codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-08-31 16:33:52 +00:00
Code Issues Releases Wiki Activity

merge from develop

Browse Source
This commit is contained in:
Greg DiCristofaro
2021-09-09 11:10:06 -04:00
parent a2025d246b 882248b43e
commit 1049052d64
27 changed files with 232 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
Core/src/org/sleuthkit/autopsy/actions/AddBlackboardArtifactTagAction.java
View File

@@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2019 Basis Technology Corp.
* Copyright 2013-2021 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -29,6 +29,7 @@ import org.openide.windows.WindowManager;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datamodel.BlackboardArtifactItem;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.TagName;
@@ -46,6 +47,8 @@ import org.sleuthkit.datamodel.TskCoreException;
})
public class AddBlackboardArtifactTagAction extends AddTagAction {
private static final long serialVersionUID = 1L;
// This class is a singleton to support multi-selection of nodes, since
// org.openide.nodes.NodeOp.findActions(Node[] nodes) will only pick up an Action if every
// node in the array returns a reference to the same action object from Node.getActions(boolean).
@@ -82,8 +85,14 @@ public class AddBlackboardArtifactTagAction extends AddTagAction {
* invocation of addTag(), we don't want to tag the same
* BlackboardArtifact more than once, so we dedupe the
* BlackboardArtifacts by stuffing them into a HashSet.
*
* RC (9/8/21): The documentation does NOT say that lookupAll() can
* return duplicates. That would be very broken. What motivated this
* "de-duping" ?
*/
selectedArtifacts.addAll(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class));
for (BlackboardArtifactItem<?> item : Utilities.actionsGlobalContext().lookupAll(BlackboardArtifactItem.class)) {
selectedArtifacts.add(item.getTskContent());
}
} else {
for (Content content : getContentToTag()) {
if (content instanceof BlackboardArtifact) {
@@ -111,4 +120,10 @@ public class AddBlackboardArtifactTagAction extends AddTagAction {
}
}).start();
}
@Override
public Object clone() throws CloneNotSupportedException {
return super.clone();
}
}

30
Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java
View File

@@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2013-2020 Basis Technology Corp.
* Copyright 2013-2021 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -44,22 +44,29 @@ import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskData;
/**
* An abstract base class for Actions that allow users to tag SleuthKit data
* An abstract super class for Actions that allow users to tag Sleuth Kit data
* model objects.
*/
abstract class AddTagAction extends AbstractAction implements Presenter.Popup {
private static final long serialVersionUID = 1L;
private static final String NO_COMMENT = "";
private final Collection<Content> content = new HashSet<>();
private final Collection<Content> contentObjsToTag;
/**
* Constructs an instance of an abstract super class for Actions that allow
* users to tag Sleuth Kit data model objects.
*
* @param menuText The menu item text.
*/
AddTagAction(String menuText) {
super(menuText);
contentObjsToTag = new HashSet<>();
}
@Override
public JMenuItem getPopupPresenter() {
content.clear();
contentObjsToTag.clear();
return new TagMenu();
}
@@ -70,7 +77,7 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup {
* @return The specified content for this action.
*/
Collection<Content> getContentToTag() {
return Collections.unmodifiableCollection(content);
return Collections.unmodifiableCollection(contentObjsToTag);
}
/**
@@ -83,8 +90,8 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup {
* apply to the Content specified.
*/
public JMenuItem getMenuForContent(Collection<? extends Content> contentToTag) {
content.clear();
content.addAll(contentToTag);
contentObjsToTag.clear();
contentObjsToTag.addAll(contentToTag);
return new TagMenu();
}
@@ -111,6 +118,11 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup {
*/
abstract protected void addTag(TagName tagName, String comment);
@Override
public Object clone() throws CloneNotSupportedException {
return super.clone();
}
/**
* Instances of this class implement a context menu user interface for
* creating or selecting a tag name for a tag and specifying an optional tag
@@ -126,7 +138,7 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup {
super(getActionDisplayName());
// Get the current set of tag names.
Map<String, TagName> tagNamesMap = null;
Map<String, TagName> tagNamesMap;
List<String> standardTagNames = TagsManager.getStandardTagNames();
Map<String, JMenu> tagSetMenuMap = new HashMap<>();
List<JMenuItem> standardTagMenuitems = new ArrayList<>();
@@ -240,5 +252,7 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup {
return tagNameItem;
}
}
}

