mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 16:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7383 from rcordovano/develop

Browse Source 
7895 reformat central repository source files
This commit is contained in:
Richard Cordovano 2021-10-25 16:07:03 -04:00 committed by GitHub
commit f7890d260a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 43 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java
View File

@ -87,7 +87,7 @@ public class IngestEventsListener {
private final PropertyChangeListener pcl1 = new IngestModuleEventListener(); private final PropertyChangeListener pcl1 = new IngestModuleEventListener();
private final PropertyChangeListener pcl2 = new IngestJobEventListener(); private final PropertyChangeListener pcl2 = new IngestJobEventListener();
final Collection<String> recentlyAddedCeArtifacts = new LinkedHashSet<>(); final Collection<String> recentlyAddedCeArtifacts = new LinkedHashSet<>();
static final int MAX_NUM_PREVIOUS_CASES_FOR_LIKELY_NOTABLE_SCORE = 10; static final int MAX_NUM_PREVIOUS_CASES_FOR_LIKELY_NOTABLE_SCORE = 10;
static final int MAX_NUM_PREVIOUS_CASES_FOR_PREV_SEEN_ARTIFACT_CREATION = 20; static final int MAX_NUM_PREVIOUS_CASES_FOR_PREV_SEEN_ARTIFACT_CREATION = 20;
@ -195,7 +195,7 @@ public class IngestEventsListener {
public synchronized static void setFlagSeenDevices(boolean value) { public synchronized static void setFlagSeenDevices(boolean value) {
flagSeenDevices = value; flagSeenDevices = value;
} }
/** /**
* Configure the listener to flag unique apps or not. * Configure the listener to flag unique apps or not.
* *
@ -204,7 +204,7 @@ public class IngestEventsListener {
public synchronized static void setFlagUniqueArtifacts(boolean value) { public synchronized static void setFlagUniqueArtifacts(boolean value) {
flagUniqueArtifacts = value; flagUniqueArtifacts = value;
} }
/** /**
* Are unique apps being flagged? * Are unique apps being flagged?
* *
@ -256,10 +256,12 @@ public class IngestEventsListener {
} }
/** /**
* Create a "previously seen" hit for a device which was previously seen * Create a "previously seen" hit for a device which was previously seen in
* in the central repository. NOTE: Artifacts that are too common will be skipped. * the central repository. NOTE: Artifacts that are too common will be
* skipped.
* *
* @param originalArtifact the artifact to create the "previously seen" item for * @param originalArtifact the artifact to create the "previously seen" item
* for
* @param caseDisplayNames the case names the artifact was previously seen * @param caseDisplayNames the case names the artifact was previously seen
* in * in
* @param aType The correlation type. * @param aType The correlation type.
@ -271,19 +273,19 @@ public class IngestEventsListener {
"IngestEventsListener.prevCount.text=Number of previous {0}: {1}"}) "IngestEventsListener.prevCount.text=Number of previous {0}: {1}"})
static private void makeAndPostPreviousSeenArtifact(BlackboardArtifact originalArtifact, List<String> caseDisplayNames, static private void makeAndPostPreviousSeenArtifact(BlackboardArtifact originalArtifact, List<String> caseDisplayNames,
CorrelationAttributeInstance.Type aType, String value) { CorrelationAttributeInstance.Type aType, String value) {
// calculate score // calculate score
Score score; Score score;
int numCases = caseDisplayNames.size(); int numCases = caseDisplayNames.size();
if (numCases <= MAX_NUM_PREVIOUS_CASES_FOR_LIKELY_NOTABLE_SCORE) { if (numCases <= MAX_NUM_PREVIOUS_CASES_FOR_LIKELY_NOTABLE_SCORE) {
score = Score.SCORE_LIKELY_NOTABLE; score = Score.SCORE_LIKELY_NOTABLE;
} else if (numCases > MAX_NUM_PREVIOUS_CASES_FOR_LIKELY_NOTABLE_SCORE && numCases <= MAX_NUM_PREVIOUS_CASES_FOR_PREV_SEEN_ARTIFACT_CREATION) { } else if (numCases > MAX_NUM_PREVIOUS_CASES_FOR_LIKELY_NOTABLE_SCORE && numCases <= MAX_NUM_PREVIOUS_CASES_FOR_PREV_SEEN_ARTIFACT_CREATION) {
score = Score.SCORE_NONE; score = Score.SCORE_NONE;
} else { } else {
// don't make an Analysis Result, the artifact is too common. // don't make an Analysis Result, the artifact is too common.
