mirror of
https://github.com/elisspace/autopsy.git
synced 2026-08-30 08:01:57 +00:00
Updated python examples and docs
This commit is contained in:
Brian Carrier
@@ -1,7 +1,13 @@
|
||||
reportmodule.py -> Report module which implements GeneralReportModuleAdapter.
|
||||
simpleingestmodule -> Data source ingest module without any GUI example code.
|
||||
ingestmodule.py -> Both data source ingest module as well as file ingest module WITH an example of GUI code.
|
||||
This folder contains sample python module files. They are public
|
||||
domain, so you are free to copy and paste them and modify them to
|
||||
your needs.
|
||||
|
||||
See the developer guide for more details and how to use and load
|
||||
the modules.
|
||||
|
||||
http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html
|
||||
|
||||
Each module in this folder should have a brief description about what they
|
||||
can do.
|
||||
|
||||
|
||||
NOTE: The Python modules must be inside folder inside the folder opened by Tools > Plugins.
|
||||
For example, place the ingestmodule.py inside folder ingest. Move that ingest folder inside opened by Tools > Plugins
|
||||
The directory opened by Tools > Plugins is cleared every time the project is cleaned.
|
||||
@@ -27,6 +27,10 @@
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
# Simple data source-level ingest module for Autopsy.
|
||||
# Search for TODO for the things that you need to change
|
||||
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from org.sleuthkit.datamodel import SleuthkitCase
|
||||
@@ -35,87 +39,112 @@ from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.casemodule.services import FileManager
|
||||
|
||||
# Sample factory that defines basic functionality and features of the module
|
||||
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
|
||||
# Factory that defines the name and details of the module and allows Autopsy
|
||||
# to create instances of the modules that will do the analysis.
|
||||
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
|
||||
class SampleJythonDataSourceIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
|
||||
# TODO: give it a unique name. Will be shown in module list, logs, etc.
|
||||
moduleName = "Sample Data Source Module"
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return "Sample Jython ingest module"
|
||||
|
||||
return self.moduleName
|
||||
|
||||
# TODO: Give it a description
|
||||
def getModuleDescription(self):
|
||||
return "Sample Jython Ingest Module without GUI example code"
|
||||
return "Sample module that does X, Y, and Z."
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
# Return true if module wants to get passed in a data source
|
||||
def isDataSourceIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isDataSourceIngestModuleFactory returns false
|
||||
def createDataSourceIngestModule(self, ingestOptions):
|
||||
# TODO: Change the class name to the name you'll make below
|
||||
return SampleJythonDataSourceIngestModule()
|
||||
|
||||
# Return true if module wants to get called for each file
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isFileIngestModuleFactory returns false
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleJythonFileIngestModule()
|
||||
|
||||
|
||||
# Data Source-level ingest module. One gets created per data source.
|
||||
# Queries for various files.
|
||||
# If you don't need a data source-level module, delete this class.
|
||||
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
|
||||
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
|
||||
|
||||
def __init__(self):
|
||||
self.context = None
|
||||
|
||||
# Where any setup and configuration is done
|
||||
# TODO: Add any setup code that you need here.
|
||||
def startUp(self, context):
|
||||
self.context = context
|
||||
|
||||
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
|
||||
# raise IngestModuleException(IngestModule(), "Oh No!")
|
||||
|
||||
# Where the analysis is done.
|
||||
# TODO: Add your analysis code in here.
|
||||
def process(self, dataSource, progressBar):
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
logger = Logger.getLogger(SampleJythonDataSourceIngestModuleFactory.moduleName)
|
||||
|
||||
# Configure progress bar for 2 tasks
|
||||
progressBar.switchToDeterminate(2)
|
||||
# we don't know how much work there is yet
|
||||
progressBar.switchToIndeterminate()
|
||||
|
||||
autopsyCase = Case.getCurrentCase()
|
||||
sleuthkitCase = autopsyCase.getSleuthkitCase()
|
||||
services = Services(sleuthkitCase)
|
||||
fileManager = services.getFileManager()