2
Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java
View File

@@ -656,7 +656,7 @@ public class IngestEventsListener {
}
// flag previously seen devices and communication accounts (emails, phones, etc)
if (flagPreviousItemsEnabled
if (flagPreviousItemsEnabled && !previousOccurrences.isEmpty()
&& (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.USBID_TYPE_ID
|| eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.ICCID_TYPE_ID
|| eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.IMEI_TYPE_ID

18
Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java
View File

@@ -121,14 +121,14 @@ public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter {
throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings");
}
@Override
public boolean isDataArtifactIngestModuleFactory() {
return true;
}
@Override
public DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) {
return new CentralRepoDataArtifactIngestModule();
}
// @Override
// public boolean isDataArtifactIngestModuleFactory() {
// return true;
// }
//
// @Override
// public DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) {
// return new CentralRepoDataArtifactIngestModule();
// }
}

2
Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsContentViewer.java
View File

@@ -132,7 +132,7 @@ public class AnalysisResultsContentViewer implements DataContentViewer {
return true;
}
TskContentItem contentItem = node.getLookup().lookup(TskContentItem.class);
TskContentItem<?> contentItem = node.getLookup().lookup(TskContentItem.class);
if (!Objects.isNull(contentItem)) {
Content content = contentItem.getTskContent();
try {

6
Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java
View File

@@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2021 Basis Technology Corp.
* Copyright 2021-2021 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -251,7 +251,7 @@ public class AnalysisResultsViewModel {
* selected in the content viewer and get the analyzed content
* as the source of the analysis results to display.
*/
selectedAnalysisResult = analysisResultItem.getAnalysisResult();
selectedAnalysisResult = analysisResultItem.getTskContent();
selectedObjectId = selectedAnalysisResult.getId();
analyzedContent = selectedAnalysisResult.getParent();
} else {
@@ -260,7 +260,7 @@ public class AnalysisResultsViewModel {
* an analysis result. Use it as the source of the analysis
* results to display.
*/
TskContentItem contentItem = node.getLookup().lookup(TskContentItem.class);
TskContentItem<?> contentItem = node.getLookup().lookup(TskContentItem.class);
analyzedContent = contentItem.getTskContent();
selectedObjectId = analyzedContent.getId();
}

2
Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties
View File

@@ -8,7 +8,7 @@ StringsContentPanel.selectAllMenuItem.text=Select All
StringsContentPanel.currentPageLabel.text_1=1
StringsContentPanel.copyMenuItem.text=Copy
StringsContentPanel.ofLabel.text_1=of
StringsContentPanel.totalPageLabel.text_1=100
StringsContentPanel.totalPageLabel.text_1=1000
StringsContentPanel.languageLabel.toolTipText=
StringsContentPanel.languageLabel.text=Script:
StringsContentPanel.languageCombo.toolTipText=Language to attempt when interpreting (extracting and decoding) strings from binary data

2
Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties-MERGED
View File

@@ -9,7 +9,7 @@ StringsContentPanel.selectAllMenuItem.text=Select All
StringsContentPanel.currentPageLabel.text_1=1
StringsContentPanel.copyMenuItem.text=Copy
StringsContentPanel.ofLabel.text_1=of
StringsContentPanel.totalPageLabel.text_1=100
StringsContentPanel.totalPageLabel.text_1=1000
StringsContentPanel.languageLabel.toolTipText=
StringsContentPanel.languageLabel.text=Script:
StringsContentPanel.languageCombo.toolTipText=Language to attempt when interpreting (extracting and decoding) strings from binary data

15
Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.form
View File

@@ -103,15 +103,6 @@
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties" key="StringsContentPanel.currentPageLabel.text_1" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[18, 25]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[7, 25]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[18, 25]"/>
</Property>
</Properties>
</Component>
<Component class="javax.swing.JSeparator" name="jSepMed2">
@@ -158,13 +149,13 @@
<ResourceString bundle="org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties" key="StringsContentPanel.totalPageLabel.text_1" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
<Property name="maximumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[21, 25]"/>
<Dimension value="[25, 25]"/>
</Property>
<Property name="minimumSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[21, 25]"/>
<Dimension value="[25, 25]"/>
</Property>
<Property name="preferredSize" type="java.awt.Dimension" editor="org.netbeans.beaninfo.editors.DimensionEditor">
<Dimension value="[21, 25]"/>
<Dimension value="[25, 25]"/>
</Property>
</Properties>
</Component>

