From e921b7a245c6405b49359b7ef413abc213e50beb Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Tue, 11 Sep 2012 15:36:21 -0400
Subject: [PATCH 01/19] minor string extract optimization

---
 .../src/org/sleuthkit/autopsy/coreutils/StringExtract.java    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
index 12e0c1ecf8..62cf8c18a2 100644
--- a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
+++ b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
@@ -237,7 +237,7 @@ public class StringExtract {
             byteVal += b[0];
 
             //skip if beyond range
-            if (byteVal > StringExtractUnicodeTable.getUnicodeTableSize() - 1) {
+            if (byteVal > StringExtractUnicodeTable.UNICODE_TABLE_SIZE - 1) {
                 break;
             }
 
@@ -421,7 +421,7 @@ public class StringExtract {
             curOffset += chBytes;
 
             //skip if beyond range
-            if (ch > StringExtractUnicodeTable.getUnicodeTableSize() - 1) {
+            if (ch > StringExtractUnicodeTable.UNICODE_TABLE_SIZE - 1) {
                 break;
             }
 

From 2b1de8f77f3787dc33c7008d3ec30f3127b75b7f Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Wed, 12 Sep 2012 14:01:16 -0400
Subject: [PATCH 02/19] Updated docs to have more structure in pages.

---
 docs/doxygen/Doxyfile                     |  5 +++--
 docs/doxygen/blackboard.dox               | 11 +++++++++++
 docs/doxygen/main.dox                     |  7 +++++++
 docs/doxygen/modContent.dox               |  6 ++++++
 docs/doxygen/modDev.dox                   |  9 +++++++++
 docs/doxygen/modIngest.dox                |  6 ++++++
 docs/doxygen/modReport.dox                |  6 ++++++
 docs/doxygen/modResult.dox                |  6 ++++++
 docs/doxygen/platformConcepts.dox         |  6 ++++++
 docs/doxygen/{design.dox => workflow.dox} |  2 +-
 10 files changed, 61 insertions(+), 3 deletions(-)
 create mode 100644 docs/doxygen/blackboard.dox
 create mode 100644 docs/doxygen/modContent.dox
 create mode 100644 docs/doxygen/modDev.dox
 create mode 100644 docs/doxygen/modIngest.dox
 create mode 100644 docs/doxygen/modReport.dox
 create mode 100644 docs/doxygen/modResult.dox
 create mode 100644 docs/doxygen/platformConcepts.dox
 rename docs/doxygen/{design.dox => workflow.dox} (99%)

diff --git a/docs/doxygen/Doxyfile b/docs/doxygen/Doxyfile
index 03cb3a7543..a9f0eb074c 100644
--- a/docs/doxygen/Doxyfile
+++ b/docs/doxygen/Doxyfile
@@ -655,8 +655,9 @@ WARN_LOGFILE           =
 # directories like "/usr/src/myproject". Separate the files or directories
 # with spaces.
 
-INPUT                  = main.dox \
-                         design.dox \
+INPUT                  = main.dox blackboard.dox workflow.dox \
+                         modContent.dox modDev.dox modIngest.dox modReport.dox \
+                         modResult.dox platformConcepts.dox \
                          regressionTesting.dox \
                          ../../Case/src \
                          ../../CoreComponentInterfaces/src \
diff --git a/docs/doxygen/blackboard.dox b/docs/doxygen/blackboard.dox
new file mode 100644
index 0000000000..06c68019dd
--- /dev/null
+++ b/docs/doxygen/blackboard.dox
@@ -0,0 +1,11 @@
+/*! \page blackboard_page The Blackboard
+
+What is the blackboard
+
+What is it used for
+
+How do modules get access to it.
+
+Refer to C++ page to reduce duplication.
+
+*/
diff --git a/docs/doxygen/main.dox b/docs/doxygen/main.dox
index 843e440b1d..7e361a2ad0 100644
--- a/docs/doxygen/main.dox
+++ b/docs/doxygen/main.dox
@@ -4,6 +4,13 @@
 Autopsy has been designed as a platform for open source tools besides just The Sleuth Kit.  This document is for developers who want to add functionality into Autopsy.  This could be in the form of enhancing the existing functionality or by making a module that plugs into it and you may distribute from your own site or push it back into the base distribution. 
 
 - \subpage design_page
+- \subpage framework_page (Basic concepts of framework and types of modules)
+- \subpage blackboard_page (what is the blackboard)
+- \subpage mod_dev_page (Developing modules:get dev env setup, getting sersvices, properties etc.)
+- \subpage mod_ingest_page (developing ingest modules)
+- \subpage mod_report_page (developing report modules)
+- \subpage mod_content_page (Developing content viewer modules)
+- \subpage mod_result_page (developing result viewers)
 - \subpage regression_test_page 
 
 */
diff --git a/docs/doxygen/modContent.dox b/docs/doxygen/modContent.dox
new file mode 100644
index 0000000000..472b4e3023
--- /dev/null
+++ b/docs/doxygen/modContent.dox
@@ -0,0 +1,6 @@
+/*! \page mod_content_page Developing Content Viewer Modules
+
+
+How to write a content viewer module.
+
+*/
diff --git a/docs/doxygen/modDev.dox b/docs/doxygen/modDev.dox
new file mode 100644
index 0000000000..ff364ead83
--- /dev/null
+++ b/docs/doxygen/modDev.dox
@@ -0,0 +1,9 @@
+/*! \page mod_dev_page Developing Module Overview 
+
+How to get dev env setup (platform, etc.)
+
+How to get access to services and what services exist.
+
+How to set properties, etc.
+
+*/
diff --git a/docs/doxygen/modIngest.dox b/docs/doxygen/modIngest.dox
new file mode 100644
index 0000000000..34eac2541d
--- /dev/null
+++ b/docs/doxygen/modIngest.dox
@@ -0,0 +1,6 @@
+/*! \page mod_ingest_page Developing Ingest Modules
+
+
+How to write an ingest module.
+
+*/
diff --git a/docs/doxygen/modReport.dox b/docs/doxygen/modReport.dox
new file mode 100644
index 0000000000..89cf46f9aa
--- /dev/null
+++ b/docs/doxygen/modReport.dox
@@ -0,0 +1,6 @@
+/*! \page mod_report_page Developing Report Modules
+
+
+How to write a report module.
+
+*/
diff --git a/docs/doxygen/modResult.dox b/docs/doxygen/modResult.dox
new file mode 100644
index 0000000000..c03691d6a1
--- /dev/null
+++ b/docs/doxygen/modResult.dox
@@ -0,0 +1,6 @@
+/*! \page mod_result_page Developing Result Viewer Modules
+
+
+How to write a result viewer module.
+
+*/
diff --git a/docs/doxygen/platformConcepts.dox b/docs/doxygen/platformConcepts.dox
new file mode 100644
index 0000000000..e7178dd996
--- /dev/null
+++ b/docs/doxygen/platformConcepts.dox
@@ -0,0 +1,6 @@
+/*! \page framework_page Autopsy Platform Concepts
+
+What frameworks / modules exist
+
+
+*/
diff --git a/docs/doxygen/design.dox b/docs/doxygen/workflow.dox
similarity index 99%
rename from docs/doxygen/design.dox
rename to docs/doxygen/workflow.dox
index 63b56e9c08..2791900a21 100644
--- a/docs/doxygen/design.dox
+++ b/docs/doxygen/workflow.dox
@@ -1,4 +1,4 @@
-/*! \page design_page General Design 
+/*! \page design_page General Workflow and Design 
 
 \section design_overview Overview
 This section outlines Autopsy design from the typical analysis work flow perspective.

From 9961887ef1e8c8ac16135784fd16f9bc56e4abe6 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Wed, 12 Sep 2012 14:47:14 -0400
Subject: [PATCH 03/19] Add user option to extract utf8/16 in ingest. Add
 option API to extractor.

---
 .../autopsy/coreutils/StringExtract.java      | 70 ++++++++++---
 .../keywordsearch/AbstractFileExtract.java    | 21 ++++
 .../AbstractFileHtmlExtract.java              | 11 +++
 .../AbstractFileStringExtract.java            | 23 ++++-
 .../AbstractFileStringIntStream.java          | 18 +++-
 .../AbstractFileTikaTextExtract.java          | 11 +++
 .../autopsy/keywordsearch/Bundle.properties   |  2 +
 .../KeywordSearchConfigurationPanel.java      |  2 +-
 .../KeywordSearchConfigurationPanel3.form     | 48 +++++++--
 .../KeywordSearchConfigurationPanel3.java     | 99 +++++++++++++++++--
 .../KeywordSearchIngestModule.java            | 31 ++++++
 11 files changed, 302 insertions(+), 34 deletions(-)

diff --git a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
index 62cf8c18a2..2018c9811a 100644
--- a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
+++ b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
@@ -50,6 +50,8 @@ public class StringExtract {
      * currently enabled scripts
      */
     private List<SCRIPT> enabledScripts;
+    private boolean enableUTF8;
+    private boolean enableUTF16;
     /**
      * supported scripts, can be overridden with enableScriptX methods
      */
@@ -73,9 +75,29 @@ public class StringExtract {
             throw new IllegalStateException("Unicode table not properly initialized, cannot instantiate StringExtract");
         }
 
-        this.setEnabledScripts(SUPPORTED_SCRIPTS);
+        setEnabledScripts(SUPPORTED_SCRIPTS);
+        enableUTF8 = true;
+        enableUTF16 = true;
     }
 
+    public boolean isEnableUTF8() {
+        return enableUTF8;
+    }
+
+    public void setEnableUTF8(boolean enableUTF8) {
+        this.enableUTF8 = enableUTF8;
+    }
+
+    public boolean isEnableUTF16() {
+        return enableUTF16;
+    }
+
+    public void setEnableUTF16(boolean enableUTF16) {
+        this.enableUTF16 = enableUTF16;
+    }
+
+    
+    
     /**
      * Sets the enabled scripts to ones provided, resets previous setting
      *
@@ -85,6 +107,7 @@ public class StringExtract {
         this.enabledScripts = scripts;
     }
 
+
     /**
      * Sets the enabled script to one provided, resets previous setting
      *
@@ -108,8 +131,8 @@ public class StringExtract {
 
     /**
      * Check if extraction of the script is enabled by this instance of the
-     * utility.
-     * For LATIN_2 (extended LATIN), enable also LATIN_1, even if it's not explicitely enabled.
+     * utility. For LATIN_2 (extended LATIN), enable also LATIN_1, even if it's
+     * not explicitely enabled.
      *
      * @param script script that was identified, to check if it is enabled
      * @return true if the the script extraction is enabled
@@ -118,8 +141,7 @@ public class StringExtract {
         if (script.equals(SCRIPT.LATIN_1)) {
             return enabledScripts.contains(SCRIPT.LATIN_1)
                     || enabledScripts.contains(SCRIPT.LATIN_2);
-        }
-        else {
+        } else {
             return enabledScripts.contains(script);
         }
 
@@ -139,6 +161,10 @@ public class StringExtract {
      * additional info
      */
     public StringExtractResult extract(byte[] buff, int len, int offset) {
+        if (this.enableUTF16 == false && this.enableUTF8 == false) {
+             return new StringExtractResult();
+        }
+        
         final int buffLen = buff.length;
 
         int processedBytes = 0;
@@ -162,16 +188,28 @@ public class StringExtract {
 
             //extract using all methods and see which one wins
             StringExtractResult resUTF16 = null;
-            if (curOffset % 2 == 0) {
+            if (enableUTF16 && curOffset % 2 == 0) {
                 StringExtractResult resUTF16En1 = extractUTF16(buff, len, curOffset, true);
                 StringExtractResult resUTF16En2 = extractUTF16(buff, len, curOffset, false);
                 resUTF16 = resUTF16En1.numChars > resUTF16En2.numChars ? resUTF16En1 : resUTF16En2;
-            }
+            } 
+            
             //results.add(extractUTF8(buff, len, curOffset));
-            StringExtractResult resUTF8 = extractUTF8(buff, len, curOffset);
+            StringExtractResult resUTF8 = null;
 
-            StringExtractResult resWin;
-            resWin = resUTF16 != null && resUTF16.numChars > resUTF8.numChars ? resUTF16 : resUTF8;
+            if (enableUTF8) {
+                resUTF8 = extractUTF8(buff, len, curOffset);
+            }
+
+            StringExtractResult resWin = null;
+            if (enableUTF8 && enableUTF16) {
+                resWin = resUTF16 != null && resUTF16.numChars > resUTF8.numChars ? resUTF16 : resUTF8;
+            } else if (enableUTF16){
+                resWin = resUTF16;
+            }
+            else if (enableUTF8) {
+                resWin = resUTF8;
+            }
 
             if (resWin.numChars >= MIN_CHARS_STRING) {
                 //record string 
@@ -189,9 +227,12 @@ public class StringExtract {
                 processedBytes += resWin.numBytes;
                 firstUnprocessedOff = resWin.offset + resWin.numBytes;
             } else {
-                //if no encodings worked, advance 1 byte
-                ++curOffset;
-                //++processedBytes;
+                //if no encodings worked, advance byte
+                if (enableUTF8 == false) {
+                    curOffset += 2;
+                } else {
+                    ++curOffset;
+                }
             }
         }
 
@@ -549,10 +590,11 @@ public class StringExtract {
                 }
             },
             LATIN_1 {
-                 @Override
+                @Override
                 public String toString() {
                     return "Latin - Basic";
                 }
+
                 @Override
                 public String getLanguages() {
                     return "English";
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileExtract.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileExtract.java
index c738c94220..c196533875 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileExtract.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileExtract.java
@@ -20,6 +20,7 @@
 package org.sleuthkit.autopsy.keywordsearch;
 
 import java.util.List;
+import java.util.Map;
 import org.sleuthkit.autopsy.coreutils.StringExtract.StringExtractUnicodeTable.SCRIPT;
 import org.sleuthkit.datamodel.AbstractFile;
 
@@ -28,6 +29,14 @@ import org.sleuthkit.datamodel.AbstractFile;
  * chunks
  */
 interface AbstractFileExtract {
+    
+    /**
+     * Common options that can be used by some extractors
+     */
+    enum ExtractOptions {
+        EXTRACT_UTF16, ///< extract UTF16 text, possible values Boolean.TRUE.toString(), Boolean.FALSE.toString()
+        EXTRACT_UTF8, ///< extract UTF8 text, possible values Boolean.TRUE.toString(), Boolean.FALSE.toString()
+    };
 
     /**
      * Get number of chunks resulted from extracting this AbstractFile
@@ -62,6 +71,18 @@ interface AbstractFileExtract {
      */
     List<SCRIPT> getScripts();
     
+    /**
+     * Get current options
+     * @return currently used, extractor specific options, or null of not supported
+     */
+    Map<String,String> getOptions();
+    
+    /**
+     * Set extractor specific options
+     * @param options options to use
+     */
+    void setOptions(Map<String,String> options);
+    
     /**
      * Determines if the extractor works only for specified types
      * is supportedTypes() or whether is a generic content extractor (such as string extractor)
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileHtmlExtract.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileHtmlExtract.java
index c0289935f9..183f60fa65 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileHtmlExtract.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileHtmlExtract.java
@@ -23,6 +23,7 @@ import java.io.InputStream;
 import java.io.Reader;
 import java.nio.charset.Charset;
 import java.util.List;
+import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.sleuthkit.autopsy.coreutils.StringExtract.StringExtractUnicodeTable.SCRIPT;
@@ -66,6 +67,16 @@ public class AbstractFileHtmlExtract implements AbstractFileExtract {
     public List<SCRIPT> getScripts() {
         return null;
     }
+    
+    @Override
+    public Map<String, String> getOptions() {
+        return null;
+    }
+
+    @Override
+    public void setOptions(Map<String, String> options) {
+
+    }
 
     @Override
     public int getNumChunks() {
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java
index 6f67028656..6d7e50680a 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java
@@ -22,7 +22,9 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.Charset;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.sleuthkit.autopsy.coreutils.StringExtract.StringExtractUnicodeTable.SCRIPT;
@@ -52,6 +54,7 @@ class AbstractFileStringExtract implements AbstractFileExtract {
     
     private static final SCRIPT DEFAULT_SCRIPT = SCRIPT.LATIN_2;
     private final List<SCRIPT> extractScripts = new ArrayList<SCRIPT>();
+    private Map<String,String> extractOptions = new HashMap<String,String>();
 
     static {
         //prepend UTF-8 BOM to start of the buffer
@@ -89,6 +92,17 @@ class AbstractFileStringExtract implements AbstractFileExtract {
         return sourceFile;
     }
 
+    @Override
+    public Map<String, String> getOptions() {
+        return extractOptions;
+    }
+
+    @Override
+    public void setOptions(Map<String, String> options) {
+        this.extractOptions = options;
+    }
+    
+
     @Override
     public boolean index(AbstractFile sourceFile) throws IngesterException {
         this.sourceFile = sourceFile;
@@ -97,8 +111,15 @@ class AbstractFileStringExtract implements AbstractFileExtract {
         
         //construct stream that extracts text as we read it
         //final InputStream stringStream = new AbstractFileStringStream(sourceFile, INDEX_CHARSET);
+        
+        final boolean extractUTF8 = 
+                Boolean.parseBoolean(extractOptions.get(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString()));
+        
+        final boolean extractUTF16 = 
+                Boolean.parseBoolean(extractOptions.get(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString()));
+        
         final InputStream stringStream = new AbstractFileStringIntStream(
-                sourceFile, extractScripts, INDEX_CHARSET);
+                sourceFile, extractScripts, extractUTF8, extractUTF16, INDEX_CHARSET);
 
         try {
             success = true;
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringIntStream.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringIntStream.java
index 6412fc4814..388aef64d2 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringIntStream.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringIntStream.java
@@ -48,6 +48,8 @@ public class AbstractFileStringIntStream extends InputStream {
     private int convertBuffOffset = 0; //offset to start returning data to user on next read()
     private int bytesInConvertBuff = 0; //amount of data currently in the buffer
     private boolean fileEOF = false; //if file has more bytes to read
+    private boolean extractUTF8;
+    private boolean extractUTF16;
     private Charset outCharset;
     private static final Logger logger = Logger.getLogger(AbstractFileStringIntStream.class.getName());
     private StringExtractResult lastExtractResult;
@@ -59,17 +61,27 @@ public class AbstractFileStringIntStream extends InputStream {
      *
      * @param content input content to process and turn into a stream to convert into strings
      * @param scripts a list of scripts to consider
+     * @param extractUTF8 whether to extract utf8 encoding
+     * @param extractUTF16 whether to extract utf16 encoding
      * @param outCharset encoding to use in the output byte stream
      */
-    public AbstractFileStringIntStream(AbstractFile content, List<SCRIPT> scripts, Charset outCharset) {
+    public AbstractFileStringIntStream(AbstractFile content, List<SCRIPT> scripts, boolean extractUTF8, 
+           boolean extractUTF16, Charset outCharset) {
         this.content = content;
         this.stringExtractor = new StringExtract();
         this.stringExtractor.setEnabledScripts(scripts);
+        this.extractUTF8 = extractUTF8;
+        this.extractUTF16 = extractUTF16;
         this.outCharset = outCharset;
+        this.stringExtractor.setEnableUTF8(extractUTF8);
+        this.stringExtractor.setEnableUTF16(extractUTF16);
     }
 
