mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-20 03:24:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' of https://github.com/sleuthkit/autopsy into develop

Browse Source
This commit is contained in:
Eugene Livis 2017-03-27 15:58:19 -04:00
commit f12a3ffcf1
18 changed files with 137 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -77,3 +77,5 @@ Core/src/org/sleuthkit/autopsy/casemodule/docs/screenshot.png
.DS_Store
.*.swp
Core/src/org/sleuthkit/autopsy/datamodel/ranges.csv
thunderbirdparser/release/modules/ext

18
Core/src/org/sleuthkit/autopsy/modules/android/CallLogAnalyzer.java
View File

@ -25,7 +25,9 @@ import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle.Messages;
@ -36,6 +38,8 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.datamodel.ContentUtils;
import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
@ -52,6 +56,9 @@ class CallLogAnalyzer {
private static final String moduleName = AndroidModuleFactory.getModuleName();
private static final Logger logger = Logger.getLogger(CallLogAnalyzer.class.getName());
private static Blackboard blackboard;
private static final IngestServices services = IngestServices.getInstance();
/**
* the names of tables that potentially hold call logs in the dbs
@ -85,6 +92,8 @@ class CallLogAnalyzer {
if (DatabasePath == null || DatabasePath.isEmpty()) {
return;
}
Collection<BlackboardArtifact> bbartifacts = new ArrayList<>();
try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + DatabasePath); //NON-NLS
Statement statement = connection.createStatement();) {
@ -112,6 +121,8 @@ class CallLogAnalyzer {
bba.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, directionString));
bba.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
bbartifacts.add(bba);
try {
// index the artifact for keyword search
blackboard.indexArtifact(bba);
@ -131,6 +142,13 @@ class CallLogAnalyzer {
} catch (SQLException e) {
logger.log(Level.SEVERE, "Could not parse call log; error connecting to db " + DatabasePath, e); //NON-NLS
}
finally {
if (!bbartifacts.isEmpty()) {
services.fireModuleDataEvent(new ModuleDataEvent(
moduleName,
BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG, bbartifacts));
}
}
}
private static enum CallDirection {

16
Core/src/org/sleuthkit/autopsy/modules/android/ContactAnalyzer.java
View File

@ -25,6 +25,8 @@ import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle.Messages;
@ -35,6 +37,8 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.datamodel.ContentUtils;
import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
@ -49,6 +53,7 @@ class ContactAnalyzer {
private static final String moduleName = AndroidModuleFactory.getModuleName();
private static final Logger logger = Logger.getLogger(ContactAnalyzer.class.getName());
private static final IngestServices services = IngestServices.getInstance();
public static void findContacts(Content dataSource, FileManager fileManager,
IngestJobContext context) {
@ -98,7 +103,8 @@ class ContactAnalyzer {
logger.log(Level.SEVERE, "Error opening database", e); //NON-NLS
return;
}
Collection<BlackboardArtifact> bbartifacts = new ArrayList<>();
try {
// get display_name, mimetype(email or phone number) and data1 (phonenumber or email address depending on mimetype)
//sorted by name, so phonenumber/email would be consecutive for a person if they exist.
@ -152,6 +158,8 @@ class ContactAnalyzer {
}
oldName = name;
bbartifacts.add(bba);
try {
// index the artifact for keyword search
blackboard.indexArtifact(bba);
@ -167,6 +175,12 @@ class ContactAnalyzer {
} catch (TskCoreException e) {
logger.log(Level.SEVERE, "Error posting to blackboard", e); //NON-NLS
} finally {
if (!bbartifacts.isEmpty()) {
services.fireModuleDataEvent(new ModuleDataEvent(
moduleName,
BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT, bbartifacts));
}
try {
if (resultSet != null) {
resultSet.close();

14
Core/src/org/sleuthkit/autopsy/modules/android/TextMessageAnalyzer.java
View File

@ -24,6 +24,8 @@ import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle;
@ -35,6 +37,8 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.datamodel.ContentUtils;
import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
@ -48,6 +52,7 @@ class TextMessageAnalyzer {
private static final String moduleName = AndroidModuleFactory.getModuleName();
private static final Logger logger = Logger.getLogger(TextMessageAnalyzer.class.getName());
private static final IngestServices services = IngestServices.getInstance();
private static Blackboard blackboard;
public static void findTexts(Content dataSource, FileManager fileManager,
@ -88,6 +93,7 @@ class TextMessageAnalyzer {
return;
}
Collection<BlackboardArtifact> bbartifacts = new ArrayList<>();
try {
resultSet = statement.executeQuery(
"SELECT address,date,read,type,subject,body FROM sms;"); //NON-NLS
@ -127,6 +133,8 @@ class TextMessageAnalyzer {
NbBundle.getMessage(TextMessageAnalyzer.class,
"TextMessageAnalyzer.bbAttribute.smsMessage")));
bbartifacts.add(bba);
try {
// index the artifact for keyword search
blackboard.indexArtifact(bba);
@ -139,6 +147,12 @@ class TextMessageAnalyzer {
} catch (Exception e) {
logger.log(Level.SEVERE, "Error parsing text messages to Blackboard", e); //NON-NLS
} finally {
if (!bbartifacts.isEmpty()) {
services.fireModuleDataEvent(new ModuleDataEvent(
moduleName,
BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE, bbartifacts));
}
try {
if (resultSet != null) {
resultSet.close();

