diff --git a/Case/src/org/sleuthkit/autopsy/casemodule/package.dox b/Case/src/org/sleuthkit/autopsy/casemodule/package.dox index 3f438b6ecc..f364558762 100644 --- a/Case/src/org/sleuthkit/autopsy/casemodule/package.dox +++ b/Case/src/org/sleuthkit/autopsy/casemodule/package.dox @@ -2,20 +2,23 @@ /** \package org.sleuthkit.autopsy.casemodule -The org.sleuthkit.autopsy.casemodule Module is responsible for organizing a case. A case contains one or more disk images and is the highest-level unit of an investigation. +The org.sleuthkit.autopsy.casemodule Module is responsible for organizing a case. A case contains one or more disk images and is the highest-level unit of an investigation. \section casemodule_contents Package Contents The important classes in this case are: - Case \section casemodule_overview Overview + All data in a case will be stored in a single database and configuration file. A case must be open before analysis can occur. You will use a Case object to get access to the data being analyzed. Case settings are stored in an XML file. See the XMLCaseManagement class for more details. Currently, only one case can be opened at a time. To determine the open case, use the Case.getCurrentCase() method. + Do not cache the case handle object obtained from this method (for example, in member variables) unless you are sure your are acting within case context; It is safer to call the method more frequently to ensure the validity of the case handle object as new cases are opened. + Once you have the object for the currently open case, Case.getRootObjects() will return the top-level Sleuth Kit Content modules. You can then get their children to go down the tree of data types. diff --git a/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox b/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox index 9beb6e1d37..e8da825fcf 100644 --- a/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox +++ b/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox @@ -1,93 +1,8 @@ /** - * \package org.sleuthkit.autopsy.corecomponentinterfaces - * This package contains the interface classes that define the core components in Autopsy. These components are used in the difference zones of the GUI. - * -NOTE: Much of this data may be out of date. It has not been updated -since a major redesign was done. +\package org.sleuthkit.autopsy.corecomponentinterfaces -\section corecomponentinterface_contents Package Contents -The following are imporant classes in this package -- TODO +This package contains the interface classes that define the core components in Autopsy. These components are used in the different zones of the GUI. +See \ref design_page for examples of the modules and such that it defines. - *

Autopsy Zones

- * There are three major zones in the Autopsy UI. The left hand side has the org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer zone. This area is where you can search for and explore data. It has all of the analysis smarts. An example of a DataExplorer is the directory tree that shows the hierarchy of directories (and hides the files from view). - * The DataExplorer area identifies a subset of the data to show the user and passes the data to the org.sleuthkit.autopsy.corecomponentinterfaces.DataResult area in the upper right. In the previous example, the contents of a specific folder would be passed to this area and displayed in a table or thumbnail form.

- * When a file or object is selected in the DataResult, it is passed to the org.sleuthkit.autopsy.corecomponentinterfaces.DataContent zone in the lower right. This is where file content can be viewed in hex form, strings, etc. - *

Data Flow

- *

Creating Nodes in DataExplorer

- * Data flows between the areas inside of a NetBeans node. The DataExplorer modules create the NetBeans nodes. They query the SQLite database or do whatever they want to identify the set of files that are of interest. They create the NetBeans nodes based on Sleuthkit data model objects. See the org.sleuthkit.autopsy.datamodel package for more details on this. - *

Getting Nodes to DataResult

- * Each DataExplorer TopComponent is responsible for creating its own DataResult TopComponent to display its results. It can choose to re-use the same TopComponent for multiple searches (as DirectoryTree does) or it can choose to make a new one each time (as FileSearch does). The setNode() method on the DataResult object is used to set the root node to display. A dummy root node must be created as the parent if a parent does not already exist. - * The DataExplorer is responsible for setting the double-click and right-click actions associated with the node. The default single click action is to pass data to DataContent. To override this, you must create a new DataResultViewer instance that overrides the propertyChange() method. The DataExplorer adds actions to wrapping the node in a FilterNode variant. The FilterNode then defines the actions for the node by overriding the getPreferredAction() and getActions() methods. As an example, org.sleuthkit.autopsy.directorytree.DataResultFilterNode and org.sleuthkit.autopsy.directorytree.DataResultFilterChildren wraps the nodes that are passed over by the DirectoryTree DataExplorer. - * DataResult can send data back to its DataExplorer by making a custom action that looks up it's instance (DataExplorer.getInstance()). - *

Getting Nodes to DataContent

- * A default DataContent viewer is created when a case is opened. To display the contents of a node, it must be passed to a DataContent instance. The default single-click behavior of the DataResultViewers is to lookup the default DataContent TopComponent and pass the selected node to it. See org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer.propertyChange(PropertyChangeEvent) for details. - *

