mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
Merge pull request #7504 from rcordovano/8212-data-source-ingest-progress-fix
8212 Leapp module fixes
This commit is contained in:
eugene7646
GitHub
commit
dcc6674c44
@ -70,9 +70,8 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
private static final String ALEAPP_FS = "fs_"; //NON-NLS
|
||||
private static final String ALEAPP_EXECUTABLE = "aleapp.exe";//NON-NLS
|
||||
private static final String ALEAPP_PATHS_FILE = "aLeapp_paths.txt"; //NON-NLS
|
||||
|
||||
private static final String XMLFILE = "aleap-artifact-attribute-reference.xml"; //NON-NLS
|
||||
|
||||
private static final String XMLFILE = "aleap-artifact-attribute-reference.xml"; //NON-NLS
|
||||
|
||||
private File aLeappExecutable;
|
||||
|
||||
@ -118,8 +117,8 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
@NbBundle.Messages({
|
||||
"ALeappAnalyzerIngestModule.error.running.aLeapp=Error running aLeapp, see log file.",
|
||||
"ALeappAnalyzerIngestModule.error.creating.output.dir=Error creating aLeapp module output directory.",
|
||||
"ALeappAnalyzerIngestModule.starting.aLeapp=Starting aLeapp",
|
||||
"ALeappAnalyzerIngestModule.running.aLeapp=Running aLeapp",
|
||||
"ALeappAnalyzerIngestModule_processing_aLeapp_results=Processing aLeapp results",
|
||||
"ALeappAnalyzerIngestModule.has.run=aLeapp",
|
||||
"ALeappAnalyzerIngestModule.aLeapp.cancelled=aLeapp run was canceled",
|
||||
"ALeappAnalyzerIngestModule.completed=aLeapp Processing Completed",
|
||||
@ -127,51 +126,62 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
@Override
|
||||
public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress statusHelper) {
|
||||
|
||||
statusHelper.switchToIndeterminate();
|
||||
statusHelper.progress(Bundle.ALeappAnalyzerIngestModule_running_aLeapp());
|
||||
|
||||
Case currentCase = Case.getCurrentCase();
|
||||
Path tempOutputPath = Paths.get(currentCase.getTempDirectory(), ALEAPP, ALEAPP_FS + dataSource.getId());
|
||||
try {
|
||||
Files.createDirectories(tempOutputPath);
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.SEVERE, String.format("Error creating aLeapp output directory %s", tempOutputPath.toString()), ex);
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
|
||||
List<String> aLeappPathsToProcess = new ArrayList<>();
|
||||
List<String> aLeappPathsToProcess;
|
||||
ProcessBuilder aLeappCommand = buildaLeappListCommand(tempOutputPath);
|
||||
try {
|
||||
int result = ExecUtil.execute(aLeappCommand, new DataSourceIngestModuleProcessTerminator(context, true));
|
||||
if (result != 0) {
|
||||
logger.log(Level.SEVERE, String.format("Error when trying to execute aLeapp program getting file paths to search for result is %d", result));
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
aLeappPathsToProcess = loadIleappPathFile(tempOutputPath);
|
||||
if (aLeappPathsToProcess.isEmpty()) {
|
||||
logger.log(Level.SEVERE, String.format("Error getting file paths to search, list is empty"));
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.SEVERE, String.format("Error when trying to execute aLeapp program getting file paths to search"), ex);
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
|
||||
statusHelper.progress(Bundle.ALeappAnalyzerIngestModule_starting_aLeapp(), 0);
|
||||
|
||||
List<AbstractFile> aLeappFilesToProcess = new ArrayList<>();
|
||||
|
||||
if (!(context.getDataSource() instanceof LocalFilesDataSource)) {
|
||||
extractFilesFromImage(dataSource, aLeappPathsToProcess, tempOutputPath);
|
||||
statusHelper.switchToDeterminate(aLeappFilesToProcess.size());
|
||||
processALeappFs(dataSource, currentCase, statusHelper, tempOutputPath.toString());
|
||||
} else {
|
||||
aLeappFilesToProcess = LeappFileProcessor.findLeappFilesToProcess(dataSource);
|
||||
statusHelper.switchToDeterminate(aLeappFilesToProcess.size());
|
||||
|
||||
Integer filesProcessedCount = 0;
|
||||
for (AbstractFile aLeappFile : aLeappFilesToProcess) {
|
||||
processALeappFile(dataSource, currentCase, statusHelper, filesProcessedCount, aLeappFile);
|
||||
filesProcessedCount++;
|
||||
if ((context.getDataSource() instanceof LocalFilesDataSource)) {
|
||||
/*
|
||||
* The data source may be local files from an iOS file system, or it
|
||||
* may be a tarred/ZIP of an iOS file system. If it is the latter,
|
||||
* extract the files we need to process.
