext/jackson-core-2.9.2.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/activemq-all-5.11.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/activemq-all-5.11.1.jar</binary-origin>

View File

@ -83,6 +83,7 @@ final class DataSourceSummaryPanel extends javax.swing.JPanel {
SleuthkitCase skCase = Case.getCurrentCaseThrows().getSleuthkitCase();
allIngestJobs.addAll(skCase.getIngestJobs());
dataSources.addAll(skCase.getDataSources());
//if for some reason multiple OS_INFO_ARTIFACTS were created with the same parent object id this will only return one OSInfo object for them
osInfoList = OSUtility.getOSInfo(skCase);
} catch (TskCoreException | NoCurrentCaseException ex) {
logger.log(Level.SEVERE, "Failed to load ingest jobs.", ex);
@ -118,11 +119,10 @@ final class DataSourceSummaryPanel extends javax.swing.JPanel {
//assumes only one Operating System per datasource
//get the datasource id from the OSInfo's first artifact if it has artifacts
if (!osInfo.getArtifacts().isEmpty() && osInfo.getArtifacts().get(0).getDataSource().getId() == selectedDataSource.getId()) {
osName = osInfo.getOSName();
//if this OSInfo object has a name use it otherwise keep checking OSInfo objects
if (!osName.isEmpty()) {
break;
osName += ", ";
}
osName += osInfo.getOSName();
}
} catch (TskCoreException ignored) {
//unable to get datasource for the OSInfo Object

View File

@ -9,6 +9,8 @@
<!-- for ingest -->
<dependency conf="autopsy_core->*" org="org.reflections" name="reflections" rev="0.9.8"/>
<dependency org="com.google.code.gson" name="gson" rev="2.8.1"/>
<!-- for viewers -->
<dependency conf="autopsy_core->*" org="com.googlecode.gstreamer-java" name="gstreamer-java" rev="1.5"/>
@ -26,7 +28,6 @@
<dependency conf="autopsy_core->*" org="commons-logging" name="commons-logging" rev="1.1.2"/>
<dependency conf="autopsy_core->*" org="commons-io" name="commons-io" rev="2.5"/>
<dependency conf="autopsy_core->*" org="log4j" name="log4j" rev="1.2.17"/>
<!-- <dependency conf="autopsy_core->*" org="org.jdom" name="jdom" rev="1.1.3"/> -->
<dependency conf="autopsy_core->*" org="org.apache.poi" name="poi-excelant" rev="3.17"/>
<dependency conf="autopsy_core->*" org="org.apache.poi" name="poi-scratchpad" rev="3.17"/>
@ -66,5 +67,5 @@
<dependency conf="autopsy_core->default" org="com.twelvemonkeys.imageio" name="imageio-thumbsdb" rev="3.2" />
<dependency conf="autopsy_core->default" org="com.twelvemonkeys.imageio" name="imageio-core" rev="3.2" />
<dependency conf="autopsy_core->default" org="com.twelvemonkeys.imageio" name="imageio-metadata" rev="3.2" />
</dependencies>
</dependencies>
</ivy-module>

View File

@ -22,7 +22,7 @@ file.reference.compiler-0.9.1.jar=release/modules/ext/compiler-0.9.1.jar
file.reference.controlsfx-8.40.11.jar=release/modules/ext/controlsfx-8.40.11.jar
file.reference.dom4j-1.6.1.jar=release/modules/ext/dom4j-1.6.1.jar
file.reference.geronimo-jms_1.1_spec-1.0.jar=release/modules/ext/geronimo-jms_1.1_spec-1.0.jar
file.reference.gson-1.4.jar=release/modules/ext/gson-1.4.jar
file.reference.gson-2.8.1.jar=release/modules/ext/gson-2.8.1.jar
file.reference.gstreamer-java-1.5.jar=release/modules/ext/gstreamer-java-1.5.jar
file.reference.guava-19.0.jar=release/modules/ext/guava-19.0.jar
file.reference.imageio-bmp-3.2.jar=release/modules/ext/imageio-bmp-3.2.jar

View File

@ -64,7 +64,11 @@
<package>com.google.common.xml</package>
<package>com.google.gson</package>
<package>com.google.gson.annotations</package>
<package>com.google.gson.internal</package>
<package>com.google.gson.internal.bind</package>
<package>com.google.gson.internal.bind.util</package>
<package>com.google.gson.reflect</package>
<package>com.google.gson.stream</package>
<package>com.sun.activation.registries</package>
<package>com.sun.activation.viewers</package>
<package>com.sun.jna</package>
@ -739,8 +743,8 @@
<binary-origin>release/modules/ext/jna-3.4.0.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/gson-1.4.jar</runtime-relative-path>
<binary-origin>release/modules/ext/gson-1.4.jar</binary-origin>
<runtime-relative-path>ext/gson-2.8.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/gson-2.8.1.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/jfxtras-common-8.0-r4.jar</runtime-relative-path>

