codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-08-31 08:32:01 +00:00
Code Issues Releases Wiki Activity

857: Reconcile Unique Accounts with Credit Card Review

Browse Source 
- Added Account Instances
 - Use a orthogonal account_id as ID for Accounts, not an obj_id in tsk_objects
 - Addressed other review comments.
This commit is contained in:
Raman
2017-10-02 11:10:37 -04:00
parent e5db6a6d16
commit 236ff62a94
10 changed files with 52 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
InternalPythonModules/android/calllog.py
View File

@@ -48,7 +48,7 @@ from org.sleuthkit.datamodel import Account
import traceback
import general
deviceAccount = None
deviceAccountInstance = None
"""
Locates a variety of different call log databases, parses them, and populates the blackboard.
@@ -90,8 +90,8 @@ class CallLogAnalyzer(general.AndroidComponentAnalyzer):
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
deviceID = ds.getDeviceId()
global deviceAccount
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
global deviceAccountInstance
deviceAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
absFiles = fileManager.findFiles(dataSource, "logs.db")
absFiles.addAll(fileManager.findFiles(dataSource, "contacts.db"))
@@ -143,10 +143,10 @@ class CallLogAnalyzer(general.AndroidComponentAnalyzer):
artifact.addAttribute(BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, general.MODULE_NAME, name))
# Create an account
calllogAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.PHONE, number, general.MODULE_NAME, abstractFile);
calllogAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(Account.Type.PHONE, number, general.MODULE_NAME, abstractFile);
# create relationship between accounts
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [calllogAccount], artifact);
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccountInstance, [calllogAccount], artifact);
bbartifacts.append(artifact)

12
InternalPythonModules/android/contact.py
View File

@@ -46,7 +46,7 @@ from org.sleuthkit.datamodel import Account
import traceback
import general
deviceAccount = None
deviceAccountInstance = None
"""
Locates a variety of different contacts databases, parses them, and populates the blackboard.
@@ -64,8 +64,8 @@ class ContactAnalyzer(general.AndroidComponentAnalyzer):
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
deviceID = ds.getDeviceId()
global deviceAccount
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
global deviceAccountInstance
deviceAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
absFiles = fileManager.findFiles(dataSource, "contacts.db")
absFiles.addAll(fileManager.findFiles(dataSource, "contacts2.db"))
@@ -146,11 +146,11 @@ class ContactAnalyzer(general.AndroidComponentAnalyzer):
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, general.MODULE_NAME, data1))
acctType = Account.Type.EMAIL
# Create an account
contactAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(acctType, data1, general.MODULE_NAME, abstractFile);
# Create an account instance
contactAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(acctType, data1, general.MODULE_NAME, abstractFile);
# create relationship between accounts
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [contactAccount], artifact);
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccountInstance, [contactAccountInstance], artifact);
oldName = name

6
InternalPythonModules/android/tangomessage.py
View File

@@ -46,7 +46,7 @@ from org.sleuthkit.datamodel import Account
import traceback
import general
deviceAccount = None
deviceAccountInstance = None
"""
Locates database for the Tango app and adds info to blackboard.
@@ -63,8 +63,8 @@ class TangoMessageAnalyzer(general.AndroidComponentAnalyzer):
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
deviceID = ds.getDeviceId()
global deviceAccount
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
global deviceAccountInstance
deviceAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
absFiles = fileManager.findFiles(dataSource, "tc.db")
for abstractFile in absFiles:

10
InternalPythonModules/android/textmessage.py
View File

@@ -47,7 +47,7 @@ from org.sleuthkit.datamodel import Account
import traceback
import general
deviceAccount = None
deviceAccountInstance = None
"""
Finds database with SMS/MMS messages and adds them to blackboard.
@@ -65,8 +65,8 @@ class TextMessageAnalyzer(general.AndroidComponentAnalyzer):
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
deviceID = ds.getDeviceId()
global deviceAccount
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
global deviceAccountInstance
deviceAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
absFiles = fileManager.findFiles(dataSource, "mmssms.db")
for abstractFile in absFiles:
@@ -118,10 +118,10 @@ class TextMessageAnalyzer(general.AndroidComponentAnalyzer):
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, general.MODULE_NAME, "SMS Message"))
# Create an account
msgAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.PHONE, address, general.MODULE_NAME, abstractFile);
msgAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(Account.Type.PHONE, address, general.MODULE_NAME, abstractFile);
# create relationship between accounts
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [msgAccount], artifact);
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccountInstance, [msgAccountInstance], artifact);
bbartifacts.append(artifact)
try:

10
InternalPythonModules/android/wwfmessage.py
View File

@@ -44,7 +44,7 @@ import traceback
import general
wwfAccountType = None
deviceAccount = None
deviceAccountInstance = None
"""
Analyzes messages from Words With Friends
@@ -65,8 +65,8 @@ class WWFMessageAnalyzer(general.AndroidComponentAnalyzer):
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
deviceID = ds.getDeviceId()
global deviceAccount
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
global deviceAccountInstance
deviceAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
absFiles = fileManager.findFiles(dataSource, "WordsFramework")
for abstractFile in absFiles:
@@ -112,10 +112,10 @@ class WWFMessageAnalyzer(general.AndroidComponentAnalyzer):
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, general.MODULE_NAME, "Words With Friends Message"))
# Create an account
wwfAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(wwfAccountType, user_id, general.MODULE_NAME, abstractFile);
wwfAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountInstance(wwfAccountType, user_id, general.MODULE_NAME, abstractFile);
# create relationship between accounts
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [wwfAccount], artifact);
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccountInstance, [wwfAccountInstance], artifact);
try:
# index the artifact for keyword search