35
Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.java
View File

@@ -95,12 +95,11 @@ public class StringsContentPanel extends javax.swing.JPanel {
currentPage = 1;
currentOffset = 0;
this.dataSource = null;
currentPageLabel.setText("");
currentPageLabel.setText("1");
totalPageLabel.setText("");
prevPageButton.setEnabled(false);
nextPageButton.setEnabled(false);
outputViewPane.setText(""); // reset the output view
setComponentsVisibility(false); // hides the components that not needed
}
/**
@@ -167,9 +166,6 @@ public class StringsContentPanel extends javax.swing.JPanel {
panelPageOfCount.add(jSepMed1);
currentPageLabel.setText(org.openide.util.NbBundle.getMessage(StringsContentPanel.class, "StringsContentPanel.currentPageLabel.text_1")); // NOI18N
currentPageLabel.setMaximumSize(new java.awt.Dimension(18, 25));
currentPageLabel.setMinimumSize(new java.awt.Dimension(7, 25));
currentPageLabel.setPreferredSize(new java.awt.Dimension(18, 25));
panelPageOfCount.add(currentPageLabel);
jSepMed2.setPreferredSize(new java.awt.Dimension(5, 0));
@@ -185,9 +181,9 @@ public class StringsContentPanel extends javax.swing.JPanel {
panelPageOfCount.add(jSepMed3);
totalPageLabel.setText(org.openide.util.NbBundle.getMessage(StringsContentPanel.class, "StringsContentPanel.totalPageLabel.text_1")); // NOI18N
totalPageLabel.setMaximumSize(new java.awt.Dimension(21, 25));
totalPageLabel.setMinimumSize(new java.awt.Dimension(21, 25));
totalPageLabel.setPreferredSize(new java.awt.Dimension(21, 25));
totalPageLabel.setMaximumSize(new java.awt.Dimension(25, 25));
totalPageLabel.setMinimumSize(new java.awt.Dimension(25, 25));
totalPageLabel.setPreferredSize(new java.awt.Dimension(25, 25));
panelPageOfCount.add(totalPageLabel);
jSepMed4.setPreferredSize(new java.awt.Dimension(5, 0));
@@ -409,24 +405,6 @@ public class StringsContentPanel extends javax.swing.JPanel {
worker.execute();
}
/**
* To set the visibility of specific components in this class.
*
* @param isVisible whether to show or hide the specific components
*/
private void setComponentsVisibility(boolean isVisible) {
currentPageLabel.setVisible(isVisible);
totalPageLabel.setVisible(isVisible);
ofLabel.setVisible(isVisible);
prevPageButton.setVisible(isVisible);
nextPageButton.setVisible(isVisible);
pageLabel.setVisible(isVisible);
pageLabel2.setVisible(isVisible);
goToPageTextField.setVisible(isVisible);
goToPageLabel.setVisible(isVisible);
languageCombo.setVisible(isVisible);
languageLabel.setVisible(isVisible);
}
/**
* Swingworker for getting the text from a content object.
@@ -509,9 +487,7 @@ public class StringsContentPanel extends javax.swing.JPanel {
int totalPage = Math.round((dataSource.getSize() - 1) / PAGE_LENGTH) + 1;
totalPageLabel.setText(Integer.toString(totalPage));
currentPageLabel.setText("1");
outputViewPane.setText(text); // set the output view
setComponentsVisibility(true); // shows the components that not needed
outputViewPane.moveCaretPosition(0);
setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
@@ -557,10 +533,7 @@ public class StringsContentPanel extends javax.swing.JPanel {
prevPageButton.setEnabled(false);
currentPage = 1;
totalPageLabel.setText("1");
currentPageLabel.setText("1");
outputViewPane.setText(text); // set the output view
setComponentsVisibility(true); // shows the components that not needed
outputViewPane.moveCaretPosition(0);
setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));

5
Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentNode.java
View File

@@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2019 Basis Technology Corp.
* Copyright 2012-2021 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@@ -39,7 +39,6 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeIns
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import org.sleuthkit.autopsy.corecomponents.DataResultViewerTable;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.AnalysisResult;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.Score;
@@ -102,7 +101,7 @@ public abstract class AbstractContentNode<T extends Content> extends ContentNode
* @param content Underlying Content instances
*/
AbstractContentNode(T content) {
this(content, Lookups.fixed(content, new TskContentItem(content)));
this(content, Lookups.fixed(content, new TskContentItem<>(content)));
}
/**

