diff --git a/Core/src/org/sleuthkit/autopsy/actions/AddBlackboardArtifactTagAction.java b/Core/src/org/sleuthkit/autopsy/actions/AddBlackboardArtifactTagAction.java index 26d1c7a9bc..06a3e2e39e 100644 --- a/Core/src/org/sleuthkit/autopsy/actions/AddBlackboardArtifactTagAction.java +++ b/Core/src/org/sleuthkit/autopsy/actions/AddBlackboardArtifactTagAction.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2011-2019 Basis Technology Corp. + * Copyright 2013-2021 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -29,6 +29,7 @@ import org.openide.windows.WindowManager; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.datamodel.BlackboardArtifactItem; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.TagName; @@ -46,6 +47,8 @@ import org.sleuthkit.datamodel.TskCoreException; }) public class AddBlackboardArtifactTagAction extends AddTagAction { + private static final long serialVersionUID = 1L; + // This class is a singleton to support multi-selection of nodes, since // org.openide.nodes.NodeOp.findActions(Node[] nodes) will only pick up an Action if every // node in the array returns a reference to the same action object from Node.getActions(boolean). @@ -82,8 +85,14 @@ public class AddBlackboardArtifactTagAction extends AddTagAction { * invocation of addTag(), we don't want to tag the same * BlackboardArtifact more than once, so we dedupe the * BlackboardArtifacts by stuffing them into a HashSet. + * + * RC (9/8/21): The documentation does NOT say that lookupAll() can + * return duplicates. That would be very broken. What motivated this + * "de-duping" ? */ - selectedArtifacts.addAll(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class)); + for (BlackboardArtifactItem item : Utilities.actionsGlobalContext().lookupAll(BlackboardArtifactItem.class)) { + selectedArtifacts.add(item.getTskContent()); + } } else { for (Content content : getContentToTag()) { if (content instanceof BlackboardArtifact) { @@ -111,4 +120,10 @@ public class AddBlackboardArtifactTagAction extends AddTagAction { } }).start(); } + + @Override + public Object clone() throws CloneNotSupportedException { + return super.clone(); + } + } diff --git a/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java b/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java index 9c059205f5..ff3dc08e04 100644 --- a/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java +++ b/Core/src/org/sleuthkit/autopsy/actions/AddTagAction.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2013-2020 Basis Technology Corp. + * Copyright 2013-2021 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -44,22 +44,29 @@ import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskData; /** - * An abstract base class for Actions that allow users to tag SleuthKit data + * An abstract super class for Actions that allow users to tag Sleuth Kit data * model objects. */ abstract class AddTagAction extends AbstractAction implements Presenter.Popup { private static final long serialVersionUID = 1L; private static final String NO_COMMENT = ""; - private final Collection content = new HashSet<>(); + private final Collection contentObjsToTag; + /** + * Constructs an instance of an abstract super class for Actions that allow + * users to tag Sleuth Kit data model objects. + * + * @param menuText The menu item text. + */ AddTagAction(String menuText) { super(menuText); + contentObjsToTag = new HashSet<>(); } @Override public JMenuItem getPopupPresenter() { - content.clear(); + contentObjsToTag.clear(); return new TagMenu(); } @@ -70,7 +77,7 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup { * @return The specified content for this action. */ Collection getContentToTag() { - return Collections.unmodifiableCollection(content); + return Collections.unmodifiableCollection(contentObjsToTag); } /** @@ -83,8 +90,8 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup { * apply to the Content specified. */ public JMenuItem getMenuForContent(Collection contentToTag) { - content.clear(); - content.addAll(contentToTag); + contentObjsToTag.clear(); + contentObjsToTag.addAll(contentToTag); return new TagMenu(); } @@ -111,6 +118,11 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup { */ abstract protected void addTag(TagName tagName, String comment); + @Override + public Object