From b7fcd5b6fc0de342fd2c3e636128850570bdeff8 Mon Sep 17 00:00:00 2001 From: Brian Carrier Date: Thu, 6 Feb 2014 17:14:17 -0500 Subject: [PATCH 1/3] Renamed mismatch module, made simple panel smaller, code directly gets GEN_INFO instead of all artifacts --- .../autopsy/fileextmismatch/Bundle.properties | 6 +- .../FileExtMismatchIngestModule.java | 75 +++++++++---------- .../FileExtMismatchSimpleConfigPanel.form | 21 +----- .../FileExtMismatchSimpleConfigPanel.java | 27 +------ 4 files changed, 43 insertions(+), 86 deletions(-) diff --git a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/Bundle.properties b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/Bundle.properties index 6b00d4a0ca..f6f7b42ae8 100644 --- a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/Bundle.properties +++ b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/Bundle.properties @@ -1,6 +1,4 @@ OpenIDE-Module-Name=FileExtMismatch -FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.text=Skip Known Files (NSRL) -FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.toolTipText=Depending on how many files have known hashes, checking this box will improve the speed of mismatch detection. FileExtMismatchConfigPanel.extHeaderLabel.text=Allowed Extensions: FileExtMismatchConfigPanel.userExtTextField.text= FileExtMismatchConfigPanel.addExtButton.text=Add Extension @@ -15,5 +13,5 @@ FileExtMismatchConfigPanel.mimeErrLabel.text=\ FileExtMismatchConfigPanel.mimeRemoveErrLabel.text=\ FileExtMismatchConfigPanel.extRemoveErrLabel.text=\ FileExtMismatchConfigPanel.saveMsgLabel.text=\ -FileExtMismatchSimpleConfigPanel.skipNoExtCheckBox.text=Skip Files Without Extensions -FileExtMismatchSimpleConfigPanel.skipTextPlain.text=Skip text/plain MIME type +FileExtMismatchSimpleConfigPanel.skipNoExtCheckBox.text=Skip files without extensions +FileExtMismatchSimpleConfigPanel.skipTextPlain.text=Skip text files diff --git a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchIngestModule.java b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchIngestModule.java index dac78f1cc1..0e95916063 100644 --- a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchIngestModule.java +++ b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchIngestModule.java @@ -50,10 +50,9 @@ import org.sleuthkit.datamodel.TskException; public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile { private static FileExtMismatchIngestModule defaultInstance = null; private static final Logger logger = Logger.getLogger(FileExtMismatchIngestModule.class.getName()); - public static final String MODULE_NAME = "File Extension Mismatch Detection"; - public static final String MODULE_DESCRIPTION = "Flags mismatched filename extensions based on file signature."; + public static final String MODULE_NAME = "Extension Mismatch Detector"; + public static final String MODULE_DESCRIPTION = "Flags files that have a non-standard extension based on their file type."; public static final String MODULE_VERSION = Version.getVersion(); - private static final String ART_NAME = "TSK_MISMATCH"; private static long processTime = 0; private static int messageId = 0; @@ -62,14 +61,11 @@ public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.In private static boolean skipNoExt = true; private static boolean skipTextPlain = false; - private int attrId = -1; - private int attrId2 = -1; private FileExtMismatchSimpleConfigPanel simpleConfigPanel; private FileExtMismatchConfigPanel advancedConfigPanel; private IngestServices services; private HashMap SigTypeToExtMap = new HashMap<>(); - private String currActualExt = ""; - private String currActualSigType = ""; + // Private to ensure Singleton status private FileExtMismatchIngestModule() { @@ -118,12 +114,12 @@ public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.In { long startTime = System.currentTimeMillis(); - boolean flag = compareSigTypeToExt(abstractFile); + boolean mismatchDetected = compareSigTypeToExt(abstractFile); processTime += (System.currentTimeMillis() - startTime); numFiles++; - if (flag) { + if (mismatchDetected) { // add artifact BlackboardArtifact bart = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED); @@ -136,52 +132,51 @@ public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.In } } + /** + * Compare file type for file and extension. + * @param abstractFile + * @return false if the two match. True if there is a mismatch. + */ private boolean compareSigTypeToExt(AbstractFile abstractFile) { try { - currActualExt = abstractFile.getNameExtension(); - + String currActualExt = abstractFile.getNameExtension(); + // If we are skipping names with no extension if (skipNoExt && currActualExt.isEmpty()) { return false; } - + // find file_sig value. - // getArtifacts by type doesn't seem to work, so get all artifacts - ArrayList artList = abstractFile.getAllArtifacts(); + // check the blackboard for a file type attribute + ArrayList attributes = abstractFile.