|
||||
*/
|
||||
List<AbstractFile> aLeappFilesToProcess = LeappFileProcessor.findLeappFilesToProcess(dataSource);
|
||||
if (!aLeappFilesToProcess.isEmpty()) {
|
||||
statusHelper.switchToDeterminate(aLeappFilesToProcess.size());
|
||||
Integer filesProcessedCount = 0;
|
||||
for (AbstractFile aLeappFile : aLeappFilesToProcess) {
|
||||
processALeappFile(dataSource, currentCase, statusHelper, filesProcessedCount, aLeappFile);
|
||||
filesProcessedCount++;
|
||||
}
|
||||
}
|
||||
// Process the logical image as a fs in aLeapp to make sure this is not a logical fs that was added
|
||||
extractFilesFromImage(dataSource, aLeappPathsToProcess, tempOutputPath);
|
||||
processALeappFs(dataSource, currentCase, statusHelper, tempOutputPath.toString());
|
||||
}
|
||||
|
||||
statusHelper.switchToIndeterminate();
|
||||
statusHelper.progress(Bundle.ILeappAnalyzerIngestModule_processing_iLeapp_results());
|
||||
extractFilesFromDataSource(dataSource, aLeappPathsToProcess, tempOutputPath);
|
||||
processALeappFs(dataSource, currentCase, statusHelper, tempOutputPath.toString());
|
||||
|
||||
IngestMessage message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
|
||||
Bundle.ALeappAnalyzerIngestModule_has_run(),
|
||||
Bundle.ALeappAnalyzerIngestModule_completed());
|
||||
@ -181,14 +191,17 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
|
||||
/**
|
||||
* Process a file from a logical image using the aLeapp program
|
||||
* @param dataSource datasource to process
|
||||
* @param currentCase current case that is being worked on
|
||||
* @param statusHelper show progress and update what is being processed
|
||||
*
|
||||
* @param dataSource datasource to process
|
||||
* @param currentCase current case that is being worked on
|
||||
* @param statusHelper show progress and update what is being
|
||||
* processed
|
||||
* @param filesProcessedCount number of files that have been processed
|
||||
* @param aLeappFile the abstract file to process
|
||||
* @param aLeappFile the abstract file to process
|
||||
*/
|
||||
private void processALeappFile(Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, int filesProcessedCount,
|
||||
AbstractFile aLeappFile) {
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ALeappAnalyzerIngestModule.processing.file", aLeappFile.getName()), filesProcessedCount);
|
||||
String currentTime = new SimpleDateFormat("yyyy-MM-dd HH-mm-ss z", Locale.US).format(System.currentTimeMillis());//NON-NLS
|
||||
Path moduleOutputPath = Paths.get(currentCase.getModuleDirectory(), ALEAPP, currentTime);
|
||||
try {
|
||||
@ -198,7 +211,6 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ALeappAnalyzerIngestModule.processing.file", aLeappFile.getName()), filesProcessedCount);
|
||||
ProcessBuilder aLeappCommand = buildaLeappCommand(moduleOutputPath, aLeappFile.getLocalAbsPath(), aLeappFile.getNameExtension());
|
||||
try {
|
||||
int result = ExecUtil.execute(aLeappCommand, new DataSourceIngestModuleProcessTerminator(context, true));
|
||||
@ -219,21 +231,20 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