return; return;
} }
String prevCases = caseDisplayNames.stream().distinct().collect(Collectors.joining(",")); String prevCases = caseDisplayNames.stream().distinct().collect(Collectors.joining(","));
String justification = "Previously seen in cases " + prevCases; String justification = "Previously seen in cases " + prevCases;
Collection<BlackboardAttribute> attributesForNewArtifact = Arrays.asList(new BlackboardAttribute( Collection<BlackboardAttribute> attributesForNewArtifact = Arrays.asList(new BlackboardAttribute(
@ -297,40 +299,42 @@ public class IngestEventsListener {
value), value),
new BlackboardAttribute( new BlackboardAttribute(
TSK_OTHER_CASES, MODULE_NAME, TSK_OTHER_CASES, MODULE_NAME,
prevCases)); prevCases));
makeAndPostArtifact(BlackboardArtifact.Type.TSK_PREVIOUSLY_SEEN, originalArtifact, attributesForNewArtifact, Bundle.IngestEventsListener_prevExists_text(), makeAndPostArtifact(BlackboardArtifact.Type.TSK_PREVIOUSLY_SEEN, originalArtifact, attributesForNewArtifact, Bundle.IngestEventsListener_prevExists_text(),
score, justification); score, justification);
} }
/** /**
* Create a "previously unseen" hit for an application which was never seen in * Create a "previously unseen" hit for an application which was never seen
* the central repository. * in the central repository.
* *
* @param originalArtifact the artifact to create the "previously unseen" item * @param originalArtifact the artifact to create the "previously unseen"
* for * item for
* @param aType The correlation type. * @param aType The correlation type.
* @param value The correlation value. * @param value The correlation value.
*/ */
static private void makeAndPostPreviouslyUnseenArtifact(BlackboardArtifact originalArtifact, CorrelationAttributeInstance.Type aType, String value) { static private void makeAndPostPreviouslyUnseenArtifact(BlackboardArtifact originalArtifact, CorrelationAttributeInstance.Type aType, String value) {
Collection<BlackboardAttribute> attributesForNewArtifact = Arrays.asList( Collection<BlackboardAttribute> attributesForNewArtifact = Arrays.asList(
new BlackboardAttribute( new BlackboardAttribute(
TSK_CORRELATION_TYPE, MODULE_NAME, TSK_CORRELATION_TYPE, MODULE_NAME,
aType.getDisplayName()), aType.getDisplayName()),
new BlackboardAttribute( new BlackboardAttribute(
TSK_CORRELATION_VALUE, MODULE_NAME, TSK_CORRELATION_VALUE, MODULE_NAME,
value)); value));
makeAndPostArtifact(BlackboardArtifact.Type.TSK_PREVIOUSLY_UNSEEN, originalArtifact, attributesForNewArtifact, "", makeAndPostArtifact(BlackboardArtifact.Type.TSK_PREVIOUSLY_UNSEEN, originalArtifact, attributesForNewArtifact, "",
Score.SCORE_LIKELY_NOTABLE, "This application has not been previously seen before"); Score.SCORE_LIKELY_NOTABLE, "This application has not been previously seen before");
} }
/** /**
* Make an artifact to flag the passed in artifact. * Make an artifact to flag the passed in artifact.
* *
* @param newArtifactType Type of artifact to create. * @param newArtifactType Type of artifact to create.