2
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java
View File

@ -241,7 +241,7 @@ public class Server {
javaHome = System.getenv("JAVA_HOME"); // NON-NLS
}
if (javaHome.isEmpty()) {
if (javaHome == null || javaHome.isEmpty()) {
logger.log(Level.WARNING, "Java not found. Keyword search functionality may not work."); //NON-NLS
}

0
thunderbirdparser/release/modules/ext/java-libpst-1.0-SNAPSHOT.jar → thirdparty/java-libpst/java-libpst-1.0-SNAPSHOT.jar vendored Executable file → Normal file
View File

56
thunderbirdparser/build.xml
View File

@ -2,7 +2,61 @@
<!-- You may freely edit this file. See harness/README in the NetBeans platform -->
<!-- for some information on what you could do (e.g. targets to override). -->
<!-- If you delete this file and reopen the project it will be recreated. -->
<project name="org.sleuthkit.autopsy.thunderbirdparser" default="netbeans" basedir=".">
<project name="org.sleuthkit.autopsy.thunderbirdparser" default="netbeans" basedir="." xmlns:ivy="antlib:org.apache.ivy.ant">
<description>Builds, tests, and runs the project org.sleuthkit.autopsy.thunderbirdparser.</description>
<import file="nbproject/build-impl.xml"/>
<property name="ivy.install.version" value="2.3.0-rc2" />
<condition property="ivy.home" value="${env.IVY_HOME}">
<isset property="env.IVY_HOME" />
</condition>
<property name="ivy.home" value="${user.home}/.ant" />
<property name="ivy.jar.dir" value="${ivy.home}/lib" />
<property name="ivy.jar.file" value="${ivy.jar.dir}/ivy.jar" />
<target name="download-ivy" unless="offline">
<available file="${ivy.jar.file}" property="ivy.available"/>
<antcall target="-download-ivy" />
</target>
<target name="-download-ivy" unless="ivy.available">
<mkdir dir="${ivy.jar.dir}"/>
<get src="http://repo2.maven.org/maven2/org/apache/ivy/ivy/${ivy.install.version}/ivy-${ivy.install.version}.jar"
dest="${ivy.jar.file}" usetimestamp="true"/>
</target>
<!-- init-ivy will bootstrap Ivy if the user doesn't have it already -->
<target name="init-ivy" depends="download-ivy" unless="ivy.lib.path">
<path id="ivy.lib.path">
<fileset dir="${ivy.jar.dir}" includes="*.jar"/>
</path>
<taskdef resource="org/apache/ivy/ant/antlib.xml"
uri="antlib:org.apache.ivy.ant" classpathref="ivy.lib.path"/>
</target>
<property name="thirdparty.dir" value="${basedir}/../thirdparty" />
<property name="ext.dir" value="release/modules/ext" />
<target name="clean" depends="projectized-common.clean">
<delete dir="${ext.dir}"/>
</target>
<target name="get-thirdparty-jars" description="get third-party jar dependencies">
<mkdir dir="${ext.dir}"/>
<copy file="${thirdparty.dir}/java-libpst/java-libpst-1.0-SNAPSHOT.jar" todir="${ext.dir}" />
</target>
<target name="init" depends="basic-init,files-init,build-init,-javac-init,init-ivy">
<!-- fetch all the dependencies from Ivy and stick them in the right places -->
<ivy:resolve/>
<ivy:retrieve conf="autopsy" sync="true" pattern="release/modules/ext/[artifact]-[revision](-[classifier]).[ext]" />
<!-- copy jars not downloaded with Ivy -->
<antcall target="get-thirdparty-jars"/>
</target>
</project>

