Merge branch 'release-4.3.0'

Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java

@@ -19,6 +19,8 @@
 package org.sleuthkit.autopsy.datamodel;
 
 import java.awt.event.ActionEvent;
+import java.beans.PropertyChangeEvent;
+import java.beans.PropertyChangeListener;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.ArrayList;
@@ -27,6 +29,7 @@ import java.util.List;
 import java.util.logging.Level;
 import javax.swing.AbstractAction;
 import javax.swing.Action;
+import org.openide.nodes.Children;
 import org.openide.nodes.Sheet;
 import org.openide.util.NbBundle;
 import org.openide.util.NbBundle.Messages;
@@ -35,11 +38,14 @@ import org.sleuthkit.autopsy.coreutils.Logger;
 import org.sleuthkit.autopsy.directorytree.ExplorerNodeActionVisitor;
 import org.sleuthkit.autopsy.directorytree.FileSearchAction;
 import org.sleuthkit.autopsy.directorytree.NewWindowViewAction;
+import org.sleuthkit.autopsy.ingest.IngestManager;
+import org.sleuthkit.autopsy.ingest.ModuleContentEvent;
 import org.sleuthkit.autopsy.ingest.RunIngestModulesDialog;
 import org.sleuthkit.datamodel.Content;
 import org.sleuthkit.datamodel.Image;
 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
 import org.sleuthkit.datamodel.TskCoreException;
+import org.sleuthkit.datamodel.VirtualDirectory;
 
 /**
  * This class is used to represent the "Node" for the image. The children of
@@ -71,6 +77,16 @@ public class ImageNode extends AbstractContentNode<Image> {
         String imgName = nameForImage(img);
         this.setDisplayName(imgName);
         this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hard-drive-icon.jpg"); //NON-NLS
+
+        // Listen for ingest events so that we can detect new added files (e.g. carved)
+        IngestManager.getInstance().addIngestModuleEventListener(pcl);
+        // Listen for case events so that we can detect when case is closed
+        Case.addPropertyChangeListener(pcl);
+    }
+
+    private void removeListeners() {
+        IngestManager.getInstance().removeIngestModuleEventListener(pcl);
+        Case.removePropertyChangeListener(pcl);
     }
 
     /**
@@ -85,8 +101,6 @@ public class ImageNode extends AbstractContentNode<Image> {
         "ImageNode.getActions.openFileSearchByAttr.text=Open File Search by Attributes",})
     public Action[] getActions(boolean context) {
 
-        
-
         List<Action> actionsList = new ArrayList<Action>();
         for (Action a : super.getActions(true)) {
             actionsList.add(a);
@@ -199,4 +213,50 @@ public class ImageNode extends AbstractContentNode<Image> {
     public String getItemType() {
         return getClass().getName();
     }
+
+    /*
+     * This property change listener refreshes the tree when a new file is
+     * carved out of this image (i.e, the image is being treated as raw bytes
+     * and was ingested by the RawDSProcessor).
+     */
+    private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
+        String eventType = evt.getPropertyName();
+
+        // See if the new file is a child of ours
+        if (eventType.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) {
+            if ((evt.getOldValue() instanceof ModuleContentEvent) == false) {
+                return;
+            }
+            ModuleContentEvent moduleContentEvent = (ModuleContentEvent) evt.getOldValue();
+            if ((moduleContentEvent.getSource() instanceof Content) == false) {
+                return;
+            }
+            Content newContent = (Content) moduleContentEvent.getSource();
+
+            try {
+                Content parent = newContent.getParent();
+                if (parent != null) {
+                    // Is this a new carved file?
+                    if (parent.getName().equals(VirtualDirectory.NAME_CARVED)) {
+                        // Was this new carved file produced from this image?
+                        if (parent.getParent().getId() == getContent().getId()) {
+                            Children children = getChildren();
+                            if (children != null) {
+                                ((ContentChildren) children).refreshChildren();
+                                children.getNodesCount();
+                            }
+                        }
+                    }
+                }
+            } catch (TskCoreException ex) {
+                // Do nothing.
+            }
+        } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
+            if (evt.getNewValue() == null) {
+                // case was closed. Remove listeners so that we don't get called with a stale case handle
+                removeListeners();
+            }
+        }
+    };
+
 }

Core/src/org/sleuthkit/autopsy/datamodel/VolumeNode.java

@@ -80,6 +80,10 @@ public class VolumeNode extends AbstractContentNode<Volume> {
         Case.removePropertyChangeListener(pcl);
     }
 
+    /*
+     * This property change listener refreshes the tree when a new file is
+     * carved out of the unallocated space of this volume.
+     */
     private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> {
         String eventType = evt.getPropertyName();
 

Experimental/src/org/sleuthkit/autopsy/experimental/autoingest/Bundle.properties

@@ -82,7 +82,13 @@ ConfirmationDialog.Exit=Exit
 ConfirmationDialog.DoNotExit=Do Not Exit
 ConfirmationDialog.ConfirmExit=All incomplete copy jobs will be cancelled. Are you sure?
 ConfirmationDialog.ConfirmExitHeader=Confirm Exit
+OpenIDE-Module-Long-Description=\
+    This module contains features that are being developed by Basis Technology and are not part of the default Autopsy distribution.  \
+    You can enable this module to use the new features.  \
+    The features should be stable, but their exact behavior and API are subject to change.  \n\n\
+    We make no guarantee that the API of this module will not change, so developers should be careful when relying on it.
 OpenIDE-Module-Name=Experimental
+OpenIDE-Module-Short-Description=This module contains features that are being developed by Basis Technology and are not part of the default Autopsy distribution.
 ReviewModeCasePanel.bnRefresh.text=&Refresh
 ReviewModeCasePanel.bnOpen.text=&Open
 ReviewModeCasePanel.rbGroupLabel.text=Show Last 10:

NEWS.txt

@@ -1,23 +1,17 @@
 ---------------- VERSION 4.3.0  --------------
 Improvements:
-- Creation and analysis (e.g., keyword search) of virtual files for slack 
-space.
-- A preloader in an Android device image does not prevent adding the image as 
-a data source (reading of secondary GPT tables supported).
-- User can add data sources with no file systems or unsupported file systems 
-as "unallocated space image files" for carving, keyword search, etc.
-- File extension mismatch analysis can be configured to check all file types, 
-all file types except text files, or only multimedia and executable files.
-- Column order changes in table views are "sticky" for each type of tree view 
-item.
-- Tree view has new file types by MIME type sub tree.
-- User can bulk add list of keywords to a keyword list.
+- Support for slack space on files (as separate virtual files) to enable keyword searching and other analysis. 
+- Simple mode for the file extension mismatch module that focuses on only only multimedia and executable files to reduce false positives. 
+- New view in tree that shows the MIME types. 
 - Tagged items are highlighted in table views.
-- Toolbar button for Image/Video Gallery
-- New "Experimental" module (activate via Tools, Plugins) with auto ingest 
-feature.
+- Ordering of columns is saved when user changes them. 
+- Support for Android devices with preloaders (uses backup GPT)
+- Support for images with no file systems (all data is added as unallocated space)
+- User can bulk add list of keywords to a keyword list.
+- New "Experimental" module (activate via Tools, Plugins) with auto ingest feature.
 - Assorted bug fixes and minor enhancements. 
 
+
 ---------------- VERSION 4.2.0  --------------
 Improvements:
 - Credit card account search.