16
Core/src/org/sleuthkit/autopsy/datamodel/AnalysisResultItem.java
View File

@@ -22,30 +22,20 @@ import com.google.common.annotations.Beta;
import org.sleuthkit.datamodel.AnalysisResult;
/**
* An Autopsy Data Model item with an underlying analysis result Sleuth Kit Data
* An Autopsy Data Model item with an underlying AnalysisResult Sleuth Kit Data
* Model object.
*/
public class AnalysisResultItem extends TskContentItem {
public class AnalysisResultItem extends BlackboardArtifactItem<AnalysisResult> {
/**
* Constructs an Autopsy Data Model item with an underlying AnalysisResult
* Sleuth Kit Data Model object.
*
* @param analysisResult The analysis result.
* @param analysisResult The AnalysisResult object.
*/
@Beta
AnalysisResultItem(AnalysisResult analysisResult) {
super(analysisResult);
}
/**
* Gets the underlying analysis result.
*
* @return The analysis result.
*/
@Beta
public AnalysisResult getAnalysisResult() {
return (AnalysisResult) (getTskContent());
}
}

44
Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java Executable file
View File

@@ -0,0 +1,44 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2021-2021 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import com.google.common.annotations.Beta;
import org.sleuthkit.datamodel.BlackboardArtifact;
/**
* An abstract super class for an Autopsy Data Model item class with an
* underlying BlackboardArtifact Sleuth Kit Data Model object, i.e., a
* DataArtifact or an AnalysisResult.
*
* @param <T> The concrete BlackboardArtifact sub class type.
*/
public abstract class BlackboardArtifactItem<T extends BlackboardArtifact> extends TskContentItem<T> {
/**
* Constructs an Autopsy Data Model item with an underlying
* BlackboardArtifact Sleuth Kit Data Model object.
*
* @param blackboardArtifact The BlackboardArtifact object.
*/
@Beta
BlackboardArtifactItem(T blackboardArtifact) {
super(blackboardArtifact);
}
}

12
Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java
View File

@@ -395,18 +395,22 @@ public class BlackboardArtifactNode extends AbstractContentNode<BlackboardArtifa
*
* NOTE: The creation of an Autopsy Data Model independent of the
* NetBeans nodes is a work in progress. At the time this comment is
* being written, this object is only used by the analysis content
* viewer.
* being written, this object is only being used to indicate the item
* represented by this BlackboardArtifactNode.
*/
TskContentItem artifactItem;
BlackboardArtifactItem<?> artifactItem;
if (artifact instanceof AnalysisResult) {
artifactItem = new AnalysisResultItem((AnalysisResult) artifact);
} else {
artifactItem = new TskContentItem(artifact);
artifactItem = new DataArtifactItem((DataArtifact) artifact);
}
/*
* Create the Lookup.
*
* NOTE: For now, we are putting both the Autopsy Data Model item and
* the Sleuth Kit Data Model item in the Lookup so that code that is not
* aware of the new Autopsy Data Model will still function.
*/
if (content == null) {
return Lookups.fixed(artifact, artifactItem);

41
Core/src/org/sleuthkit/autopsy/datamodel/DataArtifactItem.java Executable file
View File

@@ -0,0 +1,41 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2021-2021 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.datamodel;
import com.google.common.annotations.Beta;
import org.sleuthkit.datamodel.DataArtifact;
/**
* An Autopsy Data Model item with an underlying DataArtifact Sleuth Kit Data
* Model object.
*/
public class DataArtifactItem extends BlackboardArtifactItem<DataArtifact> {
/**
* Constructs an Autopsy Data Model item with an underlying DataArtifact
* Sleuth Kit Data Model object.
*
* @param dataArtifact The DataArtifact object.
*/
@Beta
DataArtifactItem(DataArtifact dataArtifact) {
super(dataArtifact);
}
}

16
Core/src/org/sleuthkit/autopsy/datamodel/TskContentItem.java
View File

@@ -24,23 +24,25 @@ import org.sleuthkit.datamodel.Content;
/**
* An Autopsy Data Model item with an underlying Sleuth Kit Data Model object
* that implements the Sleuth Kit Data Model's Content interface.
*
* @param <T> The type of the underlying Sleuth Kit Data Model object.
*/
@Beta
public class TskContentItem {
public class TskContentItem<T extends Content> {
private final Content tskContent;
private final T content;
/**
* Constructs an Autopsy Data Model item with an underlying Sleuth Kit Data
* Model object that implements the Sleuth Kit Data Model's Content
* interface.
*
* @param content The underlying Sleuth Kit Data Model object.
* @param content The Sleuth Kit Data Model object.
*
*/
@Beta
TskContentItem(Content sleuthKitContent) {
this.tskContent = sleuthKitContent;
TskContentItem(T content) {
this.content = content;
}
/**
@@ -49,8 +51,8 @@ public class TskContentItem {
* @return The Sleuth Kit Data Model object.
*/
@Beta
public Content getTskContent() {
return tskContent;
public T getTskContent() {
return content;
}
}

