codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-06 02:24:30 +00:00
Code Issues Releases Wiki Activity

Merge branch 'master' of github.com:sleuthkit/autopsy

Browse Source
This commit is contained in:
Dick Fickling
2012-02-02 14:44:01 -05:00
parent d770c67183 125819c918
commit 0a2942de02
3 changed files with 36 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chrome.java Normal file → Executable file
View File

@@ -75,13 +75,13 @@ public class Chrome {
kvs.put("Last Accessed", temprs.getString("visit_date"));
kvs.put("Reference", temprs.getString("from_visit"));
BlackboardArtifact bbart = FFSqlitedb.get(j).newArtifact(ARTIFACT_TYPE.TSK_WEB_HISTORY);
BlackboardAttribute bbatturl = new BlackboardAttribute(1,"RecentActivity","Chrome",temprs.getString("url"));
BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(),"RecentActivity","Chrome",temprs.getString("url"));
bbart.addAttribute(bbatturl);
BlackboardAttribute bbattdate = new BlackboardAttribute(31,"RecentActivity","Chrome",temprs.getString("last_visit_time"));
BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(),"RecentActivity","Chrome",temprs.getString("last_visit_time"));
bbart.addAttribute(bbattdate);
BlackboardAttribute bbattref = new BlackboardAttribute(32,"RecentActivity","Chrome",temprs.getString("from_visit"));
BlackboardAttribute bbattref = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID(),"RecentActivity","Chrome",temprs.getString("from_visit"));
bbart.addAttribute(bbattref);
BlackboardAttribute bbatttitle = new BlackboardAttribute(3,"RecentActivity","Chrome",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title"));
BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(),"RecentActivity","Chrome",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title"));
bbart.addAttribute(bbatttitle);
als.add(kvs);
@@ -141,13 +141,13 @@ public class Chrome {
cookies.add(kvs);
BlackboardArtifact bbart = FFSqlitedb.get(j).newArtifact(ARTIFACT_TYPE.TSK_WEB_COOKIE);
BlackboardAttribute bbatturl = new BlackboardAttribute(1, "RecentActivity", "Chrome", temprs.getString("host"));
BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity", "Chrome", temprs.getString("host"));
bbart.addAttribute(bbatturl);
BlackboardAttribute bbattdate = new BlackboardAttribute(2,"RecentActivity", "Chrome",temprs.getString("access_utc"));
BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(),"RecentActivity", "Chrome",temprs.getString("access_utc"));
bbart.addAttribute(bbattdate);
BlackboardAttribute bbattvalue = new BlackboardAttribute(26,"RecentActivity", "Chrome",temprs.getString("value"));
BlackboardAttribute bbattvalue = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID(),"RecentActivity", "Chrome",temprs.getString("value"));
bbart.addAttribute(bbattvalue);
BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","Chrome",((temprs.getString("name") != null) ? temprs.getString("name") : "No name"));
BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","Chrome",((temprs.getString("name") != null) ? temprs.getString("name") : "No name"));
bbart.addAttribute(bbatttitle);
@@ -204,11 +204,11 @@ public class Chrome {
kvs.put("Count", temprs.getString("urls.typed_count"));
kvs.put("Last Accessed", temprs.getString("urls._last_visit_time"));
kvs.put("Reference", temprs.getString("starred.date_added"));
BlackboardAttribute bbattdate = new BlackboardAttribute(31,"RecentActivity","Chrome",temprs.getString("last_visit_time"));
BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(),"RecentActivity","Chrome",temprs.getString("last_visit_time"));
bbart.addAttribute(bbattdate);
BlackboardAttribute bbatturl = new BlackboardAttribute(5, "RecentActivity","Chrome",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL"));
BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity","Chrome",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL"));
bbart.addAttribute(bbatturl);
BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","Chrome", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title"));
BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","Chrome", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title"));
bbart.addAttribute(bbatttitle);
bookmarks.add(kvs);

23
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java Normal file → Executable file
View File

