mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7801 from sleuthkit/develop

Browse Source 
Merge latest develop
This commit is contained in:
eugene7646 2023-06-15 15:28:49 -04:00 committed by GitHub
commit df10dd503f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
17 changed files with 959 additions and 468 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties
View File

@ -190,7 +190,6 @@ ImageFilePanel.sectorSizeLabel.text=Sector size:
LocalDiskPanel.sectorSizeLabel.text=Sector Size:
LocalFilesPanel.displayNameLabel.text=Logical File Set Display Name: Default
LocalFilesPanel.errorLabel.text=Error Label
LocalFilesPanel.selectedPaths.toolTipText=
LocalFilesPanel.clearButton.toolTipText=Clears currently selected local file paths
LocalFilesPanel.clearButton.text=Clear
LocalFilesPanel.selectButton.actionCommand=Add
@ -263,8 +262,11 @@ AddImageWizardSelectHostVisual.specifyNewHostTextField.text=
AddImageWizardSelectHostVisual.specifyNewHostRadio.text=Specify new host name
AddImageWizardSelectHostVisual.generateNewRadio.text=Generate new host name based on data source name
AddImageWizardSelectHostVisual.validationMessage.text=\
LocalFilesPanel.deleteButon.text=Delete
LocalFilesPanel.createTimeCheckBox.text=Creation Time - Often changed when a file is copied
LocalFilesPanel.modifiedTimeCheckBox.text=\ Modified Time - Often not changed when a file is copied
LocalFilesPanel.jLabel2.text=NOTE: Time stamps may have changed when the files were copied to the current location.
LocalFilesPanel.timestampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.accessTimeCheckBox.text=Access Time - Can be changed when the file is opened
LocalFilesPanel.timeStampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.timeStampNoteLabel.text=NOTE: Time stamps may have changed when the files were copied to the current location.

4
Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED
View File

@ -417,7 +417,6 @@ ImageFilePanel.sectorSizeLabel.text=Sector size:
LocalDiskPanel.sectorSizeLabel.text=Sector Size:
LocalFilesPanel.displayNameLabel.text=Logical File Set Display Name: Default
LocalFilesPanel.errorLabel.text=Error Label
LocalFilesPanel.selectedPaths.toolTipText=
LocalFilesPanel.clearButton.toolTipText=Clears currently selected local file paths
LocalFilesPanel.clearButton.text=Clear
LocalFilesPanel.selectButton.actionCommand=Add
@ -490,8 +489,11 @@ AddImageWizardSelectHostVisual.specifyNewHostTextField.text=
AddImageWizardSelectHostVisual.specifyNewHostRadio.text=Specify new host name
AddImageWizardSelectHostVisual.generateNewRadio.text=Generate new host name based on data source name
AddImageWizardSelectHostVisual.validationMessage.text=\
LocalFilesPanel.deleteButon.text=Delete
LocalFilesPanel.createTimeCheckBox.text=Creation Time - Often changed when a file is copied
LocalFilesPanel.modifiedTimeCheckBox.text=\ Modified Time - Often not changed when a file is copied
LocalFilesPanel.jLabel2.text=NOTE: Time stamps may have changed when the files were copied to the current location.
LocalFilesPanel.timestampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.accessTimeCheckBox.text=Access Time - Can be changed when the file is opened
LocalFilesPanel.timeStampToIncludeLabel.text=Timestamps To Include:
LocalFilesPanel.timeStampNoteLabel.text=NOTE: Time stamps may have changed when the files were copied to the current location.

332
Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.form
View File

@ -27,113 +27,10 @@
<AuxValue name="FormSettings_listenerGenerationStyle" type="java.lang.Integer" value="0"/>
<AuxValue name="FormSettings_variablesLocal" type="java.lang.Boolean" value="false"/>
<AuxValue name="FormSettings_variablesModifier" type="java.lang.Integer" value="2"/>
<AuxValue name="designerSize" type="java.awt.Dimension" value="-84,-19,0,5,115,114,0,18,106,97,118,97,46,97,119,116,46,68,105,109,101,110,115,105,111,110,65,-114,-39,-41,-84,95,68,20,2,0,2,73,0,6,104,101,105,103,104,116,73,0,5,119,105,100,116,104,120,112,0,0,1,30,0,0,1,-5"/>
</AuxValues>
<Layout>
<DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="jPanel1" max="32767" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Component id="errorLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="jPanel1" min="-2" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="errorLabel" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
</Layout>
<SubComponents>
<Container class="javax.swing.JPanel" name="jPanel1">
<Layout>
<DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="1" attributes="0">
<Component id="selectedPathsScrollPane" max="32767" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" max="-2" attributes="0">
<Component id="selectButton" linkSize="1" alignment="0" max="32767" attributes="0"/>
<Component id="clearButton" linkSize="1" alignment="0" max="32767" attributes="0"/>
</Group>
<EmptySpace min="-2" pref="2" max="-2" attributes="0"/>
</Group>
<Group type="102" attributes="0">
<Component id="timestampToIncludeLabel" max="32767" attributes="0"/>
<EmptySpace min="-2" max="-2" attributes="0"/>
</Group>
<Group type="102" attributes="0">
<Component id="displayNameLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="changeNameButton" min="-2" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
</Group>
</Group>
</Group>
<Group type="102" attributes="0">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="23" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="modifiedTimeCheckBox" min="-2" max="-2" attributes="0"/>
<Component id="accessTimeCheckBox" min="-2" max="-2" attributes="0"/>
<Component id="createTimeCheckBox" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
<Group type="102" alignment="0" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Component id="jLabel2" min="-2" max="-2" attributes="0"/>
</Group>
</Group>
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="0" pref="0" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<Component id="selectButton" min="-2" max="-2" attributes="0"/>
<EmptySpace min="-2" pref="36" max="-2" attributes="0"/>
<Component id="clearButton" min="-2" max="-2" attributes="0"/>
</Group>
<Component id="selectedPathsScrollPane" alignment="0" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="3" attributes="0">
<Component id="changeNameButton" alignment="3" min="-2" max="-2" attributes="0"/>
<Component id="displayNameLabel" alignment="3" min="-2" max="-2" attributes="0"/>
</Group>
<EmptySpace max="-2" attributes="0"/>
<Component id="timestampToIncludeLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="modifiedTimeCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="createTimeCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="accessTimeCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace type="separate" min="-2" max="-2" attributes="0"/>
<Component id="jLabel2" min="-2" pref="10" max="-2" attributes="0"/>
<EmptySpace pref="17" max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
</Layout>
<Layout class="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout"/>
<SubComponents>
<Component class="javax.swing.JButton" name="selectButton">
<Properties>
@ -159,6 +56,32 @@
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="selectButtonActionPerformed"/>
</Events>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="1" gridY="0" gridWidth="1" gridHeight="1" fill="2" ipadX="0" ipadY="0" insetsTop="5" insetsLeft="5" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JButton" name="deleteButon">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.deleteButon.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[70, 23]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[70, 23]"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="deleteButonActionPerformed"/>
</Events>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="1" gridY="1" gridWidth="1" gridHeight="1" fill="2" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="5" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JButton" name="clearButton">
<Properties>
@ -181,31 +104,62 @@
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="clearButtonActionPerformed"/>
</Events>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="1" gridY="2" gridWidth="1" gridHeight="1" fill="2" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="5" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Container class="javax.swing.JScrollPane" name="selectedPathsScrollPane">
<Container class="javax.swing.JScrollPane" name="fileListScrollpane">
<Properties>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[32767, 100]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[100, 100]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[379, 96]"/>
<Dimension value="[258, 100]"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
<AuxValue name="autoScrollPane" type="java.lang.Boolean" value="true"/>
</AuxValues>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="0" gridWidth="1" gridHeight="3" fill="2" ipadX="0" ipadY="0" insetsTop="5" insetsLeft="5" insetsBottom="5" insetsRight="0" anchor="10" weightX="1.0" weightY="0.0"/>
</Constraint>
</Constraints>
<Layout class="org.netbeans.modules.form.compat2.layouts.support.JScrollPaneSupportLayout"/>
<SubComponents>
<Component class="javax.swing.JTextArea" name="selectedPaths">
<Component class="javax.swing.JList" name="fileList">
<Properties>
<Property name="editable" type="boolean" value="false"/>
<Property name="columns" type="int" value="20"/>
<Property name="rows" type="int" value="5"/>
<Property name="toolTipText" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.selectedPaths.toolTipText" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
<Property name="model" type="javax.swing.ListModel" editor="org.netbeans.modules.form.editors2.ListModelEditor">
<StringArray count="0"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_TypeParameters" type="java.lang.String" value="&lt;FileRecord&gt;"/>
</AuxValues>
</Component>
</SubComponents>
</Container>
<Container class="javax.swing.JPanel" name="displayNamePanel">
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="3" gridWidth="2" gridHeight="1" fill="2" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="5" insetsBottom="5" insetsRight="5" anchor="18" weightX="1.0" weightY="0.0"/>
</Constraint>
</Constraints>
<Layout class="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout"/>
<SubComponents>
<Component class="javax.swing.JButton" name="changeNameButton">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
@ -215,6 +169,11 @@
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="changeNameButtonActionPerformed"/>
</Events>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="1" gridY="0" gridWidth="1" gridHeight="1" fill="2" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="5" insetsBottom="0" insetsRight="0" anchor="17" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JLabel" name="displayNameLabel">
<Properties>
@ -222,33 +181,61 @@
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.displayNameLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="0" gridWidth="1" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="0" insetsBottom="0" insetsRight="0" anchor="17" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JLabel" name="timestampToIncludeLabel">
<Container class="javax.swing.JPanel" name="padding">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.timestampToIncludeLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 0]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 0]"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JCheckBox" name="createTimeCheckBox">
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="2" gridY="0" gridWidth="1" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="0" insetsBottom="0" insetsRight="0" anchor="10" weightX="1.0" weightY="0.0"/>
</Constraint>
</Constraints>
<Layout>
<DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0">
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
</DimensionLayout>
</Layout>
</Container>
</SubComponents>
</Container>
<Component class="javax.swing.JLabel" name="timeStampToIncludeLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.createTimeCheckBox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.timeStampToIncludeLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="createTimeCheckBoxActionPerformed"/>
</Events>
</Component>
<Component class="javax.swing.JCheckBox" name="accessTimeCheckBox">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.accessTimeCheckBox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="accessTimeCheckBoxActionPerformed"/>
</Events>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="4" gridWidth="2" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="5" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JCheckBox" name="modifiedTimeCheckBox">
<Properties>
@ -256,19 +243,52 @@
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.modifiedTimeCheckBox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="modifiedTimeCheckBoxActionPerformed"/>
</Events>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="5" gridWidth="2" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="15" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JLabel" name="jLabel2">
<Component class="javax.swing.JCheckBox" name="createTimeCheckBox">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.jLabel2.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.createTimeCheckBox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="6" gridWidth="2" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="15" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JCheckBox" name="accessTimeCheckBox">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.accessTimeCheckBox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="7" gridWidth="2" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="15" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Component class="javax.swing.JLabel" name="timeStampNoteLabel">
<Properties>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.timeStampNoteLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="8" gridWidth="2" gridHeight="1" fill="0" ipadX="0" ipadY="0" insetsTop="10" insetsLeft="5" insetsBottom="5" insetsRight="5" anchor="18" weightX="0.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
</SubComponents>
</Container>
<Component class="javax.swing.JLabel" name="errorLabel">
<Properties>
<Property name="foreground" type="java.awt.Color" editor="org.netbeans.beaninfo.editors.ColorEditor">
@ -278,6 +298,40 @@
<ResourceString bundle="org/sleuthkit/autopsy/casemodule/Bundle.properties" key="LocalFilesPanel.errorLabel.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="9" gridWidth="2" gridHeight="1" fill="2" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="5" insetsBottom="5" insetsRight="5" anchor="18" weightX="1.0" weightY="0.0"/>
</Constraint>
</Constraints>
</Component>
<Container class="javax.swing.JPanel" name="paddingBottom">
<Properties>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[0, 0]"/>
</Property>
</Properties>
<AuxValues>
<AuxValue name="JavaCodeGenerator_VariableLocal" type="java.lang.Boolean" value="true"/>
<AuxValue name="JavaCodeGenerator_VariableModifier" type="java.lang.Integer" value="0"/>
</AuxValues>
<Constraints>
<Constraint layoutClass="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout" value="org.netbeans.modules.form.compat2.layouts.DesignGridBagLayout$GridBagConstraintsDescription">
<GridBagConstraints gridX="0" gridY="10" gridWidth="1" gridHeight="1" fill="3" ipadX="0" ipadY="0" insetsTop="0" insetsLeft="0" insetsBottom="0" insetsRight="0" anchor="10" weightX="0.0" weightY="1.0"/>
</Constraint>
</Constraints>
<Layout>
<DimensionLayout dim="0">
<Group type="103" groupAlignment="0" attributes="0">
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
</DimensionLayout>
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
</DimensionLayout>
</Layout>
</Container>
</SubComponents>
</Form>