ProcessResult fileProcessorResult = aLeappFileProcessor.processFiles(dataSource, moduleOutputPath, aLeappFile);
|
||||
|
||||
if (fileProcessorResult == ProcessResult.ERROR) {
|
||||
return;
|
||||
}
|
||||
aLeappFileProcessor.processFiles(dataSource, moduleOutputPath, aLeappFile);
|
||||
}
|
||||
|
||||
/**
|
||||
* Process a image/directory using the aLeapp program
|
||||
* @param dataSource datasource to process
|
||||
* @param currentCase current case being procesed
|
||||
* @param statusHelper show progress and update what is being processed
|
||||
*
|
||||
* @param dataSource datasource to process
|
||||
* @param currentCase current case being procesed
|
||||
* @param statusHelper show progress and update what is being
|
||||
* processed
|
||||
* @param directoryToProcess directory to run aLeapp against
|
||||
*/
|
||||
private void processALeappFs(Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, String directoryToProcess) {
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ALeappAnalyzerIngestModule.processing.filesystem"));
|
||||
String currentTime = new SimpleDateFormat("yyyy-MM-dd HH-mm-ss z", Locale.US).format(System.currentTimeMillis());//NON-NLS
|
||||
Path moduleOutputPath = Paths.get(currentCase.getModuleDirectory(), ALEAPP, currentTime);
|
||||
try {
|
||||
@ -243,7 +254,6 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ALeappAnalyzerIngestModule.processing.filesystem"));
|
||||
ProcessBuilder aLeappCommand = buildaLeappCommand(moduleOutputPath, directoryToProcess, "fs");
|
||||
try {
|
||||
int result = ExecUtil.execute(aLeappCommand, new DataSourceIngestModuleProcessTerminator(context, true));
|
||||
@ -264,23 +274,16 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
ProcessResult fileProcessorResult = aLeappFileProcessor.processFileSystem(dataSource, moduleOutputPath);
|
||||
|
||||
if (fileProcessorResult == ProcessResult.ERROR) {
|
||||
return;
|
||||
}
|
||||
|
||||
aLeappFileProcessor.processFileSystem(dataSource, moduleOutputPath);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* Build the aLeapp command to run
|
||||
*
|
||||
* @param moduleOutputPath output path for the aLeapp program.
|
||||
* @param sourceFilePath where the source files to process reside.
|
||||
*
|
||||
* @param moduleOutputPath output path for the aLeapp program.
|
||||
* @param sourceFilePath where the source files to process reside.
|
||||
* @param aLeappFileSystemType the filesystem type to process
|
||||
*
|
||||
*
|
||||
* @return the command to execute
|
||||
*/
|
||||
private ProcessBuilder buildaLeappCommand(Path moduleOutputPath, String sourceFilePath, String aLeappFileSystemType) {
|
||||
@ -311,8 +314,8 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
static private ProcessBuilder buildProcessWithRunAsInvoker(String... commandLine) {
|
||||
ProcessBuilder processBuilder = new ProcessBuilder(commandLine);
|
||||
/*
|
||||
* Add an environment variable to force aLeapp to run with
|
||||
* the same permissions Autopsy uses.
|
||||
* Add an environment variable to force aLeapp to run with the same
|
||||
* permissions Autopsy uses.