     @Override
     public int read() throws IOException {
+        if (extractUTF8 == false && extractUTF16 == false) {
+            return -1;
+        }
         final int read = read(oneCharBuf, 0, 1);
         if (read == 1) {
             return oneCharBuf[0];
@@ -88,6 +100,10 @@ public class AbstractFileStringIntStream extends InputStream {
         } else if (len == 0) {
             return 0;
         }
+        
+        if (extractUTF8 == false && extractUTF16 == false) {
+            return -1;
+        }
 
         long fileSize = content.getSize();
         if (fileSize == 0) {
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileTikaTextExtract.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileTikaTextExtract.java
index 76ae4844e9..f443cf6822 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileTikaTextExtract.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileTikaTextExtract.java
@@ -25,6 +25,7 @@ import java.nio.charset.Charset;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
@@ -87,6 +88,16 @@ public class AbstractFileTikaTextExtract implements AbstractFileExtract {
     @Override
     public List<StringExtract.StringExtractUnicodeTable.SCRIPT> getScripts() {
         return null;
+    }
+    
+        @Override
+    public Map<String, String> getOptions() {
+        return null;
+    }
+
+    @Override
+    public void setOptions(Map<String, String> options) {
+
     }
 
     @Override
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
index 858d36cd6b..e2700e3a90 100755
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
@@ -61,3 +61,5 @@ KeywordSearchIngestSimplePanel.languagesValLabel.toolTipText=
 KeywordSearchConfigurationPanel3.languagesLabel.text=Scripts to extract from unknown file types (change will be effective on next ingest):
 KeywordSearchConfigurationPanel2.chunksLabel.text=Chunks in keyword index:
 KeywordSearchConfigurationPanel2.chunksValLabel.text=-
+KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text=Extract UTF8 text
+KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text=Extract UTF16LE and UTF16BE text
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java
index 0046b2cb29..3f93caafc4 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java
@@ -41,7 +41,7 @@ public class KeywordSearchConfigurationPanel extends javax.swing.JPanel {
     private void customizeComponents() {
         setName("Advanced Keyword Search Configuration");
         tabbedPane.insertTab("Lists", null, KeywordSearchConfigurationPanel1.getDefault(), "List configuration", 0);
-        tabbedPane.insertTab("Languages", null, KeywordSearchConfigurationPanel3.getDefault(), "Languages configuration", 1);
+        tabbedPane.insertTab("String Extraction", null, KeywordSearchConfigurationPanel3.getDefault(), "Languages configuration", 1);
         tabbedPane.insertTab("General", null, KeywordSearchConfigurationPanel2.getDefault(), "General configuration", 2);
         
     }
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form
index b0b6ab85f6..ac45ee21e8 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form
@@ -18,20 +18,24 @@
       <Group type="103" groupAlignment="0" attributes="0">
           <Group type="102" alignment="0" attributes="0">
               <EmptySpace max="-2" attributes="0"/>
-              <Group type="103" groupAlignment="0" attributes="0">
-                  <Group type="102" attributes="0">
-                      <Component id="languagesLabel" min="-2" max="-2" attributes="0"/>
-                      <EmptySpace max="32767" attributes="0"/>
-                  </Group>
+              <Group type="103" groupAlignment="0" max="-2" attributes="0">
                   <Component id="langPanel" max="32767" attributes="0"/>
+                  <Component id="enableUTF16Checkbox" min="-2" max="-2" attributes="0"/>
+                  <Component id="languagesLabel" alignment="0" max="32767" attributes="0"/>
+                  <Component id="enableUTF8Checkbox" alignment="0" min="-2" max="-2" attributes="0"/>
               </Group>
+              <EmptySpace min="0" pref="0" max="32767" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>
     <DimensionLayout dim="1">
       <Group type="103" groupAlignment="0" attributes="0">
           <Group type="102" alignment="0" attributes="0">
+              <EmptySpace min="-2" max="-2" attributes="0"/>
+              <Component id="enableUTF16Checkbox" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
+              <Component id="enableUTF8Checkbox" min="-2" max="-2" attributes="0"/>
+              <EmptySpace type="unrelated" max="-2" attributes="0"/>
               <Component id="languagesLabel" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
               <Component id="langPanel" max="32767" attributes="0"/>
@@ -48,25 +52,55 @@
       </Properties>
     </Component>
     <Container class="javax.swing.JScrollPane" name="langPanel">
+      <Properties>
+        <Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
+          <Dimension value="[430, 361]"/>
+        </Property>
+      </Properties>
 
       <Layout class="org.netbeans.modules.form.compat2.layouts.support.JScrollPaneSupportLayout"/>
       <SubComponents>
         <Container class="javax.swing.JPanel" name="checkPanel">
+          <Properties>
+            <Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
+              <Dimension value="[400, 361]"/>
+            </Property>
+          </Properties>
 
           <Layout>
             <DimensionLayout dim="0">
               <Group type="103" groupAlignment="0" attributes="0">
-                  <EmptySpace min="0" pref="434" max="32767" attributes="0"/>
+                  <EmptySpace min="0" pref="411" max="32767" attributes="0"/>
               </Group>
             </DimensionLayout>
             <DimensionLayout dim="1">
               <Group type="103" groupAlignment="0" attributes="0">
-                  <EmptySpace min="0" pref="211" max="32767" attributes="0"/>
+                  <EmptySpace min="0" pref="361" max="32767" attributes="0"/>
               </Group>
             </DimensionLayout>
           </Layout>
         </Container>
       </SubComponents>
     </Container>
+    <Component class="javax.swing.JCheckBox" name="enableUTF8Checkbox">
+      <Properties>
+        <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+          <ResourceString bundle="org/sleuthkit/autopsy/keywordsearch/Bundle.properties" key="KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+        </Property>
+      </Properties>
+      <Events>
+        <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="enableUTF8CheckboxActionPerformed"/>
+      </Events>
+    </Component>
+    <Component class="javax.swing.JCheckBox" name="enableUTF16Checkbox">
+      <Properties>
+        <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+          <ResourceString bundle="org/sleuthkit/autopsy/keywordsearch/Bundle.properties" key="KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+        </Property>
+      </Properties>
+      <Events>
+        <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="enableUTF16CheckboxActionPerformed"/>
+      </Events>
+    </Component>
   </SubComponents>
 </Form>
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java
index 904b62748a..1197712370 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java
@@ -105,22 +105,50 @@ public class KeywordSearchConfigurationPanel3 extends javax.swing.JPanel {
 
     private void reloadScriptsCheckBoxes() {
         final KeywordSearchIngestModule service = KeywordSearchIngestModule.getDefault();
+        
+        boolean utf16 = 
+                Boolean.parseBoolean(service.getStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString()));
+       
+        enableUTF16Checkbox.setSelected(utf16);
+        
+        boolean utf8 = 
+                Boolean.parseBoolean(service.getStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString()));
+        enableUTF8Checkbox.setSelected(utf8);
+        
         final List<SCRIPT> serviceScripts = service.getStringExtractScripts();
         final int components = checkPanel.getComponentCount();
+        
         for (int i = 0; i < components; ++i) {
             JCheckBox ch = (JCheckBox) checkPanel.getComponent(i);
+            
             StringExtract.StringExtractUnicodeTable.SCRIPT script = scripts.get(ch.getText());
             
             ch.setSelected(serviceScripts.contains(script));
         }
+        
     }
 
     private void activateWidgets() {
         reloadScriptsCheckBoxes();
-        boolean enable = !IngestManager.getDefault().isIngestRunning()
+        
+        final KeywordSearchIngestModule service = KeywordSearchIngestModule.getDefault();
+        
+         boolean utf16 = 
+                Boolean.parseBoolean(service.getStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString()));
+       
+        enableUTF16Checkbox.setSelected(utf16);
+        
+        boolean utf8 = 
+                Boolean.parseBoolean(service.getStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString()));
+        enableUTF8Checkbox.setSelected(utf8);
+        final boolean extractEnabled = utf16 || utf8;
+        
+        boolean ingestNotRunning = !IngestManager.getDefault().isIngestRunning()
         && ! IngestManager.getDefault().isModuleRunning(KeywordSearchIngestModule.getDefault());;
         //enable / disable checboxes
-        activateScriptsCheckboxes(enable);
+        activateScriptsCheckboxes(extractEnabled && ingestNotRunning);
+        enableUTF16Checkbox.setEnabled(ingestNotRunning);
+        enableUTF8Checkbox.setEnabled(ingestNotRunning);
     }
 
     /**
@@ -135,45 +163,96 @@ public class KeywordSearchConfigurationPanel3 extends javax.swing.JPanel {
         languagesLabel = new javax.swing.JLabel();
         langPanel = new javax.swing.JScrollPane();
         checkPanel = new javax.swing.JPanel();
+        enableUTF8Checkbox = new javax.swing.JCheckBox();
+        enableUTF16Checkbox = new javax.swing.JCheckBox();
 
         org.openide.awt.Mnemonics.setLocalizedText(languagesLabel, org.openide.util.NbBundle.getMessage(KeywordSearchConfigurationPanel3.class, "KeywordSearchConfigurationPanel3.languagesLabel.text")); // NOI18N
 
+        langPanel.setPreferredSize(new java.awt.Dimension(430, 361));
+
+        checkPanel.setPreferredSize(new java.awt.Dimension(400, 361));
+
         javax.swing.GroupLayout checkPanelLayout = new javax.swing.GroupLayout(checkPanel);
         checkPanel.setLayout(checkPanelLayout);
         checkPanelLayout.setHorizontalGroup(
             checkPanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
-            .addGap(0, 434, Short.MAX_VALUE)
+            .addGap(0, 411, Short.MAX_VALUE)
         );
         checkPanelLayout.setVerticalGroup(
             checkPanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
-            .addGap(0, 211, Short.MAX_VALUE)
+            .addGap(0, 361, Short.MAX_VALUE)
         );
 
         langPanel.setViewportView(checkPanel);
 
+        org.openide.awt.Mnemonics.setLocalizedText(enableUTF8Checkbox, org.openide.util.NbBundle.getMessage(KeywordSearchConfigurationPanel3.class, "KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text")); // NOI18N
+        enableUTF8Checkbox.addActionListener(new java.awt.event.ActionListener() {
+            public void actionPerformed(java.awt.event.ActionEvent evt) {
+                enableUTF8CheckboxActionPerformed(evt);
+            }
+        });
+
+        org.openide.awt.Mnemonics.setLocalizedText(enableUTF16Checkbox, org.openide.util.NbBundle.getMessage(KeywordSearchConfigurationPanel3.class, "KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text")); // NOI18N
+        enableUTF16Checkbox.addActionListener(new java.awt.event.ActionListener() {
+            public void actionPerformed(java.awt.event.ActionEvent evt) {
+                enableUTF16CheckboxActionPerformed(evt);
+            }
+        });
+
         javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
         this.setLayout(layout);
         layout.setHorizontalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
             .addGroup(layout.createSequentialGroup()
                 .addContainerGap()
-                .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
-                    .addGroup(layout.createSequentialGroup()
-                        .addComponent(languagesLabel)
-                        .addContainerGap())
-                    .addComponent(langPanel)))
+                .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
+                    .addComponent(langPanel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                    .addComponent(enableUTF16Checkbox)
+                    .addComponent(languagesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                    .addComponent(enableUTF8Checkbox))
+                .addGap(0, 0, Short.MAX_VALUE))
         );
         layout.setVerticalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
             .addGroup(layout.createSequentialGroup()
                 .addContainerGap()
+                .addComponent(enableUTF16Checkbox)
+                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
+                .addComponent(enableUTF8Checkbox)
+                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
                 .addComponent(languagesLabel)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
-                .addComponent(langPanel))
+                .addComponent(langPanel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
         );
     }// </editor-fold>//GEN-END:initComponents
+
+    private void enableUTF8CheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_enableUTF8CheckboxActionPerformed
+        final KeywordSearchIngestModule service = KeywordSearchIngestModule.getDefault();
+        
+        boolean selected = this.enableUTF8Checkbox.isSelected();
+        
+        service.setStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString(),
+                Boolean.toString(selected));
+        
+        activateScriptsCheckboxes(selected || this.enableUTF16Checkbox.isSelected());
+        
+    }//GEN-LAST:event_enableUTF8CheckboxActionPerformed
+
+    private void enableUTF16CheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_enableUTF16CheckboxActionPerformed
+        final KeywordSearchIngestModule service = KeywordSearchIngestModule.getDefault();
+        
+        boolean selected = this.enableUTF16Checkbox.isSelected();
+        
+        service.setStringExtractOption(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString(),
+                Boolean.toString(selected));
+        
+        activateScriptsCheckboxes(selected || this.enableUTF8Checkbox.isSelected());
+    }//GEN-LAST:event_enableUTF16CheckboxActionPerformed
+
     // Variables declaration - do not modify//GEN-BEGIN:variables
     private javax.swing.JPanel checkPanel;
+    private javax.swing.JCheckBox enableUTF16Checkbox;
+    private javax.swing.JCheckBox enableUTF8Checkbox;
     private javax.swing.JScrollPane langPanel;
     private javax.swing.JLabel languagesLabel;
     // End of variables declaration//GEN-END:variables
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java
index a578428014..ae9c4948ba 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java
@@ -103,6 +103,8 @@ public final class KeywordSearchIngestModule implements IngestModuleAbstractFile
     private List<AbstractFileExtract> textExtractors;
     private AbstractFileStringExtract stringExtractor;
     private final List<SCRIPT> stringExtractScripts = new ArrayList<SCRIPT>();
+    private Map<String,String> stringExtractOptions = new HashMap<String,String>();
+    
     private final GetIsFileKnownV getIsFileKnown = new GetIsFileKnownV();
 
     private enum IngestStatus {
@@ -116,6 +118,8 @@ public final class KeywordSearchIngestModule implements IngestModuleAbstractFile
         //set default script 
         stringExtractScripts.add(SCRIPT.LATIN_1);
         stringExtractScripts.add(SCRIPT.LATIN_2);
+        stringExtractOptions.put(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString(), Boolean.TRUE.toString());
+        stringExtractOptions.put(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString(), Boolean.TRUE.toString());
     }
 
     /**
@@ -308,6 +312,9 @@ public final class KeywordSearchIngestModule implements IngestModuleAbstractFile
         //initialize extractors
         stringExtractor = new AbstractFileStringExtract();
         stringExtractor.setScripts(stringExtractScripts);
+        stringExtractor.setOptions(stringExtractOptions);
+        
+        
         //log the scripts used for debugging
         final StringBuilder sbScripts = new StringBuilder();
         for (SCRIPT s : stringExtractScripts) {
@@ -1073,4 +1080,28 @@ public final class KeywordSearchIngestModule implements IngestModuleAbstractFile
     List<SCRIPT> getStringExtractScripts() {
         return new ArrayList<SCRIPT>(this.stringExtractScripts);
     }
+    
+    /**
+     * Set / override string extract option
+     * @param key option name to set
+     * @param val option value to set
+     */
+    void setStringExtractOption(String key, String val) {
+        this.stringExtractOptions.put(key, val);
+    }
+    
+    /**
+     * get string extract option for the key
+     * @param key option name
+     * @return option string value, or empty string if the option is not set
+     */
+    String getStringExtractOption(String key) {
+        if (this.stringExtractOptions.containsKey(key)) {
+            return this.stringExtractOptions.get(key);
+        }
+        else {
+            return "";
+        }
+    }
+    
 }

From 67a00258074b4f1bc5eea8d220df7017d17455ec Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Wed, 12 Sep 2012 16:29:14 -0400
Subject: [PATCH 04/19] adjust label text

---
 .../src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
index e2700e3a90..84048f167e 100755
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
@@ -61,5 +61,5 @@ KeywordSearchIngestSimplePanel.languagesValLabel.toolTipText=
 KeywordSearchConfigurationPanel3.languagesLabel.text=Scripts to extract from unknown file types (change will be effective on next ingest):
 KeywordSearchConfigurationPanel2.chunksLabel.text=Chunks in keyword index:
 KeywordSearchConfigurationPanel2.chunksValLabel.text=-
-KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text=Extract UTF8 text
-KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text=Extract UTF16LE and UTF16BE text
+KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text=Extract UTF8 text from unknown file types
+KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text=Extract UTF16LE and UTF16BE text from unknown file types

From 3d203ad264fdc9e1fc4e2c072bd850de408f1e65 Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Wed, 12 Sep 2012 17:23:31 -0400
Subject: [PATCH 05/19] Updated docs

---
 .../sleuthkit/autopsy/casemodule/package.dox  |   5 +-
 .../corecomponentinterfaces/package.dox       |  91 +----------
 .../sleuthkit/autopsy/datamodel/package.dox   |  15 +-
 .../org/sleuthkit/autopsy/ingest/package.dox  | 153 +-----------------
 .../org/sleuthkit/autopsy/report/package.dox  |  12 +-
 docs/doxygen/Doxyfile                         |   2 +-
 docs/doxygen/blackboard.dox                   |  11 --
 docs/doxygen/main.dox                         |   6 +-
 docs/doxygen/modContent.dox                   |  29 +++-
 docs/doxygen/modDev.dox                       |   3 +
 docs/doxygen/modIngest.dox                    | 148 ++++++++++++++++-
 docs/doxygen/modResult.dox                    |  27 +++-
 docs/doxygen/platformConcepts.dox             |   8 +-
 docs/doxygen/workflow.dox                     |  91 ++++++-----
 14 files changed, 286 insertions(+), 315 deletions(-)
 delete mode 100644 docs/doxygen/blackboard.dox

diff --git a/Case/src/org/sleuthkit/autopsy/casemodule/package.dox b/Case/src/org/sleuthkit/autopsy/casemodule/package.dox
index 3f438b6ecc..f364558762 100644
--- a/Case/src/org/sleuthkit/autopsy/casemodule/package.dox
+++ b/Case/src/org/sleuthkit/autopsy/casemodule/package.dox
@@ -2,20 +2,23 @@
 /**
 \package org.sleuthkit.autopsy.casemodule
 
-The org.sleuthkit.autopsy.casemodule Module is responsible for organizing a case. A case contains one or more disk images and is the highest-level unit of an investigation. 
+The org.sleuthkit.autopsy.casemodule Module is responsible for organizing a case. A case contains one or more disk images and is the highest-level unit of an investigation.  
 