437
Core/src/org/sleuthkit/autopsy/casemodule/LocalFilesPanel.java
View File

@ -19,15 +19,17 @@
package org.sleuthkit.autopsy.casemodule;
import java.io.File;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Comparator;
import java.util.List;
import java.util.Set;
import java.util.TreeSet;
import javax.swing.JFileChooser;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import java.util.logging.Level;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import javax.swing.AbstractListModel;
import javax.swing.JOptionPane;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.PathValidator;
@ -40,10 +42,10 @@ final class LocalFilesPanel extends javax.swing.JPanel {
private static final long serialVersionUID = 1L;
private final Set<File> currentFiles = new TreeSet<>(); //keep currents in a set to disallow duplicates per add
private boolean enableNext = false;
private static final Logger logger = Logger.getLogger(LocalFilesPanel.class.getName());
private String displayName = "";
private final LocalFilesModel listModel = new LocalFilesModel();
/**
* Creates new form LocalFilesPanel
@ -56,7 +58,8 @@ final class LocalFilesPanel extends javax.swing.JPanel {
private void customInit() {
localFileChooser.setMultiSelectionEnabled(true);
errorLabel.setVisible(false);
selectedPaths.setText("");
this.fileList.setModel(listModel);
listModel.clear();
this.displayNameLabel.setText(NbBundle.getMessage(this.getClass(), "LocalFilesPanel.displayNameLabel.text"));
}
@ -68,27 +71,33 @@ final class LocalFilesPanel extends javax.swing.JPanel {
@SuppressWarnings("unchecked")
// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
private void initComponents() {
java.awt.GridBagConstraints gridBagConstraints;
localFileChooser = new javax.swing.JFileChooser();
jPanel1 = new javax.swing.JPanel();
selectButton = new javax.swing.JButton();
deleteButon = new javax.swing.JButton();
clearButton = new javax.swing.JButton();
selectedPathsScrollPane = new javax.swing.JScrollPane();
selectedPaths = new javax.swing.JTextArea();
javax.swing.JScrollPane fileListScrollpane = new javax.swing.JScrollPane();
fileList = new javax.swing.JList<>();
javax.swing.JPanel displayNamePanel = new javax.swing.JPanel();
changeNameButton = new javax.swing.JButton();
displayNameLabel = new javax.swing.JLabel();
timestampToIncludeLabel = new javax.swing.JLabel();
javax.swing.JPanel padding = new javax.swing.JPanel();
javax.swing.JLabel timeStampToIncludeLabel = new javax.swing.JLabel();
modifiedTimeCheckBox = new javax.swing.JCheckBox();
createTimeCheckBox = new javax.swing.JCheckBox();
accessTimeCheckBox = new javax.swing.JCheckBox();
modifiedTimeCheckBox = new javax.swing.JCheckBox();
jLabel2 = new javax.swing.JLabel();
javax.swing.JLabel timeStampNoteLabel = new javax.swing.JLabel();
errorLabel = new javax.swing.JLabel();
javax.swing.JPanel paddingBottom = new javax.swing.JPanel();
localFileChooser.setApproveButtonText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonText")); // NOI18N
localFileChooser.setApproveButtonToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.approveButtonToolTipText")); // NOI18N
localFileChooser.setDialogTitle(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.localFileChooser.dialogTitle")); // NOI18N
localFileChooser.setFileSelectionMode(javax.swing.JFileChooser.FILES_AND_DIRECTORIES);
setLayout(new java.awt.GridBagLayout());
org.openide.awt.Mnemonics.setLocalizedText(selectButton, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.selectButton.text")); // NOI18N
selectButton.setToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.selectButton.toolTipText")); // NOI18N
selectButton.setActionCommand(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.selectButton.actionCommand")); // NOI18N
@ -100,6 +109,29 @@ final class LocalFilesPanel extends javax.swing.JPanel {
selectButtonActionPerformed(evt);
}
});
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 1;
gridBagConstraints.gridy = 0;
gridBagConstraints.fill = java.awt.GridBagConstraints.HORIZONTAL;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(5, 5, 5, 5);
add(selectButton, gridBagConstraints);
org.openide.awt.Mnemonics.setLocalizedText(deleteButon, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.deleteButon.text")); // NOI18N
deleteButon.setMaximumSize(new java.awt.Dimension(70, 23));
deleteButon.setMinimumSize(new java.awt.Dimension(70, 23));
deleteButon.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
deleteButonActionPerformed(evt);
}
});
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 1;
gridBagConstraints.gridy = 1;
gridBagConstraints.fill = java.awt.GridBagConstraints.HORIZONTAL;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(0, 5, 5, 5);
add(deleteButon, gridBagConstraints);
org.openide.awt.Mnemonics.setLocalizedText(clearButton, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.clearButton.text")); // NOI18N
clearButton.setToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.clearButton.toolTipText")); // NOI18N
@ -111,14 +143,30 @@ final class LocalFilesPanel extends javax.swing.JPanel {
clearButtonActionPerformed(evt);
}
});
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 1;
gridBagConstraints.gridy = 2;
gridBagConstraints.fill = java.awt.GridBagConstraints.HORIZONTAL;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(0, 5, 5, 5);
add(clearButton, gridBagConstraints);
selectedPathsScrollPane.setPreferredSize(new java.awt.Dimension(379, 96));
fileListScrollpane.setMaximumSize(new java.awt.Dimension(32767, 100));
fileListScrollpane.setMinimumSize(new java.awt.Dimension(100, 100));
fileListScrollpane.setPreferredSize(new java.awt.Dimension(258, 100));
selectedPaths.setEditable(false);
selectedPaths.setColumns(20);
selectedPaths.setRows(5);
selectedPaths.setToolTipText(org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.selectedPaths.toolTipText")); // NOI18N
selectedPathsScrollPane.setViewportView(selectedPaths);
fileListScrollpane.setViewportView(fileList);
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 0;
gridBagConstraints.gridheight = 3;
gridBagConstraints.fill = java.awt.GridBagConstraints.HORIZONTAL;
gridBagConstraints.weightx = 1.0;
gridBagConstraints.insets = new java.awt.Insets(5, 5, 5, 0);
add(fileListScrollpane, gridBagConstraints);
displayNamePanel.setLayout(new java.awt.GridBagLayout());
org.openide.awt.Mnemonics.setLocalizedText(changeNameButton, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.changeNameButton.text")); // NOI18N
changeNameButton.addActionListener(new java.awt.event.ActionListener() {
@ -126,121 +174,127 @@ final class LocalFilesPanel extends javax.swing.JPanel {
changeNameButtonActionPerformed(evt);
}
});
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 1;
gridBagConstraints.gridy = 0;
gridBagConstraints.fill = java.awt.GridBagConstraints.HORIZONTAL;
gridBagConstraints.anchor = java.awt.GridBagConstraints.WEST;
gridBagConstraints.insets = new java.awt.Insets(0, 5, 0, 0);
displayNamePanel.add(changeNameButton, gridBagConstraints);
org.openide.awt.Mnemonics.setLocalizedText(displayNameLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.displayNameLabel.text")); // NOI18N
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 0;
gridBagConstraints.anchor = java.awt.GridBagConstraints.WEST;
displayNamePanel.add(displayNameLabel, gridBagConstraints);
org.openide.awt.Mnemonics.setLocalizedText(timestampToIncludeLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.timestampToIncludeLabel.text")); // NOI18N
padding.setMinimumSize(new java.awt.Dimension(0, 0));
padding.setPreferredSize(new java.awt.Dimension(0, 0));
org.openide.awt.Mnemonics.setLocalizedText(createTimeCheckBox, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.createTimeCheckBox.text")); // NOI18N
createTimeCheckBox.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
createTimeCheckBoxActionPerformed(evt);
}
});
javax.swing.GroupLayout paddingLayout = new javax.swing.GroupLayout(padding);
padding.setLayout(paddingLayout);
paddingLayout.setHorizontalGroup(
paddingLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGap(0, 0, Short.MAX_VALUE)
);
paddingLayout.setVerticalGroup(
paddingLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGap(0, 0, Short.MAX_VALUE)
);
org.openide.awt.Mnemonics.setLocalizedText(accessTimeCheckBox, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.accessTimeCheckBox.text")); // NOI18N
accessTimeCheckBox.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
accessTimeCheckBoxActionPerformed(evt);
}
});
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 2;
gridBagConstraints.gridy = 0;
gridBagConstraints.weightx = 1.0;
displayNamePanel.add(padding, gridBagConstraints);
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 3;
gridBagConstraints.gridwidth = 2;
gridBagConstraints.fill = java.awt.GridBagConstraints.HORIZONTAL;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.weightx = 1.0;
gridBagConstraints.insets = new java.awt.Insets(0, 5, 5, 5);
add(displayNamePanel, gridBagConstraints);
org.openide.awt.Mnemonics.setLocalizedText(timeStampToIncludeLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.timeStampToIncludeLabel.text")); // NOI18N
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 4;
gridBagConstraints.gridwidth = 2;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(0, 5, 5, 5);
add(timeStampToIncludeLabel, gridBagConstraints);
org.openide.awt.Mnemonics.setLocalizedText(modifiedTimeCheckBox, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.modifiedTimeCheckBox.text")); // NOI18N
modifiedTimeCheckBox.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
modifiedTimeCheckBoxActionPerformed(evt);
}
});
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 5;
gridBagConstraints.gridwidth = 2;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(0, 15, 5, 5);
add(modifiedTimeCheckBox, gridBagConstraints);
org.openide.awt.Mnemonics.setLocalizedText(jLabel2, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.jLabel2.text")); // NOI18N
org.openide.awt.Mnemonics.setLocalizedText(createTimeCheckBox, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.createTimeCheckBox.text")); // NOI18N
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 6;
gridBagConstraints.gridwidth = 2;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(0, 15, 5, 5);
add(createTimeCheckBox, gridBagConstraints);
javax.swing.GroupLayout jPanel1Layout = new javax.swing.GroupLayout(jPanel1);
jPanel1.setLayout(jPanel1Layout);
jPanel1Layout.setHorizontalGroup(
jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup()
