From 84b9e7b0d8f8ffb1d86161a92cf765f1d630db13 Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Tue, 10 Jan 2017 18:08:31 -0500 Subject: [PATCH 1/4] Add ingest and case listeners to refresh to ImageNode --- .../autopsy/datamodel/ImageNode.java | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java index d4f2ce0e8e..aee8368831 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java @@ -19,6 +19,8 @@ package org.sleuthkit.autopsy.datamodel; import java.awt.event.ActionEvent; +import java.beans.PropertyChangeEvent; +import java.beans.PropertyChangeListener; import java.sql.ResultSet; import java.sql.SQLException; import java.util.ArrayList; @@ -27,6 +29,7 @@ import java.util.List; import java.util.logging.Level; import javax.swing.AbstractAction; import javax.swing.Action; +import org.openide.nodes.Children; import org.openide.nodes.Sheet; import org.openide.util.NbBundle; import org.openide.util.NbBundle.Messages; @@ -35,11 +38,14 @@ import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.directorytree.ExplorerNodeActionVisitor; import org.sleuthkit.autopsy.directorytree.FileSearchAction; import org.sleuthkit.autopsy.directorytree.NewWindowViewAction; +import org.sleuthkit.autopsy.ingest.IngestManager; +import org.sleuthkit.autopsy.ingest.ModuleContentEvent; import org.sleuthkit.autopsy.ingest.RunIngestModulesDialog; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Image; import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery; import org.sleuthkit.datamodel.TskCoreException; +import org.sleuthkit.datamodel.VirtualDirectory; /** * This class is used to represent the "Node" for the image. The children of @@ -71,6 +77,16 @@ public class ImageNode extends AbstractContentNode { String imgName = nameForImage(img); this.setDisplayName(imgName); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hard-drive-icon.jpg"); //NON-NLS + + // Listen for ingest events so that we can detect new added files (e.g. carved) + IngestManager.getInstance().addIngestModuleEventListener(pcl); + // Listen for case events so that we can detect when case is closed + Case.addPropertyChangeListener(pcl); + } + + private void removeListeners() { + IngestManager.getInstance().removeIngestModuleEventListener(pcl); + Case.removePropertyChangeListener(pcl); } /** @@ -199,4 +215,46 @@ public class ImageNode extends AbstractContentNode { public String getItemType() { return getClass().getName(); } + + private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> { + String eventType = evt.getPropertyName(); + + // See if the new file is a child of ours + if (eventType.equals(IngestManager.IngestModuleEvent.CONTENT_CHANGED.toString())) { + if ((evt.getOldValue() instanceof ModuleContentEvent) == false) { + return; + } + ModuleContentEvent moduleContentEvent = (ModuleContentEvent) evt.getOldValue(); + if ((moduleContentEvent.getSource() instanceof Content) == false) { + return; + } + Content newContent = (Content) moduleContentEvent.getSource(); + + try { + Content parent = newContent.getParent(); + if (parent != null) { + // Is this a new carved file? + if (parent.getName().equals(VirtualDirectory.NAME_CARVED)) { + // Was this new carved file produced from this image? + if (parent.getParent().getId() == getContent().getId()) { + Children children = getChildren(); + if (children != null) { + ((ContentChildren) children).refreshChildren(); + children.getNodesCount(); + } + } + } + } + } catch (TskCoreException ex) { + // Do nothing. + } + } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) { + if (evt.getNewValue() == null) { + // case was closed. Remove listeners so that we don't get called with a stale case handle + removeListeners(); + } + } + }; + + } From b6417cbdde1cffd92f7552c0c7aff17b008d3adb Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Wed, 11 Jan 2017 10:01:03 -0500 Subject: [PATCH 2/4] Add description to Experimental module --- .../autopsy/experimental/autoingest/Bundle.properties | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Experimental/src/org/sleuthkit/autopsy/experimental/autoingest/Bundle.properties b/Experimental/src/org/sleuthkit/autopsy/experimental/autoingest/Bundle.properties index c119e136dd..d5fa88092b 100644 --- a/Experimental/src/org/sleuthkit/autopsy/experimental/autoingest/Bundle.properties +++ b/Experimental/src/org/sleuthkit/autopsy/experimental/autoingest/Bundle.properties @@ -82,7 +82,13 @@ ConfirmationDialog.Exit=Exit ConfirmationDialog.DoNotExit=Do Not Exit ConfirmationDialog.ConfirmExit=All incomplete copy jobs will be cancelled. Are you sure? ConfirmationDialog.ConfirmExitHeader=Confirm Exit +OpenIDE-Module-Long-Description=\ + This module contains features that are being developed by Basis Technology and are not part of the default Autopsy distribution. \ + You can enable this module to use the new features. \ + The features should be stable, but their exact behavior and API are subject to change. \n\n\ + We make no guarantee that the API of this module will not