clone() throws CloneNotSupportedException { + return super.clone(); + } + /** * Instances of this class implement a context menu user interface for * creating or selecting a tag name for a tag and specifying an optional tag @@ -126,7 +138,7 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup { super(getActionDisplayName()); // Get the current set of tag names. - Map tagNamesMap = null; + Map tagNamesMap; List standardTagNames = TagsManager.getStandardTagNames(); Map tagSetMenuMap = new HashMap<>(); List standardTagMenuitems = new ArrayList<>(); @@ -240,5 +252,7 @@ abstract class AddTagAction extends AbstractAction implements Presenter.Popup { return tagNameItem; } + } + } diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java index 09c02d52fe..1dad86dd90 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/eventlisteners/IngestEventsListener.java @@ -656,7 +656,7 @@ public class IngestEventsListener { } // flag previously seen devices and communication accounts (emails, phones, etc) - if (flagPreviousItemsEnabled + if (flagPreviousItemsEnabled && !previousOccurrences.isEmpty() && (eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.USBID_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.ICCID_TYPE_ID || eamArtifact.getCorrelationType().getId() == CorrelationAttributeInstance.IMEI_TYPE_ID diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java index 39c80abefc..22ce22f65f 100644 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/ingestmodule/CentralRepoIngestModuleFactory.java @@ -121,14 +121,14 @@ public class CentralRepoIngestModuleFactory extends IngestModuleFactoryAdapter { throw new IllegalArgumentException("Expected settings argument to be an instance of IngestSettings"); } - @Override - public boolean isDataArtifactIngestModuleFactory() { - return true; - } - - @Override - public DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) { - return new CentralRepoDataArtifactIngestModule(); - } +// @Override +// public boolean isDataArtifactIngestModuleFactory() { +// return true; +// } +// +// @Override +// public DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) { +// return new CentralRepoDataArtifactIngestModule(); +// } } diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsContentViewer.java b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsContentViewer.java index b056eb11db..d40f6c2a39 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsContentViewer.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsContentViewer.java @@ -132,7 +132,7 @@ public class AnalysisResultsContentViewer implements DataContentViewer { return true; } - TskContentItem contentItem = node.getLookup().lookup(TskContentItem.class); + TskContentItem contentItem = node.getLookup().lookup(TskContentItem.class); if (!Objects.isNull(contentItem)) { Content content = contentItem.getTskContent(); try { diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java index 37e4114168..b470f9dfb7 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/analysisresults/AnalysisResultsViewModel.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2021 Basis Technology Corp. + * Copyright 2021-2021 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -251,7 +251,7 @@ public class AnalysisResultsViewModel { * selected in the content viewer and get the analyzed content * as the source of the analysis results to display. */ - selectedAnalysisResult = analysisResultItem.getAnalysisResult(); + selectedAnalysisResult = analysisResultItem.getTskContent(); selectedObjectId = selectedAnalysisResult.getId(); analyzedContent = selectedAnalysisResult.getParent(); } else { @@ -260,7 +260,7 @@ public class AnalysisResultsViewModel { * an analysis result. Use it as the source of the analysis * results to display. */ - TskContentItem contentItem = node.getLookup().lookup(TskContentItem.class); + TskContentItem contentItem = node.getLookup().lookup(TskContentItem.class); analyzedContent = contentItem.getTskContent(); selectedObjectId = analyzedContent.getId(); } diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties index 341efff6d6..fb7c0f33cc 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties @@ -8,7 +8,7 @@ StringsContentPanel.selectAllMenuItem.text=Select All StringsContentPanel.currentPageLabel.text_1=1 StringsContentPanel.copyMenuItem.text=Copy