.addContainerGap()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(javax.swing.GroupLayout.Alignment.TRAILING, jPanel1Layout.createSequentialGroup()
.addComponent(selectedPathsScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
.addComponent(selectButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(clearButton, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addGap(2, 2, 2))
.addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(timestampToIncludeLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addContainerGap())
.addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(displayNameLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(changeNameButton)
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))))
.addGroup(jPanel1Layout.createSequentialGroup()
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup()
.addGap(23, 23, 23)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(modifiedTimeCheckBox)
.addComponent(accessTimeCheckBox)
.addComponent(createTimeCheckBox)))
.addGroup(jPanel1Layout.createSequentialGroup()
.addContainerGap()
.addComponent(jLabel2)))
.addGap(0, 0, Short.MAX_VALUE))
);
org.openide.awt.Mnemonics.setLocalizedText(accessTimeCheckBox, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.accessTimeCheckBox.text")); // NOI18N
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 7;
gridBagConstraints.gridwidth = 2;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(0, 15, 5, 5);
add(accessTimeCheckBox, gridBagConstraints);
jPanel1Layout.linkSize(javax.swing.SwingConstants.HORIZONTAL, new java.awt.Component[] {clearButton, selectButton});
jPanel1Layout.setVerticalGroup(
jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup()
.addGap(0, 0, 0)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(jPanel1Layout.createSequentialGroup()
.addComponent(selectButton, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGap(36, 36, 36)
.addComponent(clearButton, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addComponent(selectedPathsScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addGroup(jPanel1Layout.createParallelGroup(javax.swing.GroupLayout.Alignment.BASELINE)
.addComponent(changeNameButton)
.addComponent(displayNameLabel))
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(timestampToIncludeLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(modifiedTimeCheckBox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(createTimeCheckBox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(accessTimeCheckBox)
.addGap(18, 18, 18)
.addComponent(jLabel2, javax.swing.GroupLayout.PREFERRED_SIZE, 10, javax.swing.GroupLayout.PREFERRED_SIZE)
.addContainerGap(17, Short.MAX_VALUE))
);
org.openide.awt.Mnemonics.setLocalizedText(timeStampNoteLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.timeStampNoteLabel.text")); // NOI18N
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 8;
gridBagConstraints.gridwidth = 2;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.insets = new java.awt.Insets(10, 5, 5, 5);
add(timeStampNoteLabel, gridBagConstraints);
errorLabel.setForeground(new java.awt.Color(255, 0, 0));
org.openide.awt.Mnemonics.setLocalizedText(errorLabel, org.openide.util.NbBundle.getMessage(LocalFilesPanel.class, "LocalFilesPanel.errorLabel.text")); // NOI18N
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 9;
gridBagConstraints.gridwidth = 2;
gridBagConstraints.fill = java.awt.GridBagConstraints.HORIZONTAL;
gridBagConstraints.anchor = java.awt.GridBagConstraints.NORTHWEST;
gridBagConstraints.weightx = 1.0;
gridBagConstraints.insets = new java.awt.Insets(0, 5, 5, 5);
add(errorLabel, gridBagConstraints);
javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
this.setLayout(layout);
layout.setHorizontalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addComponent(jPanel1, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addContainerGap())
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addComponent(errorLabel)
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
paddingBottom.setMinimumSize(new java.awt.Dimension(0, 0));
javax.swing.GroupLayout paddingBottomLayout = new javax.swing.GroupLayout(paddingBottom);
paddingBottom.setLayout(paddingBottomLayout);
paddingBottomLayout.setHorizontalGroup(
paddingBottomLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGap(0, 0, Short.MAX_VALUE)
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addComponent(jPanel1, javax.swing.GroupLayout.PREFERRED_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(errorLabel))
paddingBottomLayout.setVerticalGroup(
paddingBottomLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGap(0, 0, Short.MAX_VALUE)
);
gridBagConstraints = new java.awt.GridBagConstraints();
gridBagConstraints.gridx = 0;
gridBagConstraints.gridy = 10;
gridBagConstraints.fill = java.awt.GridBagConstraints.VERTICAL;
gridBagConstraints.weighty = 1.0;
add(paddingBottom, gridBagConstraints);
}// </editor-fold>//GEN-END:initComponents
private void selectButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_selectButtonActionPerformed
@ -248,20 +302,10 @@ final class LocalFilesPanel extends javax.swing.JPanel {
if (returnVal == JFileChooser.APPROVE_OPTION) {
File[] files = localFileChooser.getSelectedFiles();
StringBuilder allPaths = new StringBuilder();
for (File f : files) {
currentFiles.add(f);
}
for (File f : currentFiles) {
//loop over set of all files to ensure list is accurate
//update label
allPaths.append(f.getAbsolutePath()).append("\n");
}
this.selectedPaths.setText(allPaths.toString());
this.selectedPaths.setToolTipText(allPaths.toString());
this.listModel.add(files);
}
enableNext = !currentFiles.isEmpty();
enableNext = !this.listModel.getFiles().isEmpty();
try {
firePropertyChange(DataSourceProcessor.DSP_PANEL_EVENT.UPDATE_UI.toString(), false, true);
@ -285,24 +329,32 @@ final class LocalFilesPanel extends javax.swing.JPanel {
}
}//GEN-LAST:event_changeNameButtonActionPerformed
private void createTimeCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_createTimeCheckBoxActionPerformed
private void deleteButonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_deleteButonActionPerformed
int minIdx = this.fileList.getMinSelectionIndex();
int maxIdx = this.fileList.getMaxSelectionIndex();
}//GEN-LAST:event_createTimeCheckBoxActionPerformed
if (minIdx >= 0 && maxIdx >= minIdx) {
this.listModel.remove(minIdx, maxIdx);
}
this.fileList.clearSelection();
private void accessTimeCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_accessTimeCheckBoxActionPerformed
enableNext = !this.listModel.getFiles().isEmpty();
}//GEN-LAST:event_accessTimeCheckBoxActionPerformed
private void modifiedTimeCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_modifiedTimeCheckBoxActionPerformed
}//GEN-LAST:event_modifiedTimeCheckBoxActionPerformed
try {
firePropertyChange(DataSourceProcessor.DSP_PANEL_EVENT.UPDATE_UI.toString(), false, true);
} catch (Exception e) {
logger.log(Level.SEVERE, "LocalFilesPanel listener threw exception", e); //NON-NLS
MessageNotifyUtil.Notify.show(NbBundle.getMessage(this.getClass(), "LocalFilesPanel.moduleErr"),
NbBundle.getMessage(this.getClass(), "LocalFilesPanel.moduleErr.msg"),
MessageNotifyUtil.MessageType.ERROR);
}
}//GEN-LAST:event_deleteButonActionPerformed
/**
* Clear the fields and undo any selection of files.
*/
void reset() {
currentFiles.clear();
selectedPaths.setText("");
this.listModel.clear();
enableNext = false;
errorLabel.setVisible(false);
displayName = "";
@ -316,20 +368,17 @@ final class LocalFilesPanel extends javax.swing.JPanel {
MessageNotifyUtil.MessageType.ERROR);
}
}
/**
* Get the path(s) which have been selected on this panel
*
* @return a List of Strings representing the path(s) for the selected files or directories
* @return a List of Strings representing the path(s) for the selected files
* or directories
*/
List<String> getContentPaths() {
List<String> pathsList = new ArrayList<>();
if (currentFiles == null) {
return pathsList;
}
for (File f : currentFiles) {
pathsList.add(f.getAbsolutePath());
}
return pathsList;
return this.listModel.getFiles().stream()
.map(File::getAbsolutePath)
.collect(Collectors.toList());
}
/**
@ -409,20 +458,104 @@ final class LocalFilesPanel extends javax.swing.JPanel {
return this.displayName;
}
/**
* A record of a file for the specific purposes of displaying in a JList
* (with toString).
*/
private static class FileRecord {
private final File file;
FileRecord(File file) {
this.file = file;
}
@Override
public String toString() {
return file == null ? "" : file.getAbsolutePath();
}
/**
* @return The underlying file.
*/
File getFile() {
return file;
}
}
/**
* JListModel for displaying files.
*/
private static class LocalFilesModel extends AbstractListModel<FileRecord> {
private List<File> items = Collections.emptyList();
@Override
public int getSize() {
return items.size();
}
@Override
public FileRecord getElementAt(int index) {
File f = items.get(index);
return new FileRecord(f);
}
/**
* Adds a series of files to the list model.
*
* @param files The files.
*/
void add(File... files) {
items = Stream.concat(items.stream(), Stream.of(files))
.sorted(Comparator.comparing(f -> f.getAbsolutePath().toLowerCase()))
.distinct()
.collect(Collectors.toList());
this.fireContentsChanged(this, 0, items.size() - 1);
}
/**
* Removes files in the list starting at minIdx going to maxIdx.
*
* @param minIdx The minimum index of items to be removed.
* @param maxIdx The maximum index to be removed.
*/
void remove(int minIdx, int maxIdx) {
for (int i = maxIdx; i >= minIdx; i--) {
items.remove(i);
}
this.fireContentsChanged(this, 0, items.size() - 1);
}
/**
* @return The files to be added to the local files data source.
*/
List<File> getFiles() {
return items;
}
/**
* Clears currently tracked local files.
*/
void clear() {
items.clear();
this.fireContentsChanged(this, 0, 0);
}
}
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JCheckBox accessTimeCheckBox;
private javax.swing.JButton changeNameButton;
private javax.swing.JButton clearButton;
private javax.swing.JCheckBox createTimeCheckBox;
private javax.swing.JButton deleteButon;
private javax.swing.JLabel displayNameLabel;
private javax.swing.JLabel errorLabel;
private javax.swing.JLabel jLabel2;
private javax.swing.JPanel jPanel1;
private javax.swing.JList<FileRecord> fileList;
private javax.swing.JFileChooser localFileChooser;
private javax.swing.JCheckBox modifiedTimeCheckBox;
private javax.swing.JButton selectButton;
private javax.swing.JTextArea selectedPaths;
private javax.swing.JScrollPane selectedPathsScrollPane;
private javax.swing.JLabel timestampToIncludeLabel;
// End of variables declaration//GEN-END:variables
}