* @param originalArtifact Artifact in current case we want to flag * @param originalArtifact Artifact in current case we want to flag
* @param attributesForNewArtifact Attributes to assign to the new artifact * @param attributesForNewArtifact Attributes to assign to the new artifact
* @param configuration The configuration to be specified for the new artifact hit * @param configuration The configuration to be specified for the
* @param score sleuthkit.datamodel.Score to be assigned to this artifact * new artifact hit
* @param score sleuthkit.datamodel.Score to be assigned
* to this artifact
* @param justification Justification string * @param justification Justification string
*/ */
private static void makeAndPostArtifact(BlackboardArtifact.Type newArtifactType, BlackboardArtifact originalArtifact, Collection<BlackboardAttribute> attributesForNewArtifact, String configuration, private static void makeAndPostArtifact(BlackboardArtifact.Type newArtifactType, BlackboardArtifact originalArtifact, Collection<BlackboardAttribute> attributesForNewArtifact, String configuration,
@ -341,8 +345,8 @@ public class IngestEventsListener {
// Create artifact if it doesn't already exist. // Create artifact if it doesn't already exist.
BlackboardArtifact.ARTIFACT_TYPE type = BlackboardArtifact.ARTIFACT_TYPE.fromID(newArtifactType.getTypeID()); BlackboardArtifact.ARTIFACT_TYPE type = BlackboardArtifact.ARTIFACT_TYPE.fromID(newArtifactType.getTypeID());
if (!blackboard.artifactExists(originalArtifact, type, attributesForNewArtifact)) { if (!blackboard.artifactExists(originalArtifact, type, attributesForNewArtifact)) {
BlackboardArtifact newArtifact = originalArtifact.newAnalysisResult( BlackboardArtifact newArtifact = originalArtifact.newAnalysisResult(
newArtifactType, score, newArtifactType, score,
null, configuration, justification, attributesForNewArtifact) null, configuration, justification, attributesForNewArtifact)
.getAnalysisResult(); .getAnalysisResult();
@ -549,14 +553,14 @@ public class IngestEventsListener {
for (BlackboardArtifact bbArtifact : bbArtifacts) { for (BlackboardArtifact bbArtifact : bbArtifacts) {
// makeCorrAttrToSave will filter out artifacts which should not be sources of CR data. // makeCorrAttrToSave will filter out artifacts which should not be sources of CR data.
List<CorrelationAttributeInstance> convertedArtifacts = new ArrayList<>(); List<CorrelationAttributeInstance> convertedArtifacts = new ArrayList<>();
if (bbArtifact instanceof DataArtifact){ if (bbArtifact instanceof DataArtifact) {
convertedArtifacts.addAll(CorrelationAttributeUtil.makeCorrAttrsToSave((DataArtifact)bbArtifact)); convertedArtifacts.addAll(CorrelationAttributeUtil.makeCorrAttrsToSave((DataArtifact) bbArtifact));
} }
for (CorrelationAttributeInstance eamArtifact : convertedArtifacts) { for (CorrelationAttributeInstance eamArtifact : convertedArtifacts) {
try { try {
// Only do something with this artifact if it's unique within the job // Only do something with this artifact if it's unique within the job
if (recentlyAddedCeArtifacts.add(eamArtifact.toString())) { if (recentlyAddedCeArtifacts.add(eamArtifact.toString())) {
// Get a list of instances for a given value (hash, email, etc.) // Get a list of instances for a given value (hash, email, etc.)