|
||||
|
||||
# Get count of files with "test" in name.
|
||||
fileCount = 0;
|
||||
# For our example, we will use FileManager to get all
|
||||
# files with the word "test"
|
||||
# in the name and then count and read them
|
||||
files = fileManager.findFiles(dataSource, "%test%")
|
||||
|
||||
numFiles = len(files)
|
||||
logger.info("found " + str(numFiles) + " files")
|
||||
progressBar.switchToDeterminate(numFiles)
|
||||
fileCount = 0;
|
||||
for file in files:
|
||||
|
||||
# Check if the user pressed cancel while we were busy
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
logger.info("Processing file: " + file.getName())
|
||||
fileCount += 1
|
||||
progressBar.progress(1)
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
|
||||
# artfiact. Refer to the developer docs for other examples.
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonDataSourceIngestModuleFactory.moduleName, "Test file")
|
||||
art.addAttribute(att)
|
||||
|
||||
# Get files by creation time.
|
||||
currentTime = System.currentTimeMillis() / 1000
|
||||
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
|
||||
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
|
||||
for otherFile in otherFiles:
|
||||
fileCount += 1
|
||||
progressBar.progress(1);
|
||||
|
||||
# To further the example, this code will read the contents of the file and count the number of bytes
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
readLen = inputStream.read(buffer)
|
||||
while (readLen != -1):
|
||||
totLen = totLen + readLen
|
||||
readLen = inputStream.read(buffer)
|
||||
|
||||
|
||||
# Update the progress bar
|
||||
progressBar.progress(fileCount)
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
#Post a message to the ingest messages in box.
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
|
||||
@@ -123,38 +152,3 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
|
||||
IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
|
||||
# File-level ingest module. One gets created per thread.
|
||||
# Looks at the attributes of the passed in file.
|
||||
# if you don't need a file-level module, delete this class.
|
||||
class SampleJythonFileIngestModule(FileIngestModule):
|
||||
|
||||
def startUp(self, context):
|
||||
pass
|
||||
|
||||
def process(self, file):
|
||||
# If the file has a txt extension, post an artifact to the blackboard.
|
||||
if file.getName().find("test") != -1:
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), "Sample Jython File Ingest Module", "Text Files")
|
||||
art.addAttribute(att)
|
||||
|
||||
# Read the contents of the file.
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
len = inputStream.read(buffer)
|
||||
while (len != -1):
|
||||
totLen = totLen + len
|
||||
len = inputStream.read(buffer)
|
||||
|
||||
# Send the size of the file to the ingest messages in box.
|
||||
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule", msgText)
|
||||
ingestServices = IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
def shutDown(self):
|
||||
pass
|
||||
128
pythonExamples/fileIngestModule.py
Executable file
128
pythonExamples/fileIngestModule.py
Executable file
@@ -0,0 +1,128 @@
|
||||
# Sample module in the public domain. Feel free to use this as a template
|
||||
# for your modules (and you can remove this header and take complete credit
|
||||
# and liability)
|
||||
#
|
||||
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
|
||||
#
|
||||
# This is free and unencumbered software released into the public domain.
|
||||
#
|
||||
# Anyone is free to copy, modify, publish, use, compile, sell, or
|
||||
# distribute this software, either in source code form or as a compiled
|
||||
# binary, for any purpose, commercial or non-commercial, and by any
|
||||
# means.
|
||||
#
|
||||
# In jurisdictions that recognize copyright laws, the author or authors
|
||||
# of this software dedicate any and all copyright interest in the
|
||||
# software to the public domain. We make this dedication for the benefit
|
||||
# of the public at large and to the detriment of our heirs and
|
||||
# successors. We intend this dedication to be an overt act of
|
||||
# relinquishment in perpetuity of all present and future rights to this
|
||||
# software under copyright law.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
|
||||
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
# Simple file-level ingest module for Autopsy.
|
||||
# Search for TODO for the things that you need to change
|
||||
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from org.sleuthkit.datamodel import SleuthkitCase
|
||||
from org.sleuthkit.datamodel import AbstractFile
|
||||
from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.casemodule.services import FileManager
|
||||
|
||||
# Factory that defines the name and details of the module and allows Autopsy
|
||||
# to create instances of the modules that will do the anlaysis.
|
||||
# TODO: Rename this to something more specific. Search and replace for it because it is used a few times
|
||||
class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
|
||||
# TODO: give it a unique name. Will be shown in module list, logs, etc.
|
||||
moduleName = "Sample file ingest Module"
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return self.moduleName
|
||||
|
||||
# TODO: Give it a description
|
||||
def getModuleDescription(self):
|
||||
return "Sample module that does X, Y, and Z."