View File

@ -39,7 +39,6 @@ file.reference.findstructapi-0.0.1.jar=release/modules/ext/findstructapi-0.0.1.j
file.reference.fontbox-2.0.8.jar=release/modules/ext/fontbox-2.0.8.jar
file.reference.geoapi-3.0.0.jar=release/modules/ext/geoapi-3.0.0.jar
file.reference.grib-4.5.5.jar=release/modules/ext/grib-4.5.5.jar
file.reference.gson-2.8.1.jar=release/modules/ext/gson-2.8.1.jar
file.reference.guava-17.0.jar=release/modules/ext/guava-17.0.jar
file.reference.hamcrest-core-1.3.jar=release/modules/ext/hamcrest-core-1.3.jar
file.reference.httpclient-4.5.4.jar=release/modules/ext/httpclient-4.5.4.jar

View File

@ -205,10 +205,6 @@
<runtime-relative-path>ext/quartz-2.2.0.jar</runtime-relative-path>
<binary-origin>release/modules/ext/quartz-2.2.0.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/sqlite-jdbc-3.25.2.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sqlite-jdbc-3.25.2.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/guava-17.0.jar</runtime-relative-path>
<binary-origin>release/modules/ext/guava-17.0.jar</binary-origin>
@ -325,10 +321,6 @@
<runtime-relative-path>ext/commons-codec-1.10.jar</runtime-relative-path>
<binary-origin>release/modules/ext/commons-codec-1.10.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/gson-2.8.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/gson-2.8.1.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/poi-ooxml-schemas-3.17.jar</runtime-relative-path>
<binary-origin>release/modules/ext/poi-ooxml-schemas-3.17.jar</binary-origin>

View File

@ -6,7 +6,4 @@
<conf name="recent-activity"/>
</configurations>
<dependencies>
<dependency conf="recent-activity->default" org="com.google.code.gson" name="gson" rev="2.1"/>
</dependencies>
</ivy-module>

View File

@ -1,4 +1,3 @@
file.reference.gson-2.1.jar=release/modules/ext/gson-2.1.jar
javac.source=1.8
javac.compilerargs=-Xlint -Xlint:-serial
license.file=../LICENSE-2.0.txt

View File

@ -63,12 +63,17 @@
<specification-version>10.14</specification-version>
</run-dependency>
</dependency>
<dependency>
<code-name-base>org.sleuthkit.autopsy.corelibs</code-name-base>
<build-prerequisite/>
<compile-dependency/>
<run-dependency>
<release-version>3</release-version>
<specification-version>1.2</specification-version>
</run-dependency>
</dependency>
</module-dependencies>
<public-packages/>
<class-path-extension>
<runtime-relative-path>ext/gson-2.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/gson-2.1.jar</binary-origin>
</class-path-extension>
</data>
</configuration>
</project>

