/* * * Autopsy Forensic Browser * * Copyright 2012 Basis Technology Corp. * * Copyright 2012 42six Solutions. * Contact: aebadirad 42six com * Project Contact/Architect: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.sleuthkit.autopsy.recentactivity; import java.io.File; import java.nio.file.Path; import java.util.ArrayList; import java.util.logging.Level; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.ingest.PipelineContext; import org.sleuthkit.autopsy.ingest.IngestDataSourceWorkerController; import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.IngestMessage; import org.sleuthkit.autopsy.ingest.IngestMessage.MessageType; import org.sleuthkit.autopsy.ingest.IngestModuleDataSource; import org.sleuthkit.autopsy.ingest.IngestModuleInit; import org.sleuthkit.datamodel.Content; /** * Recent activity image ingest module * */ public final class RAImageIngestModule extends IngestModuleDataSource { private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName()); private static RAImageIngestModule defaultInstance = null; private IngestServices services; private static int messageId = 0; private StringBuilder subCompleted = new StringBuilder(); private ArrayList modules; final public static String MODULE_VERSION = "1.0"; //public constructor is required //as multiple instances are created for processing multiple images simultenously public RAImageIngestModule() { } @Override public void process(PipelineContextpipelineContext, Content dataSource, IngestDataSourceWorkerController controller) { services.postMessage(IngestMessage.createMessage(++messageId, MessageType.INFO, this, "Started " + dataSource.getName())); controller.switchToDeterminate(modules.size()); controller.progress(0); ArrayList errors = new ArrayList<>(); for (int i = 0; i < modules.size(); i++) { Extract module = modules.get(i); if (controller.isCancelled()) { logger.log(Level.INFO, "Recent Activity has been canceled, quitting before {0}", module.getName()); break; } try { module.process(pipelineContext, dataSource, controller); } catch (Exception ex) { logger.log(Level.SEVERE, "Exception occurred in " + module.getName(), ex); subCompleted.append(module.getName()).append(" failed - see log for details
"); } controller.progress(i + 1); errors.addAll(module.getErrorMessages()); } // create the final message for inbox StringBuilder errorMessage = new StringBuilder(); String errorMsgSubject; if (!errors.isEmpty()) { errorMessage.append("Errors encountered during analysis:
    \n"); for (String msg : errors) { errorMessage.append("
  • ").append(msg).append("
  • \n"); } errorMessage.append("
\n"); if (errors.size() == 1) { errorMsgSubject = "1 error found"; } else { errorMsgSubject = errors.size() + " errors found"; } } else { errorMessage.append("No errors encountered."); errorMsgSubject = "No errors reported"; } final IngestMessage msg = IngestMessage.createMessage(++messageId, MessageType.INFO, this, "Finished " + dataSource.getName()+ " - " + errorMsgSubject, errorMessage.toString()); services.postMessage(msg); } @Override public void complete() { logger.log(Level.INFO, "complete() " + this.toString()); // close modules for (int i = 0; i < modules.size(); i++) { Extract module = modules.get(i); try { module.complete(); } catch (Exception ex) { logger.log(Level.SEVERE, "Exception occurred when completing " + module.getName(), ex); subCompleted.append(module.getName()).append(" failed to complete - see log for details
"); } } //module specific cleanup due to completion here } @Override public String getName() { return "Recent Activity"; } @Override public String getDescription() { return "Extracts recent user activity, such as Web browsing, recently used documents and installed programs."; } @Override public void init(IngestModuleInit initContext) { modules = new ArrayList<>(); logger.log(Level.INFO, "init() {0}", this.toString()); services = IngestServices.getDefault(); final Extract registry = new ExtractRegistry(); final Extract iexplore = new ExtractIE(); final Extract chrome = new Chrome(); final Extract firefox = new Firefox(); final Extract SEUQA = new SearchEngineURLQueryAnalyzer(); modules.add(chrome); modules.add(firefox); modules.add(registry); modules.add(iexplore); modules.add(SEUQA); for (Extract module : modules) { try { module.init(initContext); } catch (Exception ex) { logger.log(Level.SEVERE, "Exception during init() of " + module.getName(), ex); } } } @Override public void stop() { logger.log(Level.INFO, "RAImageIngetModule::stop()"); for (Extract module : modules) { try { module.stop(); } catch (Exception ex) { logger.log(Level.SEVERE, "Exception during stop() of " + module.getName(), ex); } } logger.log(Level.INFO, "Recent Activity processes has been shutdown."); } @Override public String getVersion() { return MODULE_VERSION; } @Override public boolean hasBackgroundJobsRunning() { return false; } protected static String getRATempPath(Case a_case) { String tmpDir = a_case.getTempDirectory() + File.separator + "RecentActivity" + File.separator; File dir = new File(tmpDir); if (dir.exists() == false) { dir.mkdirs(); } return tmpDir; } protected static String getRAOutputPath(Case a_case) { String tmpDir = a_case.getModulesOutputDirAbsPath() + File.separator + "RecentActivity" + File.separator; File dir = new File(tmpDir); if (dir.exists() == false) { dir.mkdirs(); } return tmpDir; } }