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
# Return true if module wants to get called for each file
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isFileIngestModuleFactory returns false
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleJythonFileIngestModule()
|
||||
|
||||
|
||||
# File-level ingest module. One gets created per thread.
|
||||
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
|
||||
# Looks at the attributes of the passed in file.
|
||||
class SampleJythonFileIngestModule(FileIngestModule):
|
||||
|
||||
# Where any setup and configuration is done
|
||||
# TODO: Add any setup code that you need here.
|
||||
def startUp(self, context):
|
||||
self.logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName)
|
||||
self.filesFound = 0
|
||||
|
||||
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
|
||||
# raise IngestModuleException(IngestModule(), "Oh No!")
|
||||
pass
|
||||
|
||||
# Where the analysis is done. Each file will be passed into here.
|
||||
# TODO: Add your analysis code in here.
|
||||
def process(self, file):
|
||||
|
||||
# For an example, we will flag files with .txt in the name and make a blackboard artifact.
|
||||
if file.getName().find(".txt") != -1:
|
||||
|
||||
self.logger.info("Found a text file: " + file.getName())
|
||||
self.filesFound+=1
|
||||
|
||||
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
|
||||
# artfiact. Refer to the developer docs for other examples.
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), SampleJythonFileIngestModuleFactory.moduleName, "Text Files")
|
||||
art.addAttribute(att)
|
||||
|
||||
|
||||
# To further the example, this code will read the contents of the file and count the number of bytes
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
len = inputStream.read(buffer)
|
||||
while (len != -1):
|
||||
totLen = totLen + len
|
||||
len = inputStream.read(buffer)
|
||||
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Where any shutdown code is run and resources are freed.
|
||||
# TODO: Add any shutdown code that you need here.
|
||||
def shutDown(self):
|
||||
# As a final part of this example, we'll send a message to the ingest inbox with the number of files found (in this thread)
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, SampleJythonFileIngestModuleFactory.moduleName, str(self.filesFound) + " files found")
|
||||
ingestServices = IngestServices.getInstance().postMessage(message)
|
||||
203
pythonExamples/fileIngestModuleWithGui.py
Executable file
203
pythonExamples/fileIngestModuleWithGui.py
Executable file
@@ -0,0 +1,203 @@
|
||||
# Sample module in the public domain. Feel free to use this as a template
|
||||
# for your modules (and you can remove this header and take complete credit
|
||||
# and liability)
|
||||
#
|
||||
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
|
||||
#
|
||||
# This is free and unencumbered software released into the public domain.
|
||||
#
|
||||
# Anyone is free to copy, modify, publish, use, compile, sell, or
|
||||
# distribute this software, either in source code form or as a compiled
|
||||
# binary, for any purpose, commercial or non-commercial, and by any
|
||||
# means.
|
||||
#
|
||||
# In jurisdictions that recognize copyright laws, the author or authors
|
||||
# of this software dedicate any and all copyright interest in the
|
||||
# software to the public domain. We make this dedication for the benefit
|
||||
# of the public at large and to the detriment of our heirs and
|
||||
# successors. We intend this dedication to be an overt act of
|
||||
# relinquishment in perpetuity of all present and future rights to this
|
||||
# software under copyright law.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
|
||||
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
|
||||
# Ingest module for Autopsy with GUI
|
||||
#
|
||||
# Difference between other modules in this folder is that it has a GUI
|
||||
# for user options. This is not needed for very basic modules. If you
|
||||
# don't need a configuration UI, start with the other sample module.
|
||||
#
|
||||
# Search for TODO for the things that you need to change
|
||||
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
|
||||
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from javax.swing import JCheckBox
|
||||
from javax.swing import BoxLayout
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from java.lang import IllegalArgumentException
|
||||
|
||||
# TODO: Rename this to something more specific
|
||||
class SampleFileIngestModuleWithUIFactory(IngestModuleFactoryAdapter):
|
||||
def __init__(self):
|
||||
self.settings = None
|
||||
|
||||
# TODO: give it a unique name. Will be shown in module list, logs, etc.
|
||||
moduleName = "Sample Data Source Module with UI"
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return self.moduleName
|
||||
|
||||
# TODO: Give it a description
|
||||
def getModuleDescription(self):
|
||||
return "Sample module that does X, Y, and Z."