View File

@ -22,6 +22,7 @@ import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.logging.Level;
import org.apache.commons.io.FilenameUtils;
import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.casemodule.services.FileManager;
import org.sleuthkit.autopsy.coreutils.Logger;
@ -38,41 +39,105 @@ import org.sleuthkit.datamodel.TskCoreException;
*
*/
@Messages({"DataSourceUsageAnalyzer.parentModuleName=Recent Activity"})
public class DataSourceUsageAnalyzer extends Extract {
class DataSourceUsageAnalyzer extends Extract {
private static final Logger logger = Logger.getLogger(DataSourceUsageAnalyzer.class.getName());
private Content dataSource;
@Messages({
"# {0} - OS name",
"DataSourceUsageAnalyzer.customVolume.label=OS Drive ({0})"
})
@Override
void process(Content dataSource, IngestJobContext context) {
this.dataSource = dataSource;
try {
checkForWindowsVolume();
createDataSourceUsageArtifacts();
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Failed to check if datasource contained Windows volume.", ex);
logger.log(Level.WARNING, "Failed to check if datasource contained a volume with operating system specific files", ex);
}
}
/**
* Check if the data source contains files which would indicate a windows
* volume is present in it, and create an artifact for that volume if
* detected.
* Create TSK_DATA_SOURCE_USAGE artifacts based on OS_INFO artifacts
* existing as well as other criteria such as specific paths existing.
*
* @throws TskCoreException
*/
private void checkForWindowsVolume() throws TskCoreException {
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> files = fileManager.findFilesByParentPath(dataSource.getId(), "/windows/system32");
//create an artifact if any files with the windows/system32 path were found
if (!files.isEmpty()) {
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION,
Bundle.DataSourceUsageAnalyzer_parentModuleName(),
"Windows volume")); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource, bbattributes);
private void createDataSourceUsageArtifacts() throws TskCoreException {
boolean windowsOsDetected = false;
List<BlackboardArtifact> osInfoArtifacts = tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO);
for (BlackboardArtifact osInfoArt : osInfoArtifacts) {
//if it is the current data source
if (osInfoArt.getDataSource().getId() == dataSource.getId()) {
BlackboardAttribute progNameAttr = osInfoArt.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME));
if (progNameAttr != null) {
if (progNameAttr.getValueString().isEmpty()) {
//skip empty Program Name text
} else if (progNameAttr.getDisplayString().toLowerCase().contains("windows")) { //non-nls
windowsOsDetected = true;
//use the program name when it appears to be windows
createDataSourceUsageArtifact(Bundle.DataSourceUsageAnalyzer_customVolume_label(progNameAttr.getDisplayString()));
} else {
ExtractOs.OS_TYPE osType = ExtractOs.OS_TYPE.fromOsInfoLabel(progNameAttr.getValueString());
if (osType != null) {
createDataSourceUsageArtifact(osType.getDsUsageLabel());
} else {
//unable to determine name for DATA_SOURCE_USAGE artifact using program name
createDataSourceUsageArtifact(Bundle.DataSourceUsageAnalyzer_customVolume_label(progNameAttr.getDisplayString()));
}
}
}
}
}
if (!windowsOsDetected) { //if we didn't find a windows OS_INFO artifact check if we still think it is a windows volume
checkIfOsSpecificVolume(ExtractOs.OS_TYPE.WINDOWS);
}
}
/**
* If a TSK_DATA_SOURCE_USAGE artifact does not exist with the given
* description create one.
*
* @param dataSourceUsageDescription the text for the description attribute
* of the TSK_DATA_SOURCE_USAGE artifact
*
* @throws TskCoreException
*/
private void createDataSourceUsageArtifact(String dataSourceUsageDescription) throws TskCoreException {
//if the data source usage description is not empty create a data source usage artifact if an Usage artifact does not already exist with the same description
List<BlackboardArtifact> artifacts = tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource.getId());
for (BlackboardArtifact artifact : artifacts) {
if (artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)).getValueString().equals(dataSourceUsageDescription)) {
return; //already exists don't create a duplicate
}
}
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION,
Bundle.DataSourceUsageAnalyzer_parentModuleName(),
dataSourceUsageDescription)); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource, bbattributes);
}
/**
* Check if any of the specified file paths exist for the specified OS_TYPE
* exist, if they do create a TSK_DATA_SOURCE_USAGE artifact does if one
* does not exist with the given description.
*
* @param osType - the OS_TYPE to check for
*
* @return true if any specified files exist false if none exist
*/
private void checkIfOsSpecificVolume(ExtractOs.OS_TYPE osType) throws TskCoreException {
FileManager fileManager = currentCase.getServices().getFileManager();
for (String filePath : osType.getFilePaths()) {
for (AbstractFile file : fileManager.findFiles(dataSource, FilenameUtils.getName(filePath), FilenameUtils.getPath(filePath))) {
if ((file.getParentPath() + file.getName()).equals(filePath)) {
createDataSourceUsageArtifact(osType.getDsUsageLabel());
return;
}
}
}
}
}