 \section casemodule_contents Package Contents
 The important classes in this case are:
 - Case
 
 \section casemodule_overview Overview
+
 All data in a case will be stored in a single database and configuration file.  A case must be open before analysis can occur. You will use a Case object to get access to the data being analyzed.
 
 Case settings are stored in an XML file.  See the XMLCaseManagement class for more details.
 
 Currently, only one case can be opened at a time.  To determine the open case, use the Case.getCurrentCase()  method.  
+
 Do not cache the case handle object obtained from this method (for example, in member variables) unless you are sure your are acting within case context; 
 It is safer to call the method more frequently to ensure the validity of the case handle object as new cases are opened.
+
 Once you have the object for the currently open case, Case.getRootObjects() will return the top-level Sleuth Kit Content modules. You can then get their children to go down the tree of data types.
 
 
diff --git a/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox b/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox
index 9beb6e1d37..e8da825fcf 100644
--- a/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox
+++ b/CoreComponentInterfaces/src/org/sleuthkit/autopsy/corecomponentinterfaces/package.dox
@@ -1,93 +1,8 @@
 /**
- * \package org.sleuthkit.autopsy.corecomponentinterfaces
- * This package contains the interface classes that define the core components in Autopsy.  These components are used in the difference zones of the GUI.
- *
-<em>NOTE: Much of this data may be out of date.  It has not been updated 
-since a major redesign was done. </em>
+\package org.sleuthkit.autopsy.corecomponentinterfaces
 
-\section corecomponentinterface_contents Package Contents
-The following are imporant classes in this package
-- TODO
+This package contains the interface classes that define the core components in Autopsy.  These components are used in the different zones of the GUI.
 
+See \ref design_page for examples of the modules and such that it defines. 
 
- * <h2>Autopsy Zones</h2>
- * There are three major zones in the Autopsy UI. The left hand side has the org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer zone. This area is where you can search for and explore data. It has all of the analysis smarts. An example of a DataExplorer is the directory tree that shows the hierarchy of directories (and hides the files from view).
- * The DataExplorer area identifies a subset of the data to show the user and passes the data to the org.sleuthkit.autopsy.corecomponentinterfaces.DataResult area in the upper right. In the previous example, the contents of a specific folder would be passed to this area and displayed in a table or thumbnail form.</p>
- * When a file or object is selected in the DataResult, it is passed to the org.sleuthkit.autopsy.corecomponentinterfaces.DataContent zone in the lower right. This is where file content can be viewed in hex form, strings, etc. 
- * <h2>Data Flow</h2>
- * <h3>Creating Nodes in DataExplorer</h3>
- * Data flows between the areas inside of a NetBeans node. The DataExplorer modules create the NetBeans nodes. They query the SQLite database or do whatever they want to identify the set of files that are of interest. They create the NetBeans nodes based on Sleuthkit data model objects. See the org.sleuthkit.autopsy.datamodel package for more details on this. 
- * <h3>Getting Nodes to DataResult</h3>
- * Each DataExplorer TopComponent is responsible for creating its own DataResult TopComponent to display its results. It can choose to re-use the same TopComponent for multiple searches (as DirectoryTree does) or it can choose to make a new one each time (as FileSearch does). The setNode() method on the DataResult object is used to set the root node to display. A dummy root node must be created as the parent if a parent does not already exist. 
- * The DataExplorer is responsible for setting the double-click and right-click actions associated with the node.  The default single click action is to pass data to DataContent.  To override this, you must create a new DataResultViewer instance that overrides the propertyChange() method. The DataExplorer adds actions to wrapping the node in a FilterNode variant. The FilterNode then defines the actions for the node by overriding the getPreferredAction() and getActions() methods.  As an example, org.sleuthkit.autopsy.directorytree.DataResultFilterNode and org.sleuthkit.autopsy.directorytree.DataResultFilterChildren wraps the nodes that are passed over by the DirectoryTree DataExplorer.
- * DataResult can send data back to its DataExplorer by making a custom action that looks up it's instance (DataExplorer.getInstance()).
- * <h3>Getting Nodes to DataContent </h3>
- * A default DataContent viewer is created when a case is opened. To display the contents of a node, it must be passed to a DataContent instance.  The default single-click behavior of the DataResultViewers is to lookup the default DataContent TopComponent and pass the selected node to it.   See org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer.propertyChange(PropertyChangeEvent) for details. 
- * <h2>Creating new Functionality</h2>
- * <h3>Creating a DataExplorer</h3>
- * <ol>
- * <li>Create a module from within NetBeans.  It must be dependent on these modules:
- * <ul>
- * <li>Case
- * <li>CoreComponentInterfaces
- * <li>CoreComponents
- * <li>DataModel
- * <li>DialogsAPI (if pop-ups and such are going to be used)
- * <li>Explorer & Property Sheet API
- * <li>Lookup
- * <li>Nodes API
- * <li>Setting API
- * <li>UI Utilities API
- * <li>Utilities API
- * <li>Window System API
- * </ul>
- * <li> Create a class that implements org.sleuthkit.autopsy.corecomponentinterfaces.DataExplorer. We have been making the TopComponent class be the one that implements DataExplorer. Register this class as a DataExplorer service provider by specifying "@ServiceProvider(service=DataExplorer.class)" in the class or using layer.xml. 
- * <li>Implement the methods required by the DataExplorer interface. 
- * <li>Register the class to receive property change events from the org.sleuthkit.autopsy.Case module by using its addPropertyChangeListener() method. 
- * <li>Access case data using the org.sleuthkit.autopsy.Case module. 
- * <li>Create Nodes for the data objects using the techniques outlined in the previous section.
- * <li>Wrap the nodes in FilterNodes to define actions as outlined in the previous section. 
- * <li>Send results to DataResults using the techniques outlined in the previous section. 
- * </ol>
- * <h3>Creating a DataResultViewer</h3>
- * <p>DataResultTopComponent is the high-level window in the DataResult area.  Each instance of this loads up all instances of DataResultViewers that have been registered with the system. Example viewers include the table and thumbnail views.  If you want to make your own type of viewer, follow the steps below.  Note that the table and thumbnail viewers come with Autopsy by default and can be used by all DataExplorers. 
- * <ol>
- * <li>Create a module from within NetBeans.  It must be dependent on these modules:
- * <ul>
- * <li>Case
- * <li>CoreComponentInterfaces
- * <li>CoreComponents
- * <li>DataModel
- * <li>DialogsAPI (if pop-ups and such are going to be used)
- * <li>Explorer & Property Sheet API
- * <li>Lookup
- * <li>Nodes API
- * <li>Setting API
- * <li>UI Utilities API
- * <li>Utilities API
- * <li>Window System API
- * </ul>
- * <li>Make a class that extends org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer and is registered as a service provider for the org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer class by specifying "@ServiceProvider(service = DataResultViewer.class)" or by using layer.xml.  This class will extend JPanel. </li>
- * <li>See the previous sections on default actions.</li>
- * </ol>
- * <h3>Creating a DataContentViewer</h3>
- * DataContentTopComponent is the high-level window in the DataContent area.  Each instance of this loads up all instances of DataContentViewers that have been registered with the system. Example viewers include the strings and hexdump views.  If you want to make your own type of viewer, follow the steps below.  Note that the strings, hexdump, and image viewers come with Autopsy by default and can be used by all DataExplorers and DataResults. You only need to make a new DataContentViewer if these viewers do not satisfy your needs.
- * <ol>
- * <li>Create a module from within NetBeans.  It must be dependent on these modules:
- * <ul>
- * <li>Case
- * <li>CoreComponentInterfaces
- * <li>CoreComponents
- * <li>DataModel
- * <li>DialogsAPI (if pop-ups and such are going to be used)
- * <li>Explorer & Property Sheet API
- * <li>Lookup
- * <li>Nodes API
- * <li>Setting API
- * <li>UI Utilities API
- * <li>Utilities API
- * <li>Window System API
- * </ul>
- * <li>Make a class that implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer and is registered as a service provider for DataContentViewer.class by specifying "@ServiceProvider(service = DataContentViewer.class)" or by using layer.xml.  This class must extend JPanel. </li>
- * </ol>
 */
diff --git a/DataModel/src/org/sleuthkit/autopsy/datamodel/package.dox b/DataModel/src/org/sleuthkit/autopsy/datamodel/package.dox
index 1c7584d58c..7bdd86610f 100644
--- a/DataModel/src/org/sleuthkit/autopsy/datamodel/package.dox
+++ b/DataModel/src/org/sleuthkit/autopsy/datamodel/package.dox
@@ -1,15 +1,16 @@
 /**
- * \package org.sleuthkit.autopsy.datamodel
+\package org.sleuthkit.autopsy.datamodel
 
 Contains the NetBeans Node wrappers that wrap around Sleuth Kit data model objects.
 
- * <h2>Overview</h2>
- * Autopsy 3 uses NetBeans Nodes to pass data around.  The Sleuth Kit comes with Java datamodel classes in org.sleuthkit.datamodel and it contains classes for files, directories, file systems, volumes, and other data types that can be found in a disk image. These classes are not NetBeans specific.
+\section datamodel_overview Overview
+Autopsy 3 uses NetBeans Nodes to pass data around.  The Sleuth Kit comes with Java datamodel classes in org.sleuthkit.datamodel and it contains classes for files, directories, file systems, volumes, and other data types that can be found in a disk image. These classes are not NetBeans specific.
 
- * This package, org.sleuthkit.autopsy.datamodel, contains classes that are NetBeans-specific and map to classes in the Sleuth Kit datamodel.  For example org.sleuthkit.autopsy.datamodel.DirectoryNode is the Node class for the org.sleuthkit.datamodel.Directory class.
+This package, org.sleuthkit.autopsy.datamodel, contains classes that are NetBeans-specific and map to classes in the Sleuth Kit datamodel.  For example org.sleuthkit.autopsy.datamodel.DirectoryNode is the Node class for the org.sleuthkit.datamodel.Directory class.
 
- * The underlying sleuthkit.datamodel Content objects are passed around Autopsy by being included in a Node's lookup.
+The underlying sleuthkit.datamodel Content objects are passed around Autopsy by being included in a Node's lookup.
+
+\section datamodel_creating Creating Nodes
+You should only have to create the root node in a hierarchy.  To do so, use the RootContentChildren class and pass in the list of TSK datamodel objects that you need to encapsulate.  After that, the children will automatically be created as nodes when they are requested.  ContentChildren deals with this.
 
- * <h2>Creating Nodes</h2>
- * You should only have to create the root node in a hierarchy.  To do so, use the RootContentChildren class and pass in the list of TSK datamodel objects that you need to encapsulate.  After that, the children will automatically be created as nodes when they are requested.  ContentChildren deals with this.
  */
diff --git a/Ingest/src/org/sleuthkit/autopsy/ingest/package.dox b/Ingest/src/org/sleuthkit/autopsy/ingest/package.dox
index d31618364d..db10232f90 100644
--- a/Ingest/src/org/sleuthkit/autopsy/ingest/package.dox
+++ b/Ingest/src/org/sleuthkit/autopsy/ingest/package.dox
@@ -5,161 +5,12 @@
 
 The package provides the ingest module framework.  Ingest modules perform data analysis in a multi-threaded approach. 
 
+Refer to \ref mod_ingest_page for details on developing ingest modules.
+
 \section ingestmodule_contents Package Contents
 
 The following are important classes in this package:
 - IngestManager
 - IngestMessageTopComponent
 
-
-\section ingestmodule_modules Ingest Module Basics
-
-Ingest modules analyze data from a disk image.  They typically focus on a specific type of data analysis.  The modules are loaded each time that Autopsy starts.  The user can choose to enable each module when they add an image to the case.
-
-There are two types of ingest modules. 
-- Image-level modules are passed in a reference to an image and perform general analysis on it.  These modules may query the database for a small set of files.
-- File-level modules are passed in a reference to each file.  The Ingest Manager chooses which files to pass and when.  These modules are intended to analyze most of the files on the system or that want to examine the file content of all files (i.e. to detect file type based on signature instead of file extension). 
-
-Modules post their results to the blackboard (@@@ NEED REFERENCE FOR THIS -- org.sleuthkit.datamodel) and can query the blackboard to get the results of previous modules.  For example, the hash database lookup module may want to query for a previously calculated hash value. 
-
-The IngestManager class is responsible for launching the ingest modules and passing data to them.   Modules can send messages to the ingest inbox (REFERENCE) so that users can see when data has been found. 
-
-
-\section ingestmodule_making Making Ingest Modules
-
-Refer to org.sleuthkit.autopsy.ingest.example for sample source code. 
-
-\subsection ingestmodule_making_api Module Interface
-
-The first step is to choose the correct module type.  Image-level modules will implement the IngestModuleImage interface and file-level modules will implement the IngestModuleAbstractFile interface. 
-
-There is a static getDefault() method that is not part of the interface, that every module (whether an image or a file module) needs to implement to return the registered static instance of the module.  Refer to example code in example.ExampleAbstractFileIngestModule.getDefault()
-
-File-level modules need to be singleton (only a single instance at a time).  To ensure this, make the constructor private. Ensure the default public file module constructor is overridden with the private one.  Image-level modules require a public constructor.
-
-The interfaces have several standard methods that need to be implemented.  See the interface methods for details.  
-- IngestModuleAbstract.init() is invoked every time an ingest session starts.  A module should support multiple invocations of init() throughout the application life-cycle.
-- IngestModuleAbstract.complete() is invoked when an ingest session completes.  The module should perform any resource (files, handles, caches) cleanup in this method and submit final results and post a final ingest inbox message.
-- IngestModuleAbstract.stop() is invoked on a module when an ingest session is interrupted by the user or by the system.
-The method implementation should be similar to complete() in that the module should perform any cleanup work.  If there is pending data to be processed or pending results to be reported by the module then the results should be rejected and ignored if stop() is invoked and the module should terminate as early as possible.
-- process() method is invoked to analyze the data. The specific method depends on the module type. 
-
-
-Multiple images can be ingested at the same time. The current behavior is that the files from the second image are added to the list of the files from the first image.  The impact of this on module development is that a file-level module could be passed in files from different images in consecutive calls to process().  New instances of image-level modules will be created when the second image is added.   Therefore, image-level modules should assume that the process() method will be called only once after init() is called. 
-
-Every module should support multiple init() - process() - complete(), and init() - process() - stop() invocations.
-The modules should also support multiple init() - complete() and init() - stop() invocations, 
-which can occur if ingest pipeline is started but no work is enqueued for the particular module.
-
-Module developers are encouraged to use the standard java.util.logging.Logger infrastructure to log errors to the Autopsy log.
-
-\subsection ingestmodule_making_process Process Method
-The process method is where the work is done in each type of module.  Some notes:
-- File-level modules will be called on each file in an order determined by the IngestManager.  Each module is free to quickly ignore a file based on name, signature, etc.  If a module wants to know the return value from a previously run module, it should use the IngestServices.getAbstractFileModuleResult() method. 
-- Image-level modules are expected not passed in specific files and are expected to query the database to find the files that they are interested in. 
-
-
-\subsection ingestmodule_making_registration Module Registration
-
-Ingest modules need to be registered using the Netbeans Lookup infrastructure in package's layer.xml file.
-
-An example Image-level module is: 
-\verbatim
-<file name="org-sleuthkit-autopsy-ingest-example-ExampleImageIngestModule.instance">
-  <attr name="instanceOf" stringvalue="org.sleuthkit.autopsy.ingest.IngestModuleImage"/>
-  <attr name="instanceCreate" methodvalue="org.sleuthkit.autopsy.ingest.example.ExampleImageIngestModule.getDefault"/>
-  <attr name="position" intvalue="1000"/>
-</file>
-\endverbatim
-      
-An example file-level module is: 
-  
-\verbatim
-<file name="org-sleuthkit-autopsy-ingest-example-ExampleAbstractFileIngestModule.instance">
-  <attr name="instanceOf" stringvalue="org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile"/>
-  <attr name="instanceCreate" methodvalue="org.sleuthkit.autopsy.ingest.example.ExampleAbstractFileIngestModule.getDefault"/>
-  <attr name="position" intvalue="1100"/>
-</file>
-\endverbatim
-
-Note the "position" attribute.  The attribute determines the ordering of the module in the ingest pipeline.
-Modules with lower position attribute will execute earlier.
-Use high numbers (higher than 1000) for non-core modules. If your module depends on results from another module, use a higher position attribute to enforce the dependency.
-
-Note: we plan to implement a more flexible and robust module dependency system in future versions of the Autopsy ingest framework.
-
-New modules can be added to the Autopsy ingest pipeline by dropping in jar files into build/cluster/modules.
-Dropped in module will be automatically recognized next time Autopsy starts.
-
-\subsection ingestmodule_making_results Posting Results
-
-Users will see the results from ingest modules in one of two ways:
-- Results are posted to the blackboard and will be displayed in the navigation tree
-- Messages are sent to the Ingest Inbox to notify a user of what has recently been found. 
-
-See the Blackboard (REFERENCE) documentation for posting results to it.  Modules are free to immediately post results when they find them or they can wait.  The  IngestServices.getUpdateFrequency() method returns the maximum amount of time that a module can wait before it posts its results. 
-
-An example of waiting to post results is the keyword search module.  It is resource intensive to commit the keyword index and do a keyword search.  Therefore, when its process() method is invoked, it checks if it is close to the getUpdateFrequency() since the last time it did a keyword search.  If it is, then it commits the index and performs the search. 
-
-When they add data to the blackboard, modules should notify listeners of the new data by periodically invoking IngestServices.fireModuleDataEvent() method. This allows other modules (and the main UI) to know when to query the blackboard for the latest data. 
-
-Modules should post messages to the inbox when interesting data is found.  The messages includes the module name, message subject, message details, a unique message id (in the context of the originating module), and a uniqueness attribute.  The uniqueness attribute is used to group similar messages together and to determine the overall importance priority of the message (if the same message is seen repeatedly, it is considered lower priority).
-
-It is important though to not fill up the inbox with messages.  These messages should only be sent if the result has a low false positive rate and will likely be relevant.  For example, the hash lookup module will send messages if known bad (notable) files are found, but not if known good (NSRL) files are found.  The keyword search module will send messages if a specific keyword matches, but will not send messages (by default) if a regular expression match for a URL has matches (because a lot of the URL hits will be false positives and can generate thousands of messages on a typical system). 
-
-Ingest messages have different types: there are info messages, warning messages, error messages and data messages.
-The data messages contain encapsulated blackboard artifacts and attributes. The passed in data is used by the ingest inbox GUI widget to navigate to the artifact view in the directory tree, if requested by the user.
-
-Ingest message API is defined in IngestMessage class.  The class also contains factory methods to create new messages.
-Messages are posted using IngestServices.postMessage() method, which accepts a message object created using one of the factory methods.
-
-Modules should post inbox messages to the user when stop() or complete() is invoked (refer to the examples).
-It is recommended to populate the description field of the complete inbox message to provide feedback to the user 
-summarizing the module ingest run and if any errors were encountered.
-
-
-\subsection ingestmodule_making_configuration Module Configuration
-
-Ingest modules may require user configuration. The framework 
-supports two levels of configuration: run-time and general. Run-time configuration 
-occurs when the user selects which ingest modules to run when an image is added.  This level
-of configuration should allow the user to enable or disable settings.  General configuration is more in-depth and 
-may require an interface that is more powerful than simple check boxes. 
-
-As an example, the keyword search module uses both configuration methods.  The run-time configuration allows the user
-to choose which lists of keywords to search for.  However, if the user wants to edit the lists or create lists, they 
-need to do go the general configuration window. 
-
-Module configuration is decentralized and module-specific; every module maintains its
-own configuration state and is responsible for implementing the graphical interface.
-
-The run-time configuration (also called simple configuration), is achieved by each
-ingest module providing a JPanel.   The IngestModuleAbstract.hasSimpleConfiguration(),
-IngestModuleAbstract.getSimpleConfiguration(), and IngestModuleAbstract.saveSimpleConfiguration()
-methods should be used for run-time configuration. 
-
-The general configuration is also achieved by the module returning a JPanel. A link will be provided to the general configuration from the ingest manager if it exists.
-The IngestModuleAbstract.hasAdvancedConfiguration(),
-IngestModuleAbstract.getAdvancedConfiguration(), and IngestModuleAbstract.saveAdvancedConfiguration()
-methods should be used for general configuration. 
-
-
-
-
-\section ingestmodule_events Getting Ingest Status and Events
-
-
-Other modules and core Autopsy classes may want to get the status of the ingest manager.  The IngestManager provides access to this data with the sleuthkit.autopsy.ingest.IngestManager.isIngestRunning() method.
-
-
-External modules can also register themselves as ingest module event listeners and receive event notifications (when a module is started, stopped, completed or has new data).  
-Use the IngestManager.addPropertyChangeListener() method to register a module event listener.  
-Events types received are defined in IngestManager.IngestModuleEvent enum.   
-
-At the end of the ingest, IngestManager itself will notify all listeners of IngestModuleEvent.COMPLETED event.
-The event is an indication for listeners to perform the final data refresh by quering the blackboard.
-Module developers are encouraged to generate periodic IngestModuleEvent.DATA 
-ModuleDataEvent events when they post data to the blackboard, 
-but the IngestManager will make a final event to handle scenarios where the module did not notify listeners while it was running. 
-
 */
diff --git a/Report/src/org/sleuthkit/autopsy/report/package.dox b/Report/src/org/sleuthkit/autopsy/report/package.dox
index 702a7aed4b..c6b48bdf85 100644
--- a/Report/src/org/sleuthkit/autopsy/report/package.dox
+++ b/Report/src/org/sleuthkit/autopsy/report/package.dox
@@ -1,19 +1,9 @@
 /**
-
-
 \package org.sleuthkit.autopsy.report
 