|
||||
*/
|
||||
processBuilder.environment().put("__COMPAT_LAYER", "RunAsInvoker"); //NON-NLS
|
||||
return processBuilder;
|
||||
@ -335,7 +338,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
private void addILeappReportToReports(Path aLeappOutputDir, Case currentCase) {
|
||||
List<String> allIndexFiles = new ArrayList<>();
|
||||
|
||||
try (Stream<Path> walk = Files.walk(aLeappOutputDir)) {
|
||||
try (Stream<Path> walk = Files.walk(aLeappOutputDir)) {
|
||||
|
||||
allIndexFiles = walk.map(x -> x.toString())
|
||||
.filter(f -> f.toLowerCase().endsWith("index.html")).collect(Collectors.toList());
|
||||
@ -380,7 +383,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return aLeappPathsToProcess;
|
||||
}
|
||||
|
||||
private void extractFilesFromImage(Content dataSource, List<String> aLeappPathsToProcess, Path moduleOutputPath) {
|
||||
private void extractFilesFromDataSource(Content dataSource, List<String> aLeappPathsToProcess, Path moduleOutputPath) {
|
||||
FileManager fileManager = getCurrentCase().getServices().getFileManager();
|
||||
|
||||
for (String fullFilePath : aLeappPathsToProcess) {
|
||||
@ -418,33 +421,33 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
|
||||
private void extractFileToOutput(Content dataSource, AbstractFile aLeappFile, File fileParentPath, Path parentPath) {
|
||||
if (fileParentPath.exists()) {
|
||||
if (!aLeappFile.isDir()) {
|
||||
writeaLeappFile(dataSource, aLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), aLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating aLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(parentPath);
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating aLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
if (!aLeappFile.isDir()) {
|
||||
writeaLeappFile(dataSource, aLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), aLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating aLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
if (!aLeappFile.isDir()) {
|
||||
writeaLeappFile(dataSource, aLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), aLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating aLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(parentPath);
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating aLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
if (!aLeappFile.isDir()) {
|
||||
writeaLeappFile(dataSource, aLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), aLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating aLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
private void writeaLeappFile(Content dataSource, AbstractFile aLeappFile, String parentPath) {
|
||||
String fileName = aLeappFile.getName().replace(":", "-");
|
||||
if (!fileName.matches(".") && !fileName.matches("..") && !fileName.toLowerCase().endsWith("-slack")) {
|
||||
@ -461,4 +464,16 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Writes a generic error message to the ingest inbox, directing the user to
|
||||
* consult the application log fpor more details.
|
||||
*/
|
||||
private void writeErrorMsgToIngestInbox() {
|
||||
IngestMessage message = IngestMessage.createMessage(IngestMessage.MessageType.ERROR,
|
||||
MODULE_NAME,
|
||||
Bundle.ALeappAnalyzerIngestModule_error_running_aLeapp());
|
||||
IngestServices.getInstance().postMessage(message);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@ -8,7 +8,7 @@ ALeappAnalyzerIngestModule.has.run=aLeapp
|
||||
ALeappAnalyzerIngestModule.report.name=aLeapp Html Report
|
||||
ALeappAnalyzerIngestModule.requires.windows=aLeapp module requires windows.
|
||||
ALeappAnalyzerIngestModule.running.aLeapp=Running aLeapp
|
||||
ALeappAnalyzerIngestModule.starting.aLeapp=Starting aLeapp
|
||||
ALeappAnalyzerIngestModule_processing_aLeapp_results=Processing aLeapp results
|
||||
ALeappAnalyzerModuleFactory_moduleDesc=Uses aLEAPP to analyze logical acquisitions of Android devices.
|
||||
ALeappAnalyzerModuleFactory_moduleName=Android Analyzer (aLEAPP)
|
||||
ILeappAnalyzerIngestModule.completed=iLeapp Processing Completed
|
||||
@ -31,7 +31,7 @@ AleappAnalyzerIngestModule.not.64.bit.os=aLeapp will not run on a 32bit operatin
|
||||
ILeappAnalyzerIngestModule.report.name=iLeapp Html Report
|
||||
ILeappAnalyzerIngestModule.requires.windows=iLeapp module requires windows.
|
||||
ILeappAnalyzerIngestModule.running.iLeapp=Running iLeapp
|
||||
ILeappAnalyzerIngestModule.starting.iLeapp=Starting iLeapp
|
||||
ILeappAnalyzerIngestModule_processing_iLeapp_results=Processing iLeapp results
|
||||
ILeappAnalyzerModuleFactory_moduleDesc=Uses iLEAPP to analyze logical acquisitions of iOS devices.
|
||||
ILeappAnalyzerModuleFactory_moduleName=iOS Analyzer (iLEAPP)
|
||||
LeappFileProcessor.cannot.create.calllog.relationship=Cannot create TSK_CALLLOG Relationship.