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
# TODO: Update class name to one that you create below
|
||||
def getDefaultIngestJobSettings(self):
|
||||
return SampleFileIngestModuleWithUISettings()
|
||||
|
||||
# TODO: Keep enabled only if you need ingest job-specific settings UI
|
||||
def hasIngestJobSettingsPanel(self):
|
||||
return True
|
||||
|
||||
# TODO: Update class names to ones that you create below
|
||||
def getIngestJobSettingsPanel(self, settings):
|
||||
if not isinstance(settings, SampleFileIngestModuleWithUISettings):
|
||||
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
|
||||
self.settings = settings
|
||||
return SampleFileIngestModuleWithUISettingsPanel(self.settings)
|
||||
|
||||
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
|
||||
# TODO: Update class name to one that you create below
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleFileIngestModuleWithUI(self.settings)
|
||||
|
||||
|
||||
# File-level ingest module. One gets created per thread.
|
||||
# TODO: Rename this to something more specific. Could just remove "Factory" from above name.
|
||||
# Looks at the attributes of the passed in file.
|
||||
class SampleFileIngestModuleWithUI(FileIngestModule):
|
||||
|
||||
# Autopsy will pass in the settings from the UI panel
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
|
||||
|
||||
# Where any setup and configuration is done
|
||||
# TODO: Add any setup code that you need here.
|
||||
def startUp(self, context):
|
||||
self.logger = Logger.getLogger(SampleFileIngestModuleWithUIFactory.moduleName)
|
||||
|
||||
# As an example, determine if user configured a flag in UI
|
||||
if self.local_settings.getFlag():
|
||||
self.logger.info("flag is set")
|
||||
else:
|
||||
self.logger.info("flag is not set")
|
||||
|
||||
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
|
||||
# raise IngestModuleException(IngestModule(), "Oh No!")
|
||||
pass
|
||||
|
||||
# Where the analysis is done. Each file will be passed into here.
|
||||
# TODO: Add your analysis code in here.
|
||||
def process(self, file):
|
||||
# See code in pythonExamples/fileIngestModule.py for example code
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Where any shutdown code is run and resources are freed.
|
||||
# TODO: Add any shutdown code that you need here.
|
||||
def shutDown(self):
|
||||
pass
|
||||
|
||||
# Stores the settings that can be changed for each ingest job
|
||||
# All fields in here must be serializable. It will be written to disk.
|
||||
# TODO: Rename this class
|
||||
class SampleFileIngestModuleWithUISettings(IngestModuleIngestJobSettings):
|
||||
serialVersionUID = 1L
|
||||
|
||||
def __init__(self):
|
||||
self.flag = False
|
||||
|
||||
def getVersionNumber(self):
|
||||
return serialVersionUID
|
||||
|
||||
# TODO: Define getters and settings for data you want to store from UI
|
||||
def getFlag(self):
|
||||
return self.flag
|
||||
|
||||
def setFlag(self, flag):
|
||||
self.flag = flag
|
||||
|
||||
|
||||
# UI that is shown to user for each ingest job so they can configure the job.
|
||||
# TODO: Rename this
|
||||
class SampleFileIngestModuleWithUISettingsPanel(IngestModuleIngestJobSettingsPanel):