1
Core/src/org/sleuthkit/autopsy/corecomponents/AutopsyOptionsPanel.java
View File

@ -506,7 +506,6 @@ final class AutopsyOptionsPanel extends javax.swing.JPanel {
confLoaded = true;
} catch (IOException ex) {
logger.log(Level.SEVERE, "Can't read current Jvm max memory setting from file", ex);
memField.setEnabled(false);
heapDumpFileField.setText(DEFAULT_HEAP_DUMP_FILE_FIELD);
}
memField.setText(initialMemValue);

24
Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java
View File

@ -71,7 +71,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
private static final String ALEAPP_EXECUTABLE = "aleapp.exe";//NON-NLS
private static final String ALEAPP_PATHS_FILE = "aLeapp_paths.txt"; //NON-NLS
private static final String XMLFILE = "aleap-artifact-attribute-reference.xml"; //NON-NLS
private static final String XMLFILE = "aleapp-artifact-attribute-reference.xml"; //NON-NLS
private File aLeappExecutable;
@ -86,7 +86,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
@NbBundle.Messages({
"ALeappAnalyzerIngestModule.executable.not.found=aLeapp Executable Not Found.",
"ALeappAnalyzerIngestModule.requires.windows=aLeapp module requires windows.",
"ALeappAnalyzerIngestModule.error.ileapp.file.processor.init=Failure to initialize aLeappProcessFile"})
"ALeappAnalyzerIngestModule.error.aleapp.file.processor.init=Failure to initialize aLeappProcessFile"})
@Override
public void startUp(IngestJobContext context) throws IngestModuleException {
this.context = context;
@ -100,9 +100,9 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
}
try {
aLeappFileProcessor = new LeappFileProcessor(XMLFILE, ALeappAnalyzerModuleFactory.getModuleName(), context);
aLeappFileProcessor = new LeappFileProcessor(XMLFILE, ALeappAnalyzerModuleFactory.getModuleName(), ALEAPP, context);
} catch (IOException | IngestModuleException | NoCurrentCaseException ex) {
throw new IngestModuleException(Bundle.ALeappAnalyzerIngestModule_error_ileapp_file_processor_init(), ex);
throw new IngestModuleException(Bundle.ALeappAnalyzerIngestModule_error_aleapp_file_processor_init(), ex);
}
try {
@ -148,7 +148,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
writeErrorMsgToIngestInbox();
return ProcessResult.ERROR;
}
aLeappPathsToProcess = loadIleappPathFile(tempOutputPath);
aLeappPathsToProcess = loadAleappPathFile(tempOutputPath);
if (aLeappPathsToProcess.isEmpty()) {
logger.log(Level.SEVERE, String.format("Error getting file paths to search, list is empty"));
writeErrorMsgToIngestInbox();
@ -178,7 +178,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
}
statusHelper.switchToIndeterminate();
statusHelper.progress(Bundle.ILeappAnalyzerIngestModule_processing_iLeapp_results());
statusHelper.progress(Bundle.ALeappAnalyzerIngestModule_processing_aLeapp_results());
extractFilesFromDataSource(dataSource, aLeappPathsToProcess, tempOutputPath);
processALeappFs(dataSource, currentCase, statusHelper, tempOutputPath.toString());
@ -219,7 +219,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
return;
}
addILeappReportToReports(moduleOutputPath, currentCase);
addALeappReportToReports(moduleOutputPath, currentCase);
} catch (IOException ex) {
logger.log(Level.SEVERE, String.format("Error when trying to execute aLeapp program against file %s", aLeappFile.getLocalAbsPath()), ex);
@ -227,7 +227,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
}
if (context.dataSourceIngestIsCancelled()) {
logger.log(Level.INFO, "ILeapp Analyser ingest module run was canceled"); //NON-NLS
logger.log(Level.INFO, "aLeapp Analyser ingest module run was canceled"); //NON-NLS
return;
}
@ -262,7 +262,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
return;
}
addILeappReportToReports(moduleOutputPath, currentCase);
addALeappReportToReports(moduleOutputPath, currentCase);
} catch (IOException ex) {
logger.log(Level.SEVERE, String.format("Error when trying to execute aLeapp program against file system"), ex);
@ -270,7 +270,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
}
if (context.dataSourceIngestIsCancelled()) {
logger.log(Level.INFO, "ILeapp Analyser ingest module run was canceled"); //NON-NLS
logger.log(Level.INFO, "aLeapp Analyser ingest module run was canceled"); //NON-NLS
return;
}
@ -335,7 +335,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
* Find the index.html file in the aLeapp output directory so it can be
* added to reports
*/
private void addILeappReportToReports(Path aLeappOutputDir, Case currentCase) {
private void addALeappReportToReports(Path aLeappOutputDir, Case currentCase) {
List<String> allIndexFiles = new ArrayList<>();
try (Stream<Path> walk = Files.walk(aLeappOutputDir)) {
@ -363,7 +363,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
* Reads the aLeapp paths file to get the paths that we want to extract
*
*/
private List<String> loadIleappPathFile(Path moduleOutputPath) throws FileNotFoundException, IOException {
private List<String> loadAleappPathFile(Path moduleOutputPath) throws FileNotFoundException, IOException {
List<String> aLeappPathsToProcess = new ArrayList<>();
Path filePath = Paths.get(moduleOutputPath.toString(), ALEAPP_PATHS_FILE);

2
Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/Bundle.properties-MERGED
View File

@ -1,7 +1,7 @@
ALeappAnalyzerIngestModule.aLeapp.cancelled=aLeapp run was canceled
ALeappAnalyzerIngestModule.completed=aLeapp Processing Completed
ALeappAnalyzerIngestModule.error.aleapp.file.processor.init=Failure to initialize aLeappProcessFile
ALeappAnalyzerIngestModule.error.creating.output.dir=Error creating aLeapp module output directory.
ALeappAnalyzerIngestModule.error.ileapp.file.processor.init=Failure to initialize aLeappProcessFile
ALeappAnalyzerIngestModule.error.running.aLeapp=Error running aLeapp, see log file.
ALeappAnalyzerIngestModule.executable.not.found=aLeapp Executable Not Found.
ALeappAnalyzerIngestModule.has.run=aLeapp

4
Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ILeappAnalyzerIngestModule.java
View File

@ -71,7 +71,7 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
private static final String ILEAPP_EXECUTABLE = "ileapp.exe";//NON-NLS
private static final String ILEAPP_PATHS_FILE = "iLeapp_paths.txt"; //NON-NLS
private static final String XMLFILE = "ileap-artifact-attribute-reference.xml"; //NON-NLS
private static final String XMLFILE = "ileapp-artifact-attribute-reference.xml"; //NON-NLS
private File iLeappExecutable;
@ -100,7 +100,7 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
}
try {
iLeappFileProcessor = new LeappFileProcessor(XMLFILE, ILeappAnalyzerModuleFactory.getModuleName(), context);
iLeappFileProcessor = new LeappFileProcessor(XMLFILE, ILeappAnalyzerModuleFactory.getModuleName(), ILEAPP, context);
} catch (IOException | IngestModuleException | NoCurrentCaseException ex) {
throw new IngestModuleException(Bundle.ILeappAnalyzerIngestModule_error_ileapp_file_processor_init(), ex);
}

