From db192c53c5b478d68fbc5bf9b9f1f3129b69f400 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Mon, 20 Jul 2020 08:52:14 -0400 Subject: [PATCH] update to use identifier --- .../modules/hashdatabase/HashDbManager.java | 24 +++++++++++++++---- thirdparty/OfficialHashSets/README.txt | 2 +- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbManager.java b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbManager.java index edf3028f6f..a361e25a1d 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbManager.java +++ b/Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbManager.java @@ -620,7 +620,7 @@ public class HashDbManager implements PropertyChangeListener { final String knownStatus = match.group(KNOWN_STATUS_PARAM); KnownFilesType knownFilesType = Stream.of(HashDb.KnownFilesType.values()) - .filter(k -> k.name().toUpperCase().equals(knownStatus.toUpperCase())) + .filter(k -> k.getIdentifier().toUpperCase().equals(knownStatus.toUpperCase())) .findFirst() .orElseThrow(() -> new HashDbManagerException(String.format("No KnownFilesType matches %s for file: %s", knownStatus, filename))); @@ -804,17 +804,21 @@ public class HashDbManager implements PropertyChangeListener { }) public enum KnownFilesType { - KNOWN(Bundle.HashDbManager_known_text(), TskData.FileKnown.KNOWN, false, false), - KNOWN_BAD(Bundle.HashDbManager_knownBad_text(), TskData.FileKnown.BAD, true, true), - NO_CHANGE(Bundle.HashDbManager_noChange_text(), TskData.FileKnown.UNKNOWN, true, false); + KNOWN(Bundle.HashDbManager_known_text(), "Known", TskData.FileKnown.KNOWN, false, false), + KNOWN_BAD(Bundle.HashDbManager_knownBad_text(), "Notable", TskData.FileKnown.BAD, true, true), + NO_CHANGE(Bundle.HashDbManager_noChange_text(), "NoChange", TskData.FileKnown.UNKNOWN, true, false); private final String displayName; + private final String identifier; private final TskData.FileKnown fileKnown; private final boolean allowSendInboxMessages; private final boolean defaultSendInboxMessages; - KnownFilesType(String displayName, TskData.FileKnown fileKnown, boolean allowSendInboxMessages, boolean defaultSendInboxMessages) { + KnownFilesType(String displayName, String identifier, TskData.FileKnown fileKnown, + boolean allowSendInboxMessages, boolean defaultSendInboxMessages) { + this.displayName = displayName; + this.identifier = identifier; this.fileKnown = fileKnown; this.allowSendInboxMessages = allowSendInboxMessages; this.defaultSendInboxMessages = defaultSendInboxMessages; @@ -842,6 +846,16 @@ public class HashDbManager implements PropertyChangeListener { return defaultSendInboxMessages; } + /** + * Returns the identifier for this KnownFilesType. This is used for + * Official Hash Sets in their naming convention. + * + * @return The identifier for this type. + */ + String getIdentifier() { + return identifier; + } + public String getDisplayName() { return this.displayName; } diff --git a/thirdparty/OfficialHashSets/README.txt b/thirdparty/OfficialHashSets/README.txt index b60ad7a20f..3ea1ac5801 100644 --- a/thirdparty/OfficialHashSets/README.txt +++ b/thirdparty/OfficialHashSets/README.txt @@ -1 +1 @@ -.kdb files can be placed in this directory and they will be treated as Official Hash Sets within autopsy. Official Hash Sets will be readonly within the application. Official Hash Sets should have the following naming convention: '..kdb' where '' is the name of the Official Hash Set and '' is the known status of the hash set. The known status is one of the variable names represented in the enum: HashDbManager.HashDb.KnownFilesType. As an example, a possible value could be: 'Foo.KNOWN.kdb' where the name of the Official Hash Set is 'Foo' and the known status is 'KNOWN.' \ No newline at end of file +.kdb files can be placed in this directory and they will be treated as Official Hash Sets within autopsy. Official Hash Sets will be readonly within the application. Official Hash Sets should have the following naming convention: '..kdb' where '' is the name of the Official Hash Set and '' is the known status of the hash set. The known status is the identifier for one of the variable names represented in the enum: HashDbManager.HashDb.KnownFilesType. As an example, a possible value could be: 'Foo.Notable.kdb' where the name of the Official Hash Set is 'Foo' and the known status is 'Notable' which is the identifier for KnownFilesType.KNOWN_BAD. \ No newline at end of file