View File

@ -0,0 +1,264 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2019 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.recentactivity;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.logging.Level;
import org.apache.commons.io.FilenameUtils;
import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.casemodule.services.FileManager;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.TskCoreException;
/**
* Create OS INFO artifacts for the Operating Systems believed to be present on
* the data source.
*/
@Messages({"ExtractOs.parentModuleName=Recent Activity"})
class ExtractOs extends Extract {
private static final Logger logger = Logger.getLogger(ExtractOs.class.getName());
private static final String WINDOWS_VOLUME_PATH = "/windows/system32";
private static final String OSX_VOLUME_PATH = "/System/Library/CoreServices/SystemVersion.plist";
private static final String ANDROID_VOLUME_PATH = "/data/com.android.providers.settings/databases/settings.db";
//linux specific files reference https://www.novell.com/coolsolutions/feature/11251.html
private static final String LINUX_RED_HAT_PATHS[] = {"/etc/redhat-release", "/etc/redhat_version"};
private static final String LINUX_NOVELL_SUSE_PATH = "/etc/SUSE-release";
private static final String LINUX_FEDORA_PATH = "/etc/fedora-release";
private static final String LINUX_SLACKWARE_PATHS[] = {"/etc/slackware-release", "/etc/slackware-version"};
private static final String LINUX_DEBIAN_PATHS[] = {"/etc/debian_release", "/etc/debian_version"};
private static final String LINUX_MANDRAKE_PATH = "/etc/mandrake-release";
private static final String LINUX_YELLOW_DOG_PATH = "/etc/yellowdog-release";
private static final String LINUX_SUN_JDS_PATH = "/etc/sun-release";
private static final String LINUX_SOLARIS_SPARC_PATH = "/etc/release";
private static final String LINUX_GENTOO_PATH = "/etc/gentoo-release";
private static final String LINUX_UNITED_LINUX_PATH = "/etc/UnitedLinux-release";
private static final String LINUX_UBUNTU_PATH = "/etc/lsb-release";
private Content dataSource;
@Override
void process(Content dataSource, IngestJobContext context) {
this.dataSource = dataSource;
try {
for (OS_TYPE value : OS_TYPE.values()) {
checkForOSFiles(value);
}
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Failed to check if datasource contained a volume with operating system specific files", ex);
}
}
/**
* Check if any of the specified file paths exist if they do create an OS
* Info artifact if a program name was specified.
*
* @param osType - the enumeration of OS_TYPE which represents the operating
* system being checked for
*/
private void checkForOSFiles(OS_TYPE osType) throws TskCoreException {
if (osType.getOsInfoLabel().isEmpty()) {
//shortcut out if it was called with out a specified program name so no OS INFO artifacts are created
return;
}
AbstractFile file = getFirstFileFound(osType.getFilePaths());
if (file != null) {
//check if OS INFO artifact already created on this file
if (tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, file.getId()).isEmpty()) {
//if the os info program name is not empty create an os info artifact on the first of the files found
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
Bundle.ExtractOs_parentModuleName(),
osType.getOsInfoLabel())); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, file, bbattributes);
}
}
}
/**
* Get the first file found which matches one of the specified paths. Return
* null if no file is found.
*
* @param pathsToSearchFor the list of strings which represent the paths to
* search
*
* @return the first AbstractFile found which matched a specified path to
* search for
*/
private AbstractFile getFirstFileFound(List<String> pathsToSearchFor) throws TskCoreException{
FileManager fileManager = currentCase.getServices().getFileManager();
for (String filePath : pathsToSearchFor) {
for (AbstractFile file : fileManager.findFiles(dataSource, FilenameUtils.getName(filePath), FilenameUtils.getPath(filePath))) {
if ((file.getParentPath() + file.getName()).equals(filePath)) {
return file;
}
}
}
return null;
}
@Messages({
"ExtractOs.osx.label=Mac OS X",
"ExtractOs.androidOs.label=Android",
"ExtractOs.redhatLinuxOs.label=Linux (Redhat)",
"ExtractOs.novellSUSEOs.label=Linux (Novell SUSE)",
"ExtractOs.fedoraLinuxOs.label=Linux (Fedora)",
"ExtractOs.slackwareLinuxOs.label=Linux (Slackware)",
"ExtractOs.debianLinuxOs.label=Linux (Debian)",
"ExtractOs.mandrakeLinuxOs.label=Linux (Mandrake)",
"ExtractOs.yellowDogLinuxOs.label=Linux (Yellow Dog)",
"ExtractOs.sunJDSLinuxOs.label=Linux (Sun JDS)",
"ExtractOs.solarisSparcOs.label=Linux (Solaris/Sparc)",
"ExtractOs.gentooLinuxOs.label=Linux (Gentoo)",
"ExtractOs.unitedLinuxOs.label=Linux (United Linux)",
"ExtractOs.ubuntuLinuxOs.label=Linux (Ubuntu)",
"ExtractOs.windowsVolume.label=OS Drive (Windows)",
"ExtractOs.osxVolume.label=OS Drive (OS X)",
"ExtractOs.androidVolume.label=OS Drive (Android)",
"ExtractOs.redhatLinuxVolume.label=OS Drive (Linux Redhat)",