 This package provides the reporting framework.  Reporting modules allow you to get output from Autopsy in the form of XML, HTML, etc.
 
-\section report_contents Package Contents
-
-The following are important classes in this package:
-* TODO
-
-\section report_making Making a Report Module
-
-TODO
-
+Refer to \ref mod_report_page for details on building a report module. 
 
 */
 
diff --git a/docs/doxygen/Doxyfile b/docs/doxygen/Doxyfile
index a9f0eb074c..220449a6b1 100644
--- a/docs/doxygen/Doxyfile
+++ b/docs/doxygen/Doxyfile
@@ -655,7 +655,7 @@ WARN_LOGFILE           =
 # directories like "/usr/src/myproject". Separate the files or directories
 # with spaces.
 
-INPUT                  = main.dox blackboard.dox workflow.dox \
+INPUT                  = main.dox workflow.dox \
                          modContent.dox modDev.dox modIngest.dox modReport.dox \
                          modResult.dox platformConcepts.dox \
                          regressionTesting.dox \
diff --git a/docs/doxygen/blackboard.dox b/docs/doxygen/blackboard.dox
deleted file mode 100644
index 06c68019dd..0000000000
--- a/docs/doxygen/blackboard.dox
+++ /dev/null
@@ -1,11 +0,0 @@
-/*! \page blackboard_page The Blackboard
-
-What is the blackboard
-
-What is it used for
-
-How do modules get access to it.
-
-Refer to C++ page to reduce duplication.
-
-*/
diff --git a/docs/doxygen/main.dox b/docs/doxygen/main.dox
index 7e361a2ad0..2a79e1191e 100644
--- a/docs/doxygen/main.dox
+++ b/docs/doxygen/main.dox
@@ -3,9 +3,8 @@
 <h3>Overview</h3>
 Autopsy has been designed as a platform for open source tools besides just The Sleuth Kit.  This document is for developers who want to add functionality into Autopsy.  This could be in the form of enhancing the existing functionality or by making a module that plugs into it and you may distribute from your own site or push it back into the base distribution. 
 
-- \subpage design_page
-- \subpage framework_page (Basic concepts of framework and types of modules)
-- \subpage blackboard_page (what is the blackboard)
+- \subpage workflow_page
+- \subpage platform_page (Basic concepts of framework and types of modules)
 - \subpage mod_dev_page (Developing modules:get dev env setup, getting sersvices, properties etc.)
 - \subpage mod_ingest_page (developing ingest modules)
 - \subpage mod_report_page (developing report modules)
@@ -13,6 +12,7 @@ Autopsy has been designed as a platform for open source tools besides just The S
 - \subpage mod_result_page (developing result viewers)
 - \subpage regression_test_page 
 
+<!-- Note that Case still has lots of content in package.dox -->
 */
 
 
diff --git a/docs/doxygen/modContent.dox b/docs/doxygen/modContent.dox
index 472b4e3023..6c88394373 100644
--- a/docs/doxygen/modContent.dox
+++ b/docs/doxygen/modContent.dox
@@ -1,6 +1,33 @@
 /*! \page mod_content_page Developing Content Viewer Modules
 
 
-How to write a content viewer module.
+Note that this needs cleanup and updating.  it has been copied from the CoreComponentInterfaces package description.
+
+<h3>Creating a DataContentViewer</h3>
+
+DataContentTopComponent is the high-level window in the DataContent area.  Each instance of this loads up all instances of DataContentViewers that have been registered with the system. Example viewers include the strings and hexdump views.  If you want to make your own type of viewer, follow the steps below.  Note that the strings, hexdump, and image viewers come with Autopsy by default and can be used by all DataExplorers and DataResults. You only need to make a new DataContentViewer if these viewers do not satisfy your needs.
+
+<ol>
+<li>Create a module from within NetBeans.  It must be dependent on these modules:
+<ul>
+<li>Case
+<li>CoreComponentInterfaces
+<li>CoreComponents
+<li>DataModel
+<li>DialogsAPI (if pop-ups and such are going to be used)
+<li>Explorer & Property Sheet API
+<li>Lookup
+<li>Nodes API
+<li>Setting API
+<li>UI Utilities API
+<li>Utilities API
+<li>Window System API
+</ul>
+<li>Make a class that implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer and is registered as a service provider for DataContentViewer.class by specifying "@ServiceProvider(service = DataContentViewer.class)" or by using layer.xml.  This class must extend JPanel. </li>
+</ol>
+
+Find a home for this:
+
+If multiple content viewers are supported, a preferred (default) content viewer is chosen.
 
 */
diff --git a/docs/doxygen/modDev.dox b/docs/doxygen/modDev.dox
index ff364ead83..2147ffd98d 100644
--- a/docs/doxygen/modDev.dox
+++ b/docs/doxygen/modDev.dox
@@ -6,4 +6,7 @@ How to get access to services and what services exist.
 
 How to set properties, etc.
 
+What to listen for:
+- case updates, etc.
+
 */
diff --git a/docs/doxygen/modIngest.dox b/docs/doxygen/modIngest.dox
index 34eac2541d..5aa107b512 100644
--- a/docs/doxygen/modIngest.dox
+++ b/docs/doxygen/modIngest.dox
@@ -1,6 +1,152 @@
 /*! \page mod_ingest_page Developing Ingest Modules
 
 
-How to write an ingest module.
+\section ingestmodule_modules Ingest Module Basics
 
+Ingest modules analyze data from a disk image.  They typically focus on a specific type of data analysis.  The modules are loaded each time that Autopsy starts.  The user can choose to enable each module when they add an image to the case.
+
+There are two types of ingest modules. 
+- Image-level modules are passed in a reference to an image and perform general analysis on it.  These modules may query the database for a small set of files.
+- File-level modules are passed in a reference to each file.  The Ingest Manager chooses which files to pass and when.  These modules are intended to analyze most of the files on the system or that want to examine the file content of all files (i.e. to detect file type based on signature instead of file extension). 
+
+Modules post their results to the blackboard (@@@ NEED REFERENCE FOR THIS -- org.sleuthkit.datamodel) and can query the blackboard to get the results of previous modules.  For example, the hash database lookup module may want to query for a previously calculated hash value. 
+
+The IngestManager class is responsible for launching the ingest modules and passing data to them.   Modules can send messages to the ingest inbox (REFERENCE) so that users can see when data has been found. 
+
+
+\section ingestmodule_making Making Ingest Modules
+
+Refer to org.sleuthkit.autopsy.ingest.example for sample source code. 
+
+\subsection ingestmodule_making_api Module Interface
+
+The first step is to choose the correct module type.  Image-level modules will implement the IngestModuleImage interface and file-level modules will implement the IngestModuleAbstractFile interface. 
+
+There is a static getDefault() method that is not part of the interface, that every module (whether an image or a file module) needs to implement to return the registered static instance of the module.  Refer to example code in example.ExampleAbstractFileIngestModule.getDefault()
+
+File-level modules need to be singleton (only a single instance at a time).  To ensure this, make the constructor private. Ensure the default public file module constructor is overridden with the private one.  Image-level modules require a public constructor.
+
+The interfaces have several standard methods that need to be implemented.  See the interface methods for details.  
+- IngestModuleAbstract.init() is invoked every time an ingest session starts.  A module should support multiple invocations of init() throughout the application life-cycle.
+- IngestModuleAbstract.complete() is invoked when an ingest session completes.  The module should perform any resource (files, handles, caches) cleanup in this method and submit final results and post a final ingest inbox message.
+- IngestModuleAbstract.stop() is invoked on a module when an ingest session is interrupted by the user or by the system.
+The method implementation should be similar to complete() in that the module should perform any cleanup work.  If there is pending data to be processed or pending results to be reported by the module then the results should be rejected and ignored if stop() is invoked and the module should terminate as early as possible.
+- process() method is invoked to analyze the data. The specific method depends on the module type. 
+
+
+Multiple images can be ingested at the same time. The current behavior is that the files from the second image are added to the list of the files from the first image.  The impact of this on module development is that a file-level module could be passed in files from different images in consecutive calls to process().  New instances of image-level modules will be created when the second image is added.   Therefore, image-level modules should assume that the process() method will be called only once after init() is called. 
+
+Every module should support multiple init() - process() - complete(), and init() - process() - stop() invocations.
+The modules should also support multiple init() - complete() and init() - stop() invocations, 
+which can occur if ingest pipeline is started but no work is enqueued for the particular module.
+
+Module developers are encouraged to use the standard java.util.logging.Logger infrastructure to log errors to the Autopsy log.
+
+\subsection ingestmodule_making_process Process Method
+The process method is where the work is done in each type of module.  Some notes:
+- File-level modules will be called on each file in an order determined by the IngestManager.  Each module is free to quickly ignore a file based on name, signature, etc.  If a module wants to know the return value from a previously run module, it should use the IngestServices.getAbstractFileModuleResult() method. 
+- Image-level modules are expected not passed in specific files and are expected to query the database to find the files that they are interested in. 
+
+
+\subsection ingestmodule_making_registration Module Registration
+
+Ingest modules need to be registered using the Netbeans Lookup infrastructure in package's layer.xml file.
+
+An example Image-level module is: 
+\verbatim
+<file name="org-sleuthkit-autopsy-ingest-example-ExampleImageIngestModule.instance">
+  <attr name="instanceOf" stringvalue="org.sleuthkit.autopsy.ingest.IngestModuleImage"/>
+  <attr name="instanceCreate" methodvalue="org.sleuthkit.autopsy.ingest.example.ExampleImageIngestModule.getDefault"/>
+  <attr name="position" intvalue="1000"/>
+</file>
+\endverbatim
+      
+An example file-level module is: 
+  
+\verbatim
+<file name="org-sleuthkit-autopsy-ingest-example-ExampleAbstractFileIngestModule.instance">
+  <attr name="instanceOf" stringvalue="org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile"/>
+  <attr name="instanceCreate" methodvalue="org.sleuthkit.autopsy.ingest.example.ExampleAbstractFileIngestModule.getDefault"/>
+  <attr name="position" intvalue="1100"/>
+</file>
+\endverbatim
+
+Note the "position" attribute.  The attribute determines the ordering of the module in the ingest pipeline.
+Modules with lower position attribute will execute earlier.
+Use high numbers (higher than 1000) for non-core modules. If your module depends on results from another module, use a higher position attribute to enforce the dependency.
+
+Note: we plan to implement a more flexible and robust module dependency system in future versions of the Autopsy ingest framework.
+
+New modules can be added to the Autopsy ingest pipeline by dropping in jar files into build/cluster/modules.
+Dropped in module will be automatically recognized next time Autopsy starts.
+
+\subsection ingestmodule_making_results Posting Results
+
+Users will see the results from ingest modules in one of two ways:
+- Results are posted to the blackboard and will be displayed in the navigation tree
+- Messages are sent to the Ingest Inbox to notify a user of what has recently been found. 
+
+See the Blackboard (REFERENCE) documentation for posting results to it.  Modules are free to immediately post results when they find them or they can wait.  The  IngestServices.getUpdateFrequency() method returns the maximum amount of time that a module can wait before it posts its results. 
+
+An example of waiting to post results is the keyword search module.  It is resource intensive to commit the keyword index and do a keyword search.  Therefore, when its process() method is invoked, it checks if it is close to the getUpdateFrequency() since the last time it did a keyword search.  If it is, then it commits the index and performs the search. 
+
+When they add data to the blackboard, modules should notify listeners of the new data by periodically invoking IngestServices.fireModuleDataEvent() method. This allows other modules (and the main UI) to know when to query the blackboard for the latest data. 
+
+Modules should post messages to the inbox when interesting data is found.  The messages includes the module name, message subject, message details, a unique message id (in the context of the originating module), and a uniqueness attribute.  The uniqueness attribute is used to group similar messages together and to determine the overall importance priority of the message (if the same message is seen repeatedly, it is considered lower priority).
+
+It is important though to not fill up the inbox with messages.  These messages should only be sent if the result has a low false positive rate and will likely be relevant.  For example, the hash lookup module will send messages if known bad (notable) files are found, but not if known good (NSRL) files are found.  The keyword search module will send messages if a specific keyword matches, but will not send messages (by default) if a regular expression match for a URL has matches (because a lot of the URL hits will be false positives and can generate thousands of messages on a typical system). 
+
+Ingest messages have different types: there are info messages, warning messages, error messages and data messages.
+The data messages contain encapsulated blackboard artifacts and attributes. The passed in data is used by the ingest inbox GUI widget to navigate to the artifact view in the directory tree, if requested by the user.
+
+Ingest message API is defined in IngestMessage class.  The class also contains factory methods to create new messages.
+Messages are posted using IngestServices.postMessage() method, which accepts a message object created using one of the factory methods.
+
+Modules should post inbox messages to the user when stop() or complete() is invoked (refer to the examples).
+It is recommended to populate the description field of the complete inbox message to provide feedback to the user 
+summarizing the module ingest run and if any errors were encountered.
+
+
+\subsection ingestmodule_making_configuration Module Configuration
+
+Ingest modules may require user configuration. The framework 
+supports two levels of configuration: run-time and general. Run-time configuration 
+occurs when the user selects which ingest modules to run when an image is added.  This level
+of configuration should allow the user to enable or disable settings.  General configuration is more in-depth and 
+may require an interface that is more powerful than simple check boxes. 
+
+As an example, the keyword search module uses both configuration methods.  The run-time configuration allows the user
+to choose which lists of keywords to search for.  However, if the user wants to edit the lists or create lists, they 
+need to do go the general configuration window. 
+
+Module configuration is decentralized and module-specific; every module maintains its
+own configuration state and is responsible for implementing the graphical interface.
+
+The run-time configuration (also called simple configuration), is achieved by each
+ingest module providing a JPanel.   The IngestModuleAbstract.hasSimpleConfiguration(),
+IngestModuleAbstract.getSimpleConfiguration(), and IngestModuleAbstract.saveSimpleConfiguration()
+methods should be used for run-time configuration. 
+
+The general configuration is also achieved by the module returning a JPanel. A link will be provided to the general configuration from the ingest manager if it exists.
+The IngestModuleAbstract.hasAdvancedConfiguration(),
+IngestModuleAbstract.getAdvancedConfiguration(), and IngestModuleAbstract.saveAdvancedConfiguration()
+methods should be used for general configuration. 
+
+
+
+\section ingestmodule_events Getting Ingest Status and Events
+
+
+Other modules and core Autopsy classes may want to get the status of the ingest manager.  The IngestManager provides access to this data with the sleuthkit.autopsy.ingest.IngestManager.isIngestRunning() method.
+
+
+External modules can also register themselves as ingest module event listeners and receive event notifications (when a module is started, stopped, completed or has new data).  
+Use the IngestManager.addPropertyChangeListener() method to register a module event listener.  
+Events types received are defined in IngestManager.IngestModuleEvent enum.   
+
+At the end of the ingest, IngestManager itself will notify all listeners of IngestModuleEvent.COMPLETED event.
+The event is an indication for listeners to perform the final data refresh by quering the blackboard.
+Module developers are encouraged to generate periodic IngestModuleEvent.DATA 
+ModuleDataEvent events when they post data to the blackboard, 
+but the IngestManager will make a final event to handle scenarios where the module did not notify listeners while it was running. 
 */
diff --git a/docs/doxygen/modResult.dox b/docs/doxygen/modResult.dox
index c03691d6a1..04534f58b9 100644
--- a/docs/doxygen/modResult.dox
+++ b/docs/doxygen/modResult.dox
@@ -1,6 +1,31 @@
 /*! \page mod_result_page Developing Result Viewer Modules
 
+NOTE: This has been moved from a package-level description and needs cleanup.
 