@@ -48,6 +48,7 @@ import org.sleuthkit.autopsy.datamodel.KeyValueThing;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.FsContent;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskException;
@@ -130,7 +131,12 @@ public class ExtractIE { // implements BrowserActivity {
//indexFileName = "index" + Long.toString(bbart.getArtifactID()) + ".dat";
temps = currentCase.getTempDirectory() + File.separator + indexFileName;
File datFile = new File(temps);
ContentUtils.writeToFile(fsc, datFile);
try {
ContentUtils.writeToFile(fsc, datFile);
}
catch (IOException e) {
logger.log(Level.INFO, "Error while trying to write index.dat file " + datFile.getAbsolutePath(), e);
}
boolean bPascProcSuccess = executePasco(temps, index, index);
@@ -160,12 +166,12 @@ public class ExtractIE { // implements BrowserActivity {
List<String> command = new ArrayList<String>();
command.add("-cp");
command.add(PASCO_LIB_PATH);
command.add("\"" + PASCO_LIB_PATH + "\"");
command.add(" isi.pasco2.Main");
command.add(" -T history");
command.add(indexFilePath);
command.add("\"" + indexFilePath + "\"");
//command.add(" > " + PASCO_RESULTS_PATH + "\\pasco2Result" + Integer.toString(fileIndex) + ".txt");
command.add(" > " + PASCO_RESULTS_PATH + File.separator + Long.toString(bbId));
command.add(" > " + "\"" + PASCO_RESULTS_PATH + File.separator + Long.toString(bbId) + "\"");
String[] cmd = command.toArray(new String[0]);
JavaSystemCaller.Exec.execute("java", cmd);
@@ -229,15 +235,16 @@ public class ExtractIE { // implements BrowserActivity {
PASCO_RESULTS_LUT.put("Last Accessed", lineBuff[3]);
PASCO_RESULTS_LUT.put("Reference", "None");
// TODO: Need to fix this so we have the right obj_id
BlackboardArtifact bbart = tempDb.getRootObjects().get(0).newArtifact(ARTIFACT_TYPE.TSK_WEB_HISTORY);
BlackboardAttribute bbatturl = new BlackboardAttribute(1, "RecentActivity", "Internet Explorer", lineBuff[1]);
BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity", "Internet Explorer", lineBuff[1]);
bbart.addAttribute(bbatturl);
BlackboardAttribute bbattdate = new BlackboardAttribute(31, "RecentActivity", "Internet Explorer", lineBuff[3]);
BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(), "RecentActivity", "Internet Explorer", lineBuff[3]);
bbart.addAttribute(bbattdate);
BlackboardAttribute bbattref = new BlackboardAttribute(32, "RecentActivity", "Internet Explorer", "No Ref");
BlackboardAttribute bbattref = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID(), "RecentActivity", "Internet Explorer", "No Ref");
bbart.addAttribute(bbattref);
BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity", "Internet Explorer", lineBuff[2]);
BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", "Internet Explorer", lineBuff[2]);
bbart.addAttribute(bbatttitle);
//KeyValueThing

20
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java Normal file → Executable file
View File

@@ -75,13 +75,13 @@ public class Firefox {
kvs.put("Last Accessed", temprs.getString("visit_date"));
kvs.put("Reference", temprs.getString("from_visit"));
BlackboardAttribute bbatturl = new BlackboardAttribute(1,"RecentActivity","FireFox",temprs.getString("url"));
BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(),"RecentActivity","FireFox",temprs.getString("url"));
bbart.addAttribute(bbatturl);
BlackboardAttribute bbattdate = new BlackboardAttribute(31,"RecentActivity","FireFox",temprs.getString("visit_date"));
BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(),"RecentActivity","FireFox",temprs.getString("visit_date"));
bbart.addAttribute(bbattdate);
BlackboardAttribute bbattref = new BlackboardAttribute(32,"RecentActivity","FireFox",temprs.getString("from_visit"));
BlackboardAttribute bbattref = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID(),"RecentActivity","FireFox",temprs.getString("from_visit"));
bbart.addAttribute(bbattref);
BlackboardAttribute bbatttitle = new BlackboardAttribute(3,"RecentActivity","FireFox",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title"));
BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(),"RecentActivity","FireFox",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title"));
bbart.addAttribute(bbatttitle);
//bbart.addAttribute(ATTRIBUTE_TYPE.TSK_URL, temprs.getString("url"), "RecentActivity","FireFox");
//bbart.addAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, temprs.getString("visit_date"), "RecentActivity","FireFox");
@@ -101,9 +101,9 @@ public class Firefox {
kvs.put("Count", "");
kvs.put("Last Accessed", "");
kvs.put("Reference", "");
BlackboardAttribute bbatturl = new BlackboardAttribute(5,"RecentActivity","FireFox",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL"));
BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(),"RecentActivity","FireFox",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL"));
bbart.addAttribute(bbatturl);
BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","FireFox", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title"));
BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","FireFox", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title"));
bbart.addAttribute(bbatttitle);
bookmarks.add(kvs);
@@ -163,13 +163,13 @@ public class Firefox {
kvs.put("Count", temprs.getString("value"));
kvs.put("Last Accessed", temprs.getString("lastAccessed"));
kvs.put("Reference", temprs.getString("creationTime"));
BlackboardAttribute bbatturl = new BlackboardAttribute(1, "RecentActivity", "FireFox", temprs.getString("host"));
BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity", "FireFox", temprs.getString("host"));
bbart.addAttribute(bbatturl);
BlackboardAttribute bbattdate = new BlackboardAttribute(2, "RecentActivity", "FireFox", temprs.getString("lastAccessed"));
BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), "RecentActivity", "FireFox", temprs.getString("lastAccessed"));
bbart.addAttribute(bbattdate);
BlackboardAttribute bbattvalue = new BlackboardAttribute(26, "RecentActivity", "FireFox", temprs.getString("value"));
BlackboardAttribute bbattvalue = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID(), "RecentActivity", "FireFox", temprs.getString("value"));
bbart.addAttribute(bbattvalue);
BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","FireFox",((temprs.getString("name") != null) ? temprs.getString("name") : "No name"));
BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","FireFox",((temprs.getString("name") != null) ? temprs.getString("name") : "No name"));
bbart.addAttribute(bbatttitle);