"ExtractOs.novellSUSEVolume.label=OS Drive (Linux Novell SUSE)",
"ExtractOs.fedoraLinuxVolume.label=OS Drive (Linux Fedora)",
"ExtractOs.slackwareLinuxVolume.label=OS Drive (Linux Slackware)",
"ExtractOs.debianLinuxVolume.label=OS Drive (Linux Debian)",
"ExtractOs.mandrakeLinuxVolume.label=OS Drive (Linux Mandrake)",
"ExtractOs.yellowDogLinuxVolume.label=OS Drive (Linux Yellow Dog)",
"ExtractOs.sunJDSLinuxVolume.label=OS Drive (Linux Sun JDS)",
"ExtractOs.solarisSparcVolume.label=OS Drive (Linux Solaris/Sparc)",
"ExtractOs.gentooLinuxVolume.label=OS Drive (Linux Gentoo)",
"ExtractOs.unitedLinuxVolume.label=OS Drive (Linux United Linux)",
"ExtractOs.ubuntuLinuxVolume.label=OS Drive (Linux Ubuntu)"})
/**
* Enum used for coupling the TSK_OS_INFO artifacts created in ExtractOs and
* the TSK_DATA_SOURCE_USAGE artifacts created in DataSourceUsageAnalyzer
*/
enum OS_TYPE {
WINDOWS("", Bundle.ExtractOs_windowsVolume_label(), Arrays.asList(WINDOWS_VOLUME_PATH)), //windows doesn't get OS_INFO artifacts created for it here
MAC_OS_X(Bundle.ExtractOs_osx_label(), Bundle.ExtractOs_osxVolume_label(), Arrays.asList(OSX_VOLUME_PATH)),
ANDROID(Bundle.ExtractOs_androidOs_label(), Bundle.ExtractOs_androidVolume_label(), Arrays.asList(ANDROID_VOLUME_PATH)),
LINUX_REDHAT(Bundle.ExtractOs_redhatLinuxOs_label(), Bundle.ExtractOs_redhatLinuxVolume_label(), Arrays.asList(LINUX_RED_HAT_PATHS)),
LINUX_NOVELL_SUSE(Bundle.ExtractOs_novellSUSEOs_label(), Bundle.ExtractOs_novellSUSEVolume_label(), Arrays.asList(LINUX_NOVELL_SUSE_PATH)),
LINUX_FEDORA(Bundle.ExtractOs_fedoraLinuxOs_label(), Bundle.ExtractOs_fedoraLinuxVolume_label(), Arrays.asList(LINUX_FEDORA_PATH)),
LINUX_SLACKWARE(Bundle.ExtractOs_slackwareLinuxOs_label(), Bundle.ExtractOs_slackwareLinuxVolume_label(), Arrays.asList(LINUX_SLACKWARE_PATHS)),
LINUX_DEBIAN(Bundle.ExtractOs_debianLinuxOs_label(), Bundle.ExtractOs_debianLinuxVolume_label(), Arrays.asList(LINUX_DEBIAN_PATHS)),
LINUX_MANDRAKE(Bundle.ExtractOs_mandrakeLinuxOs_label(), Bundle.ExtractOs_mandrakeLinuxVolume_label(), Arrays.asList(LINUX_MANDRAKE_PATH)),
LINUX_YELLOW_DOG(Bundle.ExtractOs_yellowDogLinuxOs_label(), Bundle.ExtractOs_yellowDogLinuxVolume_label(), Arrays.asList(LINUX_YELLOW_DOG_PATH)),
LINUX_SUN_JDS(Bundle.ExtractOs_sunJDSLinuxOs_label(), Bundle.ExtractOs_sunJDSLinuxVolume_label(), Arrays.asList(LINUX_SUN_JDS_PATH)),
LINUX_SOLARIS_SPARC(Bundle.ExtractOs_solarisSparcOs_label(), Bundle.ExtractOs_solarisSparcVolume_label(), Arrays.asList(LINUX_SOLARIS_SPARC_PATH)),
LINUX_GENTOO(Bundle.ExtractOs_gentooLinuxOs_label(), Bundle.ExtractOs_gentooLinuxVolume_label(), Arrays.asList(LINUX_GENTOO_PATH)),
LINUX_UNITED_LINUX(Bundle.ExtractOs_unitedLinuxOs_label(), Bundle.ExtractOs_unitedLinuxVolume_label(), Arrays.asList(LINUX_UNITED_LINUX_PATH)),
LINUX_UBUNTU(Bundle.ExtractOs_ubuntuLinuxOs_label(), Bundle.ExtractOs_ubuntuLinuxVolume_label(), Arrays.asList(LINUX_UBUNTU_PATH));
private final String osInfoLabel;
private final String dsUsageLabel;
private final List<String> filePaths;
/**
* Constructs a value for an OS_TYPE enum
*
* @param osInfoText - the program name to use for TSK_OS_INFO
* artifacts
* @param dsUsageText - the description to use for
* TSK_DATA_SOURCE_USAGE artifacts
* @param filePathList - the list of file paths to create these
* artifacts for
*/
private OS_TYPE(String osInfoText, String dsUsageText, List<String> filePathList) {
this.osInfoLabel = osInfoText;
this.dsUsageLabel = dsUsageText;
this.filePaths = filePathList;
}
/**
* Get the string to use for the PROG_NAME attribute of TSK_OS_INFO
* artifacts.
*
* @return osInfoLabel
*/
String getOsInfoLabel() {
return osInfoLabel;
}
/**
* Get the string to use for the DESCRIPTION attribute of
* TSK_DATA_SOURCE_USAGE artifacts.
*
* @return dsUsageLabel
*/
String getDsUsageLabel() {
return dsUsageLabel;
}
/**
* Get the list of string representations of file paths which should
* identify that this OS_TYPE is present in the data source.
*
* @return filePaths
*/
List<String> getFilePaths() {
return Collections.unmodifiableList(filePaths);
}
/**
* Given the Description text of a TSK_DATA_SOURCE_USAGE artifact
* determine what type OS_TYPE this is
*
* @param dsUsageLabel description text of the TSK_DATA_SOURCE_USAGE
* artifact
*
* @return the OS_TYPE which matches the specified dsUsageLabel, null if
* no types match
*/
static public OS_TYPE fromDsUsageLabel(String dsUsageLabel) {
for (OS_TYPE value : OS_TYPE.values()) {
if (value.getDsUsageLabel().equals(dsUsageLabel)) {
return value;
}
}
return null;
}
/**
* Given the Program Name text of a TSK_OS_INFO artifact determine what
* type OS_TYPE this is
*
* @param osInfoLabel program name text of the TSK_OS_INFO artifact
*
* @return the OS_TYPE which matches the specified osInfoLabel, null if
* no types match
*/
static public OS_TYPE fromOsInfoLabel(String osInfoLabel) {
for (OS_TYPE value : OS_TYPE.values()) {
if (value.getOsInfoLabel().equals(osInfoLabel)) {
return value;
}
}
return null;
}
}
}