14
thunderbirdparser/ivy.xml Normal file
View File

@ -0,0 +1,14 @@
<ivy-module version="2.0">
<info organisation="org.sleuthkit.autopsy" module="emailparser"/>
<configurations >
<!-- module dependencies -->
<conf name="autopsy"/>
</configurations>
<dependencies>
<dependency conf="autopsy->default" org="org.apache.james" name="apache-mime4j-core" rev="0.8.0"/>
<dependency conf="autopsy->default" org="org.apache.james" name="apache-mime4j-dom" rev="0.8.0"/>
<dependency conf="autopsy->default" org="org.apache.james" name="apache-mime4j-mbox-iterator" rev="0.8.0"/>
</dependencies>
</ivy-module>

9
thunderbirdparser/ivysettings.xml Normal file
View File

@ -0,0 +1,9 @@
<ivysettings>
<settings defaultResolver="main"/>
<resolvers>
<chain name="main">
<ibiblio name="central" m2compatible="true"/>
<ibiblio name="maven.restlet.org" root="http://maven.restlet.com" m2compatible="true" />
</chain>
</resolvers>
</ivysettings>

7
thunderbirdparser/nbproject/project.properties
View File

@ -1,7 +1,6 @@
file.reference.apache-mime4j-core-0.8.0-SNAPSHOT-sources.jar=release/modules/ext/apache-mime4j-core-0.8.0-SNAPSHOT-sources.jar
file.reference.apache-mime4j-core-0.8.0-SNAPSHOT.jar=release/modules/ext/apache-mime4j-core-0.8.0-SNAPSHOT.jar
file.reference.apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT-sources.jar=release/modules/ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT-sources.jar
file.reference.apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT.jar=release/modules/ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT.jar
file.reference.apache-mime4j-core-0.8.0.jar=release/modules/ext/apache-mime4j-core-0.8.0.jar
file.reference.apache-mime4j-dom-0.8.0.jar=release/modules/ext/apache-mime4j-dom-0.8.0.jar
file.reference.apache-mime4j-mbox-iterator-0.8.0.jar=release/modules/ext/apache-mime4j-mbox-iterator-0.8.0.jar
file.reference.java-libpst-1.0-SNAPSHOT.jar=release/modules/ext/java-libpst-1.0-SNAPSHOT.jar
javac.source=1.8
javac.compilerargs=-Xlint -Xlint:-serial

24
thunderbirdparser/nbproject/project.xml
View File

@ -51,32 +51,20 @@
</module-dependencies>
<public-packages/>
<class-path-extension>
<runtime-relative-path>ext/apache-mime4j-dom-0.8.0-SNAPSHOT-sources.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-dom-0.8.0-SNAPSHOT-sources.jar</binary-origin>
<runtime-relative-path>ext/apache-mime4j-core-0.8.0.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-core-0.8.0.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/apache-mime4j-core-0.8.0-SNAPSHOT-sources.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-core-0.8.0-SNAPSHOT-sources.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/apache-mime4j-core-0.8.0-SNAPSHOT.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-core-0.8.0-SNAPSHOT.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/apache-mime4j-dom-0.8.0-SNAPSHOT.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-dom-0.8.0-SNAPSHOT.jar</binary-origin>
<runtime-relative-path>ext/apache-mime4j-dom-0.8.0.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-dom-0.8.0.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/java-libpst-1.0-SNAPSHOT.jar</runtime-relative-path>
<binary-origin>release/modules/ext/java-libpst-1.0-SNAPSHOT.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT-sources.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT-sources.jar</binary-origin>
<runtime-relative-path>ext/apache-mime4j-mbox-iterator-0.8.0.jar</runtime-relative-path>
<binary-origin>release/modules/ext/apache-mime4j-mbox-iterator-0.8.0.jar</binary-origin>
</class-path-extension>
</data>
</configuration>

BIN
thunderbirdparser/release/modules/ext/apache-mime4j-core-0.8.0-SNAPSHOT-sources.jar
View File

Binary file not shown.

BIN
thunderbirdparser/release/modules/ext/apache-mime4j-core-0.8.0-SNAPSHOT.jar
View File

Binary file not shown.

BIN
thunderbirdparser/release/modules/ext/apache-mime4j-dom-0.8.0-SNAPSHOT-sources.jar
View File

Binary file not shown.

BIN
thunderbirdparser/release/modules/ext/apache-mime4j-dom-0.8.0-SNAPSHOT.jar
View File

Binary file not shown.

BIN
thunderbirdparser/release/modules/ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT-sources.jar
View File

Binary file not shown.

BIN
thunderbirdparser/release/modules/ext/apache-mime4j-mbox-iterator-0.8.0-SNAPSHOT.jar
View File

Binary file not shown.

BIN
thunderbirdparser/release/modules/ext/apache-mime4j-project-0.8.0-SNAPSHOT.jar
View File

Binary file not shown.