187
Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java
View File

@ -145,7 +145,11 @@ public final class LeappFileProcessor {
}
private static final Logger logger = Logger.getLogger(LeappFileProcessor.class.getName());
private final String CUSTOM_ARTIFACTS_ATTRIBUTES_FILE = "custom-artifact-attribute-list.csv";
private final String ARTIFACT_ATTRIBUTE_REFERENCE_USER = "artifact-attribute-reference-user.xml";
private final String xmlFile; //NON-NLS
private final String leapModule;
private final String moduleName;
private final IngestJobContext context;
@ -198,7 +202,7 @@ public final class LeappFileProcessor {
private final Blackboard blkBoard;
public LeappFileProcessor(String xmlFile, String moduleName, IngestJobContext context) throws IOException, IngestModuleException, NoCurrentCaseException {
public LeappFileProcessor(String xmlFile, String moduleName, String leapModule, IngestJobContext context) throws IOException, IngestModuleException, NoCurrentCaseException {
this.tsvFiles = new HashMap<>();
this.tsvFileArtifacts = new HashMap<>();
this.tsvFileArtifactComments = new HashMap<>();
@ -206,15 +210,28 @@ public final class LeappFileProcessor {
this.xmlFile = xmlFile;
this.moduleName = moduleName;
this.context = context;
this.leapModule = leapModule;
blkBoard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();
loadCustomArtifactsAttributes(blkBoard, leapModule);
createCustomArtifacts(blkBoard);
configExtractor();
loadConfigFile();
}
/**
* Generates a key trimmed and case-insensitive that can be used for a
* case-insensitive lookup in a map.
*
* @param origKey The original key.
* @return The normalized key.
*/
private static String normalizeKey(String origKey) {
return StringUtils.defaultString(origKey).trim().toLowerCase();
}
@NbBundle.Messages({
"LeappFileProcessor.error.running.Leapp=Error running Leapp, see log file.",
"LeappFileProcessor.error.creating.output.dir=Error creating Leapp module output directory.",
@ -274,7 +291,7 @@ public final class LeappFileProcessor {
.filter(f -> f.toLowerCase().endsWith(".tsv")).collect(Collectors.toList());
for (String tsvFile : allTsvFiles) {
if (tsvFiles.containsKey(FilenameUtils.getName(tsvFile.toLowerCase()))) {
if (tsvFiles.containsKey(normalizeKey(FilenameUtils.getName(tsvFile)))) {
foundTsvFiles.add(tsvFile);
}
}
@ -323,9 +340,10 @@ public final class LeappFileProcessor {
progress.progress(Bundle.LeappFileProcessor_tsvProcessed(fileName), i);
File LeappFile = new File(LeappFileName);
if (tsvFileAttributes.containsKey(fileName)) {
List<TsvColumn> attrList = tsvFileAttributes.get(fileName);
BlackboardArtifact.Type artifactType = tsvFileArtifacts.get(fileName);
String fileKey = fileName.toLowerCase().trim();
if (tsvFileAttributes.containsKey(normalizeKey(fileKey))) {
List<TsvColumn> attrList = tsvFileAttributes.get(normalizeKey(fileKey));
BlackboardArtifact.Type artifactType = tsvFileArtifacts.get(normalizeKey(fileKey));
try {
processFile(LeappFile, attrList, fileName, artifactType, dataSource);
@ -895,18 +913,15 @@ public final class LeappFileProcessor {
private Collection<BlackboardAttribute> processReadLine(List<String> lineValues, Map<String, Integer> columnIndexes,
List<TsvColumn> attrList, String fileName, int lineNum) throws IngestModuleException {
// if no attributes, return an empty row
if (MapUtils.isEmpty(columnIndexes) || CollectionUtils.isEmpty(lineValues)
|| (lineValues.size() == 1 && StringUtils.isEmpty(lineValues.get(0)))) {
return Collections.emptyList();
} else if (lineValues.size() != columnIndexes.size()) {
logger.log(Level.WARNING, String.format(
"Row at line number %d in file %s has %d columns when %d were expected based on the header row.",
lineNum, fileName, lineValues.size(), columnIndexes.size()));
return Collections.emptyList();
}
List<BlackboardAttribute> attrsToRet = new ArrayList<>();
for (TsvColumn colAttr : attrList) {
// if no matching attribute type, keep going
if (colAttr.getAttributeType() == null) {
// this handles columns that are currently ignored.
continue;
@ -920,22 +935,30 @@ public final class LeappFileProcessor {
String value = (columnIdx >= lineValues.size() || columnIdx < 0) ? null : lineValues.get(columnIdx);
if (value == null) {
logger.log(Level.WARNING, String.format("No value found for column %s at line %d in file %s. Omitting row.", colAttr.getColumnName(), lineNum, fileName));
// if column is required, return empty for this row if no value
if (colAttr.isRequired()) {
logger.log(Level.WARNING, String.format("No value found for required column %s at line %d in file %s. Omitting row.", colAttr.getColumnName(), lineNum, fileName));
return Collections.emptyList();
} else {
// otherwise, continue to next column
logger.log(Level.WARNING, String.format("No value found for column %s at line %d in file %s. Omitting column.", colAttr.getColumnName(), lineNum, fileName));
continue;
}
}
String formattedValue = formatValueBasedOnAttrType(colAttr, value);
BlackboardAttribute attr = getAttribute(colAttr.getAttributeType(), formattedValue, fileName);
if (attr == null) {
if (attr != null) {
attrsToRet.add(attr);
} else if (colAttr.isRequired()) {
logger.log(Level.WARNING, String.format("Blackboard attribute could not be parsed column %s at line %d in file %s. Omitting row.", colAttr.getColumnName(), lineNum, fileName));
return Collections.emptyList();
}
attrsToRet.add(attr);
}
if (tsvFileArtifactComments.containsKey(fileName)) {
attrsToRet.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, moduleName, tsvFileArtifactComments.get(fileName)));
if (tsvFileArtifactComments.containsKey(normalizeKey(fileName))) {
attrsToRet.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, moduleName, tsvFileArtifactComments.get(normalizeKey(fileName))));
}
return attrsToRet;
@ -1065,6 +1088,18 @@ public final class LeappFileProcessor {
}
}
/**
* Read the XML config file and load the mappings into maps
*/
private void loadConfigFile() throws IngestModuleException {
String path = PlatformUtil.getUserConfigDirectory() + File.separator + xmlFile;
loadIndividualConfigFile(path);
String userPath = PlatformUtil.getUserConfigDirectory() + File.separator + leapModule + "-" + ARTIFACT_ATTRIBUTE_REFERENCE_USER;
if (new File(userPath).exists()) {
loadIndividualConfigFile(userPath);
}
}
/**
* Read the XML config file and load the mappings into maps
*/
@ -1075,10 +1110,9 @@ public final class LeappFileProcessor {
"LeappFileProcessor.postartifacts_error=Error posting Blackboard Artifact",
"LeappFileProcessor.error.creating.new.artifacts=Error creating new artifacts."
})
private void loadConfigFile() throws IngestModuleException {
private void loadIndividualConfigFile(String path) throws IngestModuleException {
Document xmlinput;
try {
String path = PlatformUtil.getUserConfigDirectory() + File.separator + xmlFile;
File f = new File(path);
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
@ -1104,7 +1138,7 @@ public final class LeappFileProcessor {
for (int i = 0; i < nlist.getLength(); i++) {
NamedNodeMap nnm = nlist.item(i).getAttributes();
tsvFiles.put(nnm.getNamedItem("filename").getNodeValue().toLowerCase(), nnm.getNamedItem("description").getNodeValue());
tsvFiles.put(normalizeKey(nnm.getNamedItem("filename").getNodeValue()), nnm.getNamedItem("description").getNodeValue());
}
@ -1130,11 +1164,11 @@ public final class LeappFileProcessor {
logger.log(Level.SEVERE, String.format("No known artifact mapping found for [artifact: %s, %s]",
artifactName, getXmlFileIdentifier(parentName)));
} else {
tsvFileArtifacts.put(parentName, foundArtifactType);
tsvFileArtifacts.put(normalizeKey(parentName), foundArtifactType);
}
if (!comment.toLowerCase().matches("null")) {
tsvFileArtifactComments.put(parentName, comment);
tsvFileArtifactComments.put(normalizeKey(parentName), comment);
}
}
@ -1196,14 +1230,14 @@ public final class LeappFileProcessor {
columnName.trim().toLowerCase(),
"yes".compareToIgnoreCase(required) == 0);
if (tsvFileAttributes.containsKey(parentName)) {
List<TsvColumn> attrList = tsvFileAttributes.get(parentName);
if (tsvFileAttributes.containsKey(normalizeKey(parentName))) {
List<TsvColumn> attrList = tsvFileAttributes.get(normalizeKey(parentName));
attrList.add(thisCol);
tsvFileAttributes.replace(parentName, attrList);
} else {
List<TsvColumn> attrList = new ArrayList<>();
attrList.add(thisCol);
tsvFileAttributes.put(parentName, attrList);
tsvFileAttributes.put(normalizeKey(parentName), attrList);
}
}
@ -1270,7 +1304,7 @@ public final class LeappFileProcessor {
private static final Set<String> ALLOWED_EXTENSIONS = new HashSet<>(Arrays.asList("zip", "tar", "tgz"));
/**
* Find the files that will be processed by the iLeapp program
* Find the files that will be processed by the Leapp program
*
* @param dataSource
*
@ -1303,6 +1337,111 @@ public final class LeappFileProcessor {
return leappFilesToProcess;
}
/**
* Create custom artifacts that are defined in the xLeapp xml file(s).
*
*/
private void loadCustomArtifactsAttributes(Blackboard blkBoard, String leapModule) {
for (Map.Entry<String, String> customArtifact : CUSTOM_ARTIFACT_MAP.entrySet()) {
String artifactName = customArtifact.getKey();
String artifactDescription = customArtifact.getValue();
createCustomAttributesArtifacts(blkBoard, "artifact", artifactName, artifactDescription, null);
}
File customFilePath = new File(PlatformUtil.getUserConfigDirectory() + File.separator + leapModule + '-' + CUSTOM_ARTIFACTS_ATTRIBUTES_FILE);
if (customFilePath.exists()) {
try (MappingIterator<List<String>> iterator = new CsvMapper()
.enable(CsvParser.Feature.WRAP_AS_ARRAY)
.readerFor(List.class)
.with(CsvSchema.emptySchema().withColumnSeparator(','))
.readValues(customFilePath)) {
if (iterator.hasNext()) {
// Header line we can skip
List<String> headerItems = iterator.next();
int lineNum = 2;
while (iterator.hasNext()) {
List<String> columnItems = iterator.next();
if (columnItems.size() > 3) {
createCustomAttributesArtifacts(blkBoard, columnItems.get(0), columnItems.get(1), columnItems.get(2), columnItems.get(3));
} else {
createCustomAttributesArtifacts(blkBoard, columnItems.get(0), columnItems.get(1), columnItems.get(2), null);
}
}
}
} catch (IOException ex) {
logger.log(Level.WARNING, String.format("Failed to read/open file %s.", customFilePath), ex);
}
}
}
/**
* Create custom attributes that are defined in the xLeapp xml file(s).
*
*/
private void createCustomAttributesArtifacts(Blackboard blkBoard, String atType, String atName, String atDescription, String attrType) {
if (atType.toLowerCase().equals("artifact")) {
try {
BlackboardArtifact.Type customArtifactType = blkBoard.getOrAddArtifactType(atName.toUpperCase(), atDescription);
} catch (Blackboard.BlackboardException ex) {
logger.log(Level.WARNING, String.format("Failed to create custom artifact type %s.", atName), ex);
}
return;
}
switch (attrType.toLowerCase()) {
case "json":
case "string":
try {
BlackboardAttribute.Type customAttrbiuteType = blkBoard.getOrAddAttributeType(atName.toUpperCase(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, atDescription);
} catch (Blackboard.BlackboardException ex) {
logger.log(Level.WARNING, String.format("Failed to create custom attribute type %s.", atName), ex);
}
return;
case "integer":
try {
BlackboardAttribute.Type customAttrbiuteType = blkBoard.getOrAddAttributeType(atName.toUpperCase(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, atDescription);
} catch (Blackboard.BlackboardException ex) {
logger.log(Level.WARNING, String.format("Failed to create custom attribute type %s.", atName), ex);
}
return;
case "long":
try {
BlackboardAttribute.Type customAttrbiuteType = blkBoard.getOrAddAttributeType(atName.toUpperCase(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, atDescription);
} catch (Blackboard.BlackboardException ex) {
logger.log(Level.WARNING, String.format("Failed to create custom attribute type %s.", atName), ex);
}
return;
case "double":
try {
BlackboardAttribute.Type customAttrbiuteType = blkBoard.getOrAddAttributeType(atName.toUpperCase(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, atDescription);
} catch (Blackboard.BlackboardException ex) {
logger.log(Level.WARNING, String.format("Failed to create custom attribute type %s.", atName), ex);
}
return;
case "byte":
try {
BlackboardAttribute.Type customAttrbiuteType = blkBoard.getOrAddAttributeType(atName.toUpperCase(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE, atDescription);
} catch (Blackboard.BlackboardException ex) {
logger.log(Level.WARNING, String.format("Failed to create custom attribute type %s.", atName), ex);
}
return;
case "datetime":
try {
BlackboardAttribute.Type customAttrbiuteType = blkBoard.getOrAddAttributeType(atName.toUpperCase(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME, atDescription);
} catch (Blackboard.BlackboardException ex) {
logger.log(Level.WARNING, String.format("Failed to create custom attribute type %s.", atName), ex);
}
return;
default:
logger.log(Level.WARNING, String.format("Attribute Type %s for file %s not defined.", attrType, atName)); //NON-NLS
return;
}
}
/**
* Create custom artifacts that are defined in the xLeapp xml file(s).
*