|
||||
|
||||
@ -73,7 +73,6 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
|
||||
private static final String XMLFILE = "ileap-artifact-attribute-reference.xml"; //NON-NLS
|
||||
|
||||
|
||||
private File iLeappExecutable;
|
||||
|
||||
private IngestJobContext context;
|
||||
@ -95,7 +94,7 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
if (false == PlatformUtil.is64BitOS()) {
|
||||
throw new IngestModuleException(NbBundle.getMessage(this.getClass(), "IleappAnalyzerIngestModule.not.64.bit.os"));
|
||||
}
|
||||
|
||||
|
||||
if (false == PlatformUtil.isWindowsOS()) {
|
||||
throw new IngestModuleException(Bundle.ILeappAnalyzerIngestModule_requires_windows());
|
||||
}
|
||||
@ -118,8 +117,8 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
@NbBundle.Messages({
|
||||
"ILeappAnalyzerIngestModule.error.running.iLeapp=Error running iLeapp, see log file.",
|
||||
"ILeappAnalyzerIngestModule.error.creating.output.dir=Error creating iLeapp module output directory.",
|
||||
"ILeappAnalyzerIngestModule.starting.iLeapp=Starting iLeapp",
|
||||
"ILeappAnalyzerIngestModule.running.iLeapp=Running iLeapp",
|
||||
"ILeappAnalyzerIngestModule_processing_iLeapp_results=Processing iLeapp results",
|
||||
"ILeappAnalyzerIngestModule.has.run=iLeapp",
|
||||
"ILeappAnalyzerIngestModule.iLeapp.cancelled=iLeapp run was canceled",
|
||||
"ILeappAnalyzerIngestModule.completed=iLeapp Processing Completed",
|
||||
@ -127,51 +126,62 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
@Override
|
||||
public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress statusHelper) {
|
||||
|
||||
statusHelper.switchToIndeterminate();
|
||||
statusHelper.progress(Bundle.ILeappAnalyzerIngestModule_running_iLeapp());
|
||||
|
||||
Case currentCase = Case.getCurrentCase();
|
||||
Path tempOutputPath = Paths.get(currentCase.getTempDirectory(), ILEAPP, ILEAPP_FS + dataSource.getId());
|
||||
try {
|
||||
Files.createDirectories(tempOutputPath);
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.SEVERE, String.format("Error creating iLeapp output directory %s", tempOutputPath.toString()), ex);
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
|
||||
List<String> iLeappPathsToProcess = new ArrayList<>();
|
||||
List<String> iLeappPathsToProcess;
|
||||
ProcessBuilder iLeappCommand = buildiLeappListCommand(tempOutputPath);
|
||||
try {
|
||||
int result = ExecUtil.execute(iLeappCommand, new DataSourceIngestModuleProcessTerminator(context, true));
|
||||
if (result != 0) {
|
||||
logger.log(Level.SEVERE, String.format("Error when trying to execute iLeapp program getting file paths to search for result is %d", result));
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
iLeappPathsToProcess = loadIleappPathFile(tempOutputPath);
|
||||
if (iLeappPathsToProcess.isEmpty()) {
|
||||
logger.log(Level.SEVERE, String.format("Error getting file paths to search, list is empty"));
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.SEVERE, String.format("Error when trying to execute iLeapp program getting file paths to search"), ex);
|
||||
writeErrorMsgToIngestInbox();
|
||||
return ProcessResult.ERROR;
|
||||
}
|
||||
|
||||
statusHelper.progress(Bundle.ILeappAnalyzerIngestModule_starting_iLeapp(), 0);
|
||||
|
||||
List<AbstractFile> iLeappFilesToProcess = new ArrayList<>();
|
||||
|
||||
if (!(context.getDataSource() instanceof LocalFilesDataSource)) {
|
||||
extractFilesFromImage(dataSource, iLeappPathsToProcess, tempOutputPath);
|
||||
statusHelper.switchToDeterminate(iLeappFilesToProcess.size());
|
||||
processILeappFs(dataSource, currentCase, statusHelper, tempOutputPath.toString());
|
||||
} else {
|
||||
iLeappFilesToProcess = LeappFileProcessor.findLeappFilesToProcess(dataSource);
|
||||
statusHelper.switchToDeterminate(iLeappFilesToProcess.size());
|
||||
|
||||
Integer filesProcessedCount = 0;
|
||||
for (AbstractFile iLeappFile : iLeappFilesToProcess) {
|
||||
processILeappFile(dataSource, currentCase, statusHelper, filesProcessedCount, iLeappFile);
|
||||
filesProcessedCount++;
|
||||
if ((context.getDataSource() instanceof LocalFilesDataSource)) {
|
||||
/*
|
||||
* The data source may be local files from an iOS file system, or it
|
||||
* may be a tarred/ZIP of an iOS file system. If it is the latter,
|
||||
* extract the files we need to process.
