Merge branch 'develop' of https://github.com/sleuthkit/autopsy into global_settings_python

pythonExamples/Aug2015DataSourceTutorial/FindContactsDb.py

@@ -0,0 +1,188 @@
+# Sample module in the public domain. Feel free to use this as a template
+# for your modules (and you can remove this header and take complete credit
+# and liability)
+#
+# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+
+# Simple data source-level ingest module for Autopsy.
+# Used as part of Python tutorials from Basis Technology - August 2015
+# 
+# Looks for files of a given name, opens then in SQLite, queries the DB,
+# and makes artifacts
+
+import jarray
+import inspect
+import os
+from java.lang import Class
+from java.lang import System
+from java.sql  import DriverManager, SQLException
+from java.util.logging import Level
+from java.io import File
+from org.sleuthkit.datamodel import SleuthkitCase
+from org.sleuthkit.datamodel import AbstractFile
+from org.sleuthkit.datamodel import ReadContentInputStream
+from org.sleuthkit.datamodel import BlackboardArtifact
+from org.sleuthkit.datamodel import BlackboardAttribute
+from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
+from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
+from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
+from org.sleuthkit.autopsy.ingest import IngestMessage
+from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.ingest import ModuleDataEvent
+from org.sleuthkit.autopsy.coreutils import Logger
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.casemodule.services import Services
+from org.sleuthkit.autopsy.casemodule.services import FileManager
+from org.sleuthkit.autopsy.datamodel import ContentUtils
+
+
+# Factory that defines the name and details of the module and allows Autopsy
+# to create instances of the modules that will do the analysis.
+class ContactsDbIngestModuleFactory(IngestModuleFactoryAdapter):
+
+    moduleName = "Contacts Db Analyzer"
+
+    def getModuleDisplayName(self):
+        return self.moduleName
+
+    def getModuleDescription(self):
+        return "Sample module that parses contacts.db"
+
+    def getModuleVersionNumber(self):
+        return "1.0"
+
+    def isDataSourceIngestModuleFactory(self):
+        return True
+
+    def createDataSourceIngestModule(self, ingestOptions):
+        return ContactsDbIngestModule()
+
+
+# Data Source-level ingest module.  One gets created per data source.
+class ContactsDbIngestModule(DataSourceIngestModule):
+
+    _logger = Logger.getLogger(ContactsDbIngestModuleFactory.moduleName)
+
+    def log(self, level, msg):
+        self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
+
+    def __init__(self):
+        self.context = None
+
+    # Where any setup and configuration is done
+    # 'context' is an instance of org.sleuthkit.autopsy.ingest.IngestJobContext.
+    # See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1ingest_1_1_ingest_job_context.html
+    def startUp(self, context):
+        self.context = context
+        # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
+        # raise IngestModuleException("Oh No!")
+
+    # Where the analysis is done.
+    # The 'dataSource' object being passed in is of type org.sleuthkit.datamodel.Content.
+    # See: http://www.sleuthkit.org/sleuthkit/docs/jni-docs/interfaceorg_1_1sleuthkit_1_1datamodel_1_1_content.html
+    # 'progressBar' is of type org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress
+    # See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1ingest_1_1_data_source_ingest_module_progress.html
+    def process(self, dataSource, progressBar):
+        
+        # we don't know how much work there is yet
+        progressBar.switchToIndeterminate()
+        