83
Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml → Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleapp-artifact-attribute-reference.xml
View File

@ -36,6 +36,14 @@
</ArtifactName>
</FileName>
<FileName filename="accounts ce 10.tsv" description="Accounts_ce">
<ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="accounts ce 0">
<AttributeName attributename="TSK_USER_ID" columnName="Name" required="yes" />
<AttributeName attributename="TSK_PROG_NAME" columnName="Type" required="yes" />
<AttributeName attributename="TSK_PASSWORD" columnName="Password" required="yes" />
</ArtifactName>
</FileName>
<FileName filename="authtokens 0.tsv" description="Authtokens">
<ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="Authtokens">
<AttributeName attributename="null" columnName="ID" required="no" />
@ -54,7 +62,15 @@
</ArtifactName>
</FileName>
<FileName filename="Browser Bookmarks.tsv" description="Browser Bookmarks">
<FileName filename="accounts de 10.tsv" description="Accounts_de">
<ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="accounts de 0">
<AttributeName attributename="null" columnName="Last password entry" required="no" />
<AttributeName attributename="TSK_USER_ID" columnName="Name" required="yes" />
<AttributeName attributename="TSK_PROG_NAME" columnName="Type" required="yes" />
</ArtifactName>
</FileName>
<FileName filename="Browser - Bookmarks.tsv" description="Browser Bookmarks">
<ArtifactName artifactname="TSK_WEB_BOOKMARK" comment="Browser Bookmarks">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Added Date" required="yes" />
<AttributeName attributename="TSK_URL" columnName="URL" required="yes" />
@ -64,7 +80,7 @@
</ArtifactName>
</FileName>
<FileName filename="Browser cookies.tsv" description="Browser Cookies">
<FileName filename="Browser - Cookies.tsv" description="Browser Cookies">
<ArtifactName artifactname="TSK_WEB_COOKIE" comment="Browser Cookies">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Date" required="yes" />
<AttributeName attributename="TSK_URL" columnName="Host" required="yes" />
@ -76,7 +92,7 @@
</ArtifactName>
</FileName>
<FileName filename="Browser History.tsv" description="Browser History">
<FileName filename="Browser - Web History.tsv" description="Browser History">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Browser History">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
<AttributeName attributename="TSK_URL" columnName="URL" required="yes"/>
@ -86,7 +102,7 @@
</ArtifactName>
</FileName>
<FileName filename="Browser keyword search terms.tsv" description="Browser keyword Search Terms">
<FileName filename="Browser - Keyword Search Terms.tsv" description="Browser keyword Search Terms">
<ArtifactName artifactname="TSK_WEB_SEARCH_QUERY" comment="Browser Keyword Search Terms">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
<AttributeName attributename="TSK_TEXT" columnName="Term" required="yes"/>
@ -94,7 +110,7 @@
</ArtifactName>
</FileName>
<FileName filename="Browser login data.tsv" description="Browser Login Data">
<FileName filename="Browser - Login Data.tsv" description="Browser Login Data">
<ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="Browser Login">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Time" required="yes" />
<AttributeName attributename="TSK_USER_ID" columnName="Username" required="yes" />
@ -104,7 +120,7 @@
</ArtifactName>
</FileName>
<FileName filename="Browser offline pages.tsv" description="Browser Offline Pages">
<FileName filename="Browser - Offline Pages.tsv" description="Browser Offline Pages">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Browser Offline Pages">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Creation Time" required="yes" />
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Time" required="yes" />
@ -116,7 +132,7 @@
</ArtifactName>
</FileName>
<FileName filename="Browser search terms.tsv" description="Browser Search Terms">
<FileName filename="Browser - Search Terms.tsv" description="Browser Search Terms">
<ArtifactName artifactname="TSK_WEB_SEARCH_QUERY" comment="Browser Search Terms">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
<AttributeName attributename="TSK_TEXT" columnName="Search Term" required="yes"/>
@ -126,7 +142,7 @@
</ArtifactName>
</FileName>
<FileName filename="Browser top sites.tsv" description="Browser Top Sites">
<FileName filename="Browser - Top Sites.tsv" description="Browser Top Sites">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Browser Top Sites">
<AttributeName attributename="TSK_URL" columnName="URL" required="yes" />
<AttributeName attributename="null" columnName="Rank" required="no" />
@ -151,7 +167,7 @@
</ArtifactName>
</FileName>
<FileName filename="Chrome Bookmarks.tsv" description="Chrome Bookmarks">
<FileName filename="Chrome - Bookmarks.tsv" description="Chrome Bookmarks">
<ArtifactName artifactname="TSK_WEB_BOOKMARK" comment="Chrome Bookmarks">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Added Date" required="yes" />
<AttributeName attributename="TSK_URL" columnName="URL" required="yes" />
@ -161,7 +177,7 @@
</ArtifactName>
</FileName>
<FileName filename="Chrome cookies.tsv" description="Chrome Cookies">
<FileName filename="Chrome - cookies.tsv" description="Chrome Cookies">
<ArtifactName artifactname="TSK_WEB_COOKIE" comment="Chrome Cookies">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Date" required="yes" />
<AttributeName attributename="TSK_URL" columnName="Host" required="yes" />
@ -173,7 +189,7 @@
</ArtifactName>
</FileName>
<FileName filename="Chrome History.tsv" description="Chrome History">
<FileName filename="Chrome - Web History.tsv" description="Chrome History">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Chrome History">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
<AttributeName attributename="TSK_URL" columnName="URL" required="yes"/>
@ -183,17 +199,18 @@
</ArtifactName>
</FileName>
<FileName filename="Chrome login data.tsv" description="Chrome Login Data">
<FileName filename="Chrome - login data.tsv" description="Chrome Login Data">
<ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="Chrome Login">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Time" required="yes" />
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Time" required="no" />
<AttributeName attributename="TSK_USER_ID" columnName="Username" required="yes" />
<AttributeName attributename="TSK_PASSWORD" columnName="Password" required="yes" />
<AttributeName attributename="TSK_PASSWORD" columnName="Password" required="no" />
<AttributeName attributename="TSK_URL" columnName="Origin URL" required="no" />
<AttributeName attributename="null" columnName="Blacklisted by User" required="no" />
<AttributeName attributename="null" columnName="Browser Name" required="no" />
</ArtifactName>
</FileName>
<FileName filename="Chrome offline pages.tsv" description="Chrome Offline Pages">
<FileName filename="Chrome - offline pages.tsv" description="Chrome Offline Pages">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Chrome Offline Pages">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Creation Time" required="yes" />
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Time" required="yes" />
@ -205,7 +222,7 @@
</ArtifactName>
</FileName>
<FileName filename="Chrome search terms.tsv" description="Chrome Search Terms">
<FileName filename="Chrome - search terms.tsv" description="Chrome Search Terms">
<ArtifactName artifactname="TSK_WEB_SEARCH_QUERY" comment="Chrome Search Terms">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
<AttributeName attributename="TSK_TEXT" columnName="Search Term" required="yes"/>
@ -215,7 +232,7 @@
</ArtifactName>
</FileName>
<FileName filename="Chrome top sites.tsv" description="Chrome Top Sites">
<FileName filename="Chrome - top sites.tsv" description="Chrome Top Sites">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Chrome Top Sites">
<AttributeName attributename="TSK_URL" columnName="URL" required="yes" />
<AttributeName attributename="null" columnName="Rank" required="no" />
@ -224,7 +241,7 @@
</ArtifactName>
</FileName>
<FileName filename="Edge Bookmarks.tsv" description="Edge Bookmarks">
<FileName filename="Edge - Bookmarks.tsv" description="Edge Bookmarks">
<ArtifactName artifactname="TSK_WEB_BOOKMARK" comment="Edge Bookmarks">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Added Date" required="yes" />
<AttributeName attributename="TSK_URL" columnName="URL" required="yes" />
@ -234,19 +251,19 @@
</ArtifactName>
</FileName>
<FileName filename="Edge cookies.tsv" description="Edge Cookies">
<FileName filename="Edge - cookies.tsv" description="Edge Cookies">
<ArtifactName artifactname="TSK_WEB_COOKIE" comment="Edge Cookies">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Date" required="yes" />
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Date" required="no" />
<AttributeName attributename="TSK_URL" columnName="Host" required="yes" />
<AttributeName attributename="TSK_NAME" columnName="Name" required="yes" />
<AttributeName attributename="TSK_VALUE" columnName="Value" required="yes" />
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Date" required="yes" />
<AttributeName attributename="TSK_DATETIME_END" columnName="Expiration Date" required="yes" />
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Date" required="no" />
<AttributeName attributename="TSK_DATETIME_END" columnName="Expiration Date" required="no" />
<AttributeName attributename="null" columnName="Path" required="no" />
</ArtifactName>
</FileName>
<FileName filename="Edge History.tsv" description="Edge History">
<FileName filename="Edge - Web History.tsv" description="Edge History">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Edge History">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
<AttributeName attributename="TSK_URL" columnName="URL" required="yes"/>
@ -256,7 +273,7 @@
</ArtifactName>
</FileName>
<FileName filename="Edge login data.tsv" description="Edge Login Data">
<FileName filename="Edge - login data.tsv" description="Edge Login Data">
<ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="Edge Login">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Time" required="yes" />
<AttributeName attributename="TSK_USER_ID" columnName="Username" required="yes" />
@ -266,7 +283,7 @@
</ArtifactName>
</FileName>
<FileName filename="Edge offline pages.tsv" description="Edge Offline Pages">
<FileName filename="Edge - offline pages.tsv" description="Edge Offline Pages">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Edge Offline Pages">
<AttributeName attributename="TSK_DATETIME_CREATED" columnName="Creation Time" required="yes" />
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Time" required="yes" />
@ -278,7 +295,7 @@
</ArtifactName>
</FileName>
<FileName filename="Edge search terms.tsv" description="Edge Search Terms">
<FileName filename="Edge - search terms.tsv" description="Edge Search Terms">
<ArtifactName artifactname="TSK_WEB_SEARCH_QUERY" comment="Chrome Search Terms">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
<AttributeName attributename="TSK_TEXT" columnName="Search Term" required="yes"/>
@ -288,7 +305,7 @@
</ArtifactName>
</FileName>
<FileName filename="Edge top sites.tsv" description="Edge Top Sites">
<FileName filename="Edge - top sites.tsv" description="Edge Top Sites">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="Edge Top Sites">
<AttributeName attributename="TSK_URL" columnName="URL" required="yes" />
<AttributeName attributename="null" columnName="Rank" required="no" />
@ -317,7 +334,7 @@
<FileName filename="installed apps library.tsv" description="Installed Apps (Library)">
<ArtifactName artifactname="TSK_INSTALLED_PROG" comment="Installed Apps (Library)">
<AttributeName attributename="TSK_DATETIME" columnName="Purchase Time" required="yes"/>
<AttributeName attributename="TSK_DATETIME" columnName="Purchase Time" required="no"/>
<AttributeName attributename="null" columnName="Account" required="no"/>
<AttributeName attributename="TSK_PROG_NAME" columnName="Doc ID" required="yes"/>
</ArtifactName>
@ -329,13 +346,21 @@
</ArtifactName>
</FileName>
<FileName filename="installed apps - GMS_0.tsv" description="Installed Apps">
<ArtifactName artifactname="TSK_INSTALLED_PROG" comment="Installed Apps GSM">
<AttributeName attributename="TSK_PROG_NAME" columnName="Bundle ID" required="yes" />
</ArtifactName>
</FileName>
<FileName filename="installed apps vending.tsv" description="Installed Apps (Vending)">
<ArtifactName artifactname="TSK_INSTALLED_PROG" comment="Installed Apps (Vending)">
<AttributeName attributename="TSK_DATETIME" columnName="First Download" required="yes" />
<AttributeName attributename="TSK_DATETIME" columnName="First Download" required="no" />
<AttributeName attributename="TSK_PROG_NAME" columnName="Package Name" required="yes" />
<AttributeName attributename="null" columnName="Title" required="no" />
<AttributeName attributename="null" columnName="Install Reason" required="no" />
<AttributeName attributename="null" columnName="Last Updated" required="no" />
<AttributeName attributename="null" columnName="Auto Update?" required="no" />
<AttributeName attributename="null" columnName="Account" required="no" />
</ArtifactName>
</FileName>