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); + for (BlackboardAttribute attribute : attributes) { + String currActualSigType = attribute.getValueString(); + if (skipTextPlain) { + if (!currActualExt.isEmpty() && currActualSigType.equals("text/plain")) { + return false; + } + } - for (BlackboardArtifact art : artList) { - List atrList = art.getAttributes(); - for (BlackboardAttribute att : atrList) { - if (att.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID()) { - currActualSigType = att.getValueString(); - if (skipTextPlain) - { - if (!currActualExt.isEmpty()&&currActualSigType.equals("text/plain")) - { - return false; - } - } - //get known allowed values from the map for this type - String[] slist = SigTypeToExtMap.get(att.getValueString()); - if (slist != null) { - List allowedExtList = Arrays.asList(slist); + //get known allowed values from the map for this type + String[] allowedExtArray = SigTypeToExtMap.get(currActualSigType); + if (allowedExtArray != null) { + List allowedExtList = Arrays.asList(allowedExtArray); - // see if the filename ext is in the allowed list - if (allowedExtList != null) { - for (String e : allowedExtList) { - if (e.equals(currActualExt)) { - return false; - } - } - return true; //potential mismatch + // see if the filename ext is in the allowed list + if (allowedExtList != null) { + for (String e : allowedExtList) { + if (e.equals(currActualExt)) { + return false; } } + return true; //potential mismatch } - } + } } } catch (TskCoreException ex) { - Exceptions.printStackTrace(ex); + logger.log(Level.WARNING, "Error while getting file signature from blackboard.", ex); } + return false; } diff --git a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.form b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.form index 21d366a524..507dc635ba 100644 --- a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.form +++ b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.form @@ -21,9 +21,8 @@ - - + @@ -33,28 +32,12 @@ - - - + - - - - - - - - - - - - - - diff --git a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.java b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.java index c490fdce95..ff0b7faa60 100644 --- a/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.java +++ b/FileExtMismatch/src/org/sleuthkit/autopsy/fileextmismatch/FileExtMismatchSimpleConfigPanel.java @@ -30,8 +30,7 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel { } private void customizeComponents() { - // Hidden for now - skipKnownCheckBox.setVisible(false); + } @@ -44,19 +43,9 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel { // //GEN-BEGIN:initComponents private void initComponents() { - skipKnownCheckBox = new javax.swing.JCheckBox(); skipNoExtCheckBox = new javax.swing.JCheckBox(); skipTextPlain = new javax.swing.JCheckBox(); - skipKnownCheckBox.setSelected(true); - skipKnownCheckBox.setText(org.openide.util.NbBundle.getMessage(FileExtMismatchSimpleConfigPanel.class, "FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.text")); // NOI18N - skipKnownCheckBox.setToolTipText(org.openide.util.NbBundle.getMessage(FileExtMismatchSimpleConfigPanel.class, "FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.toolTipText")); // NOI18N - skipKnownCheckBox.addActionListener(new java.awt.event.ActionListener() { - public void actionPerformed(java.awt.event.ActionEvent evt) { - skipKnownCheckBoxActionPerformed(evt); - } - }); - skipNoExtCheckBox.setSelected(true); skipNoExtCheckBox.setText(org.openide.util.NbBundle.getMessage(FileExtMismatchSimpleConfigPanel.class, "FileExtMismatchSimpleConfigPanel.skipNoExtCheckBox.text")); // NOI18N skipNoExtCheckBox.addActionListener(new java.awt.event.ActionListener() { @@ -80,9 +69,8 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel { .addContainerGap() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addComponent(skipTextPlain) - .addComponent(skipNoExtCheckBox) - .addComponent(skipKnownCheckBox, javax.swing.GroupLayout.PREFERRED_SIZE, 