+        # Find files named contacts.db, regardless of parent path
+        fileManager = Case.getCurrentCase().getServices().getFileManager()
+        files = fileManager.findFiles(dataSource, "contacts.db")
+
+        numFiles = len(files)
+        progressBar.switchToDeterminate(numFiles)
+        fileCount = 0;
+        for file in files:
+
+            # Check if the user pressed cancel while we were busy
+            if self.context.isJobCancelled():
+                return IngestModule.ProcessResult.OK
+
+            self.log(Level.INFO, "Processing file: " + file.getName())
+            fileCount += 1
+
+            # Save the DB locally in the temp folder. use file id as name to reduce collisions
+            lclDbPath = os.path.join(Case.getCurrentCase().getTempDirectory(), str(file.getId()) + ".db")
+            ContentUtils.writeToFile(file, File(lclDbPath))
+                        
+            # Open the DB using JDBC
+            try: 
+                Class.forName("org.sqlite.JDBC").newInstance()
+                dbConn = DriverManager.getConnection("jdbc:sqlite:%s"  % lclDbPath)
+            except SQLException as e:
+                self.log(Level.INFO, "Could not open database file (not SQLite) " + file.getName() + " (" + e.getMessage() + ")")
+                return IngestModule.ProcessResult.OK
+            
+            # Query the contacts table in the database and get all columns. 
+            try:
+                stmt = dbConn.createStatement()
+                resultSet = stmt.executeQuery("SELECT * FROM contacts")
+            except SQLException as e:
+                self.log(Level.INFO, "Error querying database for contacts table (" + e.getMessage() + ")")
+                return IngestModule.ProcessResult.OK
+
+            # Cycle through each row and create artifacts
+            while resultSet.next():
+                try: 
+                    name  = resultSet.getString("name")
+                    email = resultSet.getString("email")
+                    phone = resultSet.getString("phone")
+                except SQLException as e:
+                    self.log(Level.INFO, "Error getting values from contacts table (" + e.getMessage() + ")")
+                
+                
+                # Make an artifact on the blackboard, TSK_CONTACT and give it attributes for each of the fields
+                art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT)
+                
+                art.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON.getTypeID(), 
+                    ContactsDbIngestModuleFactory.moduleName, name))
+                
+                art.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL.getTypeID(), 
+                    ContactsDbIngestModuleFactory.moduleName, email))
+
+                art.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER.getTypeID(), 
+                    ContactsDbIngestModuleFactory.moduleName, phone))
+                
+            # Fire an event to notify the UI and others that there are new artifacts  
+            IngestServices.getInstance().fireModuleDataEvent(
+                ModuleDataEvent(ContactsDbIngestModuleFactory.moduleName, 
+                BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT, None))
+                
+            # Clean up
+            stmt.close()
+            dbConn.close()
+            os.remove(lclDbPath)
+
+            
+        # After all databases, post a message to the ingest messages in box.
+        message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
+            "ContactsDb Analyzer", "Found %d files" % fileCount)
+        IngestServices.getInstance().postMessage(message)
+        
+        return IngestModule.ProcessResult.OK