Creating new Functionality

- *

Creating a DataExplorer

- *
    - *
  1. Create a module from within NetBeans. It must be dependent on these modules: - * - *
  2. Create a class that implements org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer. We have been making the TopComponent class be the one that implements DataExplorer. Register this class as a DataExplorer service provider by specifying "@ServiceProvider(service=DataExplorer.class)" in the class or using layer.xml. - *
  3. Implement the methods required by the DataExplorer interface. - *
  4. Register the class to receive property change events from the org.sleuthkit.autopsy.Case module by using its addPropertyChangeListener() method. - *
  5. Access case data using the org.sleuthkit.autopsy.Case module. - *
  6. Create Nodes for the data objects using the techniques outlined in the previous section. - *
  7. Wrap the nodes in FilterNodes to define actions as outlined in the previous section. - *
  8. Send results to DataResults using the techniques outlined in the previous section. - *
- *

Creating a DataResultViewer

- *

DataResultTopComponent is the high-level window in the DataResult area. Each instance of this loads up all instances of DataResultViewers that have been registered with the system. Example viewers include the table and thumbnail views. If you want to make your own type of viewer, follow the steps below. Note that the table and thumbnail viewers come with Autopsy by default and can be used by all DataExplorers. - *

    - *
  1. Create a module from within NetBeans. It must be dependent on these modules: - * - *
  2. Make a class that extends org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer and is registered as a service provider for the org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer class by specifying "@ServiceProvider(service = DataResultViewer.class)" or by using layer.xml. This class will extend JPanel.
    3. - *
  3. See the previous sections on default actions.
    4. - *
- *

Creating a DataContentViewer

- * DataContentTopComponent is the high-level window in the DataContent area. Each instance of this loads up all instances of DataContentViewers that have been registered with the system. Example viewers include the strings and hexdump views. If you want to make your own type of viewer, follow the steps below. Note that the strings, hexdump, and image viewers come with Autopsy by default and can be used by all DataExplorers and DataResults. You only need to make a new DataContentViewer if these viewers do not satisfy your needs. - *
    - *
  1. Create a module from within NetBeans. It must be dependent on these modules: - * - *
  2. Make a class that implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer and is registered as a service provider for DataContentViewer.class by specifying "@ServiceProvider(service = DataContentViewer.class)" or by using layer.xml. This class must extend JPanel.
    3. - *
*/ diff --git a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties index 5dc30152ef..0cf1621f2a 100644 --- a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties +++ b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties @@ -50,7 +50,7 @@ DataResultTopComponent.numberMatchLabel.text=0 # Product Information panel -LBL_Description=
\n Product Version: {0}
Sleuth Kit Version: {7}
Netbeans RCP Build: {8}
Java: {1}; {2}
System: {3}; {4}; {5}
Userdir: {6}
+LBL_Description=
\n Product Version: {0} ({9})
Sleuth Kit Version: {7}
Netbeans RCP Build: {8}
Java: {1}; {2}
System: {3}; {4}; {5}
Userdir: {6}
Format_OperatingSystem_Value={0} version {1} running on {2} LBL_Copyright=
The Autopsy Forensic Browser is a graphical interface to the command line digital investigation analysis tools in The Sleuth Kit.

Copyright © 2003-2012. For more information, please visit: http\://www.sleuthkit.org.
URL_ON_IMG=http://www.sleuthkit.org/ diff --git a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java index c0268bac47..81a9f8cad1 100644 --- a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java +++ b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java @@ -54,7 +54,7 @@ class ProductInformationPanel extends JPanel implements HyperlinkListener { jLabel1.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR)); description.setText(org.openide.util.NbBundle.getMessage(ProductInformationPanel.class, "LBL_Description", new Object[]{getProductVersionValue(), getJavaValue(), getVMValue(), - getOperatingSystemValue(), getEncodingValue(), getSystemLocaleValue(), getUserDirValue(), getSleuthKitVersionValue(), Version.getNetbeansBuild()})); + getOperatingSystemValue(), getEncodingValue(), getSystemLocaleValue(), getUserDirValue(), getSleuthKitVersionValue(), Version.getNetbeansBuild(), Version.getBuildType().toString()})); description.addHyperlinkListener(this); copyright.addHyperlinkListener(this); copyright.setBackground(getBackground()); diff --git a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java index 12e0c1ecf8..1063f7570d 100644 --- a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java +++ b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java @@ -34,9 +34,9 @@ import org.sleuthkit.autopsy.coreutils.StringExtract.StringExtractUnicodeTable.S * Currently supports UTF-16 LE, UTF-16 BE and UTF8 Latin, Cyrillic, Chinese, * Arabic * - * TODO: - process control characters - testing: check non-printable common - * chars sometimes extracted (font?) - handle tie better (when number of chars - * in result is equal) + * TODO: process control characters + * + * TODO: handle tie better (when number of chars in 2 results is equal) */ public class StringExtract { @@ -50,6 +50,8 @@ public class StringExtract { * currently enabled scripts */ private List