|
||||
*/
|
||||
List<AbstractFile> iLeappFilesToProcess = LeappFileProcessor.findLeappFilesToProcess(dataSource);
|
||||
if (!iLeappFilesToProcess.isEmpty()) {
|
||||
statusHelper.switchToDeterminate(iLeappFilesToProcess.size());
|
||||
Integer filesProcessedCount = 0;
|
||||
for (AbstractFile iLeappFile : iLeappFilesToProcess) {
|
||||
processILeappFile(dataSource, currentCase, statusHelper, filesProcessedCount, iLeappFile);
|
||||
filesProcessedCount++;
|
||||
}
|
||||
}
|
||||
// Process the logical image as a fs in iLeapp to make sure this is not a logical fs that was added
|
||||
extractFilesFromImage(dataSource, iLeappPathsToProcess, tempOutputPath);
|
||||
processILeappFs(dataSource, currentCase, statusHelper, tempOutputPath.toString());
|
||||
}
|
||||
|
||||
statusHelper.switchToIndeterminate();
|
||||
statusHelper.progress(Bundle.ILeappAnalyzerIngestModule_processing_iLeapp_results());
|
||||
extractFilesFromDataSource(dataSource, iLeappPathsToProcess, tempOutputPath);
|
||||
processILeappFs(dataSource, currentCase, statusHelper, tempOutputPath.toString());
|
||||
|
||||
IngestMessage message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
|
||||
Bundle.ILeappAnalyzerIngestModule_has_run(),
|
||||
Bundle.ILeappAnalyzerIngestModule_completed());
|
||||
@ -180,15 +190,19 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
}
|
||||
|
||||
/**
|
||||
* Process each tar/zip file that is found in a logical image that contains xLeapp data
|
||||
* @param dataSource Datasource where the file has been found
|
||||
* @param currentCase current case
|
||||
* @param statusHelper Progress bar for messages to show user
|
||||
* Process each tar/zip file that is found in a logical image that contains
|
||||
* xLeapp data
|
||||
*
|
||||
* @param dataSource Datasource where the file has been found
|
||||
* @param currentCase current case
|
||||
* @param statusHelper Progress bar for messages to show user
|
||||
* @param filesProcessedCount count that is incremented for progress bar
|
||||
* @param iLeappFile abstract file that will be processed
|
||||
* @param iLeappFile abstract file that will be processed
|
||||
*/
|
||||
private void processILeappFile(Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, int filesProcessedCount,
|
||||
AbstractFile iLeappFile) {
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ILeappAnalyzerIngestModule.processing.file", iLeappFile.getName()), filesProcessedCount);
|
||||
|
||||
String currentTime = new SimpleDateFormat("yyyy-MM-dd HH-mm-ss z", Locale.US).format(System.currentTimeMillis());//NON-NLS
|
||||
Path moduleOutputPath = Paths.get(currentCase.getModuleDirectory(), ILEAPP, currentTime);
|
||||
try {
|
||||
@ -198,7 +212,6 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ILeappAnalyzerIngestModule.processing.file", iLeappFile.getName()), filesProcessedCount);
|
||||
ProcessBuilder iLeappCommand = buildiLeappCommand(moduleOutputPath, iLeappFile.getLocalAbsPath(), iLeappFile.getNameExtension());
|
||||
try {
|
||||
int result = ExecUtil.execute(iLeappCommand, new DataSourceIngestModuleProcessTerminator(context, true));
|
||||
@ -219,21 +232,19 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
ProcessResult fileProcessorResult = iLeappFileProcessor.processFiles(dataSource, moduleOutputPath, iLeappFile);
