From aa4e4dacbef88b8e3c0840198fa2b499cb6b3663 Mon Sep 17 00:00:00 2001 From: Brian Carrier Date: Thu, 2 Feb 2012 13:58:24 -0500 Subject: [PATCH 1/2] Use attribute enum values instead of hard coded numbers --- .../autopsy/recentactivity/Chrome.java | 22 +++++++++---------- .../autopsy/recentactivity/ExtractIE.java | 9 ++++---- .../autopsy/recentactivity/Firefox.java | 20 ++++++++--------- 3 files changed, 26 insertions(+), 25 deletions(-) mode change 100644 => 100755 RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chrome.java mode change 100644 => 100755 RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java mode change 100644 => 100755 RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chrome.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chrome.java old mode 100644 new mode 100755 index e87aac2f2a..e3448d9026 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chrome.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Chrome.java @@ -75,13 +75,13 @@ public class Chrome { kvs.put("Last Accessed", temprs.getString("visit_date")); kvs.put("Reference", temprs.getString("from_visit")); BlackboardArtifact bbart = FFSqlitedb.get(j).newArtifact(ARTIFACT_TYPE.TSK_WEB_HISTORY); - BlackboardAttribute bbatturl = new BlackboardAttribute(1,"RecentActivity","Chrome",temprs.getString("url")); + BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(),"RecentActivity","Chrome",temprs.getString("url")); bbart.addAttribute(bbatturl); - BlackboardAttribute bbattdate = new BlackboardAttribute(31,"RecentActivity","Chrome",temprs.getString("last_visit_time")); + BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(),"RecentActivity","Chrome",temprs.getString("last_visit_time")); bbart.addAttribute(bbattdate); - BlackboardAttribute bbattref = new BlackboardAttribute(32,"RecentActivity","Chrome",temprs.getString("from_visit")); + BlackboardAttribute bbattref = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID(),"RecentActivity","Chrome",temprs.getString("from_visit")); bbart.addAttribute(bbattref); - BlackboardAttribute bbatttitle = new BlackboardAttribute(3,"RecentActivity","Chrome",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title")); + BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(),"RecentActivity","Chrome",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title")); bbart.addAttribute(bbatttitle); als.add(kvs); @@ -141,13 +141,13 @@ public class Chrome { cookies.add(kvs); BlackboardArtifact bbart = FFSqlitedb.get(j).newArtifact(ARTIFACT_TYPE.TSK_WEB_COOKIE); - BlackboardAttribute bbatturl = new BlackboardAttribute(1, "RecentActivity", "Chrome", temprs.getString("host")); + BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity", "Chrome", temprs.getString("host")); bbart.addAttribute(bbatturl); - BlackboardAttribute bbattdate = new BlackboardAttribute(2,"RecentActivity", "Chrome",temprs.getString("access_utc")); + BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(),"RecentActivity", "Chrome",temprs.getString("access_utc")); bbart.addAttribute(bbattdate); - BlackboardAttribute bbattvalue = new BlackboardAttribute(26,"RecentActivity", "Chrome",temprs.getString("value")); + BlackboardAttribute bbattvalue = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID(),"RecentActivity", "Chrome",temprs.getString("value")); bbart.addAttribute(bbattvalue); - BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","Chrome",((temprs.getString("name") != null) ? temprs.getString("name") : "No name")); + BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","Chrome",((temprs.getString("name") != null) ? temprs.getString("name") : "No name")); bbart.addAttribute(bbatttitle); @@ -204,11 +204,11 @@ public class Chrome { kvs.put("Count", temprs.getString("urls.typed_count")); kvs.put("Last Accessed", temprs.getString("urls._last_visit_time")); kvs.put("Reference", temprs.getString("starred.date_added")); - BlackboardAttribute bbattdate = new BlackboardAttribute(31,"RecentActivity","Chrome",temprs.getString("last_visit_time")); + BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(),"RecentActivity","Chrome",temprs.getString("last_visit_time")); bbart.addAttribute(bbattdate); - BlackboardAttribute bbatturl = new BlackboardAttribute(5, "RecentActivity","Chrome",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL")); + BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity","Chrome",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL")); bbart.addAttribute(bbatturl); - BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","Chrome", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title")); + BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","Chrome", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title")); bbart.addAttribute(bbatttitle); bookmarks.add(kvs); diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java old mode 100644 new mode 100755 index c912a5056c..4a0a2c5bba --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java @@ -48,6 +48,7 @@ import org.sleuthkit.autopsy.datamodel.KeyValueThing; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardAttribute; +import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; import org.sleuthkit.datamodel.FsContent; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.datamodel.TskException; @@ -230,13 +231,13 @@ public class ExtractIE { // implements BrowserActivity { PASCO_RESULTS_LUT.put("Reference", "None"); BlackboardArtifact bbart = tempDb.getBlackboardArtifact(bbartId); - BlackboardAttribute bbatturl = new BlackboardAttribute(1, "RecentActivity", "Internet Explorer", lineBuff[1]); + BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity", "Internet Explorer", lineBuff[1]); bbart.addAttribute(bbatturl); - BlackboardAttribute bbattdate = new BlackboardAttribute(31, "RecentActivity", "Internet Explorer", lineBuff[3]); + BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(), "RecentActivity", "Internet Explorer", lineBuff[3]); bbart.addAttribute(bbattdate); - BlackboardAttribute bbattref = new BlackboardAttribute(32, "RecentActivity", "Internet Explorer", "No Ref"); + BlackboardAttribute bbattref = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID(), "RecentActivity", "Internet Explorer", "No Ref"); bbart.addAttribute(bbattref); - BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity", "Internet Explorer", lineBuff[2]); + BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", "Internet Explorer", lineBuff[2]); bbart.addAttribute(bbatttitle); //KeyValueThing diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java old mode 100644 new mode 100755 index 1bd8f501da..cc71bace37 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Firefox.java @@ -75,13 +75,13 @@ public class Firefox { kvs.put("Last Accessed", temprs.getString("visit_date")); kvs.put("Reference", temprs.getString("from_visit")); - BlackboardAttribute bbatturl = new BlackboardAttribute(1,"RecentActivity","FireFox",temprs.getString("url")); + BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(),"RecentActivity","FireFox",temprs.getString("url")); bbart.addAttribute(bbatturl); - BlackboardAttribute bbattdate = new BlackboardAttribute(31,"RecentActivity","FireFox",temprs.getString("visit_date")); + BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LAST_ACCESSED.getTypeID(),"RecentActivity","FireFox",temprs.getString("visit_date")); bbart.addAttribute(bbattdate); - BlackboardAttribute bbattref = new BlackboardAttribute(32,"RecentActivity","FireFox",temprs.getString("from_visit")); + BlackboardAttribute bbattref = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID(),"RecentActivity","FireFox",temprs.getString("from_visit")); bbart.addAttribute(bbattref); - BlackboardAttribute bbatttitle = new BlackboardAttribute(3,"RecentActivity","FireFox",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title")); + BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(),"RecentActivity","FireFox",((temprs.getString("title") != null) ? temprs.getString("title") : "No Title")); bbart.addAttribute(bbatttitle); //bbart.addAttribute(ATTRIBUTE_TYPE.TSK_URL, temprs.getString("url"), "RecentActivity","FireFox"); //bbart.addAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, temprs.getString("visit_date"), "RecentActivity","FireFox"); @@ -101,9 +101,9 @@ public class Firefox { kvs.put("Count", ""); kvs.put("Last Accessed", ""); kvs.put("Reference", ""); - BlackboardAttribute bbatturl = new BlackboardAttribute(5,"RecentActivity","FireFox",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL")); + BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(),"RecentActivity","FireFox",((temprs.getString("url") != null) ? temprs.getString("url") : "No URL")); bbart.addAttribute(bbatturl); - BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","FireFox", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title")); + BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","FireFox", ((temprs.getString("title") != null) ? temprs.getString("title").replaceAll("'", "''") : "No Title")); bbart.addAttribute(bbatttitle); bookmarks.add(kvs); @@ -163,13 +163,13 @@ public class Firefox { kvs.put("Count", temprs.getString("value")); kvs.put("Last Accessed", temprs.getString("lastAccessed")); kvs.put("Reference", temprs.getString("creationTime")); - BlackboardAttribute bbatturl = new BlackboardAttribute(1, "RecentActivity", "FireFox", temprs.getString("host")); + BlackboardAttribute bbatturl = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL.getTypeID(), "RecentActivity", "FireFox", temprs.getString("host")); bbart.addAttribute(bbatturl); - BlackboardAttribute bbattdate = new BlackboardAttribute(2, "RecentActivity", "FireFox", temprs.getString("lastAccessed")); + BlackboardAttribute bbattdate = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), "RecentActivity", "FireFox", temprs.getString("lastAccessed")); bbart.addAttribute(bbattdate); - BlackboardAttribute bbattvalue = new BlackboardAttribute(26, "RecentActivity", "FireFox", temprs.getString("value")); + BlackboardAttribute bbattvalue = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID(), "RecentActivity", "FireFox", temprs.getString("value")); bbart.addAttribute(bbattvalue); - BlackboardAttribute bbatttitle = new BlackboardAttribute(3, "RecentActivity","FireFox",((temprs.getString("name") != null) ? temprs.getString("name") : "No name")); + BlackboardAttribute bbatttitle = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity","FireFox",((temprs.getString("name") != null) ? temprs.getString("name") : "No name")); bbart.addAttribute(bbatttitle); From d09404c6de0854ca1fd8771707a1b14a7c79419f Mon Sep 17 00:00:00 2001 From: adam-m Date: Thu, 2 Feb 2012 14:06:39 -0500 Subject: [PATCH 2/2] Quote paths for windows shell in case there is a space --- .../sleuthkit/autopsy/recentactivity/ExtractIE.java | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java index c912a5056c..d3052a4484 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java @@ -130,7 +130,12 @@ public class ExtractIE { // implements BrowserActivity { indexFileName = "index" + Long.toString(bbart.getArtifactID()) + ".dat"; temps = currentCase.getTempDirectory() + File.separator + indexFileName; File datFile = new File(temps); - ContentUtils.writeToFile(fsc, datFile); + try { + ContentUtils.writeToFile(fsc, datFile); + } + catch (IOException e) { + logger.log(Level.INFO, "Error while trying to write index.dat file " + datFile.getAbsolutePath(), e); + } boolean bPascProcSuccess = executePasco(temps, index, bbart.getArtifactID()); @@ -160,12 +165,12 @@ public class ExtractIE { // implements BrowserActivity { List command = new ArrayList(); command.add("-cp"); - command.add(PASCO_LIB_PATH); + command.add("\"" + PASCO_LIB_PATH + "\""); command.add(" isi.pasco2.Main"); command.add(" -T history"); - command.add(indexFilePath); + command.add("\"" + indexFilePath + "\""); //command.add(" > " + PASCO_RESULTS_PATH + "\\pasco2Result" + Integer.toString(fileIndex) + ".txt"); - command.add(" > " + PASCO_RESULTS_PATH + File.separator + Long.toString(bbId)); + command.add(" > " + "\"" + PASCO_RESULTS_PATH + File.separator + Long.toString(bbId) + "\""); String[] cmd = command.toArray(new String[0]); JavaSystemCaller.Exec.execute("java", cmd);