StringsContentPanel.ofLabel.text_1=of -StringsContentPanel.totalPageLabel.text_1=100 +StringsContentPanel.totalPageLabel.text_1=1000 StringsContentPanel.languageLabel.toolTipText= StringsContentPanel.languageLabel.text=Script: StringsContentPanel.languageCombo.toolTipText=Language to attempt when interpreting (extracting and decoding) strings from binary data diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties-MERGED index 024103570d..c859dc8f33 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/Bundle.properties-MERGED @@ -9,7 +9,7 @@ StringsContentPanel.selectAllMenuItem.text=Select All StringsContentPanel.currentPageLabel.text_1=1 StringsContentPanel.copyMenuItem.text=Copy StringsContentPanel.ofLabel.text_1=of -StringsContentPanel.totalPageLabel.text_1=100 +StringsContentPanel.totalPageLabel.text_1=1000 StringsContentPanel.languageLabel.toolTipText= StringsContentPanel.languageLabel.text=Script: StringsContentPanel.languageCombo.toolTipText=Language to attempt when interpreting (extracting and decoding) strings from binary data diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.form b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.form index 6253570c82..6c579799b6 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.form +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.form @@ -103,15 +103,6 @@ - - - - - - - - - @@ -158,13 +149,13 @@ - + - + - + diff --git a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.java b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.java index 750f143e0e..e83dadadef 100644 --- a/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.java +++ b/Core/src/org/sleuthkit/autopsy/contentviewers/textcontentviewer/StringsContentPanel.java @@ -95,12 +95,11 @@ public class StringsContentPanel extends javax.swing.JPanel { currentPage = 1; currentOffset = 0; this.dataSource = null; - currentPageLabel.setText(""); + currentPageLabel.setText("1"); totalPageLabel.setText(""); prevPageButton.setEnabled(false); nextPageButton.setEnabled(false); outputViewPane.setText(""); // reset the output view - setComponentsVisibility(false); // hides the components that not needed } /** @@ -167,9 +166,6 @@ public class StringsContentPanel extends javax.swing.JPanel { panelPageOfCount.add(jSepMed1); currentPageLabel.setText(org.openide.util.NbBundle.getMessage(StringsContentPanel.class, "StringsContentPanel.currentPageLabel.text_1")); // NOI18N - currentPageLabel.setMaximumSize(new java.awt.Dimension(18, 25)); - currentPageLabel.setMinimumSize(new java.awt.Dimension(7, 25)); - currentPageLabel.setPreferredSize(new java.awt.Dimension(18, 25)); panelPageOfCount.add(currentPageLabel); jSepMed2.setPreferredSize(new java.awt.Dimension(5, 0)); @@ -185,9 +181,9 @@ public class StringsContentPanel extends javax.swing.JPanel { panelPageOfCount.add(jSepMed3); totalPageLabel.setText(org.openide.util.NbBundle.getMessage(StringsContentPanel.class, "StringsContentPanel.totalPageLabel.text_1")); // NOI18N - totalPageLabel.setMaximumSize(new java.awt.Dimension(21, 25)); - totalPageLabel.setMinimumSize(new java.awt.Dimension(21, 25)); - totalPageLabel.setPreferredSize(new java.awt.Dimension(21, 25)); + totalPageLabel.setMaximumSize(new java.awt.Dimension(25, 25)); + totalPageLabel.setMinimumSize(new java.awt.Dimension(25, 25)); + totalPageLabel.setPreferredSize(new java.awt.Dimension(25, 25)); panelPageOfCount.add(totalPageLabel); jSepMed4.setPreferredSize(new java.awt.Dimension(5, 0)); @@ -409,24 +405,6 @@ public class StringsContentPanel extends javax.swing.JPanel { worker.execute(); } - /** - * To set the visibility of specific components in this class. - * - * @param isVisible whether to show or hide the specific components - */ - private void setComponentsVisibility(boolean isVisible) { - currentPageLabel.setVisible(isVisible); - totalPageLabel.setVisible(isVisible); - ofLabel.setVisible(isVisible); - prevPageButton.setVisible(isVisible); - nextPageButton.setVisible(isVisible); - pageLabel.setVisible(isVisible); - pageLabel2.setVisible(isVisible); - goToPageTextField.setVisible(isVisible); - goToPageLabel.setVisible(isVisible); - languageCombo.setVisible(isVisible); - languageLabel.setVisible(isVisible); - } /** * Swingworker for getting the text from a content object. @@ -509,9 +487,7 @@ public class StringsContentPanel extends javax.swing.JPanel { int totalPage = Math.round((dataSource.getSize() - 1) / PAGE_LENGTH) + 1; totalPageLabel.setText(Integer.toString(totalPage)); - currentPageLabel.setText("1"); outputViewPane.setText(text); // set the output view - setComponentsVisibility(true); // shows the components that not needed outputViewPane.moveCaretPosition(0); setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR)); @@ -557,10 +533,7 @@ public class StringsContentPanel extends javax.swing.JPanel { prevPageButton.setEnabled(false); currentPage = 1; - totalPageLabel.setText("1"); - currentPageLabel.setText("1"); outputViewPane.setText(text); // set the output view - setComponentsVisibility(true); // shows the components that not needed outputViewPane.moveCaretPosition(0); setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR)); diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentNode.java index daf8cd84da..cb4bb9794c 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentNode.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2011-2019 Basis Technology Corp. + * Copyright 2012-2021 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -39,7 +39,6 @@ import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeIns import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type; import org.sleuthkit.autopsy.corecomponents.DataResultViewerTable; import org.sleuthkit.autopsy.coreutils.Logger; -import org.sleuthkit.datamodel.AnalysisResult; import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Score; @@ -102,7 +101,7 @@ public abstract class AbstractContentNode extends ContentNode * @param content Underlying Content instances */ AbstractContentNode(T content) { - this(content, Lookups.fixed(content, new TskContentItem(content))); + this(content, Lookups.fixed(content, new TskContentItem<>(content))); } /** diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/AnalysisResultItem.java b/Core/src/org/sleuthkit/autopsy/datamodel/AnalysisResultItem.java index 442d070f5c..20ee3652c0 100755 --- a/Core/src/org/sleuthkit/autopsy/datamodel/AnalysisResultItem.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/AnalysisResultItem.java @@ -22,30 +22,20 @@ import com.google.common.annotations.Beta; import org.sleuthkit.datamodel.AnalysisResult; /** - * An Autopsy Data Model item with an underlying analysis result Sleuth Kit Data + * An Autopsy Data Model item with an underlying AnalysisResult Sleuth Kit Data * Model object. */ -public class AnalysisResultItem extends TskContentItem { +public class AnalysisResultItem extends BlackboardArtifactItem { /** * Constructs an Autopsy Data Model item with an underlying AnalysisResult * Sleuth Kit Data Model object. * - * @param analysisResult The analysis result. + * @param analysisResult The AnalysisResult object. */ @Beta AnalysisResultItem(AnalysisResult analysisResult) { super(analysisResult); } - /** - * Gets the underlying analysis result. - * - * @return The analysis result. - */ - @Beta - public AnalysisResult getAnalysisResult() { - return (AnalysisResult) (getTskContent()); - } - } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java new file mode 100755 index 0000000000..8d4cab5ea5 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactItem.java @@ -0,0 +1,44 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2021-2021 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.datamodel; + +import com.google.common.annotations.Beta; +import org.sleuthkit.datamodel.BlackboardArtifact; + +/** + * An abstract super class for an Autopsy Data Model item class with an + * underlying BlackboardArtifact Sleuth Kit Data Model object, i.e., a + * DataArtifact or an AnalysisResult. + * + * @param The concrete BlackboardArtifact sub class type. + */ +public abstract class BlackboardArtifactItem extends TskContentItem { + + /** + * Constructs an Autopsy Data Model item with an underlying + * BlackboardArtifact Sleuth Kit Data Model object. + * + * @param blackboardArtifact The BlackboardArtifact object. + */ + @Beta + BlackboardArtifactItem(T blackboardArtifact) { + super(blackboardArtifact); + } + +} diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 32518ee40a..b368ca118c 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -395,18 +395,22 @@ public