6
Core/src/org/sleuthkit/autopsy/datamodel/utils/IconsUtil.java
View File

@@ -127,6 +127,12 @@ public final class IconsUtil {
imageFile = "gps-area.png"; //NON-NLS
} else if (typeID == ARTIFACT_TYPE.TSK_YARA_HIT.getTypeID()) {
imageFile = "yara_16.png"; //NON-NLS
} else if (typeID == ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID()) {
imageFile = "previously-seen.png"; //NON-NLS
} else if (typeID == ARTIFACT_TYPE.TSK_PREVIOUSLY_UNSEEN.getTypeID()) {
imageFile = "previously-unseen.png"; //NON-NLS
} else if (typeID == ARTIFACT_TYPE.TSK_PREVIOUSLY_NOTABLE.getTypeID()) {
imageFile = "red-circle-exclamation.png"; //NON-NLS
} else {
imageFile = "artifact-icon.png"; //NON-NLS
}

BIN
Core/src/org/sleuthkit/autopsy/images/previously-seen.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 6.3 KiB

BIN
Core/src/org/sleuthkit/autopsy/images/previously-unseen.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 6.5 KiB

8
Core/src/org/sleuthkit/autopsy/ingest/DataArtifactIngestPipeline.java
View File

@@ -44,10 +44,10 @@ final class DataArtifactIngestPipeline extends IngestTaskPipeline<DataArtifactIn
@Override
Optional<PipelineModule<DataArtifactIngestTask>> acceptModuleTemplate(IngestModuleTemplate template) {
Optional<IngestTaskPipeline.PipelineModule<DataArtifactIngestTask>> module = Optional.empty();
if (template.isDataArtifactIngestModuleTemplate()) {
DataArtifactIngestModule ingestModule = template.createDataArtifactIngestModule();
module = Optional.of(new DataArtifactIngestPipelineModule(ingestModule, template.getModuleName()));
}
// if (template.isDataArtifactIngestModuleTemplate()) {
// DataArtifactIngestModule ingestModule = template.createDataArtifactIngestModule();
// module = Optional.of(new DataArtifactIngestPipelineModule(ingestModule, template.getModuleName()));
// }
return module;
}

20
Core/src/org/sleuthkit/autopsy/ingest/IngestJobPipeline.java
View File

@@ -368,9 +368,9 @@ final class IngestJobPipeline {
if (template.isFileIngestModuleTemplate()) {
addModuleTemplateToSortingMap(javaFileModuleTemplates, jythonFileModuleTemplates, template);
}
if (template.isDataArtifactIngestModuleTemplate()) {
addModuleTemplateToSortingMap(javaArtifactModuleTemplates, jythonArtifactModuleTemplates, template);
}
// if (template.isDataArtifactIngestModuleTemplate()) {
// addModuleTemplateToSortingMap(javaArtifactModuleTemplates, jythonArtifactModuleTemplates, template);
// }
}
/**
@@ -616,13 +616,13 @@ final class IngestJobPipeline {
type = IngestModuleType.MULTIPLE;
}
}
if (moduleTemplate.isDataArtifactIngestModuleTemplate()) {
if (type == null) {
type = IngestModuleType.DATA_ARTIFACT;
} else {
type = IngestModuleType.MULTIPLE;
}
}
// if (moduleTemplate.isDataArtifactIngestModuleTemplate()) {
// if (type == null) {
// type = IngestModuleType.DATA_ARTIFACT;
// } else {
// type = IngestModuleType.MULTIPLE;
// }
// }
return type;
}

2
Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java
View File

@@ -318,7 +318,7 @@ public final class IngestJobSettings {
// Add modules that are going to be used for this ingest depending on type.
for (IngestModuleFactory moduleFactory : allModuleFactories) {
if (moduleFactory.isDataArtifactIngestModuleFactory() || ingestType.equals(IngestType.ALL_MODULES)) {
if (/*moduleFactory.isDataArtifactIngestModuleFactory() ||*/ ingestType.equals(IngestType.ALL_MODULES)) {
moduleFactories.add(moduleFactory);
} else if (this.ingestType.equals(IngestType.DATA_SOURCE_ONLY) && moduleFactory.isDataSourceIngestModuleFactory()) {
moduleFactories.add(moduleFactory);