List<CorrelationAttributeInstance> previousOccurrences = new ArrayList<>(); List<CorrelationAttributeInstance> previousOccurrences = new ArrayList<>();
// check if we are flagging things // check if we are flagging things
@ -591,7 +595,7 @@ public class IngestEventsListener {
continue; continue;
} }
} }
// flag previously seen devices and communication accounts (emails, phones, etc) // flag previously seen devices and communication accounts (emails, phones, etc)
if (flagPreviousItemsEnabled && !previousOccurrences.isEmpty() if (flagPreviousItemsEnabled && !previousOccurrences.isEmpty()
&& (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.USBID_TYPE_ID && (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.USBID_TYPE_ID
@ -605,12 +609,12 @@ public class IngestEventsListener {
List<String> caseDisplayNames = getCaseDisplayNames(previousOccurrences); List<String> caseDisplayNames = getCaseDisplayNames(previousOccurrences);
makeAndPostPreviousSeenArtifact(bbArtifact, caseDisplayNames, eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue()); makeAndPostPreviousSeenArtifact(bbArtifact, caseDisplayNames, eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue());
} }
// flag previously unseen apps and domains // flag previously unseen apps and domains
if (flagUniqueItemsEnabled if (flagUniqueItemsEnabled
&& (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.INSTALLED_PROGS_TYPE_ID && (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.INSTALLED_PROGS_TYPE_ID
|| eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.DOMAIN_TYPE_ID)) { || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.DOMAIN_TYPE_ID)) {
if (previousOccurrences.isEmpty()) { if (previousOccurrences.isEmpty()) {
makeAndPostPreviouslyUnseenArtifact(bbArtifact, eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue()); makeAndPostPreviouslyUnseenArtifact(bbArtifact, eamArtifact.getCorrelationType(), eamArtifact.getCorrelationValue());
} }
@ -635,7 +639,7 @@ public class IngestEventsListener {
} // DATA_ADDED } // DATA_ADDED
} }
} }
/** /**
* Gets case display names for a list of CorrelationAttributeInstance. * Gets case display names for a list of CorrelationAttributeInstance.
* *
@ -666,5 +670,5 @@ public class IngestEventsListener {
} }
} }
return caseNames; return caseNames;
} }
} }

4
Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModule.java
View File

@ -256,7 +256,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
} }
if (IngestEventsListener.getCeModuleInstanceCount() == 1 || !IngestEventsListener.isFlagUniqueArtifacts()) { if (IngestEventsListener.getCeModuleInstanceCount() == 1 || !IngestEventsListener.isFlagUniqueArtifacts()) {
IngestEventsListener.setFlagUniqueArtifacts(flagUniqueArtifacts); IngestEventsListener.setFlagUniqueArtifacts(flagUniqueArtifacts);
} }
if (CentralRepository.isEnabled() == false) { if (CentralRepository.isEnabled() == false) {
/* /*
@ -360,7 +360,7 @@ final class CentralRepoIngestModule implements FileIngestModule {
// Create artifact if it doesn't already exist. // Create artifact if it doesn't already exist.
if (!blackboard.artifactExists(abstractFile, TSK_PREVIOUSLY_NOTABLE, attributes)) { if (!blackboard.artifactExists(abstractFile, TSK_PREVIOUSLY_NOTABLE, attributes)) {
BlackboardArtifact tifArtifact = abstractFile.newAnalysisResult( BlackboardArtifact tifArtifact = abstractFile.newAnalysisResult(
BlackboardArtifact.Type.TSK_PREVIOUSLY_NOTABLE, Score.SCORE_NOTABLE, BlackboardArtifact.Type.TSK_PREVIOUSLY_NOTABLE, Score.SCORE_NOTABLE,
null, Bundle.CentralRepoIngestModule_prevTaggedSet_text(), justification, attributes) null, Bundle.CentralRepoIngestModule_prevTaggedSet_text(), justification, attributes)
.getAnalysisResult(); .getAnalysisResult();
try { try {

4
Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java
View File

@ -64,7 +64,7 @@ public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter {
return Version.getVersion(); return Version.getVersion();
} }
@Override @Override
public boolean isFileIngestModuleFactory() { public boolean isFileIngestModuleFactory() {
return true; return true;
} }
@ -83,7 +83,7 @@ public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter {
} }
throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings"); throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings");
} }
@Override @Override
public boolean hasGlobalSettingsPanel() { public boolean hasGlobalSettingsPanel() {
return true; return true;