class BlackboardArtifactNode extends AbstractContentNode artifactItem; if (artifact instanceof AnalysisResult) { artifactItem = new AnalysisResultItem((AnalysisResult) artifact); } else { - artifactItem = new TskContentItem(artifact); + artifactItem = new DataArtifactItem((DataArtifact) artifact); } /* * Create the Lookup. + * + * NOTE: For now, we are putting both the Autopsy Data Model item and + * the Sleuth Kit Data Model item in the Lookup so that code that is not + * aware of the new Autopsy Data Model will still function. */ if (content == null) { return Lookups.fixed(artifact, artifactItem); diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DataArtifactItem.java b/Core/src/org/sleuthkit/autopsy/datamodel/DataArtifactItem.java new file mode 100755 index 0000000000..c43d3a311c --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/datamodel/DataArtifactItem.java @@ -0,0 +1,41 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2021-2021 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.datamodel; + +import com.google.common.annotations.Beta; +import org.sleuthkit.datamodel.DataArtifact; + +/** + * An Autopsy Data Model item with an underlying DataArtifact Sleuth Kit Data + * Model object. + */ +public class DataArtifactItem extends BlackboardArtifactItem { + + /** + * Constructs an Autopsy Data Model item with an underlying DataArtifact + * Sleuth Kit Data Model object. + * + * @param dataArtifact The DataArtifact object. + */ + @Beta + DataArtifactItem(DataArtifact dataArtifact) { + super(dataArtifact); + } + +} diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/TskContentItem.java b/Core/src/org/sleuthkit/autopsy/datamodel/TskContentItem.java index 999474cc1d..9113cf6b7c 100755 --- a/Core/src/org/sleuthkit/autopsy/datamodel/TskContentItem.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/TskContentItem.java @@ -24,23 +24,25 @@ import org.sleuthkit.datamodel.Content; /** * An Autopsy Data Model item with an underlying Sleuth Kit Data Model object * that implements the Sleuth Kit Data Model's Content interface. + * + * @param The type of the underlying Sleuth Kit Data Model object. */ @Beta -public class TskContentItem { +public class TskContentItem { - private final Content tskContent; + private final T content; /** * Constructs an Autopsy Data Model item with an underlying Sleuth Kit Data * Model object that implements the Sleuth Kit Data Model's Content * interface. * - * @param content The underlying Sleuth Kit Data Model object. + * @param content The Sleuth Kit Data Model object. * */ @Beta - TskContentItem(Content sleuthKitContent) { - this.tskContent = sleuthKitContent; + TskContentItem(T content) { + this.content = content; } /** @@ -49,8 +51,8 @@ public class TskContentItem { * @return The Sleuth Kit Data Model object. */ @Beta - public Content getTskContent() { - return tskContent; + public T getTskContent() { + return content; } } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/utils/IconsUtil.java b/Core/src/org/sleuthkit/autopsy/datamodel/utils/IconsUtil.java index de88e41e04..58bf8b26d2 100755 --- a/Core/src/org/sleuthkit/autopsy/datamodel/utils/IconsUtil.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/utils/IconsUtil.java @@ -127,6 +127,12 @@ public final class IconsUtil { imageFile = "gps-area.png"; //NON-NLS } else if (typeID == ARTIFACT_TYPE.TSK_YARA_HIT.getTypeID()) { imageFile = "yara_16.png"; //NON-NLS + } else if (typeID == ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID()) { + imageFile = "previously-seen.png"; //NON-NLS + } else if (typeID == ARTIFACT_TYPE.TSK_PREVIOUSLY_UNSEEN.getTypeID()) { + imageFile = "previously-unseen.png"; //NON-NLS + } else if (typeID == ARTIFACT_TYPE.TSK_PREVIOUSLY_NOTABLE.getTypeID()) { + imageFile = "red-circle-exclamation.png"; //NON-NLS } else { imageFile = "artifact-icon.png"; //NON-NLS } diff --git a/Core/src/org/sleuthkit/autopsy/images/previously-seen.png b/Core/src/org/sleuthkit/autopsy/images/previously-seen.png new file mode 100644 index 0000000000..1bd707232e Binary files /dev/null and b/Core/src/org/sleuthkit/autopsy/images/previously-seen.png differ diff --git a/Core/src/org/sleuthkit/autopsy/images/previously-unseen.png b/Core/src/org/sleuthkit/autopsy/images/previously-unseen.png new file mode 100644 index 0000000000..02fc8b5008 Binary files /dev/null and b/Core/src/org/sleuthkit/autopsy/images/previously-unseen.png differ diff --git a/Core/src/org/sleuthkit/autopsy/ingest/DataArtifactIngestPipeline.java b/Core/src/org/sleuthkit/autopsy/ingest/DataArtifactIngestPipeline.java index 824d7d7fe9..a25485a352 100755 --- a/Core/src/org/sleuthkit/autopsy/ingest/DataArtifactIngestPipeline.