View File

@ -992,7 +992,7 @@ class ExtractRegistry extends Extract {
* Create a UserInfo object
*
* @param name - the os user account name
* @param userIdString - the SID for the user account
* @param userSidString - the SID for the user account
*/
private UserInfo(String name, String userSidString) {
userName = name;

View File

@ -1,4 +1,4 @@
/*
/*
*
* Autopsy Forensic Browser
*
@ -46,7 +46,7 @@ public final class RAImageIngestModule implements DataSourceIngestModule {
private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName());
private final List<Extract> extractors = new ArrayList<>();
private final List<Extract> browserExtracters = new ArrayList<>();
private final List<Extract> browserExtractors = new ArrayList<>();
private IngestServices services = IngestServices.getInstance();
private IngestJobContext context;
private StringBuilder subCompleted = new StringBuilder();
@ -70,22 +70,24 @@ public final class RAImageIngestModule implements DataSourceIngestModule {
Extract chrome = new Chrome();
Extract firefox = new Firefox();
Extract SEUQA = new SearchEngineURLQueryAnalyzer();
Extract dataSourceProfiler = new DataSourceUsageAnalyzer();
Extract osExtract = new ExtractOs();
Extract dataSourceAnalyzer = new DataSourceUsageAnalyzer();
extractors.add(chrome);
extractors.add(firefox);
extractors.add(iexplore);
extractors.add(recentDocuments);
extractors.add(dataSourceProfiler);
extractors.add(SEUQA); // this needs to run after the web browser modules
extractors.add(registry); // this runs last because it is slowest
extractors.add(registry); // this should run after quicker modules like the browser modules and needs to run before the DataSourceUsageAnalyzer
extractors.add(osExtract); // this needs to run before the DataSourceUsageAnalyzer
extractors.add(dataSourceAnalyzer); //this needs to run after ExtractRegistry and ExtractOs
browserExtracters.add(chrome);
browserExtracters.add(firefox);
browserExtracters.add(iexplore);
browserExtractors.add(chrome);
browserExtractors.add(firefox);
browserExtractors.add(iexplore);
for (Extract extracter : extractors) {
extracter.init();
for (Extract extractor : extractors) {
extractor.init();
}
}
@ -155,7 +157,7 @@ public final class RAImageIngestModule implements DataSourceIngestModule {
StringBuilder historyMsg = new StringBuilder();
historyMsg.append(
NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.title", dataSource.getName()));
for (Extract module : browserExtracters) {
for (Extract module : browserExtractors) {
historyMsg.append("<li>").append(module.getName()); //NON-NLS
historyMsg.append(": ").append((module.foundData()) ? NbBundle
.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.found") : NbBundle

