From dfccd20491f028a04ca42981e93f45951ad0cce2 Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Mon, 16 Aug 2021 13:32:50 -0400 Subject: [PATCH] Add static string to EncryptionDetection Added static string to EncryptionDetection module to keep a consistent message that can be called for password protected files. --- .../modules/embeddedfileextractor/SevenZipExtractor.java | 2 +- .../EncryptionDetectionFileIngestModule.java | 3 +-- .../EncryptionDetectionModuleFactory.java | 8 +++----- 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/SevenZipExtractor.java b/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/SevenZipExtractor.java index 31f12eafce..a96de76442 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/SevenZipExtractor.java +++ b/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/SevenZipExtractor.java @@ -96,7 +96,7 @@ class SevenZipExtractor { //encryption type strings private static final String ENCRYPTION_FILE_LEVEL = NbBundle.getMessage(EmbeddedFileExtractorIngestModule.class, "EmbeddedFileExtractorIngestModule.ArchiveExtractor.encryptionFileLevel"); - private static final String ENCRYPTION_FULL = EncryptionDetectionModuleFactory.getPasswordProtectMessage(); + private static final String ENCRYPTION_FULL = EncryptionDetectionModuleFactory.PASSWORD_PROTECT_MESSAGE; //zip bomb detection private static final int MAX_DEPTH = 4; diff --git a/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionFileIngestModule.java index 1834f349fb..81e7c1877e 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionFileIngestModule.java @@ -119,7 +119,6 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter } @Messages({ -// "EncryptionDetectionFileIngestModule.artifactComment.password=Password protection detected.", "EncryptionDetectionFileIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f)." }) @Override @@ -160,7 +159,7 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter String.format(Bundle.EncryptionDetectionFileIngestModule_artifactComment_suspected(), calculatedEntropy)); } else if (isFilePasswordProtected(file)) { return flagFile(file, BlackboardArtifact.Type.TSK_ENCRYPTION_DETECTED, Score.SCORE_NOTABLE, - EncryptionDetectionModuleFactory.getPasswordProtectMessage()); + EncryptionDetectionModuleFactory.PASSWORD_PROTECT_MESSAGE); } } } catch (ReadContentInputStreamException | SAXException | TikaException | UnsupportedCodecException ex) { diff --git a/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionModuleFactory.java b/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionModuleFactory.java index 2d1aceebab..7cfff12b07 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionModuleFactory.java @@ -42,15 +42,13 @@ import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel; public class EncryptionDetectionModuleFactory implements IngestModuleFactory { + public static final String PASSWORD_PROTECT_MESSAGE = Bundle.EncryptionDetectionFileIngestModule_artifactComment_password(); + @Override public String getModuleDisplayName() { return getModuleName(); } - - public static String getPasswordProtectMessage() { - return Bundle.EncryptionDetectionFileIngestModule_artifactComment_password(); - } - + /** * Get the name of the module. *