165, javax.swing.GroupLayout.PREFERRED_SIZE)) - .addGap(0, 327, Short.MAX_VALUE)) + .addComponent(skipNoExtCheckBox)) + .addGap(0, 138, Short.MAX_VALUE)) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) @@ -90,16 +78,10 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel { .addComponent(skipNoExtCheckBox) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addComponent(skipTextPlain) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) - .addComponent(skipKnownCheckBox) - .addContainerGap(72, Short.MAX_VALUE)) + .addContainerGap(51, Short.MAX_VALUE)) ); }// //GEN-END:initComponents - private void skipKnownCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_skipKnownCheckBoxActionPerformed - FileExtMismatchIngestModule.setSkipKnown(skipKnownCheckBox.isSelected()); - }//GEN-LAST:event_skipKnownCheckBoxActionPerformed - private void skipNoExtCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_skipNoExtCheckBoxActionPerformed FileExtMismatchIngestModule.setSkipNoExt(skipNoExtCheckBox.isSelected()); }//GEN-LAST:event_skipNoExtCheckBoxActionPerformed @@ -110,7 +92,6 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel { }//GEN-LAST:event_skipTextPlainActionPerformed // Variables declaration - do not modify//GEN-BEGIN:variables - private javax.swing.JCheckBox skipKnownCheckBox; private javax.swing.JCheckBox skipNoExtCheckBox; private javax.swing.JCheckBox skipTextPlain; // End of variables declaration//GEN-END:variables From f9a3d1472f6e83ee14f21f67ee3ab787f2de48e7 Mon Sep 17 00:00:00 2001 From: Brian Carrier Date: Thu, 6 Feb 2014 17:14:44 -0500 Subject: [PATCH 2/3] Made simple panel smaller --- .../autopsy/filetypeid/FileTypeIdSimpleConfigPanel.form | 2 +- .../autopsy/filetypeid/FileTypeIdSimpleConfigPanel.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.form b/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.form index 29004307b5..b91cd2e25e 100644 --- a/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.form +++ b/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.form @@ -28,7 +28,7 @@ - + diff --git a/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.java b/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.java index cffd6afd5c..980f4e4f41 100644 --- a/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.java +++ b/FileTypeId/src/org/sleuthkit/autopsy/filetypeid/FileTypeIdSimpleConfigPanel.java @@ -67,7 +67,7 @@ package org.sleuthkit.autopsy.filetypeid; .addGroup(layout.createSequentialGroup() .addGap(11, 11, 11) .addComponent(skipKnownCheckBox) - .addContainerGap(175, Short.MAX_VALUE)) + .addContainerGap(45, Short.MAX_VALUE)) ); }// //GEN-END:initComponents From 92e5d3e776ef5f6ad99af0bb3a7a6a0f7b796f7d Mon Sep 17 00:00:00 2001 From: Brian Carrier Date: Thu, 6 Feb 2014 17:15:33 -0500 Subject: [PATCH 3/3] updated layout and text of HashDB simple panel --- .../autopsy/hashdatabase/Bundle.properties | 6 ++-- .../hashdatabase/HashDbSimpleConfigPanel.form | 25 +++++++++------- .../hashdatabase/HashDbSimpleConfigPanel.java | 30 ++++++++++++------- 3 files changed, 38 insertions(+), 23 deletions(-) diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties index 7e2fa92971..b452e495e2 100644 --- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties +++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties @@ -57,8 +57,8 @@ ModalNoButtons.CURRENTLYON_LABEL.text=Currently Indexing x of y ModalNoButtons.GO_GET_COFFEE_LABEL.text=Hash databases are currently being indexed, this may take some time. ModalNoButtons.cancelButton.text=Cancel ModalNoButtons.CANCEL_BUTTON.text=Cancel -HashDbSimpleConfigPanel.knownBadHashDbsLabel.text=Enable known bad databases for ingest: -HashDbSimpleConfigPanel.knownHashDbsLabel.text=Enable known hash databases for ingest: +HashDbSimpleConfigPanel.knownBadHashDbsLabel.text=Select known BAD hash databases to use: +HashDbSimpleConfigPanel.knownHashDbsLabel.text=Select known hash databases to use: HashDbImportDatabaseDialog.knownRadioButton.text=Known (NSRL or other) HashDbCreateDatabaseDialog.knownRadioButton.text=Known HashDbCreateDatabaseDialog.jLabel1.text=Database Path: @@ -73,7 +73,7 @@ HashDbImportDatabaseDialog.sendIngestMessagesCheckbox.text=Send ingest messages HashDbImportDatabaseDialog.hashSetNameTextField.text= HashDbConfigPanel.createDatabaseButton.text=Create Database