pythonExamples/Aug2015DataSourceTutorial/README.txt

@@ -0,0 +1,10 @@
+This folder contains files that were created for an August 2015 Tutorial from Basis Technology.
+
+http://www.basistech.com/python-autopsy-module-tutorial-2-the-data-source-ingest-module/
+
+
+It contains the following:
+- FindContactsDb.py: Script to find databases and parse them.
+- Contacts.db: Sample database with the correct name and schema for the FindContactsDb.py script.
+- RunExe.py: Script that runs img_stat.exe on disk images. 
+- img_stat.exe: 32-bit version of img_stat.exe from The Sleuth Kit that is needed by RunExe.py.

pythonExamples/Aug2015DataSourceTutorial/RunExe.py

@@ -0,0 +1,146 @@
+# Sample module in the public domain. Feel free to use this as a template
+# for your modules (and you can remove this header and take complete credit
+# and liability)
+#
+# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+
+# Simple data source-level ingest module for Autopsy.
+# Used as part of Python tutorials from Basis Technology - August 2015
+# 
+# Runs img_stat tool from The Sleuth Kit on each data source, saves the
+# output, and adds a report to the Case for the output
+
+import jarray
+import inspect
+import os
+import subprocess
+from java.lang import Class
+from java.lang import System
+from java.util.logging import Level
+from org.sleuthkit.datamodel import SleuthkitCase
+from org.sleuthkit.datamodel import AbstractFile
+from org.sleuthkit.datamodel import ReadContentInputStream
+from org.sleuthkit.datamodel import BlackboardArtifact
+from org.sleuthkit.datamodel import BlackboardAttribute
+from org.sleuthkit.datamodel import Image
+from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
+from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
+from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
+from org.sleuthkit.autopsy.ingest import IngestMessage
+from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.ingest import ModuleDataEvent
+from org.sleuthkit.autopsy.coreutils import Logger
+from org.sleuthkit.autopsy.coreutils import PlatformUtil
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.casemodule.services import Services
+from org.sleuthkit.autopsy.datamodel import ContentUtils
+
+
+# Factory that defines the name and details of the module and allows Autopsy
+# to create instances of the modules that will do the analysis.
+class RunExeIngestModuleFactory(IngestModuleFactoryAdapter):
+
+    moduleName = "Run EXE Module"
+
+    def getModuleDisplayName(self):
+        return self.moduleName
+
+    def getModuleDescription(self):
+        return "Sample module that runs img_stat on each disk image."
+
+    def getModuleVersionNumber(self):
+        return "1.0"
+
+    def isDataSourceIngestModuleFactory(self):
+        return True
+
+    def createDataSourceIngestModule(self, ingestOptions):
+        return RunExeIngestModule()
+
+
+# Data Source-level ingest module.  One gets created per data source.
+class RunExeIngestModule(DataSourceIngestModule):
+
+    _logger = Logger.getLogger(RunExeIngestModuleFactory.moduleName)
+
+    def log(self, level, msg):
+        self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
+
+    def __init__(self):
+        self.context = None
+
+    # Where any setup and configuration is done
+    # 'context' is an instance of org.sleuthkit.autopsy.ingest.IngestJobContext.
+    # See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1ingest_1_1_ingest_job_context.html
+    def startUp(self, context):
+        self.context = context
+        
+        # Get path to EXE based on where this script is run from.
+        # Assumes EXE is in same folder as script
+        # Verify it is there before any ingest starts
+        self.path_to_exe = os.path.join(os.path.dirname(os.path.abspath(__file__)), "img_stat.exe")
+        if not os.path.exists(self.path_to_exe):
+            raise IngestModuleException("EXE was not found in module folder")
+
+    # Where the analysis is done.
+    # The 'dataSource' object being passed in is of type org.sleuthkit.datamodel.Content.
+    # See: http://www.sleuthkit.org/sleuthkit/docs/jni-docs/interfaceorg_1_1sleuthkit_1_1datamodel_1_1_content.html
+    # 'progressBar' is of type org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress
+    # See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1ingest_1_1_data_source_ingest_module_progress.html
+    def process(self, dataSource, progressBar):
+        
+        # we don't know how much work there will be
+        progressBar.switchToIndeterminate()
+        
+        # Example has only a Windows EXE, so bail if we aren't on Windows
+        if not PlatformUtil.isWindowsOS(): 
+            self.log(Level.INFO, "Ignoring data source.  Not running on Windows")
+            return IngestModule.ProcessResult.OK
+
+        # Verify we have a disk image and not a folder of files
+        if not isinstance(dataSource, Image):
+            self.log(Level.INFO, "Ignoring data source.  Not an image")
+            return IngestModule.ProcessResult.OK
+
+        # Get disk image paths            
+        imagePaths = dataSource.getPaths()
+        
+        # We'll save our output to a file in the reports folder, named based on EXE and data source ID
+        reportPath = os.path.join(Case.getCurrentCase().getCaseDirectory(), "Reports", "img_stat-" + str(dataSource.getId()) + ".txt") 
+        reportHandle = open(reportPath, 'w')
+        
+        # Run the EXE, saving output to the report
+        # NOTE: we should really be checking for if the module has been
+        # cancelled and then killing the process. 
+        self.log(Level.INFO, "Running program on data source")
+        subprocess.Popen([self.path_to_exe, imagePaths[0]], stdout=reportHandle).communicate()[0]    
+        reportHandle.close()
+        
+        # Add the report to the case, so it shows up in the tree
+        Case.getCurrentCase().addReport(reportPath, "Run EXE", "img_stat output")
+        
+        return IngestModule.ProcessResult.OK