14
Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactory.java
View File

@@ -228,7 +228,7 @@ public interface IngestModuleFactory {
*
* @return A file ingest module instance.
*/
default FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings ingestOptions) {
default FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings settings) {
throw new UnsupportedOperationException();
}
@@ -238,9 +238,9 @@ public interface IngestModuleFactory {
*
* @return True or false.
*/
default boolean isDataArtifactIngestModuleFactory() {
return false;
}
// default boolean isDataArtifactIngestModuleFactory() {
// return false;
// }
/**
* Creates a data artifact ingest module instance.
@@ -267,8 +267,8 @@ public interface IngestModuleFactory {
*
* @return A file ingest module instance.
*/
default DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) {
throw new UnsupportedOperationException();
}
// default DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) {
// throw new UnsupportedOperationException();
// }
}

12
Core/src/org/sleuthkit/autopsy/ingest/IngestModuleTemplate.java
View File

@@ -85,13 +85,13 @@ public final class IngestModuleTemplate {
return moduleFactory.createFileIngestModule(settings);
}
public boolean isDataArtifactIngestModuleTemplate() {
return moduleFactory.isDataArtifactIngestModuleFactory();
}
// public boolean isDataArtifactIngestModuleTemplate() {
// return moduleFactory.isDataArtifactIngestModuleFactory();
// }
public DataArtifactIngestModule createDataArtifactIngestModule() {
return moduleFactory.createDataArtifactIngestModule(settings);
}
// public DataArtifactIngestModule createDataArtifactIngestModule() {
// return moduleFactory.createDataArtifactIngestModule(settings);
// }
public void setEnabled(boolean enabled) {
this.enabled = enabled;

8
Core/src/org/sleuthkit/autopsy/modules/filetypeid/CustomFileTypesManager.java
View File

@@ -336,6 +336,14 @@ final class CustomFileTypesManager {
signatureList.add(new Signature(byteArray, 8L));
fileType = new FileType("application/x.android-hdb", signatureList);
autopsyDefinedFileTypes.add(fileType);
/**
* Add custom type for fixed-size VHDs.
*/
signatureList.clear();
signatureList.add(new Signature("conectix", 511L, false)); //NON-NLS
fileType = new FileType("application/x-vhd", signatureList); //NON-NLS
autopsyDefinedFileTypes.add(fileType);
} catch (IllegalArgumentException ex) {
/*

9
Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java
View File

@@ -394,6 +394,15 @@ public class HTMLReport implements TableReportModule {
case TSK_YARA_HIT:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/yara_16.png"); //NON-NLS
break;
case TSK_PREVIOUSLY_SEEN:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/previously-seen.png"); //NON-NLS
break;
case TSK_PREVIOUSLY_UNSEEN:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/previously-unseen.png"); //NON-NLS
break;
case TSK_PREVIOUSLY_NOTABLE:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/red-circle-exclamation.png"); //NON-NLS
break;
default:
logger.log(Level.WARNING, "useDataTypeIcon: unhandled artifact type = {0}", dataType); //NON-NLS
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/star.png"); //NON-NLS

18
thirdparty/rr-full/plugins/shellbags_xp.pl vendored
View File

@@ -37,9 +37,6 @@ package shellbags_xp;
use strict;
use Time::Local;
require 'shellitems.pl';
my %config = (hive => "NTUSER\.DAT",
hivemask => 32,
output => "report",
@@ -779,13 +776,13 @@ sub parseFolderEntry {
$str = substr($data,$ofs,length($data) - 30);
my $longname = (split(/\x00\x00/,$str,2))[0];
$longname =~ s/\x00//g;
$longname = $longname.chr 0x00;
if ($longname ne "") {
$item{name} = Utf16ToUtf8($longname);
}
else {
$item{name} = _Utf16ToUtf8($shortname);
$item{name} = Utf16ToUtf8($shortname);
}
return %item;
}
@@ -934,5 +931,14 @@ sub printData {
return @display;
}
#---------------------------------------------------------------------
# Utf16ToUtf8()
#---------------------------------------------------------------------
sub Utf16ToUtf8 {
my $str = $_[0];
Encode::from_to($str,'UTF-16LE','utf8');
my $str2 = Encode::decode_utf8($str);
return $str;
}
1;