diff --git a/Core/src/org/sleuthkit/autopsy/modules/plaso/Bundle.properties b/Core/src/org/sleuthkit/autopsy/modules/plaso/Bundle.properties new file mode 100644 index 0000000000..41fafe0295 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/modules/plaso/Bundle.properties @@ -0,0 +1,3 @@ +PlasoModuleSettingsPanel.jTextArea1.text=All plaso parsers except chrome_cache and the ones listed below are run. chrome_cache duplicates data collected by the RecentActivity module. The parsers below add significantly to the processing time and should only be enabled if the events they produce are needed. +PlasoModuleSettingsPanel.winRegCheckBox.text=winreg: Parser for Windows NT Registry (REGF) files. +PlasoModuleSettingsPanel.peCheckBox.text=pe: Parser for Portable Executable (PE) files. diff --git a/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleFactory.java b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleFactory.java index 9191569220..8b11a0f205 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleFactory.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2018 Basis Technology Corp. + * Copyright 2018-2019 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -22,20 +22,21 @@ import org.openide.util.NbBundle; import org.openide.util.lookup.ServiceProvider; import org.sleuthkit.autopsy.coreutils.Version; import org.sleuthkit.autopsy.ingest.DataSourceIngestModule; +import org.sleuthkit.autopsy.ingest.FileIngestModule; import org.sleuthkit.autopsy.ingest.IngestModuleFactory; -import org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter; +import org.sleuthkit.autopsy.ingest.IngestModuleGlobalSettingsPanel; import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings; +import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel; /** - * An factory that creates data source ingest modules that runs plaso - * against an image and saves the storage file to module output. + * An factory that creates data source ingest modules that runs plaso against an + * image and saves the storage file to module output. */ @ServiceProvider(service = IngestModuleFactory.class) -public class PlasoModuleFactory extends IngestModuleFactoryAdapter { - @NbBundle.Messages({ - "PlasoModuleFactory_moduleName=Plaso" - }) +public class PlasoModuleFactory implements IngestModuleFactory { + + @NbBundle.Messages({"PlasoModuleFactory_moduleName=Plaso"}) static String getModuleName() { return Bundle.PlasoModuleFactory_moduleName(); } @@ -45,10 +46,7 @@ public class PlasoModuleFactory extends IngestModuleFactoryAdapter { return getModuleName(); } - @NbBundle.Messages({ - "PlasoModuleFactory_moduleDesc=Runs Plaso against a Data Source." - }) - + @NbBundle.Messages({"PlasoModuleFactory_moduleDesc=Runs Plaso against a Data Source."}) @Override public String getModuleDescription() { return Bundle.PlasoModuleFactory_moduleDesc(); @@ -68,4 +66,47 @@ public class PlasoModuleFactory extends IngestModuleFactoryAdapter { public DataSourceIngestModule createDataSourceIngestModule(IngestModuleIngestJobSettings ingestOptions) { return new PlasoIngestModule(); } + + @Override + public boolean hasGlobalSettingsPanel() { + return false; + } + + @Override + public IngestModuleGlobalSettingsPanel getGlobalSettingsPanel() { + throw new UnsupportedOperationException(); + } + + @Override + public IngestModuleIngestJobSettings getDefaultIngestJobSettings() { + return new PlasoModuleSettings(); + } + + @Override + public boolean hasIngestJobSettingsPanel() { + return true; + } + + @NbBundle.Messages({"PlasoModuleFactory.getIngestJobSettingsPanel.exception.msg=Expected settings argument to be instanceof PlasoModuleSettings"}) + @Override + public IngestModuleIngestJobSettingsPanel getIngestJobSettingsPanel(IngestModuleIngestJobSettings settings) { + assert settings instanceof PlasoModuleSettings; + if (settings instanceof PlasoModuleSettings) { + return new PlasoModuleSettingsPanel((PlasoModuleSettings) settings); + } else { + throw new IllegalArgumentException(NbBundle.getMessage(PlasoModuleFactory.class, + "PlasoModuleFactory.getIngestJobSettingsPanel.exception.msg")); + } + + } + + @Override + public boolean isFileIngestModuleFactory() { + return false; + } + + @Override + public FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings settings) { + throw new UnsupportedOperationException(); + } } diff --git a/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettings.java b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettings.java new file mode 100644 index 0000000000..8fe0fa08e0 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettings.java @@ -0,0 +1,50 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2019 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.modules.plaso; + +import java.util.HashMap; +import