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/DataArtifactIngestPipeline.java @@ -44,10 +44,10 @@ final class DataArtifactIngestPipeline extends IngestTaskPipeline> acceptModuleTemplate(IngestModuleTemplate template) { Optional> module = Optional.empty(); - if (template.isDataArtifactIngestModuleTemplate()) { - DataArtifactIngestModule ingestModule = template.createDataArtifactIngestModule(); - module = Optional.of(new DataArtifactIngestPipelineModule(ingestModule, template.getModuleName())); - } +// if (template.isDataArtifactIngestModuleTemplate()) { +// DataArtifactIngestModule ingestModule = template.createDataArtifactIngestModule(); +// module = Optional.of(new DataArtifactIngestPipelineModule(ingestModule, template.getModuleName())); +// } return module; } diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobPipeline.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobPipeline.java index c68dde5911..bdaaa9f3a9 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobPipeline.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobPipeline.java @@ -368,9 +368,9 @@ final class IngestJobPipeline { if (template.isFileIngestModuleTemplate()) { addModuleTemplateToSortingMap(javaFileModuleTemplates, jythonFileModuleTemplates, template); } - if (template.isDataArtifactIngestModuleTemplate()) { - addModuleTemplateToSortingMap(javaArtifactModuleTemplates, jythonArtifactModuleTemplates, template); - } +// if (template.isDataArtifactIngestModuleTemplate()) { +// addModuleTemplateToSortingMap(javaArtifactModuleTemplates, jythonArtifactModuleTemplates, template); +// } } /** @@ -616,13 +616,13 @@ final class IngestJobPipeline { type = IngestModuleType.MULTIPLE; } } - if (moduleTemplate.isDataArtifactIngestModuleTemplate()) { - if (type == null) { - type = IngestModuleType.DATA_ARTIFACT; - } else { - type = IngestModuleType.MULTIPLE; - } - } +// if (moduleTemplate.isDataArtifactIngestModuleTemplate()) { +// if (type == null) { +// type = IngestModuleType.DATA_ARTIFACT; +// } else { +// type = IngestModuleType.MULTIPLE; +// } +// } return type; } diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java index 7de83ded4c..8f2db29849 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestJobSettings.java @@ -318,7 +318,7 @@ public final class IngestJobSettings { // Add modules that are going to be used for this ingest depending on type. for (IngestModuleFactory moduleFactory : allModuleFactories) { - if (moduleFactory.isDataArtifactIngestModuleFactory() || ingestType.equals(IngestType.ALL_MODULES)) { + if (/*moduleFactory.isDataArtifactIngestModuleFactory() ||*/ ingestType.equals(IngestType.ALL_MODULES)) { moduleFactories.add(moduleFactory); } else if (this.ingestType.equals(IngestType.DATA_SOURCE_ONLY) && moduleFactory.isDataSourceIngestModuleFactory()) { moduleFactories.add(moduleFactory); diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactory.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactory.java index e473086d18..15fb96eded 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactory.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleFactory.java @@ -228,7 +228,7 @@ public interface IngestModuleFactory { * * @return A file ingest module instance. */ - default FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings ingestOptions) { + default FileIngestModule createFileIngestModule(IngestModuleIngestJobSettings settings) { throw new UnsupportedOperationException(); } @@ -238,9 +238,9 @@ public interface IngestModuleFactory { * * @return True or false. */ - default boolean isDataArtifactIngestModuleFactory() { - return false; - } +// default boolean isDataArtifactIngestModuleFactory() { +// return false; +// } /** * Creates a data artifact ingest module instance. @@ -267,8 +267,8 @@ public interface IngestModuleFactory { * * @return A file ingest module instance. */ - default DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) { - throw new UnsupportedOperationException(); - } +// default DataArtifactIngestModule createDataArtifactIngestModule(IngestModuleIngestJobSettings settings) { +// throw new UnsupportedOperationException(); +// } } diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleTemplate.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleTemplate.java index 26285f6439..0bb947c1cd 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleTemplate.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestModuleTemplate.java @@ -85,13 +85,13 @@ public final class IngestModuleTemplate { return moduleFactory.createFileIngestModule(settings); } - public boolean isDataArtifactIngestModuleTemplate() { - return moduleFactory.isDataArtifactIngestModuleFactory(); - } +// public boolean isDataArtifactIngestModuleTemplate() { +// return moduleFactory.isDataArtifactIngestModuleFactory(); +// } - public DataArtifactIngestModule createDataArtifactIngestModule() { - return moduleFactory.createDataArtifactIngestModule(settings); - } +// public DataArtifactIngestModule createDataArtifactIngestModule() { +// return moduleFactory.createDataArtifactIngestModule(settings); +// } public void setEnabled(boolean enabled) { this.enabled = enabled; diff --git a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/CustomFileTypesManager.java b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/CustomFileTypesManager.java index 7175b3f023..57ce4c51b3 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/CustomFileTypesManager.java +++ b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/CustomFileTypesManager.java @@ -336,6 +336,14 @@ final class CustomFileTypesManager { signatureList.add(new Signature(byteArray, 8L)); fileType = new FileType("application/x.android-hdb", signatureList); autopsyDefinedFileTypes.add(fileType); + + /** + * Add custom type for fixed-size VHDs. + */ + signatureList.clear(); + signatureList.add(new Signature("conectix", 511L, false)); //NON-NLS + fileType = new FileType("application/x-vhd", signatureList); //NON-NLS + autopsyDefinedFileTypes.add(fileType); } catch (IllegalArgumentException ex) { /* diff --git a/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java b/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java index aa084d66f3..31323800b0 100644 --- a/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java +++ b/Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java @@ -394,6 +394,15 @@ public class HTMLReport implements TableReportModule { case TSK_YARA_HIT: in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/yara_16.png"); //NON-NLS break; + case TSK_PREVIOUSLY_SEEN: + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/previously-seen.png"); //NON-NLS + break; + case TSK_PREVIOUSLY_UNSEEN: + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/previously-unseen.png"); //NON-NLS + break; + case TSK_PREVIOUSLY_NOTABLE: + in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/red-circle-exclamation.png"); //NON-NLS + break; default: logger.log(Level.WARNING, "useDataTypeIcon: unhandled artifact type = {0}", dataType); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/star.png"); //NON-NLS diff --git a/thirdparty/rr-full/plugins/shellbags_xp.pl b/thirdparty/rr-full/plugins/shellbags_xp.pl index 4eaea3e58d..25082ea89b 100644 --- a/thirdparty/rr-full/plugins/shellbags_xp.pl +++ b/thirdparty/rr-full/plugins/shellbags_xp.pl @@ -37,9 +37,6 @@ package shellbags_xp; use strict; use Time::Local; -require 'shellitems.pl'; - - my %config = (hive => "NTUSER\.DAT", hivemask => 32, output => "report", @@ -779,13 +776,13 @@ sub parseFolderEntry { $str = substr($data,$ofs,length($data) - 30); my $longname = (split(/\x00\x00/,$str,2))[0]; - $longname =~ s/\x00//g; - + $longname = $longname.chr 0x00; + if ($longname ne "") { $item{name} = Utf16ToUtf8($longname); } else { - $item{name} = _Utf16ToUtf8($shortname); + $item{name} = Utf16ToUtf8($shortname); } return %item; } @@ -934,5 +931,14 @@ sub printData { return @display; } +#--------------------------------------------------------------------- +# Utf16ToUtf8() +#--------------------------------------------------------------------- +sub Utf16ToUtf8 { + my $str = $_[0]; + Encode::from_to($str,'UTF-16LE','utf8'); + my $str2 = Encode::decode_utf8($str); + return $str; +} 1;