|
||||
|
||||
if (fileProcessorResult == ProcessResult.ERROR) {
|
||||
return;
|
||||
}
|
||||
iLeappFileProcessor.processFiles(dataSource, moduleOutputPath, iLeappFile);
|
||||
}
|
||||
|
||||
/**
|
||||
* Process extracted files from a disk image using xLeapp
|
||||
* @param dataSource Datasource where the file has been found
|
||||
* @param currentCase current case
|
||||
* @param statusHelper Progress bar for messages to show user
|
||||
* @param directoryToProcess
|
||||
*
|
||||
* @param dataSource Datasource where the file has been found
|
||||
* @param currentCase current case
|
||||
* @param statusHelper Progress bar for messages to show user
|
||||
* @param directoryToProcess
|
||||
*/
|
||||
private void processILeappFs(Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, String directoryToProcess) {
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ILeappAnalyzerIngestModule.processing.filesystem"));
|
||||
String currentTime = new SimpleDateFormat("yyyy-MM-dd HH-mm-ss z", Locale.US).format(System.currentTimeMillis());//NON-NLS
|
||||
Path moduleOutputPath = Paths.get(currentCase.getModuleDirectory(), ILEAPP, currentTime);
|
||||
try {
|
||||
@ -243,7 +254,6 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
statusHelper.progress(NbBundle.getMessage(this.getClass(), "ILeappAnalyzerIngestModule.processing.filesystem"));
|
||||
ProcessBuilder iLeappCommand = buildiLeappCommand(moduleOutputPath, directoryToProcess, "fs");
|
||||
try {
|
||||
int result = ExecUtil.execute(iLeappCommand, new DataSourceIngestModuleProcessTerminator(context, true));
|
||||
@ -264,19 +274,16 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
return;
|
||||
}
|
||||
|
||||
ProcessResult fileProcessorResult = iLeappFileProcessor.processFileSystem(dataSource, moduleOutputPath);
|
||||
|
||||
if (fileProcessorResult == ProcessResult.ERROR) {
|
||||
return;
|
||||
}
|
||||
|
||||
iLeappFileProcessor.processFileSystem(dataSource, moduleOutputPath);
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the command to run xLeapp
|
||||
* @param moduleOutputPath output path for xLeapp
|
||||
* @param sourceFilePath path where the xLeapp file is
|
||||
*
|
||||
* @param moduleOutputPath output path for xLeapp
|
||||
* @param sourceFilePath path where the xLeapp file is
|
||||
* @param iLeappFileSystemType type of file to process tar/zip/fs
|
||||
*
|
||||
* @return process to run
|
||||
*/
|
||||
private ProcessBuilder buildiLeappCommand(Path moduleOutputPath, String sourceFilePath, String iLeappFileSystemType) {
|
||||
@ -294,7 +301,9 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
|
||||
/**
|
||||
* Command to run xLeapp using the path option
|
||||
*
|
||||
* @param moduleOutputPath path where the file paths output will reside
|
||||
*
|
||||
* @return process to run
|
||||
*/
|
||||
private ProcessBuilder buildiLeappListCommand(Path moduleOutputPath) {
|
||||
@ -311,8 +320,8 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
static private ProcessBuilder buildProcessWithRunAsInvoker(String... commandLine) {
|
||||
ProcessBuilder processBuilder = new ProcessBuilder(commandLine);
|
||||
/*
|
||||
* Add an environment variable to force iLeapp to run with
|
||||
* the same permissions Autopsy uses.
