mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 02:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'issue192_fixes' of https://github.com/narfindustries/autopsy into narfindustries-issue192_fixes

Browse Source
This commit is contained in:
Richard Cordovano 2017-07-05 15:12:21 -04:00
commit f0c5709311
4 changed files with 54 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifact.java
View File

@ -43,7 +43,7 @@ public class EamArtifact implements Serializable {
public static final int EMAIL_TYPE_ID = 2;
public static final int PHONE_TYPE_ID = 3;
public static final int USBID_TYPE_ID = 4;
/**
* Load the default correlation types
*/
@ -65,7 +65,8 @@ public class EamArtifact implements Serializable {
public EamArtifact(Type correlationType, String correlationValue) {
this.ID = "";
this.correlationType = correlationType;
this.correlationValue = correlationValue;
// Lower-case all values to normalize and improve correlation hits, going forward make sure this makes sense for all correlation types
this.correlationValue = correlationValue.toLowerCase();
this.artifactInstances = new ArrayList<>();
}
@ -110,7 +111,8 @@ public class EamArtifact implements Serializable {
* @param correlationValue the correlationValue to set
*/
public void setCorrelationValue(String correlationValue) {
this.correlationValue = correlationValue;
// Lower-case all values to normalize and improve correlation hits, going forward make sure this makes sense for all correlation types
this.correlationValue = correlationValue.toLowerCase();
}
/**
@ -161,12 +163,13 @@ public class EamArtifact implements Serializable {
private Boolean enabled;
/**
*
* @param id Unique ID for this Correlation Type
* @param displayName Name of this type displayed in the UI.
* @param dbTableName Central Repository db table where data of this type is stored
* @param supported Is this Type currently supported
* @param enabled Is this Type currentl enabled.
*
* @param id Unique ID for this Correlation Type
* @param displayName Name of this type displayed in the UI.
* @param dbTableName Central Repository db table where data of this
* type is stored
* @param supported Is this Type currently supported
* @param enabled Is this Type currentl enabled.
*/
public Type(int id, String displayName, String dbTableName, Boolean supported, Boolean enabled) {
this.id = id;
@ -178,13 +181,14 @@ public class EamArtifact implements Serializable {
/**
* Constructior for custom types where we do not know the Type ID until
* the row has been entered into the correlation_types table
* in the Central Repository.
*
* @param displayName Name of this type displayed in the UI.
* @param dbTableName Central Repository db table where data of this type is stored
* @param supported Is this Type currently supported
* @param enabled Is this Type currentl enabled.
* the row has been entered into the correlation_types table in the
* Central Repository.
*
* @param displayName Name of this type displayed in the UI.
* @param dbTableName Central Repository db table where data of this
* type is stored
* @param supported Is this Type currently supported
* @param enabled Is this Type currentl enabled.
*/
public Type(String displayName, String dbTableName, Boolean supported, Boolean enabled) {
this(-1, displayName, dbTableName, supported, enabled);
@ -308,18 +312,17 @@ public class EamArtifact implements Serializable {
}
/**
* To support having different database tables for each Type,
* this field provides the prefix/suffix of the table name,
* which allows us to automatically compute the table names
* and indicies.
*
* It is the prefix for the instances tables *_instances.
* It is the suffix for the reference tables reference_*.
*
* To support having different database tables for each Type, this field
* provides the prefix/suffix of the table name, which allows us to
* automatically compute the table names and indicies.
*
* It is the prefix for the instances tables *_instances. It is the
* suffix for the reference tables reference_*.
*
* When custom Types are added in the future, they are already supported
* by just giving the desired value for the table name for each custom
* Type. Possibly having all custom Types use a common table name.
*
*
* @return the dbTableName
*/
public String getDbTableName() {

6
CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactInstance.java
View File

@ -124,7 +124,8 @@ public class EamArtifactInstance implements Serializable {
this.ID = ID;
this.eamCase = eamCase;
this.eamDataSource = eamDataSource;
this.filePath = filePath;
// Lower case paths to normalize paths and improve correlation results, if this causes significant issues on case-sensitive file systems, remove
this.filePath = filePath.toLowerCase();
this.comment = comment;
this.knownStatus = knownStatus;
this.globalStatus = globalStatus;
@ -204,7 +205,8 @@ public class EamArtifactInstance implements Serializable {
* @param filePath the filePath to set
*/
public void setFilePath(String filePath) {
this.filePath = filePath;
// Lower case paths to normalize paths and improve correlation results, if this causes significant issues on case-sensitive file systems, remove
this.filePath = filePath.toLowerCase();
}
/**

11
CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactUtil.java
View File

@ -129,8 +129,8 @@ public class EamArtifactUtil {
|| BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeID
|| BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeID)) {
// Lower-case this to normalize domains
value = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)).getValueString();
} else if (aType.getId() == EamArtifact.PHONE_TYPE_ID
&& (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeID
|| BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeID
@ -144,6 +144,15 @@ public class EamArtifactUtil {
value = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)).getValueString();
}
// Remove all non-numeric symbols to semi-normalize phone numbers, preserving leading "+" character
if (value != null) {
String newValue = value.replaceAll("\\D", "");
if (value.startsWith("+")) {
newValue = "+" + newValue;
}
value = newValue;
}
} else if (aType.getId() == EamArtifact.USBID_TYPE_ID
&& BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeID) {

22
CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamGlobalFileInstance.java
View File

@ -32,6 +32,14 @@ public class EamGlobalFileInstance {
private TskData.FileKnown knownStatus;
private String comment;
public EamGlobalFileInstance(
int globalSetID,
String MD5Hash,
TskData.FileKnown knownStatus,
String comment) {
this(-1, globalSetID, MD5Hash, knownStatus, comment);
}
public EamGlobalFileInstance(
int instanceID,
int globalSetID,
@ -40,19 +48,12 @@ public class EamGlobalFileInstance {
String comment) {
this.instanceID = instanceID;
this.globalSetID = globalSetID;
this.MD5Hash = MD5Hash;
// Normalize hashes by lower casing
this.MD5Hash = MD5Hash.toLowerCase();
this.knownStatus = knownStatus;
this.comment = comment;
}
public EamGlobalFileInstance(
int globalSetID,
String MD5Hash,
TskData.FileKnown knownStatus,
String comment) {
this(-1, globalSetID, MD5Hash, knownStatus, comment);
}
@Override
public boolean equals(Object otherInstance) {
if (this == otherInstance) {
@ -111,7 +112,8 @@ public class EamGlobalFileInstance {
* @param MD5Hash the MD5Hash to set
*/
public void setMD5Hash(String MD5Hash) {
this.MD5Hash = MD5Hash;
// Normalize hashes by lower casing
this.MD5Hash = MD5Hash.toLowerCase();
}
/**