109
Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml → Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileapp-artifact-attribute-reference.xml
View File

@ -66,14 +66,24 @@
</FileName>
<FileName filename="Bluetooth paired.tsv" description="Bluetooth Paired">
<ArtifactName artifactname="TSK_BLUETOOTH_PAIRING" comment="Bluetooth Paired">
<AttributeName attributename="TSK_DATETIME" columnName="Last Seen Time" required="no" />
<AttributeName attributename="TSK_MAC_ADDRESS" columnName="MAC Address" required="no" />
<AttributeName attributename="TSK_DEVICE_NAME" columnName="Name Key" required="yes" />
<AttributeName attributename="null" columnName="Name" required="no" />
<AttributeName attributename="null" columnName="Device Product ID" required="no" />
<AttributeName attributename="null" columnName="Default Name" required="no" />
</ArtifactName>
</FileName>
<FileName filename="Bluetooth paired LE.tsv" description="Bluetooth Paired LE">
<ArtifactName artifactname="TSK_BLUETOOTH_PAIRING" comment="Bluetooth Paired">
<AttributeName attributename="TSK_DEVICE_ID" columnName="UUID" required="yes" />
<AttributeName attributename="TSK_DEVICE_NAME" columnName="Name" required="yes" />
<AttributeName attributename="null" columnName="Name Origin" required="no" />
<AttributeName attributename="null" columnName="Address" required="no" />
<AttributeName attributename="null" columnName="Resolved Address" required="no" />
<AttributeName attributename="TSK_DATETIME" columnName="Last Seen Time" required="yes" />
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Connection Time" required="yes" />
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Connection Time" required="no" />
</ArtifactName>
</FileName>
@ -92,16 +102,17 @@
<FileName filename="Call History.tsv" description="Call Logs">
<ArtifactName artifactname="TSK_CALLLOG" comment="Call Logs">
<AttributeName attributename="TSK_DATETIME_START" columnName="Timestamp" required="yes" />
<AttributeName attributename="TSK_PHONE_NUMBER_FROM" columnName="Address" required="yes" />
<AttributeName attributename="null" columnName="Was Answered" required="no" />
<AttributeName attributename="TSK_DATETIME_START" columnName="Starting Timestamp" required="yes" />
<AttributeName attributename="TSK_DATETIME_END" columnName="Ending Timestamp" required="no" />
<AttributeName attributename="TSK_PHONE_NUMBER_FROM" columnName="Phone Number" required="yes" />
<AttributeName attributename="null" columnName="Name" required="no" />
<AttributeName attributename="null" columnName="Answered" required="no" />
<AttributeName attributename="null" columnName="Call Type" required="no" />
<AttributeName attributename="null" columnName="Originated" required="no" />
<AttributeName attributename="null" columnName="Duration in Secs" required="no" />
<AttributeName attributename="null" columnName="Call Direction" required="no" />
<AttributeName attributename="null" columnName="Call Duration" required="no" />
<AttributeName attributename="null" columnName="ISO County Code" required="no" />
<AttributeName attributename="null" columnName="Location" required="no" />
<AttributeName attributename="null" columnName="Service Provider" required="no" />
<AttributeName attributename="TSK_TEXT_FILE" columnName="source file" required="yes"/>
</ArtifactName>
</FileName>
@ -713,18 +724,23 @@
</ArtifactName>
</FileName>
<FileName filename="Safari Browser History.tsv" description="Safari Browser">
<FileName filename="Recent WebSearches.tsv" description="Recent Web Searches">
<ArtifactName artifactname="TSK_WEB_SEARCH_QUERY" comment="null">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Date" required="yes" />
<AttributeName attributename="TSK_TEXT" columnName="Search Term" required="yes" />
</ArtifactName>
</FileName>
<FileName filename="Safari Browser - History.tsv" description="Safari Browser">
<ArtifactName artifactname="TSK_WEB_HISTORY" comment="null">
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Visit Time" required="yes" />
<AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Visit Timestamp" required="no" />
<AttributeName attributename="TSK_TITLE" columnName="Title" required="no" />
<AttributeName attributename="TSK_URL" columnName="URL" required="yes" />
<AttributeName attributename="null" columnName="Visit Count" required="no" />
<AttributeName attributename="TSK_TITLE" columnName="Title" required="yes" />
<AttributeName attributename="null" columnName="iCloud Sync" required="no" />
<AttributeName attributename="null" columnName="Load Successful" required="no" />
<AttributeName attributename="null" columnName="Visit ID" required="no" />
<AttributeName attributename="TSK_REFERRER" columnName="Redirect Source" required="yes" />
<AttributeName attributename="TSK_REFERRER" columnName="Redirect Source" required="no" />
<AttributeName attributename="null" columnName="Redirect Destination" required="no" />
<AttributeName attributename="null" columnName="History Item ID" required="no" />
<AttributeName attributename="null" columnName="Visit ID" required="no" />
<AttributeName attributename="null" columnName="Origin" required="no" />
</ArtifactName>
</FileName>
@ -744,22 +760,28 @@
</ArtifactName>
</FileName>
<FileName filename="SMS - iMessage.tsv" description="SMS - iMessage">
<FileName filename="SMS &amp; iMessage - Messages.tsv" description="SMS - iMessage">
<ArtifactName artifactname="TSK_MESSAGE" comment="SMS - iMessage">
<AttributeName attributename="TSK_DATETIME" columnName="Message Date" required="yes" />
<AttributeName attributename="null" columnName="Date Delivered" required="no" />
<AttributeName attributename="null" columnName="Date Read" required="no" />
<AttributeName attributename="TSK_DATETIME" columnName="Message Timestamp" required="yes" />
<AttributeName attributename="null" columnName="Read Timestamp" required="no" />
<AttributeName attributename="TSK_TEXT" columnName="Message" required="yes" />
<AttributeName attributename="TSK_PHONE_NUMBER_FROM" columnName="Contact ID" required="yes" />
<AttributeName attributename="null" columnName="Service" required="no" />
<AttributeName attributename="TSK_PHONE_NUMBER_TO" columnName="Account" required="yes" />
<AttributeName attributename="null" columnName="Is Delivered" required="no" />
<AttributeName attributename="null" columnName="Is from Me" required="no" />
<AttributeName attributename="null" columnName="Filename" required="no" />
<AttributeName attributename="null" columnName="MIME Type" required="no" />
<AttributeName attributename="null" columnName="Transfer Type" required="no" />
<AttributeName attributename="null" columnName="Total Bytes" required="no" />
<AttributeName attributename="TSK_TEXT_FILE" columnName="source file" required="yes"/>
<AttributeName attributename="null" columnName="Message Direction" required="no" />
<AttributeName attributename="null" columnName="Message Sent" required="no" />
<AttributeName attributename="null" columnName="Message Delivered" required="no" />
<AttributeName attributename="null" columnName="Message Read" required="no" />
<AttributeName attributename="null" columnName="Account" required="no" />
<AttributeName attributename="null" columnName="Account Login" required="no" />
<AttributeName attributename="null" columnName="Chat" required="no" />
<AttributeName attributename="null" columnName="Contact ID" required="no" />
<AttributeName attributename="null" columnName="Attachment Name" required="no" />
<AttributeName attributename="null" columnName="Attachment Path" required="no" />
<AttributeName attributename="null" columnName="Attachment Timestamp" required="no" />
<AttributeName attributename="null" columnName="Attachment Mimetype" required="no" />
<AttributeName attributename="null" columnName="Attachment Size (Bytes)" required="no" />
<AttributeName attributename="null" columnName="Message Row ID" required="no" />
<AttributeName attributename="TSK_THREAD_ID" columnName="Chat ID" required="no" />
<AttributeName attributename="null" columnName="From Me" required="no" />
</ArtifactName>
</FileName>
@ -779,4 +801,33 @@
</ArtifactName>
</FileName>
<FileName filename="Wifi Known Networks.tsv" description="Wifi Known Networks">
<ArtifactName artifactname="TSK_WIFI_NETWORK" comment="Wifi">
<AttributeName attributename="TSK_SSID" columnName="SSID" required="yes" />
<AttributeName attributename="TSK_MAC_ADDRESS" columnName="BSSID" required="yes" />
<AttributeName attributename="null" columnName="Network usage" required="no" />
<AttributeName attributename="null" columnName="Country code" required="no" />
<AttributeName attributename="TSK_DEVICE_ID" columnName="Device name" required="yes" />
<AttributeName attributename="null" columnName="Manufacturer" required="no" />
<AttributeName attributename="null" columnName="Serial number" required="no" />
<AttributeName attributename="TSK_DEVICE_MODEL" columnName="Model name" required="no" />
<AttributeName attributename="TSK_DATETIME" columnName="Last joined" required="yes" />
<AttributeName attributename="null" columnName="Last autojoined" required="no" />
<AttributeName attributename="null" columnName="Enabled" required="no" />
</ArtifactName>
</FileName>
<FileName filename="Wifi Network Store Model - Networks.tsv" description="Wifi Network Store Model - Networks">
<ArtifactName artifactname="TSK_WIFI_NETWORK" comment="Wifi">
<AttributeName attributename="TSK_DATETIME" columnName="Last Connected Timestamp" required="no" />
<AttributeName attributename="null" columnName="PK" required="no" />
<AttributeName attributename="TSK_SSID" columnName="SSID" required="yes" />
<AttributeName attributename="TSK_GEO_LATITUDE" columnName="Latitude" required="no" />
<AttributeName attributename="TSK_GEO_LONGITUDE" columnName="Longitude" required="no" />
<AttributeName attributename="TSK_MAC_ADDRESS" columnName="BSSID" required="no" />
<AttributeName attributename="null" columnName="5 GHz Network" required="no" />
<AttributeName attributename="null" columnName="2.4 GHz Network" required="no" />
</ArtifactName>
</FileName>
</iLeap_Files_To_Process>