View File

@ -11,125 +11,126 @@ autoupdate.catalog.url=https://updates.netbeans.org/netbeans/updates/${netbeans-
cluster.path=\
${nbplatform.active.dir}/harness:\
${nbplatform.active.dir}/java:\
${nbplatform.active.dir}/platform
${nbplatform.active.dir}/platform:\
${nbplatform.active.dir}/cluster
disabled.modules=\
org.apache.tools.ant.module,\
org.netbeans.api.debugger.jpda,\
org.netbeans.modules.debugger.jpda.jsui,\
org.netbeans.api.java,\
org.netbeans.api.maven,\
org.netbeans.lib.nbjavac,\
org.netbeans.libs.cglib,\
org.netbeans.libs.javacapi,\
org.netbeans.libs.javacimpl,\
org.netbeans.libs.springframework,\
org.netbeans.modules.ant.browsetask,\
org.netbeans.modules.ant.debugger,\
org.netbeans.modules.ant.freeform,\
org.netbeans.modules.ant.grammar,\
org.netbeans.modules.ant.kit,\
org.netbeans.modules.beans,\
org.netbeans.modules.classfile,\
org.netbeans.modules.dbschema,\
org.netbeans.modules.debugger.jpda,\
org.netbeans.modules.debugger.jpda.ant,\
org.netbeans.modules.debugger.jpda.js,\
org.netbeans.modules.debugger.jpda.kit,\
org.netbeans.modules.debugger.jpda.projects,\
org.netbeans.modules.debugger.jpda.ui,\
org.netbeans.modules.debugger.jpda.visual,\
org.netbeans.modules.findbugs.installer,\
org.netbeans.modules.form,\
org.netbeans.modules.form.binding,\
org.netbeans.modules.form.j2ee,\
org.netbeans.modules.form.kit,\
org.netbeans.modules.form.nb,\
org.netbeans.modules.form.refactoring,\
org.netbeans.modules.hibernate,\
org.netbeans.modules.hibernate4lib,\
org.netbeans.modules.hibernatelib,\
org.netbeans.modules.hudson.ant,\
org.netbeans.modules.hudson.maven,\
org.netbeans.modules.i18n,\
org.netbeans.modules.i18n.form,\
org.netbeans.modules.j2ee.core.utilities,\
org.netbeans.modules.j2ee.eclipselink,\
org.netbeans.modules.j2ee.eclipselinkmodelgen,\
org.netbeans.modules.j2ee.jpa.refactoring,\
org.netbeans.modules.j2ee.jpa.verification,\
org.netbeans.modules.j2ee.metadata,\
org.netbeans.modules.j2ee.metadata.model.support,\
org.netbeans.modules.j2ee.persistence,\
org.netbeans.modules.j2ee.persistence.kit,\
org.netbeans.modules.j2ee.persistenceapi,\
org.netbeans.modules.java.api.common,\
org.netbeans.modules.java.debug,\
org.netbeans.modules.java.editor,\
org.netbeans.modules.java.editor.lib,\
org.netbeans.modules.java.examples,\
org.netbeans.modules.java.freeform,\
org.netbeans.modules.java.guards,\
org.netbeans.modules.java.helpset,\
org.netbeans.modules.java.hints,\
org.netbeans.modules.java.hints.declarative,\
org.netbeans.modules.java.hints.declarative.test,\
org.netbeans.modules.java.hints.legacy.spi,\
org.netbeans.modules.java.hints.test,\
org.netbeans.modules.java.hints.ui,\
org.netbeans.modules.java.j2sedeploy,\
org.netbeans.modules.java.j2seembedded,\
org.netbeans.modules.java.j2seplatform,\
org.netbeans.modules.java.j2seprofiles,\
org.netbeans.modules.java.j2seproject,\
org.netbeans.modules.java.kit,\
org.netbeans.modules.java.lexer,\
org.netbeans.modules.java.metrics,\
org.netbeans.modules.java.navigation,\
org.netbeans.modules.java.platform,\
org.netbeans.modules.java.preprocessorbridge,\
org.netbeans.modules.java.project,\
org.netbeans.modules.java.source,\
org.netbeans.modules.java.source.ant,\
org.netbeans.modules.java.source.queries,\
org.netbeans.modules.java.source.queriesimpl,\
org.netbeans.modules.java.sourceui,\
org.netbeans.modules.java.testrunner,\
org.netbeans.modules.javadoc,\
org.netbeans.modules.javaee.injection,\
org.netbeans.modules.javawebstart,\
org.netbeans.modules.junit,\
org.netbeans.modules.maven,\
org.netbeans.modules.maven.checkstyle,\
org.netbeans.modules.maven.coverage,\
org.netbeans.modules.maven.embedder,\
org.netbeans.modules.maven.grammar,\
org.netbeans.libs.cglib,\
org.netbeans.modules.maven.graph,\
org.netbeans.modules.maven.hints,\
org.netbeans.modules.maven.indexer,\
org.netbeans.modules.maven.junit,\
org.netbeans.modules.maven.kit,\
org.netbeans.modules.maven.model,\
org.netbeans.modules.maven.osgi,\
org.netbeans.modules.maven.persistence,\
org.netbeans.modules.maven.refactoring,\
org.netbeans.modules.maven.repository,\
org.netbeans.modules.maven.search,\
org.netbeans.modules.maven.spring,\
org.netbeans.modules.java.hints.declarative.test,\
org.netbeans.libs.javacapi,\
org.netbeans.modules.nashorn.execution,\
org.netbeans.modules.java.metrics,\
org.netbeans.modules.debugger.jpda.js,\
org.netbeans.api.java,\
org.netbeans.modules.debugger.jpda.ant,\
org.netbeans.modules.java.source.ant,\
org.netbeans.modules.maven.refactoring,\
org.netbeans.modules.ant.debugger,\