java.util.Map; +import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings; + +/** + * + */ +public class PlasoModuleSettings implements IngestModuleIngestJobSettings { + + private static final long serialVersionUID = 1L; + + Map parsers = new HashMap<>(); + + public PlasoModuleSettings() { + } + + /** + * Gets the serialization version number. + * + * @return A serialization version number. + */ + @Override + public long getVersionNumber() { + return serialVersionUID; + } + + void setParserEnabled(String parserName, boolean selected) { + parsers.put(parserName, selected); + } +} diff --git a/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettingsPanel.form b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettingsPanel.form new file mode 100644 index 0000000000..3f398c5069 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettingsPanel.form @@ -0,0 +1,84 @@ + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
diff --git a/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettingsPanel.java b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettingsPanel.java new file mode 100644 index 0000000000..3738a28e08 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoModuleSettingsPanel.java @@ -0,0 +1,116 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2019 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.modules.plaso; + +import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings; +import org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel; + +/** + * + * + */ +public class PlasoModuleSettingsPanel extends IngestModuleIngestJobSettingsPanel { + + private final PlasoModuleSettings settings; + + public PlasoModuleSettingsPanel(PlasoModuleSettings settings) { + this.settings = settings; + initComponents(); + } + + /** This method is called from within the constructor to initialize the + * form. WARNING: Do NOT modify this code. The content of this method is + * always regenerated by the Form Editor. + */ + @SuppressWarnings("unchecked") + // //GEN-BEGIN:initComponents + private void initComponents() { + + winRegCheckBox = new javax.swing.JCheckBox(); + peCheckBox = new javax.swing.JCheckBox(); + jTextArea1 = new javax.swing.JTextArea(); + + org.openide.awt.Mnemonics.setLocalizedText(winRegCheckBox, org.openide.util.NbBundle.getMessage(PlasoModuleSettingsPanel.class, "PlasoModuleSettingsPanel.winRegCheckBox.text")); // NOI18N + winRegCheckBox.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + winRegCheckBoxActionPerformed(evt); + } + }); + + org.openide.awt.Mnemonics.setLocalizedText(peCheckBox, org.openide.util.NbBundle.getMessage(PlasoModuleSettingsPanel.class, "PlasoModuleSettingsPanel.peCheckBox.text")); // NOI18N + peCheckBox.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + peCheckBoxActionPerformed(evt); + } + }); + + jTextArea1.setEditable(false); + jTextArea1.setBackground(new java.awt.Color(240, 240, 240)); + jTextArea1.setColumns(20); + jTextArea1.setLineWrap(true); + jTextArea1.setRows(5); + jTextArea1.setText(org.openide.util.NbBundle.getMessage(PlasoModuleSettingsPanel.class, "PlasoModuleSettingsPanel.jTextArea1.text")); // NOI18N + jTextArea1.setWrapStyleWord(true); + jTextArea1.setBorder(null); + + javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); + this.setLayout(layout); + layout.setHorizontalGroup( + layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addGroup(layout.createSequentialGroup() + .addContainerGap() + .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addComponent(jTextArea1) + .addComponent(peCheckBox) + .addComponent(winRegCheckBox)) + .addContainerGap()) + ); + layout.setVerticalGroup( + layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) + .addGroup(layout.createSequentialGroup() + .addContainerGap() + .addComponent(jTextArea1, javax.swing.GroupLayout.DEFAULT_SIZE, 117, Short.MAX_VALUE) + .addGap(18, 18, 18) + .addComponent(winRegCheckBox) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) + .addComponent(peCheckBox) + .addContainerGap()) + ); + }// //GEN-END:initComponents + + private void winRegCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_winRegCheckBoxActionPerformed + settings.setParserEnabled("winreg", winRegCheckBox.isSelected()); + }//GEN-LAST:event_winRegCheckBoxActionPerformed + + private void peCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_peCheckBoxActionPerformed + settings.setParserEnabled("pe", peCheckBox.isSelected()); + }//GEN-LAST:event_peCheckBoxActionPerformed + + @Override + public IngestModuleIngestJobSettings getSettings() { + return settings; + } + + + // Variables declaration - do not modify//GEN-BEGIN:variables + private javax.swing.JTextArea jTextArea1; + private javax.swing.JCheckBox peCheckBox; + private javax.swing.JCheckBox winRegCheckBox; + // End of variables declaration//GEN-END:variables +}