|
||||
* Add an environment variable to force iLeapp to run with the same
|
||||
* permissions Autopsy uses.
|
||||
*/
|
||||
processBuilder.environment().put("__COMPAT_LAYER", "RunAsInvoker"); //NON-NLS
|
||||
return processBuilder;
|
||||
@ -335,7 +344,7 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
private void addILeappReportToReports(Path iLeappOutputDir, Case currentCase) {
|
||||
List<String> allIndexFiles;
|
||||
|
||||
try (Stream<Path> walk = Files.walk(iLeappOutputDir)) {
|
||||
try (Stream<Path> walk = Files.walk(iLeappOutputDir)) {
|
||||
|
||||
allIndexFiles = walk.map(x -> x.toString())
|
||||
.filter(f -> f.toLowerCase().endsWith("index.html")).collect(Collectors.toList());
|
||||
@ -383,11 +392,12 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
|
||||
/**
|
||||
* Extract files from a disk image to process with xLeapp
|
||||
* @param dataSource Datasource of the image
|
||||
* @param iLeappPathsToProcess List of paths to extract content from
|
||||
* @param moduleOutputPath path to write content to
|
||||
*
|
||||
* @param dataSource Datasource of the image
|
||||
* @param iLeappPathsToProcess List of paths to extract content from
|
||||
* @param moduleOutputPath path to write content to
|
||||
*/
|
||||
private void extractFilesFromImage(Content dataSource, List<String> iLeappPathsToProcess, Path moduleOutputPath) {
|
||||
private void extractFilesFromDataSource(Content dataSource, List<String> iLeappPathsToProcess, Path moduleOutputPath) {
|
||||
FileManager fileManager = getCurrentCase().getServices().getFileManager();
|
||||
|
||||
for (String fullFilePath : iLeappPathsToProcess) {
|
||||
@ -425,42 +435,44 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
|
||||
/**
|
||||
* Create path and file from datasource in temp
|
||||
* @param dataSource datasource of the image
|
||||
* @param iLeappFile abstract file to write out
|
||||
*
|
||||
* @param dataSource datasource of the image
|
||||
* @param iLeappFile abstract file to write out
|
||||
* @param fileParentPath parent file path
|
||||
* @param parentPath parent file
|
||||
* @param parentPath parent file
|
||||
*/
|
||||
private void extractFileToOutput(Content dataSource, AbstractFile iLeappFile, File fileParentPath, Path parentPath) {
|
||||
if (fileParentPath.exists()) {
|
||||
if (!iLeappFile.isDir()) {
|
||||
writeiLeappFile(dataSource, iLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), iLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating iLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(parentPath);
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating iLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
if (!iLeappFile.isDir()) {
|
||||
writeiLeappFile(dataSource, iLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), iLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating iLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
if (!iLeappFile.isDir()) {
|
||||
writeiLeappFile(dataSource, iLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), iLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating iLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(parentPath);
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating iLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
if (!iLeappFile.isDir()) {
|
||||
writeiLeappFile(dataSource, iLeappFile, fileParentPath.toString());
|
||||
} else {
|
||||
try {
|
||||
Files.createDirectories(Paths.get(parentPath.toString(), iLeappFile.getName()));
|
||||
} catch (IOException ex) {
|
||||
logger.log(Level.INFO, String.format("Error creating iLeapp output directory %s", parentPath.toString()), ex);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Write out file to output
|
||||
*
|
||||
* @param dataSource datasource of disk image
|
||||
* @param iLeappFile acstract file to write out
|
||||
* @param parentPath path to write file to
|
||||
@ -481,4 +493,16 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Writes a generic error message to the ingest inbox, directing the user to
|
||||
* consult the application log fpor more details.
|
||||
*/
|
||||
private void writeErrorMsgToIngestInbox() {
|
||||
IngestMessage message = IngestMessage.createMessage(IngestMessage.MessageType.ERROR,
|
||||
MODULE_NAME,
|
||||
Bundle.ILeappAnalyzerIngestModule_error_running_iLeapp());
|
||||
IngestServices.getInstance().postMessage(message);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user