change, so developers should be careful when relying on it. OpenIDE-Module-Name=Experimental +OpenIDE-Module-Short-Description=This module contains features that are being developed by Basis Technology and are not part of the default Autopsy distribution. ReviewModeCasePanel.bnRefresh.text=&Refresh ReviewModeCasePanel.bnOpen.text=&Open ReviewModeCasePanel.rbGroupLabel.text=Show Last 10: From 5b52aa2ac82a8120dcfdb4a6341605f440564c31 Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Wed, 11 Jan 2017 17:34:26 -0500 Subject: [PATCH 3/4] Add comments to ImageNode and VolumeNode PCLs --- .../sleuthkit/autopsy/datamodel/ImageNode.java | 16 +++++++++------- .../sleuthkit/autopsy/datamodel/VolumeNode.java | 4 ++++ 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java index aee8368831..8b2f3b9ae7 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ImageNode.java @@ -77,9 +77,9 @@ public class ImageNode extends AbstractContentNode { String imgName = nameForImage(img); this.setDisplayName(imgName); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/hard-drive-icon.jpg"); //NON-NLS - + // Listen for ingest events so that we can detect new added files (e.g. carved) - IngestManager.getInstance().addIngestModuleEventListener(pcl); + IngestManager.getInstance().addIngestModuleEventListener(pcl); // Listen for case events so that we can detect when case is closed Case.addPropertyChangeListener(pcl); } @@ -101,8 +101,6 @@ public class ImageNode extends AbstractContentNode { "ImageNode.getActions.openFileSearchByAttr.text=Open File Search by Attributes",}) public Action[] getActions(boolean context) { - - List actionsList = new ArrayList(); for (Action a : super.getActions(true)) { actionsList.add(a); @@ -215,7 +213,12 @@ public class ImageNode extends AbstractContentNode { public String getItemType() { return getClass().getName(); } - + + /* + * This property change listener refreshes the tree when a new file is + * carved out of this image (i.e, the image is being treated as raw bytes + * and was ingested by the RawDSProcessor). + */ private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> { String eventType = evt.getPropertyName(); @@ -255,6 +258,5 @@ public class ImageNode extends AbstractContentNode { } } }; - - + } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/VolumeNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/VolumeNode.java index 161a972743..ba37cd4f09 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/VolumeNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/VolumeNode.java @@ -80,6 +80,10 @@ public class VolumeNode extends AbstractContentNode { Case.removePropertyChangeListener(pcl); } + /* + * This property change listener refreshes the tree when a new file is + * carved out of the unallocated space of this volume. + */ private final PropertyChangeListener pcl = (PropertyChangeEvent evt) -> { String eventType = evt.getPropertyName(); From 2717163d021307ba926a9915206568bcfd3ce522 Mon Sep 17 00:00:00 2001 From: Brian Carrier Date: Wed, 18 Jan 2017 16:08:05 -0500 Subject: [PATCH 4/4] updated NEWS --- NEWS.txt | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/NEWS.txt b/NEWS.txt index 7a0c8cb200..daff4c1a7a 100644 --- a/NEWS.txt +++ b/NEWS.txt @@ -1,23 +1,17 @@ ---------------- VERSION 4.3.0 -------------- Improvements: -- Creation and analysis (e.g., keyword search) of virtual files for slack -space. -- A preloader in an Android device image does not prevent adding the image as -a data source (reading of secondary GPT tables supported). -- User can add data sources with no file systems or unsupported file systems -as "unallocated space image files" for carving, keyword search, etc. -- File extension mismatch analysis can be configured to check all file types, -all file types except text files, or only multimedia and executable files. -- Column order changes in table views are "sticky" for each type of tree view -item. -- Tree view has new file types by MIME type sub tree. -- User can bulk add list of keywords to a keyword list. +- Support for slack space on files (as separate virtual files) to enable keyword searching and other analysis. +- Simple mode for the file extension mismatch module that focuses on only only multimedia and executable files to reduce false positives. +- New view in tree that shows the MIME types. - Tagged items are highlighted in table views. -- Toolbar button for Image/Video Gallery -- New "Experimental" module (activate via Tools, Plugins) with auto ingest -feature. +- Ordering of columns is saved when user changes them. +- Support for Android devices with preloaders (uses backup GPT) +- Support for images with no file systems (all data is added as unallocated space) +- User can bulk add list of keywords to a keyword list. +- New "Experimental" module (activate via Tools, Plugins) with auto ingest feature. - Assorted bug fixes and minor enhancements. + ---------------- VERSION 4.2.0 -------------- Improvements: - Credit card account search.