-How to write a result viewer module.
+<h3>Creating a DataResultViewer</h3>
+<p>DataResultTopComponent is the high-level window in the DataResult area.  Each instance of this loads up all instances of DataResultViewers that have been registered with the system. Example viewers include the table and thumbnail views.  If you want to make your own type of viewer, follow the steps below.  Note that the table and thumbnail viewers come with Autopsy by default and can be used by all DataExplorers. 
+
+<ol>
+<li>Create a module from within NetBeans.  It must be dependent on these modules:
+<ul>
+<li>Case
+<li>CoreComponentInterfaces
+<li>CoreComponents
+<li>DataModel
+<li>DialogsAPI (if pop-ups and such are going to be used)
+<li>Explorer & Property Sheet API
+<li>Lookup
+<li>Nodes API
+<li>Setting API
+<li>UI Utilities API
+<li>Utilities API
+<li>Window System API
+</ul>
+
+<li>Make a class that extends org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer and is registered as a service provider for the org.sleuthkit.autopsy.corecomponentinterfaces.DataResultViewer class by specifying "@ServiceProvider(service = DataResultViewer.class)" or by using layer.xml.  This class will extend JPanel. </li>
+
+<li>See the previous sections on default actions. (note that this refers to the CoreComponentINterfaces package-level description, which I think is now in \ref design_data_flow).</li>
+
+</ol>
 
 */
diff --git a/docs/doxygen/platformConcepts.dox b/docs/doxygen/platformConcepts.dox
index e7178dd996..b38d65093b 100644
--- a/docs/doxygen/platformConcepts.dox
+++ b/docs/doxygen/platformConcepts.dox
@@ -1,6 +1,10 @@
-/*! \page framework_page Autopsy Platform Concepts
+/*! \page platform_page Autopsy Platform Concepts
 
-What frameworks / modules exist
+What frameworks / modules exist and what each does. They have already been mentioned on the previous page, so this should just be a bullet list with links to other pages for more details.
+
+blackboard 
+
+igest inbox
 
 
 */
diff --git a/docs/doxygen/workflow.dox b/docs/doxygen/workflow.dox
index 30214aeb80..ac33b9a240 100644
--- a/docs/doxygen/workflow.dox
+++ b/docs/doxygen/workflow.dox
@@ -1,4 +1,4 @@
-/*! \page design_page General Workflow and Design 
+/*! \page workflow_page General Workflow and Design 
 
 \section design_overview Overview
 This section outlines Autopsy design from the typical analysis work flow perspective.
@@ -10,62 +10,43 @@ This page is organized based on these phases:
 
 \section design_case Creating a Case
 
-The first step in Autopsy work flow is creating a case. This is done in the org.sleuthkit.autopsy.casemodule package (package \ref casemodule_overview).  This module contains the wizards needed and deals with how to store the information.  You should not need to do much modifications in this package.  But, you will want to use the org.sleuthkit.autopsy.casemodule.Case object to access all data related to this case.
+The first step in Autopsy work flow is creating a case. This is done in the org.sleuthkit.autopsy.casemodule package (see \ref casemodule_overview for details).  This module contains the wizards needed and deals with how to store the information.  You should not need to do much modifications in this package.  But, you will want to use the org.sleuthkit.autopsy.casemodule.Case object to access all data related to this case.
 
 
-\section design_image Adding an Image
 
-After case is created, one or more disk images can be added to the case.  There is a wizard to guide that process
-and it is located in the org.sleuthkit.autopsy.casemodule package.  Refer to the package section \ref casemodule_add_image for more details on the wizard. 
+\section design_image Adding an Image and Running Ingest Modules
 
-	
-After image has been added to the case, the user can select one or more ingest modules to be executed on the image.
-Ingest modules focus on a specific type of analysis task and run in the background.  The results from the ingest module can be found in the results tree and in the ingest inbox.  
+After case is created, one or more disk images can be added to the case.  There is a wizard to guide that process and it is located in the org.sleuthkit.autopsy.casemodule package.  Refer to the package section \ref casemodule_add_image for more details on the wizard. Most developers will not need to touch this code though. 
 
-The org.sleuthkit.autopsy.ingest package provides the basic infrastructure for the ingest module management.    See the \ref ingestmodue_contents page for more details.  
+After image has been added to the case, the user can select one or more ingest modules to be executed on the image.  Ingest modules focus on a specific type of analysis task and run in the background.  The results from the ingest module can be found in the results tree and in the ingest inbox.  
 
-A list of standard modules that come with Autopsy can be found in:
+The org.sleuthkit.autopsy.ingest package provides the basic infrastructure for the ingest module management.
+
+A list of standard ingest modules that come with Autopsy can be found in:
 - org.sleuthkit.autopsy.keywordsearch
 - org.sleuthkit.autopsy.recentactivity
 - org.sleuthkit.autopsy.hashdatabase
 - org.sleuthkit.autopsy.thunderbirdparser
 
-See \ref ingestmodule_making for more details on making an ingest module.
+See \ref mod_ingest_page for more details on making an ingest module.
 
 
 \section design_view Viewing Results
 
-The UI has three main areas.  The tree on the left-hand side, the result viewers in the upper right, and the content viewers in the lower right.  Data passes between these areas by encapsulating them in Node objects (see org.openide.nodes.Node).  Nodes use property sheets to encapsulate data (blackboard attributes) and are modeled in a parent-child hierarchy with other nodes.
-The hierarchy is used to visually represent the data and to trigger child node updates when the parent node is selected.
-Node child factories are invoked by the Netbeans framework at the time of parent node selection to populate and refresh the child node view.
-
-The tree on the left hand-side shows the analysis results.  Its contents are populated from the central database.   See the org.sleuthkit.autopsy.directorytree module for more details. 
-
-The area in the upper right is the result viewer area.  When a node is selected from the tree, the data is sent to this area.  It is a framework with modules that display the data in different layouts.  The org.sleuthkit.autopsy.corecomponentsinterfaces package has the interface to make one of these modules.  
-
-When an item is selected from the result viewer area, it is passed to the bottom right content viewers.  It too is a framework with many modules that know how to show information about a specific file in different ways.  The org.sleuthkit.autopsy.corecomponentsinterfaces package has the interface to make one of these modules.  See XXX on building new content viewers.
+The UI has three main areas.  The tree on the left-hand side, the result viewers in the upper right, and the content viewers in the lower right.  Data passes between these areas by encapsulating them in Netbeans Node objects (see org.openide.nodes.Node).  These allow Autopsy to generically handle all types of data.  The org.sleuthkit.autopsy.datamodel package details with wrapping the org.sleuthkit.datamodel objects as Netbeans Nodes. 
+ 
 
 
-<!-- @@@ MOVE THIS SOMEWHERE ELSE -- the directory tree package maybe??
+Nodes are modeled in a parent-child hierarchy with other nodes.  All data within a Case is represented in a hierarchy with the disk images being one level below the case and volumes and such below the image. 
 
-The component is by default registered with the ingest manager as an ingest event listener.
-The viewer first loads all the viewer-supported data currently in the blackboard when Autopsy starts.  
-During the ingest process the viewer receives events from ingest modules
-(relayed by ingest manager) and it selectively refreshes parts of the tree providing real-time updates to the user.
-When ingest is completed, the viewer responds to the final ingest data event generated by the ingest manager, 
-and performs a final refresh of all viewer-supported data in the blackboard.
+The tree on the left hand-side shows the analysis results.  Its contents are populated from the central database.   This is where you can browse the file system contents and see the results from the blackboard (see \ref blackboard_page).  The tree is implemented in the org.sleuthkit.autopsy.directorytree package. 
+
+The area in the upper right is the result viewer area.  When a node is selected from the tree, the node and its children are sent to this area.  This area is used to view a set of nodes.  The viewer is itself a framework with modules that display the data in different layouts.  For example, the standard version comes with a table viewer and a thumbnail viewer.  Refer to \ref mod_result_page for details on building a module. 
+
+When an item is selected from the result viewer area, it is passed to the bottom right content viewers.  It too is a framework with many modules that know how to show information about a specific file in different ways.  For example, there are viewers that show the data in a hex dump format, extract the strings, and display pictures and movies.  
+See  \ref mod_content_page for details on building new content viewers.
 
 
-User normally initiates result navigation in the directory tree.  
-
-Node content support capabilities are registered in the node's Lookup.
-Multiple content viewers (such as strings, hex, extracted text, media) can support the node content.
-If multiple content viewers are supported, a preferred (default) content viewer is chosen.
-
-For more information refer to org.sleuthkit.autopsy.corecomponents, org.sleuthkit.autopsy.corecomponentsinterfaces
-and  
-
--->
 
 \section design_report Report generation
 
@@ -84,4 +65,40 @@ Please refer to report.dox and org.sleuthkit.autopsy.report package API document
 -->
 
 
+
+<!-- @@@ MOVE THIS SOMEWHERE ELSE -- the directory tree package maybe??
+
+The component is by default registered with the ingest manager as an ingest event listener.
+The viewer first loads all the viewer-supported data currently in the blackboard when Autopsy starts.  
+During the ingest process the viewer receives events from ingest modules
+(relayed by ingest manager) and it selectively refreshes parts of the tree providing real-time updates to the user.
+When ingest is completed, the viewer responds to the final ingest data event generated by the ingest manager, 
+and performs a final refresh of all viewer-supported data in the blackboard.
+
+
+Node content support capabilities are registered in the node's Lookup.
+-->
+
+<!-- This is too detailed for here, but maybe should be broken up and put into the sections on making a result viewer and such…
+
+\section design_data_flow Data Flow
+
+\subsection design_data_flow_create Creating Nodes in DataExplorer
+
+Data flows between the UI zones using a NetBeans node. The DataExplorer modules create the NetBeans nodes. They query the SQLite database or do whatever they want to identify the set of files that are of interest. They create the NetBeans nodes based on Sleuthkit data model objects. See the org.sleuthkit.autopsy.datamodel package for more details on this. 
+
+\subsection design_data_flow_toResult Getting Nodes to DataResult
+
+Each DataExplorer TopComponent is responsible for creating its own DataResult TopComponent to display its results. It can choose to re-use the same TopComponent for multiple searches (as DirectoryTree does) or it can choose to make a new one each time (as FileSearch does). The setNode() method on the DataResult object is used to set the root node to display. A dummy root node must be created as the parent if a parent does not already exist. 
+
+The DataExplorer is responsible for setting the double-click and right-click actions associated with the node.  The default single click action is to pass data to DataContent.  To override this, you must create a new DataResultViewer instance that overrides the propertyChange() method. The DataExplorer adds actions to wrapping the node in a FilterNode variant. The FilterNode then defines the actions for the node by overriding the getPreferredAction() and getActions() methods.  As an example, org.sleuthkit.autopsy.directorytree.DataResultFilterNode and org.sleuthkit.autopsy.directorytree.DataResultFilterChildren wraps the nodes that are passed over by the DirectoryTree DataExplorer.
+
+DataResult can send data back to its DataExplorer by making a custom action that looks up it's instance (DataExplorer.getInstance()).
+
+\subsection design_data_flow_toContent Getting Nodes to DataContent
+
+A default DataContent viewer is created when a case is opened. To display the contents of a node, it must be passed to a DataContent instance.  The default single-click behavior of the DataResultViewers is to lookup the default DataContent TopComponent and pass the selected node to it.   See org.sleuthkit.autopsy.corecomponents.AbstractDataResultViewer.propertyChange(PropertyChangeEvent) for details. 
+
+-->
+
 */

From e0d7eb1e799177cfb835403f1c7c4b00d6f6591e Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Wed, 12 Sep 2012 17:27:02 -0400
Subject: [PATCH 06/19] Use fast ASCII extraction if only Latin basic/English
 is enabled. Move method to StringExtract class.

---
 .../autopsy/coreutils/StringExtract.java      | 87 +++++++++++++++++++
 .../autopsy/datamodel/DataConversion.java     | 67 +-------------
 .../AbstractFileStringStream.java             |  6 +-
 3 files changed, 90 insertions(+), 70 deletions(-)

diff --git a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
index 2018c9811a..90287bfa5c 100644
--- a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
+++ b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
@@ -146,6 +146,20 @@ public class StringExtract {
         }
 
     }
+    
+    /**
+     * Determine if Basic Latin/English extraction is set enabled only 
+     * @return true if only Basic Latin/English extraction is set enabled only
+     */
+    public boolean isExtractionLatinBasicOnly() {
+        if (enabledScripts.size() == 1
+                && enabledScripts.get(0).equals(SCRIPT.LATIN_1)) {
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
 
     public static List<SCRIPT> getSupportedScripts() {
         return SUPPORTED_SCRIPTS;
@@ -165,6 +179,16 @@ public class StringExtract {
              return new StringExtractResult();
         }
         
+        //special case for Latin basic, use ASCII (fast extraction)
+        if (isExtractionLatinBasicOnly()) {
+            String extrStr = extractASCII(buff, len, offset);
+            StringExtractResult res = new StringExtractResult();
+            res.numBytes = len;
+            res.numChars = extrStr.length();
+            res.textString = extrStr;
+            return res;
+        }
+        
         final int buffLen = buff.length;
 
         int processedBytes = 0;
@@ -519,6 +543,69 @@ public class StringExtract {
 
         return res;
     }
+    
+    /*
+     * Extract UTF8/16 ASCII characters from byte buffer - only works for Latin, but fast
+     *
+     * The definition of printable are:
+     *  -- All of the letters, numbers, and punctuation.
+     *  -- space and tab
+     *  -- It does NOT include newlines or control chars.
+     *  -- When looking for ASCII strings, they evaluate each byte and when they find four or more printable characters they get printed out with a newline in between each string.
+     *  -- When looking for Unicode strings, they evaluate each two byte sequence and look for four or more printable characters…
+     *
+     * @param readBuf          the bytes that the string read from
+     * @param len           buffer length
+     * @param offset offset to start converting from
+     *
+     */
+    public static String extractASCII(byte[] readBuf, int len, int offset) {
+        final StringBuilder result = new StringBuilder();
+        StringBuilder temp = new StringBuilder();
+        int curLen = 0;
+
+        final char NL = (char) 10; // ASCII char for new line
+        final String NLS = Character.toString(NL);
+        boolean singleConsecZero = false; //preserve the current sequence of chars if 1 consecutive zero char
+        for (int i = offset; i < len; i++) {
+            char curChar = (char) readBuf[i];
+            if (curChar == 0 && singleConsecZero == false) {
+                //preserve the current sequence if max consec. 1 zero char 
+                singleConsecZero = true;
+            } else {
+                singleConsecZero = false;
+            }
+            //ignore non-printable ASCII chars
+            if (isPrintableAscii(curChar)) {
+                temp.append(curChar);
+                ++curLen;
+            } else if (!singleConsecZero) {
+                if (curLen >= MIN_CHARS_STRING) {
+                    // add to the result and also add the new line at the end
+                    result.append(temp);
+                    result.append(NLS);
+                }
+                // reset the temp and curLen
+                temp = new StringBuilder();
+                curLen = 0;
+
+            }
+        }
+
+        result.append(temp);
+        return result.toString();
+    }
+
+    /**
+     * Determine if char is a printable ASCII char
+     * in range <32,126> and a tab
+     * @param c char to test
+     * @return true if it's a printable char, or false otherwise
+     */
+    public static boolean isPrintableAscii(char c) {
+        return (c >= 32 && c <= 126) || c == 9;
+    }
+
 
     /**
      * Representation of the string extraction result
diff --git a/DataModel/src/org/sleuthkit/autopsy/datamodel/DataConversion.java b/DataModel/src/org/sleuthkit/autopsy/datamodel/DataConversion.java
index 5dc9635f99..292fbe68fa 100644
--- a/DataModel/src/org/sleuthkit/autopsy/datamodel/DataConversion.java
+++ b/DataModel/src/org/sleuthkit/autopsy/datamodel/DataConversion.java
@@ -109,72 +109,7 @@ public class DataConversion {
         }
     }
 
-    /*
-     * Gets only the printable string from the given characters
-     *
-     * The definition of printable are:
-     *  -- All of the letters, numbers, and punctuation.
-     *  -- space and tab
-     *  -- It does NOT include newlines or control chars.
-     *  -- When looking for ASCII strings, they evaluate each byte and when they find four or more printable characters they get printed out with a newline in between each string.
-     *  -- When looking for Unicode strings, they evaluate each two byte sequence and look for four or more printable characters…
-     *
-     * @param readBuf          the bytes that the string read from
-     * @param len           length of text in the buffer to convert, starting at position 0
-     * @param minStringLen     minimum length of consecutive chars to qualify as a string
-     *
-     * TODO should be encoding specific and detect UTF8, UTF16LE, UTF16BE
-     * then process remainder of the string using detected encoding  
-     * 
-     * @author jantonius
-     */
-    public static String getString(byte[] readBuf, int len, int minStringLen) {
-        final StringBuilder result = new StringBuilder();
-        StringBuilder temp = new StringBuilder();
-        int curLen = 0;
-
-        final char NL = (char) 10; // ASCII char for new line
-        final String NLS = Character.toString(NL);
-        boolean singleConsecZero = false; //preserve the current sequence of chars if 1 consecutive zero char
-        for (int i = 0; i < len; i++) {
-            char curChar = (char) readBuf[i];
-            if (curChar == 0 && singleConsecZero == false) {
-                //preserve the current sequence if max consec. 1 zero char 
-                singleConsecZero = true;
-            } else {
-                singleConsecZero = false;
-            }
-            //ignore non-printable ASCII chars
-            if (isPrintableAscii(curChar)) {
-                temp.append(curChar);
-                ++curLen;
-            } else if (!singleConsecZero) {
-                if (curLen >= minStringLen) {
-                    // add to the result and also add the new line at the end
-                    result.append(temp);
-                    result.append(NLS);
-                }
-                // reset the temp and curLen
-                temp = new StringBuilder();
-                curLen = 0;
-
-            }
-        }
-
-        result.append(temp);
-        return result.toString();
-    }
-
-    /**
-     * Determine if char is a printable ASCII char
-     * in range <32,126> and a tab
-     * @param c char to test
-     * @return true if it's a printable char, or false otherwise
-     */
-    public static boolean isPrintableAscii(char c) {
-        return (c >= 32 && c <= 126) || c == 9;
-    }
-
+    
     /**
      * Converts the given paths into the formatted path. This mainly used for
      * the paths for the "new directory table" and "new output view".
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringStream.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringStream.java
index 49d2783d49..a3e4943383 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringStream.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringStream.java
@@ -20,11 +20,9 @@ package org.sleuthkit.autopsy.keywordsearch;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.UnsupportedEncodingException;
 import java.nio.charset.Charset;
-import java.util.logging.Level;
 import java.util.logging.Logger;
-import org.sleuthkit.autopsy.datamodel.DataConversion;
+import org.sleuthkit.autopsy.coreutils.StringExtract;
 import org.sleuthkit.datamodel.AbstractFile;
 import org.sleuthkit.datamodel.TskException;
 
@@ -165,7 +163,7 @@ public class AbstractFileStringStream extends InputStream {
             } else {
                 singleConsecZero = false;
             }
-            if (DataConversion.isPrintableAscii(c)) {
+            if (StringExtract.isPrintableAscii(c)) {
                 tempString.append(c);
                 ++tempStringLen;
                 if (tempStringLen >= MIN_PRINTABLE_CHARS) {

From 5b9fc01c20db6d55011753ae0795bf4973497646 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Wed, 12 Sep 2012 17:28:57 -0400
Subject: [PATCH 07/19] make default string extract script in ingest to be
 Latin basic only, not also extended.