pythonExamples/July2015FileTutorial_BigRound/FindBigRoundFiles.py

@@ -0,0 +1,133 @@
+# Sample module in the public domain. Feel free to use this as a template
+# for your modules (and you can remove this header and take complete credit
+# and liability)
+#
+# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+# Simple file-level ingest module for Autopsy.
+# Used as part of Python tutorials from Basis Technology - July 2015
+# http://www.basistech.com/python-autopsy-module-tutorial-1-the-file-ingest-module/
+#
+# Looks for big files that are a multiple of 4096 and makes artifacts
+
+
+import jarray
+import inspect
+from java.lang import System
+from java.util.logging import Level
+from org.sleuthkit.datamodel import SleuthkitCase
+from org.sleuthkit.datamodel import AbstractFile
+from org.sleuthkit.datamodel import ReadContentInputStream
+from org.sleuthkit.datamodel import BlackboardArtifact
+from org.sleuthkit.datamodel import BlackboardAttribute
+from org.sleuthkit.datamodel import TskData
+from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
+from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
+from org.sleuthkit.autopsy.ingest import FileIngestModule
+from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
+from org.sleuthkit.autopsy.ingest import IngestMessage
+from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.ingest import ModuleDataEvent
+from org.sleuthkit.autopsy.coreutils import Logger
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.casemodule.services import Services
+from org.sleuthkit.autopsy.casemodule.services import FileManager
+
+# Factory that defines the name and details of the module and allows Autopsy
+# to create instances of the modules that will do the anlaysis.
+class FindBigRoundFilesIngestModuleFactory(IngestModuleFactoryAdapter):
+
+    moduleName = "Big and Round File Finder"
+
+    def getModuleDisplayName(self):
+        return self.moduleName
+
+    def getModuleDescription(self):
+        return "Sample module that files large files that are a multiple of 4096."
+
+    def getModuleVersionNumber(self):
+        return "1.0"
+
+    # Return true if module wants to get called for each file
+    def isFileIngestModuleFactory(self):
+        return True
+
+    # can return null if isFileIngestModuleFactory returns false
+    def createFileIngestModule(self, ingestOptions):
+        return FindBigRoundFilesIngestModule()
+
+
+# File-level ingest module.  One gets created per thread.
+class FindBigRoundFilesIngestModule(FileIngestModule):
+
+    _logger = Logger.getLogger(FindBigRoundFilesIngestModuleFactory.moduleName)
+
+    def log(self, level, msg):
+        self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
+
+    # Where any setup and configuration is done
+    # 'context' is an instance of org.sleuthkit.autopsy.ingest.IngestJobContext.
+    # See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1ingest_1_1_ingest_job_context.html
+    # TODO: Add any setup code that you need here.
+    def startUp(self, context):
+        self.filesFound = 0
+
+        # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
+        # raise IngestModuleException("Oh No!")
+        pass
+
+    # Where the analysis is done.  Each file will be passed into here.
+    # The 'file' object being passed in is of type org.sleuthkit.datamodel.AbstractFile.
+    # See: http://www.sleuthkit.org/sleuthkit/docs/jni-docs/classorg_1_1sleuthkit_1_1datamodel_1_1_abstract_file.html
+    def process(self, file):
+        # Skip non-files
+        if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) or 
+            (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) or 
+            (file.isFile() == False)):
+            return IngestModule.ProcessResult.OK
+
+        # Look for files bigger than 10MB that are a multiple of 4096            
+        if ((file.getSize() > 10485760) and ((file.getSize() % 4096) == 0)):
+
+            # Make an artifact on the blackboard.  TSK_INTERESTING_FILE_HIT is a generic type of
+            # artifact.  Refer to the developer docs for other examples.
+            art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
+            att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), 
+                  FindBigRoundFilesIngestModuleFactory.moduleName, "Big and Round Files")
+            art.addAttribute(att)
+  
+            # Fire an event to notify the UI and others that there is a new artifact  
+            IngestServices.getInstance().fireModuleDataEvent(
+                ModuleDataEvent(FindBigRoundFilesIngestModuleFactory.moduleName, 
+                    BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, None));
+
+        return IngestModule.ProcessResult.OK
+ 
+    # Where any shutdown code is run and resources are freed.
+    # TODO: Add any shutdown code that you need here.
+    def shutDown(self):
+        None

pythonExamples/July2015FileTutorial_BigRound/README.txt

@@ -0,0 +1,6 @@
+This folder contains files that were created for an July 2015 Tutorial from Basis Technology.
+
+It contains the following:
+- FindBigRoundFiles.py: Module to find files that are bigger than 10MB and multiple of 4k
+- bigRoundFile.dat: File that should be found if added as logical file and module is run on it
+- nonRoundfile.dat: File that should not be flagged if added as logical file and module is run on it. 