HashDbImportDatabaseDialog.openButton.text=Open... -HashDbSimpleConfigPanel.alwaysCalcHashesCheckbox.text=Calculate hashes even if no hash database is selected +HashDbSimpleConfigPanel.alwaysCalcHashesCheckbox.text=Calculate MD5 even if no hash database is selected HashDbCreateDatabaseDialog.jLabel3.text=Hash Set Name: HashDbCreateDatabaseDialog.okButton.text=OK HashDbCreateDatabaseDialog.databasePathTextField.text= diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.form b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.form index 75a4788a57..a940de429e 100644 --- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.form +++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.form @@ -19,16 +19,19 @@ - + + - - + + + + + - - + @@ -37,15 +40,14 @@ - - - + + - - + + @@ -98,6 +100,9 @@ + + + diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.java b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.java index 4149ccccfd..899c3cb84b 100644 --- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.java +++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimpleConfigPanel.java @@ -195,6 +195,11 @@ public class HashDbSimpleConfigPanel extends javax.swing.JPanel { knownHashDbsLabel.setText(org.openide.util.NbBundle.getMessage(HashDbSimpleConfigPanel.class, "HashDbSimpleConfigPanel.knownHashDbsLabel.text")); // NOI18N alwaysCalcHashesCheckbox.setText(org.openide.util.NbBundle.getMessage(HashDbSimpleConfigPanel.class, "HashDbSimpleConfigPanel.alwaysCalcHashesCheckbox.text")); // NOI18N + alwaysCalcHashesCheckbox.addActionListener(new java.awt.event.ActionListener() { + public void actionPerformed(java.awt.event.ActionEvent evt) { + alwaysCalcHashesCheckboxActionPerformed(evt); + } + }); jScrollPane2.setBorder(javax.swing.BorderFactory.createEtchedBorder()); @@ -218,33 +223,38 @@ public class HashDbSimpleConfigPanel extends javax.swing.JPanel { .addGroup(layout.createSequentialGroup() .addContainerGap() .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE) + .addComponent(alwaysCalcHashesCheckbox, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.DEFAULT_SIZE, 285, Short.MAX_VALUE) .addGroup(layout.createSequentialGroup() + .addGap(10, 10, 10) .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) - .addComponent(knownHashDbsLabel) - .addComponent(knownBadHashDbsLabel)) + .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE) + .addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE))) + .addGroup(layout.createSequentialGroup() + .addComponent(knownHashDbsLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 272, javax.swing.GroupLayout.PREFERRED_SIZE) .addGap(0, 0, Short.MAX_VALUE)) - .addComponent(jScrollPane2, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE) - .addComponent(alwaysCalcHashesCheckbox, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) + .addComponent(knownBadHashDbsLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)) .addContainerGap()) ); layout.setVerticalGroup( layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) .addGroup(layout.createSequentialGroup() - .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) .addComponent(knownHashDbsLabel) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) - .addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 55, javax.swing.GroupLayout.PREFERRED_SIZE) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED) + .addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 58, javax.swing.GroupLayout.PREFERRED_SIZE) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) .addComponent(knownBadHashDbsLabel) .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED) - .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 55, javax.swing.GroupLayout.PREFERRED_SIZE) - .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) + .addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 85, javax.swing.GroupLayout.PREFERRED_SIZE) + .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) .addComponent(alwaysCalcHashesCheckbox) .addContainerGap()) ); }// //GEN-END:initComponents + private void alwaysCalcHashesCheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_alwaysCalcHashesCheckboxActionPerformed + // TODO add your handling code here: + }//GEN-LAST:event_alwaysCalcHashesCheckboxActionPerformed + // Variables declaration - do not modify//GEN-BEGIN:variables private javax.swing.JCheckBox alwaysCalcHashesCheckbox; private javax.swing.JScrollPane jScrollPane1;