---
 .../autopsy/keywordsearch/KeywordSearchIngestModule.java        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java
index ae9c4948ba..81bbcfbb8d 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java
@@ -117,7 +117,7 @@ public final class KeywordSearchIngestModule implements IngestModuleAbstractFile
     private KeywordSearchIngestModule() {
         //set default script 
         stringExtractScripts.add(SCRIPT.LATIN_1);
-        stringExtractScripts.add(SCRIPT.LATIN_2);
+        
         stringExtractOptions.put(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString(), Boolean.TRUE.toString());
         stringExtractOptions.put(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString(), Boolean.TRUE.toString());
     }

From e981a8519fbc17bdbf26f0ec217b49c68e3a8546 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 10:57:06 -0400
Subject: [PATCH 08/19] Better fast English only string extraction using
 AbstractFileStringStream (does not break words)

---
 .../autopsy/coreutils/StringExtract.java      | 16 +++------------
 .../AbstractFileStringExtract.java            | 20 +++++++++++++++----
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
index 90287bfa5c..1063f7570d 100644
--- a/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
+++ b/CoreUtils/src/org/sleuthkit/autopsy/coreutils/StringExtract.java
@@ -34,9 +34,9 @@ import org.sleuthkit.autopsy.coreutils.StringExtract.StringExtractUnicodeTable.S
  * Currently supports UTF-16 LE, UTF-16 BE and UTF8 Latin, Cyrillic, Chinese,
  * Arabic
  *
- * TODO: - process control characters - testing: check non-printable common
- * chars sometimes extracted (font?) - handle tie better (when number of chars
- * in result is equal)
+ * TODO: process control characters 
+ * 
+ * TODO: handle tie better (when number of chars in 2 results is equal)
  */
 public class StringExtract {
 
@@ -179,16 +179,6 @@ public class StringExtract {
              return new StringExtractResult();
         }
         
-        //special case for Latin basic, use ASCII (fast extraction)
-        if (isExtractionLatinBasicOnly()) {
-            String extrStr = extractASCII(buff, len, offset);
-            StringExtractResult res = new StringExtractResult();
-            res.numBytes = len;
-            res.numChars = extrStr.length();
-            res.textString = extrStr;
-            return res;
-        }
-        
         final int buffLen = buff.length;
 
         int processedBytes = 0;
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java
index 6d7e50680a..072442aac4 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/AbstractFileStringExtract.java
@@ -109,17 +109,29 @@ class AbstractFileStringExtract implements AbstractFileExtract {
         this.numChunks = 0; //unknown until indexing is done
         boolean success = false;
         
-        //construct stream that extracts text as we read it
-        //final InputStream stringStream = new AbstractFileStringStream(sourceFile, INDEX_CHARSET);
-        
+     
         final boolean extractUTF8 = 
                 Boolean.parseBoolean(extractOptions.get(AbstractFileExtract.ExtractOptions.EXTRACT_UTF8.toString()));
         
         final boolean extractUTF16 = 
                 Boolean.parseBoolean(extractOptions.get(AbstractFileExtract.ExtractOptions.EXTRACT_UTF16.toString()));
         
-        final InputStream stringStream = new AbstractFileStringIntStream(
+        if (extractUTF8 == false && extractUTF16 == false) {
+            //nothing to do
+            return true;
+        }
+        
+        InputStream stringStream = null;
+        //check which extract stream to use
+        if (extractScripts.size() == 1 && extractScripts.get(0).equals(SCRIPT.LATIN_1) ) {
+            //optimal for english, english only
+            stringStream = new AbstractFileStringStream(sourceFile, INDEX_CHARSET);
+        }
+        else {
+            stringStream = new AbstractFileStringIntStream(
                 sourceFile, extractScripts, extractUTF8, extractUTF16, INDEX_CHARSET);
+        }
+        
 
         try {
             success = true;

From 7dbae1a7058e0474b022b89167f4ce3d3d592f70 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 11:02:14 -0400
Subject: [PATCH 09/19] update tooltip

---
 .../autopsy/keywordsearch/KeywordSearchConfigurationPanel.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java
index 3f93caafc4..18ef3cb92c 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel.java
@@ -41,7 +41,7 @@ public class KeywordSearchConfigurationPanel extends javax.swing.JPanel {
     private void customizeComponents() {
         setName("Advanced Keyword Search Configuration");
         tabbedPane.insertTab("Lists", null, KeywordSearchConfigurationPanel1.getDefault(), "List configuration", 0);
-        tabbedPane.insertTab("String Extraction", null, KeywordSearchConfigurationPanel3.getDefault(), "Languages configuration", 1);
+        tabbedPane.insertTab("String Extraction", null, KeywordSearchConfigurationPanel3.getDefault(), "String extraction configuration for Keyword Search Ingest", 1);
         tabbedPane.insertTab("General", null, KeywordSearchConfigurationPanel2.getDefault(), "General configuration", 2);
         
     }

From 443b2281b9fd6eb64947635b30c5c500da237856 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 11:14:00 -0400
Subject: [PATCH 10/19] add get logger API to IngestServices

---
 .../sleuthkit/autopsy/ingest/IngestServices.java | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/Ingest/src/org/sleuthkit/autopsy/ingest/IngestServices.java b/Ingest/src/org/sleuthkit/autopsy/ingest/IngestServices.java
index 85e6cf58a1..504ccb1b9c 100644
--- a/Ingest/src/org/sleuthkit/autopsy/ingest/IngestServices.java
+++ b/Ingest/src/org/sleuthkit/autopsy/ingest/IngestServices.java
@@ -20,11 +20,13 @@
 
 package org.sleuthkit.autopsy.ingest;
 
+import java.util.logging.Logger;
+
 
 /**
  * Services available to ingest modules via singleton instance,
- * e.g. for interacting with the ingest manager
- * for sending data events, ingest messages, getting configurations, etc.
+ * e.g. for logging, interacting with the ingest manager
+ * sending data events notifications, ingest messages, getting configurations, etc.
  * 
  */
 public class IngestServices {
@@ -48,6 +50,16 @@ public class IngestServices {
         return instance;
     }
     
+    
+    /**
+     * Get a logger to be used by the module to log messages to log files
+     * @param module module to get the logger for
+     * @return logger object
+     */
+    public Logger getLogger(IngestModuleAbstract module) {
+        return Logger.getLogger(module.getName());
+    }
+    
     /**
      * Post ingest message
      * @param message ingest message to be posted by ingest module

From f31a5eea4685706339896f1cc0b47c8f30675fc7 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 13:09:51 -0400
Subject: [PATCH 11/19] Adjusting wording, add a warning dialog when deleting
 lists/keywords globally

---
 .../autopsy/keywordsearch/Bundle.properties   | 19 +++++-----
 .../KeywordSearchConfigurationPanel2.form     |  2 +-
 .../KeywordSearchConfigurationPanel2.java     |  2 +-
 .../KeywordSearchConfigurationPanel3.form     | 35 +++++++++++++------
 .../KeywordSearchConfigurationPanel3.java     | 28 ++++++++++-----
 .../KeywordSearchEditListPanel.java           | 15 +++++++-
 .../KeywordSearchIngestSimplePanel.form       |  2 +-
 .../KeywordSearchIngestSimplePanel.java       |  2 +-
 8 files changed, 72 insertions(+), 33 deletions(-)

diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
index 84048f167e..acfad3b516 100755
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
@@ -24,14 +24,14 @@ KeywordSearchEditListPanel.copyMenuItem.text=Copy
 KeywordSearchEditListPanel.exportButton.text=Export List
 KeywordSearchEditListPanel.deleteListButton.text=Delete List
 KeywordSearchListsManagementPanel.newListButton.text=New List
-KeywordSearchEditListPanel.useForIngestCheckbox.text=Use during ingest
+KeywordSearchEditListPanel.useForIngestCheckbox.text=Enable for ingest
 KeywordSearchListsManagementPanel.importButton.text=Import List
 KeywordSearchPanel.searchBox.text=Search...
 KeywordSearchPanel.regExCheckboxMenuItem.text=Use Regular Expressions
 KeywordSearchPanel.settingsLabel.text=
 KeywordSearchListsViewerPanel.searchAddButton.text=Search
 KeywordSearchListsViewerPanel.manageListsButton.text=Manage Lists
-KeywordSearchIngestSimplePanel.jLabel1.text=Select lists to use during ingest:
+KeywordSearchIngestSimplePanel.jLabel1.text=Select keyword lists to enable during ingest:
 KeywordSearchListsViewerPanel.ingestIndexLabel.text=Files Indexed:
 KeywordSearchEditListPanel.selectorsCombo.toolTipText=Regular Expression selector type (optional)
 KeywordSearchPanel.searchButton.text=
@@ -48,18 +48,19 @@ ExtractedContentPanel.pageOfLabel.text=of
 ExtractedContentPanel.pageCurLabel.text=-
 ExtractedContentPanel.pageTotalLabel.text=-
 ExtractedContentPanel.hitLabel.toolTipText=
-KeywordSearchEditListPanel.ingestMessagesCheckbox.text=Send messages to inbox during ingest
+KeywordSearchEditListPanel.ingestMessagesCheckbox.text=Enable sending messages to inbox during ingest
 KeywordSearchEditListPanel.ingestMessagesCheckbox.toolTipText=Send messages during triage / ingest when hits on keyword from this list occur
-KeywordSearchConfigurationPanel2.skipNSRLCheckBox.text=Do not add files in NSRL (known files) to keyword index
+KeywordSearchConfigurationPanel2.skipNSRLCheckBox.text=Do not add files in NSRL (known files) to keyword index during ingest
 KeywordSearchConfigurationPanel2.skipNSRLCheckBox.toolTipText=Requires Hash DB service to had run previously, or be selected for next ingest.
 KeywordSearchConfigurationPanel2.filesIndexedValue.text=-
 KeywordSearchConfigurationPanel2.filesIndexedLabel.text=Files in keyword index:
-KeywordSearchIngestSimplePanel.languagesLabel.text=Scripts to extract from unknown file types (in Advanced settings):
+KeywordSearchIngestSimplePanel.languagesLabel.text=Scripts enabled for string extraction from unknown file types:
 KeywordSearchIngestSimplePanel.languagesValLabel.text=-
-KeywordSearchIngestSimplePanel.languagesLabel.toolTipText=
+KeywordSearchIngestSimplePanel.languagesLabel.toolTipText=Scripts enabled for string extraction from unknown file types. Changes can be done in Advanced Settings.
 KeywordSearchIngestSimplePanel.languagesValLabel.toolTipText=
-KeywordSearchConfigurationPanel3.languagesLabel.text=Scripts to extract from unknown file types (change will be effective on next ingest):
+KeywordSearchConfigurationPanel3.languagesLabel.text=Enabled scripts (languages):
 KeywordSearchConfigurationPanel2.chunksLabel.text=Chunks in keyword index:
 KeywordSearchConfigurationPanel2.chunksValLabel.text=-
-KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text=Extract UTF8 text from unknown file types
-KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text=Extract UTF16LE and UTF16BE text from unknown file types
+KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text=Enable UTF8 text extraction
+KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text=Enable UTF16LE and UTF16BE string extraction
+KeywordSearchConfigurationPanel3.jLabel1.text=Ingest settings for string extraction from unknown file types (changes effective on next ingest)
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.form b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.form
index 86ecd6f394..c7507a5657 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.form
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.form
@@ -37,7 +37,7 @@
                       </Group>
                   </Group>
               </Group>
-              <EmptySpace pref="147" max="32767" attributes="0"/>
+              <EmptySpace pref="81" max="32767" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.java
index 289e2307ee..3b51d3933e 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel2.java
@@ -117,7 +117,7 @@ public class KeywordSearchConfigurationPanel2 extends javax.swing.JPanel {
                         .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
                             .addComponent(filesIndexedValue, javax.swing.GroupLayout.DEFAULT_SIZE, 104, Short.MAX_VALUE)
                             .addComponent(chunksValLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))))
-                .addContainerGap(147, Short.MAX_VALUE))
+                .addContainerGap(81, Short.MAX_VALUE))
         );
         layout.setVerticalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form
index ac45ee21e8..040d51dc49 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.form
@@ -16,13 +16,18 @@
   <Layout>
     <DimensionLayout dim="0">
       <Group type="103" groupAlignment="0" attributes="0">
-          <Group type="102" alignment="0" attributes="0">
-              <EmptySpace max="-2" attributes="0"/>
-              <Group type="103" groupAlignment="0" max="-2" attributes="0">
-                  <Component id="langPanel" max="32767" attributes="0"/>
-                  <Component id="enableUTF16Checkbox" min="-2" max="-2" attributes="0"/>
-                  <Component id="languagesLabel" alignment="0" max="32767" attributes="0"/>
-                  <Component id="enableUTF8Checkbox" alignment="0" min="-2" max="-2" attributes="0"/>
+          <Group type="102" attributes="0">
+              <Group type="103" groupAlignment="0" attributes="0">
+                  <Group type="102" alignment="0" attributes="0">
+                      <EmptySpace max="-2" attributes="0"/>
+                      <Group type="103" groupAlignment="0" max="-2" attributes="0">
+                          <Component id="langPanel" max="32767" attributes="0"/>
+                          <Component id="enableUTF16Checkbox" min="-2" max="-2" attributes="0"/>
+                          <Component id="languagesLabel" alignment="0" max="32767" attributes="0"/>
+                          <Component id="enableUTF8Checkbox" alignment="0" min="-2" max="-2" attributes="0"/>
+                      </Group>
+                  </Group>
+                  <Component id="jLabel1" alignment="0" min="-2" max="-2" attributes="0"/>
               </Group>
               <EmptySpace min="0" pref="0" max="32767" attributes="0"/>
           </Group>
@@ -31,14 +36,17 @@
     <DimensionLayout dim="1">
       <Group type="103" groupAlignment="0" attributes="0">
           <Group type="102" alignment="0" attributes="0">
-              <EmptySpace min="-2" max="-2" attributes="0"/>
+              <EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
+              <Component id="jLabel1" min="-2" max="-2" attributes="0"/>
+              <EmptySpace type="unrelated" max="-2" attributes="0"/>
               <Component id="enableUTF16Checkbox" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
               <Component id="enableUTF8Checkbox" min="-2" max="-2" attributes="0"/>
-              <EmptySpace type="unrelated" max="-2" attributes="0"/>
+              <EmptySpace min="-2" pref="4" max="-2" attributes="0"/>
               <Component id="languagesLabel" min="-2" max="-2" attributes="0"/>
               <EmptySpace max="-2" attributes="0"/>
-              <Component id="langPanel" max="32767" attributes="0"/>
+              <Component id="langPanel" min="-2" pref="346" max="-2" attributes="0"/>
+              <EmptySpace max="-2" attributes="0"/>
           </Group>
       </Group>
     </DimensionLayout>
@@ -102,5 +110,12 @@
         <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="enableUTF16CheckboxActionPerformed"/>
       </Events>
     </Component>
+    <Component class="javax.swing.JLabel" name="jLabel1">
+      <Properties>
+        <Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
+          <ResourceString bundle="org/sleuthkit/autopsy/keywordsearch/Bundle.properties" key="KeywordSearchConfigurationPanel3.jLabel1.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
+        </Property>
+      </Properties>
+    </Component>
   </SubComponents>
 </Form>
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java
index 1197712370..6864bb41f8 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchConfigurationPanel3.java
@@ -165,6 +165,7 @@ public class KeywordSearchConfigurationPanel3 extends javax.swing.JPanel {
         checkPanel = new javax.swing.JPanel();
         enableUTF8Checkbox = new javax.swing.JCheckBox();
         enableUTF16Checkbox = new javax.swing.JCheckBox();
+        jLabel1 = new javax.swing.JLabel();
 
         org.openide.awt.Mnemonics.setLocalizedText(languagesLabel, org.openide.util.NbBundle.getMessage(KeywordSearchConfigurationPanel3.class, "KeywordSearchConfigurationPanel3.languagesLabel.text")); // NOI18N
 
@@ -199,30 +200,38 @@ public class KeywordSearchConfigurationPanel3 extends javax.swing.JPanel {
             }
         });
 