pythonExamples/dataSourceIngestModule.py

@@ -98,7 +98,7 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
     def startUp(self, context):
         self.context = context
         # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
-		# raise IngestModuleException(IngestModule(), "Oh No!")
+		# raise IngestModuleException("Oh No!")
 
     # Where the analysis is done.
     # The 'dataSource' object being passed in is of type org.sleuthkit.datamodel.Content.
@@ -107,20 +107,15 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
     # See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1ingest_1_1_data_source_ingest_module_progress.html
     # TODO: Add your analysis code in here.
     def process(self, dataSource, progressBar):
-        if self.context.isJobCancelled():
-            return IngestModule.ProcessResult.OK
 
         # we don't know how much work there is yet
         progressBar.switchToIndeterminate()
 
-        autopsyCase = Case.getCurrentCase()
-        sleuthkitCase = autopsyCase.getSleuthkitCase()
-        services = Services(sleuthkitCase)
-        fileManager = services.getFileManager()
-
         # For our example, we will use FileManager to get all
         # files with the word "test"
         # in the name and then count and read them
+        # FileManager API: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1casemodule_1_1services_1_1_file_manager.html
+        fileManager = Case.getCurrentCase().getServices().getFileManager()
         files = fileManager.findFiles(dataSource, "%test%")
 
         numFiles = len(files)

pythonExamples/fileIngestModule.py

@@ -99,7 +99,7 @@ class SampleJythonFileIngestModule(FileIngestModule):
         self.filesFound = 0
 
         # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
-        # raise IngestModuleException(IngestModule(), "Oh No!")
+        # raise IngestModuleException("Oh No!")
         pass
 