19
build-windows-installer.xml
View File

@ -174,11 +174,11 @@
<move file="${nbdist.dir}/installer_${app.name}_64-SetupFiles/installer_${app.name}_64.msi" tofile="${nbdist.dir}/${app.name}-${app.version}-64bit.msi" />
</target>
<!-- 32/64 specific since config settings are different -->
<!-- Sets Java 17 JVM parameters -->
<target name="update-config" description="Updates configuration file with correct JVM args.">
<property name="inst.property.file" value="${inst-path}/etc/${app.name}.conf" />
<!-- Sets max heap size to be ${jvm.max.mem} which is set in the run-ai-(32/64) target -->
<var name="jvm.args" value="&quot;--branding ${app.name} -J-Xms24m -J-Xmx${jvm.max.mem} -J-XX:+UseStringDeduplication -J-Dprism.order=sw -J--add-opens=java.base/java.net=ALL-UNNAMED -J--add-opens=java.desktop/javax.swing=ALL-UNNAMED -J--add-opens=javafx.controls/javafx.scene.control.skin=ALL-UNNAMED -J--add-exports=java.desktop/sun.awt=ALL-UNNAMED -J--add-exports=javafx.controls/com.sun.javafx.scene.control.inputmap=ALL-UNNAMED -J--add-exports=javafx.base/com.sun.javafx.event=ALL-UNNAMED&quot;" />
<!-- Sets Java 17 JVM parameters -->
<var name="jvm.args" value="&quot;--branding ${app.name} -J-Xms24m -J-XX:+UseStringDeduplication -J-Dprism.order=sw -J--add-opens=java.base/java.net=ALL-UNNAMED -J--add-opens=java.desktop/javax.swing=ALL-UNNAMED -J--add-opens=javafx.controls/javafx.scene.control.skin=ALL-UNNAMED -J--add-exports=java.desktop/sun.awt=ALL-UNNAMED -J--add-exports=javafx.controls/com.sun.javafx.scene.control.inputmap=ALL-UNNAMED -J--add-exports=javafx.base/com.sun.javafx.event=ALL-UNNAMED&quot;" />
<propertyfile file="${inst.property.file}">
<entry key="default_options" value="@JVM_OPTIONS" />
<!-- Update configuration file to include runtime -->
@ -223,6 +223,19 @@
<arg line="/edit ${aip-path} /AddFolder APPDIR\${photorec-rel-path} ${photorec-path-to-use}"/>
</exec>
<!-- FOR 4.21.0 RELEASE ONLY! In rare circumstances on some OSs, due to
Java 17 update some of the existing legacy Java 8 JVM arguments prevent
JVM 17 from starting. Therefore we are overwiriting the Java 8 Autopsy.conf
file with a Java 17 Autopsy.conf file, just in case. This should be removed
from future Autopsy releases. -->
<exec executable="${ai-exe-path}" failonerror="yes">
<arg value="/edit"/>
<arg value="${aip-path}"/>
<arg value="/AddFolder"/>
<arg value="AppDataFolder\${app.name}"/>
<arg value="${basedir}\installer_autopsy\etc"/>
</exec>
<echo message="Removing extra ewfexport_exec binaries..."/>
<exec executable="${ai-exe-path}">
<arg line="/edit ${aip-path} /DelFolder APPDIR\${ewfexport-path-todelete}"/>

71
installer_autopsy/etc/autopsy.conf Executable file
View File

@ -0,0 +1,71 @@
#Thu, 15 Jun 2023 09:17:11 -0400
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
# ${HOME} will be replaced by user home directory according to platform.
#
# Default locations of userdir and cachedir:
# (http://wiki.netbeans.org/FaqWhatIsUserdir)
#
# On Windows ${DEFAULT_USERDIR_ROOT} will be replaced by the launcher
# with <AppData>\<AppName>, where <AppData> is the value of
# "AppData" key in Windows Registry under
# "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
# and ${DEFAULT_CACHEDIR_ROOT} will be replaced by the launcher
# with the value of "<LocalAppData>\<AppName>\Cache" where "LocalAppData"
# is a key in Windows Registry under
# "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders".
# <AppName> is the the executable's filename without the extension.
#
# On Mac ${DEFAULT_USERDIR_ROOT} will be replaced by the launcher
# with "~/Library/Application Support/<AppName>" and
# ${DEFAULT_CACHEDIR_ROOT} with "~/Library/Caches/<AppName>"
# where <AppName> is the launcher script's name.
#
# On other systems ${DEFAULT_USERDIR_ROOT} will be replaced by the launcher
# with "${HOME}/.<AppName>" and ${DEFAULT_CACHEDIR_ROOT} with
# "${HOME}/.cache/<AppName>".
#
# You can also use ${HOME} variable which will be replaced with
# user.home JVM system property value.
#
# The above location variables are valid only in the default_userdir and
# default_cachedir properties.
#
# NOTE: If you specify a non-default userdir path on command line
# (--userdir option) and don't specify a cachedir path (--cachedir option),
# cachedir will be in "<userdir>/var/cache".
#
# Cachedir must be different from userdir. The same cachedir and userdir
# would cause problems.
#
default_userdir=${DEFAULT_USERDIR_ROOT}
default_cachedir="${DEFAULT_CACHEDIR_ROOT}/dev"
# options used by the launcher by default, can be overridden by explicit
# command line switches
default_options="--branding autopsy -J-Xms24m -J-XX:+UseStringDeduplication -J-Dprism.order=sw -J--add-opens=java.base/java.net=ALL-UNNAMED -J--add-opens=java.desktop/javax.swing=ALL-UNNAMED -J--add-opens=javafx.controls/javafx.scene.control.skin=ALL-UNNAMED -J--add-exports=java.desktop/sun.awt=ALL-UNNAMED -J--add-exports=javafx.controls/com.sun.javafx.scene.control.inputmap=ALL-UNNAMED -J--add-exports=javafx.base/com.sun.javafx.event=ALL-UNNAMED"
# for development purposes you may wish to append: -J-Dnetbeans.logger.console=true -J-ea
# default location of JDK/JRE, can be overridden by using --jdkhome <dir> switch
#jdkhome="/path/to/jdk"
# clusters' paths separated by path.separator (semicolon on Windows, colon on Unices)
#extra_clusters=
jdkhome="jre"

1
thirdparty/aLeapp/Version.txt vendored Normal file
View File

@ -0,0 +1 @@
ALEAPP v3.1.6: Android Logs, Events, and Protobuf Parser

BIN
thirdparty/aLeapp/aleapp.exe vendored
View File

Binary file not shown.

1
thirdparty/iLeapp/Version.txt vendored Normal file
View File

@ -0,0 +1 @@
iLEAPP v1.18.6: iLEAPP Logs, Events, and Properties Parser

BIN
thirdparty/iLeapp/ileapp.exe vendored
View File

Binary file not shown.