+        org.openide.awt.Mnemonics.setLocalizedText(jLabel1, org.openide.util.NbBundle.getMessage(KeywordSearchConfigurationPanel3.class, "KeywordSearchConfigurationPanel3.jLabel1.text")); // NOI18N
+
         javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
         this.setLayout(layout);
         layout.setHorizontalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
             .addGroup(layout.createSequentialGroup()
-                .addContainerGap()
-                .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
-                    .addComponent(langPanel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                    .addComponent(enableUTF16Checkbox)
-                    .addComponent(languagesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                    .addComponent(enableUTF8Checkbox))
+                .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
+                    .addGroup(layout.createSequentialGroup()
+                        .addContainerGap()
+                        .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING, false)
+                            .addComponent(langPanel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                            .addComponent(enableUTF16Checkbox)
+                            .addComponent(languagesLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                            .addComponent(enableUTF8Checkbox)))
+                    .addComponent(jLabel1))
                 .addGap(0, 0, Short.MAX_VALUE))
         );
         layout.setVerticalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
             .addGroup(layout.createSequentialGroup()
-                .addContainerGap()
+                .addGap(4, 4, 4)
+                .addComponent(jLabel1)
+                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
                 .addComponent(enableUTF16Checkbox)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
                 .addComponent(enableUTF8Checkbox)
-                .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
+                .addGap(4, 4, 4)
                 .addComponent(languagesLabel)
                 .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
-                .addComponent(langPanel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
+                .addComponent(langPanel, javax.swing.GroupLayout.PREFERRED_SIZE, 346, javax.swing.GroupLayout.PREFERRED_SIZE)
+                .addContainerGap())
         );
     }// </editor-fold>//GEN-END:initComponents
 
@@ -253,6 +262,7 @@ public class KeywordSearchConfigurationPanel3 extends javax.swing.JPanel {
     private javax.swing.JPanel checkPanel;
     private javax.swing.JCheckBox enableUTF16Checkbox;
     private javax.swing.JCheckBox enableUTF8Checkbox;
+    private javax.swing.JLabel jLabel1;
     private javax.swing.JScrollPane langPanel;
     private javax.swing.JLabel languagesLabel;
     // End of variables declaration//GEN-END:variables
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchEditListPanel.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchEditListPanel.java
index 2c0c46aa8e..8f245f29c6 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchEditListPanel.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchEditListPanel.java
@@ -587,9 +587,15 @@ class KeywordSearchEditListPanel extends javax.swing.JPanel implements ListSelec
     }//GEN-LAST:event_saveListButtonActionPerformed
 
     private void deleteWordButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_deleteWordButtonActionPerformed
+        if (KeywordSearchUtil.displayConfirmDialog("Removing a keyword"
+                , "This will remove a keyword from the list globally (for all Cases). "
+                + "Do you want to proceed? "
+                , KeywordSearchUtil.DIALOG_MESSAGE_TYPE.WARN) ) {
+        
         tableModel.deleteSelected(keywordTable.getSelectedRows());
         KeywordSearchListsXML.getCurrent().addList(currentKeywordList);
         initButtons();
+        }
     }//GEN-LAST:event_deleteWordButtonActionPerformed
 
     private void addWordFieldActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_addWordFieldActionPerformed
@@ -638,17 +644,24 @@ class KeywordSearchEditListPanel extends javax.swing.JPanel implements ListSelec
             final KeywordSearchListsXML exporter = new KeywordSearchListsXML(fileAbs);
             boolean written = exporter.writeLists(toWrite);
             if (written) {
-                KeywordSearchUtil.displayDialog(FEATURE_NAME, "Keyword lists exported", KeywordSearchUtil.DIALOG_MESSAGE_TYPE.INFO);
+                KeywordSearchUtil.displayDialog(FEATURE_NAME, "Keyword lists exported",
+                        KeywordSearchUtil.DIALOG_MESSAGE_TYPE.INFO);
             }
         }
     }//GEN-LAST:event_exportButtonActionPerformed
 
     private void deleteListButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_deleteListButtonActionPerformed
+        if (KeywordSearchUtil.displayConfirmDialog("Delete a keyword list"
+                , "This will delete the keyword list globally (for all Cases). "
+                + "Do you want to proceed with the deletion? "
+                , KeywordSearchUtil.DIALOG_MESSAGE_TYPE.WARN) ) {
+        
         KeywordSearchListsXML deleter = KeywordSearchListsXML.getCurrent();
         String toDelete = currentKeywordList.getName();
         currentKeywordList = null;
         initButtons();
         deleter.deleteList(toDelete);
+        }
     }//GEN-LAST:event_deleteListButtonActionPerformed
 
     private void chRegexActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_chRegexActionPerformed
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.form b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.form
index 6f8099b415..9ffe987310 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.form
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.form
@@ -33,7 +33,7 @@
                           </Group>
                           <Group type="102" attributes="0">
                               <Component id="languagesLabel" min="-2" max="-2" attributes="0"/>
-                              <EmptySpace min="0" pref="5" max="32767" attributes="0"/>
+                              <EmptySpace min="0" pref="0" max="32767" attributes="0"/>
                           </Group>
                       </Group>
                       <EmptySpace max="-2" attributes="0"/>
diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.java
index 507c80526e..42f1396948 100644
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestSimplePanel.java
@@ -128,7 +128,7 @@ public class KeywordSearchIngestSimplePanel extends javax.swing.JPanel {
                                 .addComponent(languagesValLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
                             .addGroup(layout.createSequentialGroup()
                                 .addComponent(languagesLabel)
-                                .addGap(0, 5, Short.MAX_VALUE)))
+                                .addGap(0, 0, Short.MAX_VALUE)))
                         .addContainerGap())
                     .addGroup(layout.createSequentialGroup()
                         .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)

From aa5099fcd336b8065d2c565f0d11bb7b1290bc1b Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 13:25:40 -0400
Subject: [PATCH 12/19] disable solr log writing in release build

---
 .../autopsy/keywordsearch/Server.java         | 26 ++++++++++---------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java
index a6e7fcf1eb..a38df445f8 100755
--- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java
+++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java
@@ -211,14 +211,16 @@ class Server {
         public void run() {
             InputStreamReader isr = new InputStreamReader(stream);
             BufferedReader br = new BufferedReader(isr);
+            final Version.Type builtType = Version.getBuildType();
             try {
                 OutputStreamWriter osw = new OutputStreamWriter(out, PlatformUtil.getDefaultPlatformCharset());
                 BufferedWriter bw = new BufferedWriter(osw);
                 String line = null;
                 while (doRun && (line = br.readLine()) != null) {
-                    bw.write(line);
-                    bw.newLine();
-                    if (Version.getBuildType() == Version.Type.DEVELOPMENT) {
+                    if (builtType == Version.Type.DEVELOPMENT) {
+                        bw.write(line);
+                        bw.newLine();
+                    //if (builtType == Version.Type.DEVELOPMENT) {
                         //flush buffers if dev version for debugging
                         bw.flush();
                     }
@@ -397,11 +399,11 @@ class Server {
 
         return currentCore.queryNumIndexedFiles();
     }
-    
-     /**
-     * Execute query that gets only number of all Solr file chunks (not logical files) indexed without
-     * actually returning the content. 
-     * 
+
+    /**
+     * Execute query that gets only number of all Solr file chunks (not logical
+     * files) indexed without actually returning the content.
+     *
      * @return int representing number of indexed chunks
      * @throws SolrServerException
      */
@@ -675,10 +677,10 @@ class Server {
         private int queryNumIndexedFiles() throws SolrServerException {
             return queryNumIndexedDocuments() - queryNumIndexedChunks();
         }
-        
-         /**
-         * Execute query that gets only number of all chunks (not logical files, or all documents)
-         * indexed without actually returning the content
+
+        /**
+         * Execute query that gets only number of all chunks (not logical files,
+         * or all documents) indexed without actually returning the content
          *
          * @return int representing number of indexed chunks
          * @throws SolrServerException

From 50573ff29f912afe3b49ba066e5f9c63e9a652de Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 13:45:22 -0400
Subject: [PATCH 13/19] hashdb wording changes in config

---
 .../org/sleuthkit/autopsy/hashdatabase/Bundle.properties  | 6 +++---
 .../autopsy/hashdatabase/HashDbManagementPanel.form       | 2 +-
 .../autopsy/hashdatabase/HashDbManagementPanel.java       | 8 +++++++-
 .../sleuthkit/autopsy/hashdatabase/HashDbSimplePanel.java | 6 +++---
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties
index 65bb2d8c31..7cc2c481e8 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties
@@ -7,7 +7,7 @@ HashDbSimplePanel.knownValLabel.text=-
 HashDbSimplePanel.notableValLabel.text=-
 HashDbMgmtPanel.addNotableButton.text=Add Known Bad Database
 HashDbMgmtPanel.removeNotableButton.text=Remove Selected
-HashDbSimplePanel.jLabel1.text=Select known bad databases to use during ingest:
+HashDbSimplePanel.jLabel1.text=Enable known bad databases for ingest:
 HashDbMgmtPanel.nsrlNameLabel.text=Not Configured
 HashDbMgmtPanel.setNSRLButton.text=Change
 HashDbMgmtPanel.jLabel1.text=Known Bad Database(s):
@@ -20,8 +20,8 @@ HashDbManagementPanel.hashDbNameLabel.text=No database selected
 HashDbManagementPanel.locationLabel.text=Location:
 HashDbManagementPanel.hashDbLocationLabel.text=No database selected
 HashDbManagementPanel.deleteButton.text=Delete
-HashDbManagementPanel.useForIngestCheckbox.text=Use during ingest
-HashDbManagementPanel.showInboxMessagesCheckBox.text=Send messages to inbox during ingest
+HashDbManagementPanel.useForIngestCheckbox.text=Enable for ingest
+HashDbManagementPanel.showInboxMessagesCheckBox.text=Enable sending messages to inbox during ingest
 HashDbManagementPanel.indexLabel.text=Index Status:
 HashDbManagementPanel.indexButton.text=Index
 HashDbManagementPanel.ingestRunningLabel.text=
diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.form b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.form
index c9ee4dc675..0d9daa6e96 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.form
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.form
@@ -152,7 +152,7 @@
                           </Group>
                           <Group type="102" alignment="1" attributes="0">
                               <Component id="showInboxMessagesCheckBox" min="-2" max="-2" attributes="0"/>
-                              <EmptySpace pref="21" max="32767" attributes="0"/>
+                              <EmptySpace pref="16" max="32767" attributes="0"/>
                               <Component id="deleteButton" min="-2" max="-2" attributes="0"/>
                           </Group>
                       </Group>
diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java
index 96af55fb92..5aa051a0ac 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java
@@ -303,7 +303,7 @@ public class HashDbManagementPanel extends javax.swing.JPanel {
                         .addGap(0, 0, Short.MAX_VALUE))
                     .addGroup(rightPanelLayout.createSequentialGroup()
                         .addComponent(showInboxMessagesCheckBox)
-                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 21, Short.MAX_VALUE)
+                        .addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, 16, Short.MAX_VALUE)
                         .addComponent(deleteButton)))
                 .addContainerGap())
         );
@@ -353,6 +353,11 @@ public class HashDbManagementPanel extends javax.swing.JPanel {
     }// </editor-fold>//GEN-END:initComponents
 
     private void deleteButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_deleteButtonActionPerformed
+        if (JOptionPane.showConfirmDialog(null, "This will remove a hash database entry globally (for all Cases).",
+                "Deleting a Hash Database Entry", 
+                JOptionPane.YES_NO_OPTION, 
+                JOptionPane.WARNING_MESSAGE) == JOptionPane.YES_OPTION) {
+
         int selected = getSelection();
         HashDbXML xmlHandle = HashDbXML.getCurrent();
         if (xmlHandle.getNSRLSet() != null) {
@@ -365,6 +370,7 @@ public class HashDbManagementPanel extends javax.swing.JPanel {
             HashDbXML.getCurrent().removeKnownBadSetAt(selected);
         }
         hashSetTableModel.resync();
+        }
     }//GEN-LAST:event_deleteButtonActionPerformed
 
     private void hashSetTableKeyPressed(java.awt.event.KeyEvent evt) {//GEN-FIRST:event_hashSetTableKeyPressed
diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimplePanel.java b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimplePanel.java
index 9a64667bd0..74f1e35fc9 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimplePanel.java
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbSimplePanel.java
@@ -193,10 +193,10 @@ public class HashDbSimplePanel extends javax.swing.JPanel {
         nsrl = HashDbXML.getCurrent().getNSRLSet();
 
         if (nsrl == null || nsrl.getUseForIngest() == false) {
-            nsrlDbLabelVal.setText("Not Configured");
+            nsrlDbLabelVal.setText("Disabled");
         }
         else {
-            nsrlDbLabelVal.setText("Configured");
+            nsrlDbLabelVal.setText("Enabled");
         }
         
         reloadCalc();
@@ -231,7 +231,7 @@ public class HashDbSimplePanel extends javax.swing.JPanel {
                 if (columnIndex == 0) {
                     return "";
                 } else {
-                    return "Not Configured";
+                    return "Disabled";
                 }
             } else {
                 HashDb db = xmlHandle.getKnownBadSets().get(rowIndex);

From 56f6fedfd8413a3aac40b911f1616bee94336312 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 13:49:28 -0400
Subject: [PATCH 14/19] more hashdb wording changes

---
 .../sleuthkit/autopsy/hashdatabase/Bundle.properties  |  4 ++--
 .../autopsy/hashdatabase/HashDbAddDatabaseDialog.form |  5 ++++-
 .../autopsy/hashdatabase/HashDbAddDatabaseDialog.java | 11 ++++++++++-
 .../autopsy/hashdatabase/HashDbManagementPanel.java   |  2 +-
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties
index 7cc2c481e8..1246c408d4 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/Bundle.properties
@@ -37,8 +37,8 @@ HashDbAddDatabaseDialog.browseButton.text=Browse
 HashDbAddDatabaseDialog.jLabel1.text=Enter the name of the database:
 HashDbAddDatabaseDialog.databaseNameTextField.text=
 HashDbAddDatabaseDialog.jLabel2.text=Select the type of database:
-HashDbAddDatabaseDialog.useForIngestCheckbox.text=Use during ingest
-HashDbAddDatabaseDialog.sendInboxMessagesCheckbox.text=Send messages to inbox during ingest
+HashDbAddDatabaseDialog.useForIngestCheckbox.text=Enable for ingest
+HashDbAddDatabaseDialog.sendInboxMessagesCheckbox.text=Enable sending messages to inbox during ingest
 HashDbManagementPanel.importButton.text=Import
 HashDbSearchPanel.hashTable.columnModel.title0=MD5 Hashes
 HashDbSearchPanel.hashTable.columnModel.title3=Title 4
diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.form b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.form
index 4473a179b7..f336266aed 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.form
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.form
@@ -67,7 +67,7 @@
                           <Component id="useForIngestCheckbox" alignment="0" min="-2" max="-2" attributes="0"/>
                           <Component id="sendInboxMessagesCheckbox" alignment="0" min="-2" max="-2" attributes="0"/>
                       </Group>
-                      <EmptySpace min="0" pref="183" max="32767" attributes="0"/>
+                      <EmptySpace min="0" pref="135" max="32767" attributes="0"/>
                   </Group>
               </Group>
           </Group>
@@ -199,6 +199,9 @@
           <ResourceString bundle="org/sleuthkit/autopsy/hashdatabase/Bundle.properties" key="HashDbAddDatabaseDialog.useForIngestCheckbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
         </Property>
       </Properties>
+      <Events>
+        <EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="useForIngestCheckboxActionPerformed"/>
+      </Events>
     </Component>
     <Component class="javax.swing.JCheckBox" name="sendInboxMessagesCheckbox">
       <Properties>
diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.java b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.java
index a6f2bcf595..fde152a6a2 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.java
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbAddDatabaseDialog.java
@@ -131,6 +131,11 @@ class HashDbAddDatabaseDialog extends javax.swing.JDialog {
 
         useForIngestCheckbox.setSelected(true);
         org.openide.awt.Mnemonics.setLocalizedText(useForIngestCheckbox, org.openide.util.NbBundle.getMessage(HashDbAddDatabaseDialog.class, "HashDbAddDatabaseDialog.useForIngestCheckbox.text")); // NOI18N
+        useForIngestCheckbox.addActionListener(new java.awt.event.ActionListener() {
+            public void actionPerformed(java.awt.event.ActionEvent evt) {
+                useForIngestCheckboxActionPerformed(evt);
+            }
+        });
 
         sendInboxMessagesCheckbox.setSelected(true);
         org.openide.awt.Mnemonics.setLocalizedText(sendInboxMessagesCheckbox, org.openide.util.NbBundle.getMessage(HashDbAddDatabaseDialog.class, "HashDbAddDatabaseDialog.sendInboxMessagesCheckbox.text")); // NOI18N
@@ -171,7 +176,7 @@ class HashDbAddDatabaseDialog extends javax.swing.JDialog {
                         .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
                             .addComponent(useForIngestCheckbox)
                             .addComponent(sendInboxMessagesCheckbox))
-                        .addGap(0, 183, Short.MAX_VALUE))))
+                        .addGap(0, 135, Short.MAX_VALUE))))
         );
         layout.setVerticalGroup(
             layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@@ -293,6 +298,10 @@ class HashDbAddDatabaseDialog extends javax.swing.JDialog {
         this.dispose();
     }//GEN-LAST:event_okButtonActionPerformed
 
+    private void useForIngestCheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_useForIngestCheckboxActionPerformed
+        // TODO add your handling code here:
+    }//GEN-LAST:event_useForIngestCheckboxActionPerformed
+
     // Variables declaration - do not modify//GEN-BEGIN:variables
     private javax.swing.JButton browseButton;
     private javax.swing.ButtonGroup buttonGroup1;
diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java
index 5aa051a0ac..523ceeaf37 100644
--- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java
+++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbManagementPanel.java
@@ -353,7 +353,7 @@ public class HashDbManagementPanel extends javax.swing.JPanel {
     }// </editor-fold>//GEN-END:initComponents
 
     private void deleteButtonActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_deleteButtonActionPerformed
-        if (JOptionPane.showConfirmDialog(null, "This will remove a hash database entry globally (for all Cases).",
+        if (JOptionPane.showConfirmDialog(null, "This will remove the hash database entry globally (for all Cases).",
                 "Deleting a Hash Database Entry", 
                 JOptionPane.YES_NO_OPTION, 
                 JOptionPane.WARNING_MESSAGE) == JOptionPane.YES_OPTION) {

From 97d2c353138243cd08706e2ea7fc858b7be2aa8d Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Thu, 13 Sep 2012 15:24:10 -0400
Subject: [PATCH 15/19] UPdated doc layout

---
 docs/doxygen/main.dox             | 12 ++++++------
 docs/doxygen/modContent.dox       |  2 +-
 docs/doxygen/modDev.dox           | 28 ++++++++++++++++++++++------
 docs/doxygen/modIngest.dox        |  8 ++++++++
 docs/doxygen/modReport.dox        |  8 +++++++-
 docs/doxygen/modResult.dox        |  2 +-
 docs/doxygen/platformConcepts.dox | 18 ++++++++++++++----
 docs/doxygen/workflow.dox         | 13 +------------
 8 files changed, 60 insertions(+), 31 deletions(-)

diff --git a/docs/doxygen/main.dox b/docs/doxygen/main.dox
index 2a79e1191e..932f4a2976 100644
--- a/docs/doxygen/main.dox
+++ b/docs/doxygen/main.dox
@@ -4,12 +4,12 @@
 Autopsy has been designed as a platform for open source tools besides just The Sleuth Kit.  This document is for developers who want to add functionality into Autopsy.  This could be in the form of enhancing the existing functionality or by making a module that plugs into it and you may distribute from your own site or push it back into the base distribution. 
 