     # Where the analysis is done.  Each file will be passed into here.

pythonExamples/fileIngestModuleWithGui.py

@@ -0,0 +1,207 @@
+# Sample module in the public domain. Feel free to use this as a template
+# for your modules (and you can remove this header and take complete credit
+# and liability)
+#
+# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+
+
+# Ingest module for Autopsy with GUI
+#
+# Difference between other modules in this folder is that it has a GUI
+# for user options.  This is not needed for very basic modules. If you
+# don't need a configuration UI, start with the other sample module.
+#
+# Search for TODO for the things that you need to change
+# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
+
+
+import jarray
+import inspect
+from java.lang import System
+from java.util.logging import Level
+from javax.swing import JCheckBox
+from javax.swing import BoxLayout
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.casemodule.services import Services
+from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
+from org.sleuthkit.autopsy.ingest import FileIngestModule
+from org.sleuthkit.autopsy.ingest import IngestMessage
+from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
+from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
+from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
+from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
+from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
+from org.sleuthkit.datamodel import BlackboardArtifact
+from org.sleuthkit.datamodel import BlackboardAttribute
+from org.sleuthkit.datamodel import ReadContentInputStream
+from org.sleuthkit.autopsy.coreutils import Logger
+from java.lang import IllegalArgumentException
+
+# TODO: Rename this to something more specific
+class SampleFileIngestModuleWithUIFactory(IngestModuleFactoryAdapter):
+    def __init__(self):
+        self.settings = None
+
+    # TODO: give it a unique name.  Will be shown in module list, logs, etc.
+    moduleName = "Sample Data Source Module with UI"
+
+    def getModuleDisplayName(self):
+        return self.moduleName
+
+    # TODO: Give it a description
+    def getModuleDescription(self):
+        return "Sample module that does X, Y, and Z."
+
+    def getModuleVersionNumber(self):
+        return "1.0"
+
+    # TODO: Update class name to one that you create below
+    def getDefaultIngestJobSettings(self):
+        return SampleFileIngestModuleWithUISettings()
+
+    # TODO: Keep enabled only if you need ingest job-specific settings UI
+    def hasIngestJobSettingsPanel(self):
+        return True
+
+    # TODO: Update class names to ones that you create below
+    def getIngestJobSettingsPanel(self, settings):
+        if not isinstance(settings, SampleFileIngestModuleWithUISettings):
+            raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
+        self.settings = settings
+        return SampleFileIngestModuleWithUISettingsPanel(self.settings)
+
+
+    def isFileIngestModuleFactory(self):
+        return True
+
+
+    # TODO: Update class name to one that you create below
+    def createFileIngestModule(self, ingestOptions):
+        return SampleFileIngestModuleWithUI(self.settings)
+
+
+# File-level ingest module.  One gets created per thread.
+# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
+# Looks at the attributes of the passed in file.
+class SampleFileIngestModuleWithUI(FileIngestModule):
+
+    _logger = Logger.getLogger(SampleFileIngestModuleWithUIFactory.moduleName)
+
+    def log(self, level, msg):
+        self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
+
+    # Autopsy will pass in the settings from the UI panel
+    def __init__(self, settings):
+        self.local_settings = settings
+
+
+    # Where any setup and configuration is done
+    # TODO: Add any setup code that you need here.
+    def startUp(self, context):
+        # As an example, determine if user configured a flag in UI
+        if self.local_settings.getFlag():
+            self.log(Level.INFO, "flag is set")
+        else:
+            self.log(Level.INFO, "flag is not set")
+
+        # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
+        # raise IngestModuleException("Oh No!")
+        pass
+
+    # Where the analysis is done.  Each file will be passed into here.
+    # TODO: Add your analysis code in here.
+    def process(self, file):
+        # See code in pythonExamples/fileIngestModule.py for example code
+        return IngestModule.ProcessResult.OK
+
+    # Where any shutdown code is run and resources are freed.
+    # TODO: Add any shutdown code that you need here.
+    def shutDown(self):
+        pass
+
+# Stores the settings that can be changed for each ingest job
+# All fields in here must be serializable.  It will be written to disk.
+# TODO: Rename this class
+class SampleFileIngestModuleWithUISettings(IngestModuleIngestJobSettings):
+    serialVersionUID = 1L
+
+    def __init__(self):
+        self.flag = False
+
+    def getVersionNumber(self):
+        return serialVersionUID
+
+    # TODO: Define getters and settings for data you want to store from UI
+    def getFlag(self):
+        return self.flag
+
+    def setFlag(self, flag):
+        self.flag = flag
+
+
+# UI that is shown to user for each ingest job so they can configure the job.
+# TODO: Rename this
+class SampleFileIngestModuleWithUISettingsPanel(IngestModuleIngestJobSettingsPanel):
+    # Note, we can't use a self.settings instance variable.
+    # Rather, self.local_settings is used.
+    # https://wiki.python.org/jython/UserGuide#javabean-properties
+    # Jython Introspector generates a property - 'settings' on the basis
+    # of getSettings() defined in this class. Since only getter function
+    # is present, it creates a read-only 'settings' property. This auto-
+    # generated read-only property overshadows the instance-variable -
+    # 'settings'
+
+    # We get passed in a previous version of the settings so that we can
+    # prepopulate the UI
+    # TODO: Update this for your UI
+    def __init__(self, settings):
+        self.local_settings = settings
+        self.initComponents()
+        self.customizeComponents()
+
+    # TODO: Update this for your UI
+    def checkBoxEvent(self, event):
+        if self.checkbox.isSelected():
+            self.local_settings.setFlag(True)
+        else:
+            self.local_settings.setFlag(False)
+
+    # TODO: Update this for your UI
+    def initComponents(self):
+        self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
+        self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
+        self.add(self.checkbox)
+
+    # TODO: Update this for your UI
+    def customizeComponents(self):
+        self.checkbox.setSelected(self.local_settings.getFlag())
+
+    # Return the settings used
+    def getSettings(self):
+        return self.local_settings
+

pythonExamples/reportmodule.py

@@ -28,24 +28,37 @@
 # OTHER DEALINGS IN THE SOFTWARE.
 