org.netbeans.modules.hibernatelib,\
org.netbeans.modules.hibernate,\
org.netbeans.lib.nbjavac,\
org.netbeans.modules.debugger.jpda.kit,\
org.netbeans.modules.maven.persistence,\
org.netbeans.modules.javaee.injection,\
org.netbeans.modules.maven,\
org.netbeans.modules.performance,\
org.netbeans.modules.performance.java,\
org.netbeans.modules.projectimport.eclipse.core,\
org.netbeans.modules.projectimport.eclipse.j2se,\
org.netbeans.modules.refactoring.java,\
org.netbeans.spi.java.hints,\
org.netbeans.modules.spellchecker.bindings.java,\
org.netbeans.modules.spring.beans,\
org.netbeans.modules.testng,\
org.netbeans.modules.testng.ant,\
org.netbeans.modules.testng.maven,\
org.netbeans.modules.websvc.jaxws21,\
org.netbeans.modules.websvc.jaxws21api,\
org.netbeans.modules.websvc.saas.codegen.java,\
org.netbeans.modules.whitelist,\
org.netbeans.modules.java.j2seproject,\
org.netbeans.modules.javawebstart,\
org.netbeans.modules.debugger.jpda,\
org.netbeans.modules.ant.grammar,\
org.netbeans.modules.maven.checkstyle,\
org.netbeans.modules.java.source.queries,\
org.netbeans.modules.refactoring.java,\
org.netbeans.modules.java.examples,\
org.netbeans.modules.j2ee.jpa.verification,\
org.netbeans.modules.j2ee.jpa.refactoring,\
org.netbeans.modules.j2ee.metadata.model.support,\
org.netbeans.modules.classfile,\
org.netbeans.modules.maven.coverage,\
org.netbeans.modules.debugger.jpda.ui,\
org.netbeans.modules.java.guards,\
org.netbeans.modules.xml.jaxb,\
org.netbeans.modules.java.preprocessorbridge,\
org.netbeans.modules.debugger.jpda.jsui,\
org.netbeans.api.debugger.jpda,\
org.netbeans.modules.ant.freeform,\
org.netbeans.modules.java.sourceui,\
org.netbeans.modules.projectimport.eclipse.j2se,\
org.netbeans.modules.form,\
org.netbeans.modules.junit,\
org.netbeans.modules.j2ee.persistence.kit,\
org.netbeans.modules.j2ee.metadata,\
org.netbeans.modules.java.j2seplatform,\
org.netbeans.modules.javadoc,\
org.netbeans.modules.debugger.jpda.projects,\
org.netbeans.modules.java.source,\
org.netbeans.modules.maven.spring,\
org.netbeans.modules.maven.search,\
org.netbeans.modules.java.debug,\
org.netbeans.modules.maven.grammar,\
org.netbeans.modules.java.kit,\
org.netbeans.modules.testng,\
org.netbeans.modules.spring.beans,\
org.netbeans.modules.websvc.saas.codegen.java,\
org.netbeans.modules.java.editor.lib,\
org.netbeans.modules.java.testrunner,\
org.netbeans.modules.java.source.queriesimpl,\
org.netbeans.modules.maven.junit,\
org.netbeans.modules.maven.hints,\
org.netbeans.modules.xml.tools.java,\
org.netbeans.spi.java.hints
org.netbeans.modules.j2ee.persistenceapi,\
org.netbeans.modules.java.j2seprofiles,\
org.netbeans.modules.form.kit,\
org.netbeans.modules.projectimport.eclipse.core,\
org.netbeans.modules.form.refactoring,\
org.apache.tools.ant.module,\
org.netbeans.modules.testng.maven,\
org.netbeans.modules.java.hints.test,\
org.netbeans.modules.i18n.form,\
org.netbeans.modules.maven.kit,\
org.netbeans.modules.beans,\
org.netbeans.modules.java.platform,\
org.netbeans.modules.java.hints.legacy.spi,\
org.netbeans.modules.java.lexer,\
org.netbeans.modules.java.hints,\
org.netbeans.modules.java.j2seembedded,\
org.netbeans.modules.java.hints.ui,\
org.netbeans.modules.java.editor,\
org.netbeans.modules.websvc.jaxws21,\
org.netbeans.modules.hudson.maven,\
org.netbeans.modules.java.j2sedeploy,\
org.netbeans.libs.javacimpl,\
org.netbeans.modules.java.helpset,\
org.netbeans.modules.i18n,\
org.netbeans.modules.dbschema,\
org.netbeans.api.maven,\
org.netbeans.modules.findbugs.installer,\
org.netbeans.modules.j2ee.eclipselinkmodelgen,\
org.netbeans.modules.form.nb,\
org.netbeans.modules.debugger.jpda.visual,\
org.netbeans.modules.form.j2ee,\
org.netbeans.modules.java.project,\
org.netbeans.modules.java.api.common,\
org.netbeans.modules.j2ee.persistence,\
org.netbeans.modules.java.freeform,\
org.netbeans.modules.whitelist,\
org.netbeans.libs.springframework,\
org.netbeans.modules.maven.embedder,\
org.netbeans.modules.ant.kit,\
org.netbeans.modules.java.hints.declarative,\
org.netbeans.modules.testng.ant,\
org.netbeans.modules.form.binding,\
org.netbeans.modules.ant.browsetask,\
org.netbeans.modules.j2ee.core.utilities,\
org.netbeans.modules.performance.java,\
org.netbeans.modules.websvc.jaxws21api,\
org.netbeans.modules.maven.repository,\
org.netbeans.modules.j2ee.eclipselink,\
org.netbeans.modules.maven.model,\
org.netbeans.modules.hibernate4lib,\
org.netbeans.modules.java.navigation,\
org.netbeans.modules.maven.indexer,\
org.netbeans.modules.maven.osgi