 - \subpage workflow_page
-- \subpage platform_page (Basic concepts of framework and types of modules)
-- \subpage mod_dev_page (Developing modules:get dev env setup, getting sersvices, properties etc.)
-- \subpage mod_ingest_page (developing ingest modules)
-- \subpage mod_report_page (developing report modules)
-- \subpage mod_content_page (Developing content viewer modules)
-- \subpage mod_result_page (developing result viewers)
+- \subpage platform_page
+- \subpage mod_dev_page
+- \subpage mod_ingest_page
+- \subpage mod_report_page
+- \subpage mod_content_page
+- \subpage mod_result_page
 - \subpage regression_test_page 
 
 <!-- Note that Case still has lots of content in package.dox -->
diff --git a/docs/doxygen/modContent.dox b/docs/doxygen/modContent.dox
index 6c88394373..0ac4ca6833 100644
--- a/docs/doxygen/modContent.dox
+++ b/docs/doxygen/modContent.dox
@@ -5,7 +5,7 @@ Note that this needs cleanup and updating.  it has been copied from the CoreComp
 
 <h3>Creating a DataContentViewer</h3>
 
-DataContentTopComponent is the high-level window in the DataContent area.  Each instance of this loads up all instances of DataContentViewers that have been registered with the system. Example viewers include the strings and hexdump views.  If you want to make your own type of viewer, follow the steps below.  Note that the strings, hexdump, and image viewers come with Autopsy by default and can be used by all DataExplorers and DataResults. You only need to make a new DataContentViewer if these viewers do not satisfy your needs.
+DataContentTopComponent is the high-level window in the DataContent area.  Each instance of this loads up all instances of DataContentViewers that have been registered with the system. Example viewers include the strings and hexdump views.  If you want to make your own type of viewer, follow the steps below.  
 
 <ol>
 <li>Create a module from within NetBeans.  It must be dependent on these modules:
diff --git a/docs/doxygen/modDev.dox b/docs/doxygen/modDev.dox
index 2147ffd98d..6d25dc5ee4 100644
--- a/docs/doxygen/modDev.dox
+++ b/docs/doxygen/modDev.dox
@@ -1,12 +1,28 @@
-/*! \page mod_dev_page Developing Module Overview 
+/*! \page mod_dev_page Development Overview 
 
-How to get dev env setup (platform, etc.)
+<!-- @@@ Update -->
 
-How to get access to services and what services exist.
+\section mod_dev_setup Basic Setup
 
-How to set properties, etc.
+what do they need to download and configure to develop modules?  Refer to BUILDING.txt as much as possible. Do they need to download source to develop modules or can they use a releae version?
 
-What to listen for:
-- case updates, etc.
+\section mod_dev_module How to Create a Module
+
+Steps to make a module (Netbeans menu options, adding in Autopsy as a platform, etc.
+
+\section mod_dev_services Getting Access to Services
+
+List the services and how to get access to them. Currently, I can think of Case, Loging, IngestManager.... The class description for each service class should have the details.
+
+\section mod_dev_properties Saving Settings and Properties
+
+If a module needs to have options and properties, how should they store them and get themsevles setup in the options viewer.
+
+\section mod_dev_events Registering for events
+
+What events hsould modules register for..  I'm not sure what goes in here with the new design.  
+- Case Updates?
+
+We also need to sync this up with \ref ingestmodule_events.
 
 */
diff --git a/docs/doxygen/modIngest.dox b/docs/doxygen/modIngest.dox
index 5aa107b512..61b766f34c 100644
--- a/docs/doxygen/modIngest.dox
+++ b/docs/doxygen/modIngest.dox
@@ -82,6 +82,9 @@ Dropped in module will be automatically recognized next time Autopsy starts.
 
 \subsection ingestmodule_making_results Posting Results
 
+<!-- @@@ -->
+NOTE: This needs to be made more in sync with the \ref platform_blackboard and \ref platform_inbox sections.  
+
 Users will see the results from ingest modules in one of two ways:
 - Results are posted to the blackboard and will be displayed in the navigation tree
 - Messages are sent to the Ingest Inbox to notify a user of what has recently been found. 
@@ -109,6 +112,9 @@ summarizing the module ingest run and if any errors were encountered.
 
 \subsection ingestmodule_making_configuration Module Configuration
 
+<!-- @@@ -->
+NOTE: Make sure we update this to reflect \ref mod_dev_properties and reduce duplicate comments.
+
 Ingest modules may require user configuration. The framework 
 supports two levels of configuration: run-time and general. Run-time configuration 
 occurs when the user selects which ingest modules to run when an image is added.  This level
@@ -136,6 +142,8 @@ methods should be used for general configuration.
 
 \section ingestmodule_events Getting Ingest Status and Events
 
+<!-- @@@ -->
+NOTE: Sync this up with \ref mod_dev_events.
 
 Other modules and core Autopsy classes may want to get the status of the ingest manager.  The IngestManager provides access to this data with the sleuthkit.autopsy.ingest.IngestManager.isIngestRunning() method.
 
diff --git a/docs/doxygen/modReport.dox b/docs/doxygen/modReport.dox
index 89cf46f9aa..e0c31d16da 100644
--- a/docs/doxygen/modReport.dox
+++ b/docs/doxygen/modReport.dox
@@ -1,6 +1,12 @@
 /*! \page mod_report_page Developing Report Modules
 
 
-How to write a report module.
+<!-- @@@ Cleanup -->
+Each reporting submodule implements org.sleuthkit.autopsy.report.ReportModule interface and registers itself in layer.xml
+
+Reporting submodule typically interacts with 3 components:
+- org.sleuthkit.autopsy.report.ReportConfiguration - to read current reporting configuration set by the user,
+- Blackboard API in org.sleuthkit.datamodel.SleuthkitCase class - to traverse and read blackboard artifacts and attributes,
+- an API (possibly external/thirdparty API) to convert blackboard artifacts data structures to the desired reporting format.
 
 */
diff --git a/docs/doxygen/modResult.dox b/docs/doxygen/modResult.dox
index 04534f58b9..effa6cf436 100644
--- a/docs/doxygen/modResult.dox
+++ b/docs/doxygen/modResult.dox
@@ -3,7 +3,7 @@
 NOTE: This has been moved from a package-level description and needs cleanup.
 
 <h3>Creating a DataResultViewer</h3>
-<p>DataResultTopComponent is the high-level window in the DataResult area.  Each instance of this loads up all instances of DataResultViewers that have been registered with the system. Example viewers include the table and thumbnail views.  If you want to make your own type of viewer, follow the steps below.  Note that the table and thumbnail viewers come with Autopsy by default and can be used by all DataExplorers. 
+<p>DataResultTopComponent is the high-level window in the DataResult area.  Each instance of this loads up all instances of DataResultViewers that have been registered with the system. Example viewers include the table and thumbnail views.  If you want to make your own type of viewer, follow the steps below.  
 
 <ol>
 <li>Create a module from within NetBeans.  It must be dependent on these modules:
diff --git a/docs/doxygen/platformConcepts.dox b/docs/doxygen/platformConcepts.dox
index b38d65093b..ddc91f1e9c 100644
--- a/docs/doxygen/platformConcepts.dox
+++ b/docs/doxygen/platformConcepts.dox
@@ -1,10 +1,20 @@
-/*! \page platform_page Autopsy Platform Concepts
+/*! \page platform_page Platform Concepts
 
-What frameworks / modules exist and what each does. They have already been mentioned on the previous page, so this should just be a bullet list with links to other pages for more details.
+\section platform_basics Basic Concepts
 
-blackboard 
+- Central database
+- Ingest Modules that analyze data quickly and provide quick results
+- Single tree to browse for results
+- Framework to view sets of results with (table, thumbnail, etc.)
+- Framework to view file content (hex, strings, etc.)
 
-igest inbox
+\section platform_blackboard The Blackboard
+
+Provide some basic details, link to the C++ docs, and link to the Java API.
+
+\section platform_inbox Ingest Inbox
+
+Provide some details and API
 
 
 */
diff --git a/docs/doxygen/workflow.dox b/docs/doxygen/workflow.dox
index ac33b9a240..09a30f8abf 100644
--- a/docs/doxygen/workflow.dox
+++ b/docs/doxygen/workflow.dox
@@ -54,17 +54,6 @@ When ingest is complete, the user can generate reports.  There is a reporting fr
 \ref report_making for details on building a new report module. 
 
 
-<!--Each reporting submodule implements org.sleuthkit.autopsy.report.ReportModule interface and registers itself in layer.xml
-
-Reporting submodule typically interacts with 3 components:
-- org.sleuthkit.autopsy.report.ReportConfiguration - to read current reporting configuration set by the user,
-- Blackboard API in org.sleuthkit.datamodel.SleuthkitCase class - to traverse and read blackboard artifacts and attributes,
-- an API (possibly external/thirdparty API) to convert blackboard artifacts data structures to the desired reporting format.
-
-Please refer to report.dox and org.sleuthkit.autopsy.report package API documentation for more details on how to implement a custom reporting submodule.
--->
-
-
 
 <!-- @@@ MOVE THIS SOMEWHERE ELSE -- the directory tree package maybe??
 
@@ -79,7 +68,7 @@ and performs a final refresh of all viewer-supported data in the blackboard.
 Node content support capabilities are registered in the node's Lookup.
 -->
 
-<!-- This is too detailed for here, but maybe should be broken up and put into the sections on making a result viewer and such…
+<!-- @@@ This is too detailed for here, but maybe should be broken up and put into the sections on making a result viewer and such…
 
 \section design_data_flow Data Flow
 

From c7e7b19e990fdf6553e4d737068bf68d5a694347 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 15:35:26 -0400
Subject: [PATCH 16/19] add build type to about dialog

---
 .../src/org/sleuthkit/autopsy/corecomponents/Bundle.properties  | 2 +-
 .../autopsy/corecomponents/ProductInformationPanel.java         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties
index 5dc30152ef..0cf1621f2a 100644
--- a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties
+++ b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/Bundle.properties
@@ -50,7 +50,7 @@ DataResultTopComponent.numberMatchLabel.text=0
 
 
 # Product Information panel
-LBL_Description=<div style=\"font-size: 12pt; font-family: Verdana, 'Verdana CE',  Arial, 'Arial CE', 'Lucida Grande CE', lucida, 'Helvetica CE', sans-serif;\">\n    <b>Product Version:</b> {0} <br><b>Sleuth Kit Version:</b> {7} <br><b>Netbeans RCP Build:</b> {8} <br> <b>Java:</b> {1}; {2}<br> <b>System:</b> {3}; {4}; {5}<br><b>Userdir:</b> {6}</div>
+LBL_Description=<div style=\"font-size: 12pt; font-family: Verdana, 'Verdana CE',  Arial, 'Arial CE', 'Lucida Grande CE', lucida, 'Helvetica CE', sans-serif;\">\n    <b>Product Version:</b> {0} ({9}) <br><b>Sleuth Kit Version:</b> {7} <br><b>Netbeans RCP Build:</b> {8} <br> <b>Java:</b> {1}; {2}<br> <b>System:</b> {3}; {4}; {5}<br><b>Userdir:</b> {6}</div>
 Format_OperatingSystem_Value={0} version {1} running on {2}
 LBL_Copyright=<div style\="font-size\: 12pt; font-family\: Verdana, 'Verdana CE',  Arial, 'Arial CE', 'Lucida Grande CE', lucida, 'Helvetica CE', sans-serif; "> The Autopsy Forensic Browser is a graphical interface to the command line digital investigation analysis tools in The Sleuth Kit. <br> <br>Copyright &copy; 2003-2012. For more information, please visit: <a style\="color\: \#1E2A60;" href\="http\://www.sleuthkit.org">http\://www.sleuthkit.org</a>. </div>
 URL_ON_IMG=http://www.sleuthkit.org/
diff --git a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java
index c0268bac47..81a9f8cad1 100644
--- a/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java
+++ b/CoreComponents/src/org/sleuthkit/autopsy/corecomponents/ProductInformationPanel.java
@@ -54,7 +54,7 @@ class ProductInformationPanel extends JPanel implements HyperlinkListener {
         jLabel1.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
         description.setText(org.openide.util.NbBundle.getMessage(ProductInformationPanel.class,
                 "LBL_Description", new Object[]{getProductVersionValue(), getJavaValue(), getVMValue(),
-                    getOperatingSystemValue(), getEncodingValue(), getSystemLocaleValue(), getUserDirValue(), getSleuthKitVersionValue(), Version.getNetbeansBuild()}));
+                    getOperatingSystemValue(), getEncodingValue(), getSystemLocaleValue(), getUserDirValue(), getSleuthKitVersionValue(), Version.getNetbeansBuild(), Version.getBuildType().toString()}));
         description.addHyperlinkListener(this);
         copyright.addHyperlinkListener(this);
         copyright.setBackground(getBackground());

From f02eecae20120929133dccef88b5009813b97a7b Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 16:36:33 -0400
Subject: [PATCH 17/19] In dir tree dO not show expand button on volume node,
 if it has no fs children

---
 .../DirectoryTreeFilterChildren.java          | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/DirectoryTree/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterChildren.java b/DirectoryTree/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterChildren.java
index 4158ed02d6..5742a39c62 100644
--- a/DirectoryTree/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterChildren.java
+++ b/DirectoryTree/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeFilterChildren.java
@@ -28,9 +28,12 @@ import org.sleuthkit.autopsy.datamodel.DisplayableItemNode;
 import org.sleuthkit.autopsy.datamodel.DisplayableItemNodeVisitor;
 import org.sleuthkit.autopsy.datamodel.FileNode;
 import org.sleuthkit.autopsy.datamodel.LayoutFileNode;
+import org.sleuthkit.autopsy.datamodel.VolumeNode;
 import org.sleuthkit.datamodel.Content;
 import org.sleuthkit.datamodel.Directory;
+import org.sleuthkit.datamodel.LayoutFile;
 import org.sleuthkit.datamodel.TskException;
+import org.sleuthkit.datamodel.Volume;
 
 /**
  * This class wraps around nodes that are displayed in the directory tree and
@@ -82,6 +85,7 @@ class DirectoryTreeFilterChildren extends FilterNode.Children {
     /**
      * Don't show expansion button on leaves leaf: all children are (file) or
      * (directory named "." or "..")
+     *
      * @param node
      * @return whether node is a leaf
      */
@@ -104,6 +108,26 @@ class DirectoryTreeFilterChildren extends FilterNode.Children {
         return ret;
     }
 
+    private static boolean isLeafVolume(VolumeNode node) {
+        Volume vol = node.getLookup().lookup(Volume.class);
+        boolean ret = true;
+
+        try {
+            for (Content c : vol.getChildren()) {
+                if (! (c instanceof LayoutFile) ){
+                    ret = false;
+                    break;
+                }
+            }
+
+        } catch (TskException ex) {
+            Logger.getLogger(DirectoryTreeFilterChildren.class.getName())
+                    .log(Level.WARNING, "Error getting volume children", ex);
+            return false;
+        }
+        return ret;
+    }
+
     /**
      * Helper to ignore the '.' and '..' directories
      */
@@ -139,6 +163,11 @@ class DirectoryTreeFilterChildren extends FilterNode.Children {
         public Boolean visit(DirectoryNode dn) {
             return isLeafDirectory(dn);
         }
+
+        @Override
+        public Boolean visit(VolumeNode vn) {
+            return isLeafVolume(vn);
+        }
     }
 
     private static class ShowItemVisitor extends DisplayableItemNodeVisitor.Default<Boolean> {

From b111200164c319856282e25167aa5839e50cb0a6 Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Thu, 13 Sep 2012 17:19:30 -0400
Subject: [PATCH 18/19] update regression

---
 .../src/org/sleuthkit/autopsy/testing/RegressionTest.java       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Testing/test/qa-functional/src/org/sleuthkit/autopsy/testing/RegressionTest.java b/Testing/test/qa-functional/src/org/sleuthkit/autopsy/testing/RegressionTest.java
index 2f04461be3..c82429eab8 100644
--- a/Testing/test/qa-functional/src/org/sleuthkit/autopsy/testing/RegressionTest.java
+++ b/Testing/test/qa-functional/src/org/sleuthkit/autopsy/testing/RegressionTest.java
@@ -200,7 +200,7 @@ public class RegressionTest extends TestCase{
         jbo0.pushNoBlock();
         JFileChooserOperator jfco0 = new JFileChooserOperator();
         jfco0.chooseFile(words);
-        JCheckBoxOperator jcbo = new JCheckBoxOperator(jdo, "Use during ingest", 0);
+        JCheckBoxOperator jcbo = new JCheckBoxOperator(jdo, "Enable for ingest", 0);
         jcbo.doClick();
         JButtonOperator jbo2 = new JButtonOperator(jdo, "OK", 0);
         jbo2.pushNoBlock();

From 849ee5dd76437824196e20d4048cde45cc7722ca Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Fri, 14 Sep 2012 10:28:02 -0400
Subject: [PATCH 19/19] Updated NEWS

---
 NEWS.txt | 2 --
 1 file changed, 2 deletions(-)

diff --git a/NEWS.txt b/NEWS.txt
index d181b6a84b..d00163ec71 100644
--- a/NEWS.txt
+++ b/NEWS.txt
@@ -1,6 +1,4 @@
 3.0.0b5 (September 12, 2012)
-Funded by US Army Intelligence Center of Excellence (USAICoE):
-
 New features:
 - Added international string extraction from unknown file types.
 - Removed size limitations of large files for keyword searching.