 
-# Report module for Autopsy.
+# Sample report module for Autopsy.  Use as a starting point for new modules.
 #
 # Search for TODO for the things that you need to change
 # See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
 
-from java.lang import System
-from org.sleuthkit.autopsy.casemodule import Case
-from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
 import os
+from java.lang import System
+from java.util.logging import Level
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.coreutils import Logger
+from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
+from org.sleuthkit.autopsy.report.ReportProgressPanel import ReportStatus
 
-# TODO: Rename this to something more specific
+
+# TODO: Rename the class to something more specific
 class SampleGeneralReportModule(GeneralReportModuleAdapter):
 
     # TODO: Rename this.  Will be shown to users when making a report
-    def getName(self):
-        return "Sample Jython Report Module"
+    moduleName = "Sample Report Module"
 
-    # TODO: rewrite this
+    _logger = None
+    def log(self, level, msg):
+        if _logger == None:
+            _logger = Logger.getLogger(self.moduleName)
+
+        self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
+
+    def getName(self):
+        return self.moduleName
+
+    # TODO: Give it a useful description
     def getDescription(self):
         return "A sample Jython report module"
 
@@ -54,30 +67,43 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
         return "sampleReport.txt"
 
     # TODO: Update this method to make a report
+    # The 'baseReportDir' object being passed in is a string with the directory that reports are being stored in.   Report should go into baseReportDir + getRelativeFilePath().
+    # The 'progressBar' object is of type ReportProgressPanel.
+    #   See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1report_1_1_report_progress_panel.html
     def generateReport(self, baseReportDir, progressBar):
         
-            # For an example, we write a file with the number of files created in the past 2 weeks
-            # Configure progress bar for 2 tasks
-            progressBar.setIndeterminate(False)
-            progressBar.start()
-            progressBar.setMaximumProgress(2)
+        # For an example, we write a file with the number of files created in the past 2 weeks
+        # Configure progress bar for 2 tasks
+        progressBar.setIndeterminate(False)
+        progressBar.start()
+        progressBar.setMaximumProgress(2)
 
-            # Get files by created in last two weeks.
-            fileCount = 0
-            autopsyCase = Case.getCurrentCase()
-            sleuthkitCase = autopsyCase.getSleuthkitCase()
-            currentTime = System.currentTimeMillis() / 1000
-            minTime = currentTime - (14 * 24 * 60 * 60)
-            otherFiles = sleuthkitCase.findFilesWhere("crtime > %d" % minTime)
-            for otherFile in otherFiles:
-                    fileCount += 1
-            progressBar.increment()
-            
-            # Write the result to the report file.
-            report = open(os.path.join(baseReportDir, self.getRelativeFilePath()), 'w')
-            report.write("file count = %d" % fileCount)
-            Case.getCurrentCase().addReport(report.name, "SampleGeneralReportModule", "Sample Python Report");
-            report.close()
-            
-            progressBar.increment()
-            progressBar.complete()
+        # Find epoch time of when 2 weeks ago was
+        currentTime = System.currentTimeMillis() / 1000
+        minTime = currentTime - (14 * 24 * 60 * 60) # (days * hours * minutes * seconds)
+
+        # Query the database for files that meet our criteria
+        sleuthkitCase = Case.getCurrentCase().getSleuthkitCase()
+        files = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
+
+        fileCount = 0
+        for file in files:
+            fileCount += 1
+            # Could do something else here and write it to HTML, CSV, etc.
+
+        # Increment since we are done with step #1
+        progressBar.increment()
+
+        # Write the count to the report file.
+        fileName = os.path.join(baseReportDir, self.getRelativeFilePath())
+        report = open(fileName, 'w')
+        report.write("file count = %d" % fileCount)
+        report.close()
+
+        # Add the report to the Case, so it is shown in the tree
+        Case.getCurrentCase().addReport(fileName, self.moduleName, "File Count Report");
+
+        progressBar.increment()
+
+        # Call this with ERROR if report was not generated
+        progressBar.complete(ReportStatus.COMPLETE)