|
||||
# Note, we can't use a self.settings instance variable.
|
||||
# Rather, self.local_settings is used.
|
||||
# https://wiki.python.org/jython/UserGuide#javabean-properties
|
||||
# Jython Introspector generates a property - 'settings' on the basis
|
||||
# of getSettings() defined in this class. Since only getter function
|
||||
# is present, it creates a read-only 'settings' property. This auto-
|
||||
# generated read-only property overshadows the instance-variable -
|
||||
# 'settings'
|
||||
|
||||
# We get passed in a previous version of the settings so that we can
|
||||
# prepopulate the UI
|
||||
# TODO: Update this for your UI
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
self.initComponents()
|
||||
self.customizeComponents()
|
||||
|
||||
# TODO: Update this for your UI
|
||||
def checkBoxEvent(self, event):
|
||||
if self.checkbox.isSelected():
|
||||
self.local_settings.setFlag(True)
|
||||
else:
|
||||
self.local_settings.setFlag(False)
|
||||
|
||||
# TODO: Update this for your UI
|
||||
def initComponents(self):
|
||||
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
|
||||
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
|
||||
self.add(self.checkbox)
|
||||
|
||||
# TODO: Update this for your UI
|
||||
def customizeComponents(self):
|
||||
self.checkbox.setSelected(self.local_settings.getFlag())
|
||||
|
||||
# Return the settings used
|
||||
def getSettings(self):
|
||||
return self.local_settings
|
||||
|
||||
|
||||
@@ -1,266 +0,0 @@
|
||||
# Sample module in the public domain. Feel free to use this as a template
|
||||
# for your modules (and you can remove this header and take complete credit
|
||||
# and liability)
|
||||
#
|
||||
# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
|
||||
#
|
||||
# This is free and unencumbered software released into the public domain.
|
||||
#
|
||||
# Anyone is free to copy, modify, publish, use, compile, sell, or
|
||||
# distribute this software, either in source code form or as a compiled
|
||||
# binary, for any purpose, commercial or non-commercial, and by any
|
||||
# means.
|
||||
#
|
||||
# In jurisdictions that recognize copyright laws, the author or authors
|
||||
# of this software dedicate any and all copyright interest in the
|
||||
# software to the public domain. We make this dedication for the benefit
|
||||
# of the public at large and to the detriment of our heirs and
|
||||
# successors. We intend this dedication to be an overt act of
|
||||
# relinquishment in perpetuity of all present and future rights to this
|
||||
# software under copyright law.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
|
||||
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
|
||||
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
# OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
import jarray
|
||||
from java.lang import System
|
||||
from javax.swing import JCheckBox
|
||||
from javax.swing import BoxLayout
|
||||
from org.sleuthkit.autopsy.casemodule import Case
|
||||
from org.sleuthkit.autopsy.casemodule.services import Services
|
||||
from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import FileIngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestMessage
|
||||
from org.sleuthkit.autopsy.ingest import IngestModule
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettings
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleIngestJobSettingsPanel
|
||||
from org.sleuthkit.autopsy.ingest import IngestServices
|
||||
from org.sleuthkit.autopsy.ingest import IngestModuleGlobalSettingsPanel
|
||||
from org.sleuthkit.datamodel import BlackboardArtifact
|
||||
from org.sleuthkit.datamodel import BlackboardAttribute
|
||||
from org.sleuthkit.datamodel import ReadContentInputStream
|
||||
from org.sleuthkit.autopsy.coreutils import Logger
|
||||
from java.lang import IllegalArgumentException
|
||||
|
||||
# Sample factory that defines basic functionality and features of the module
|
||||
# It implements IngestModuleFactoryAdapter which is a no-op implementation of
|
||||
# IngestModuleFactory.
|
||||
class SampleJythonIngestModuleFactory(IngestModuleFactoryAdapter):
|
||||
def __init__(self):
|
||||
self.settings = None
|
||||
|
||||
def getModuleDisplayName(self):
|
||||
return "Sample Jython(GUI) ingest module"
|
||||
|
||||
def getModuleDescription(self):
|
||||
return "Sample Jython Ingest Module with GUI example code"
|
||||
|
||||
def getModuleVersionNumber(self):
|
||||
return "1.0"
|
||||
|
||||
def getDefaultIngestJobSettings(self):
|
||||
return SampleIngestModuleSettings()
|
||||
|
||||
def hasIngestJobSettingsPanel(self):
|
||||
return True
|
||||
|
||||
def getIngestJobSettingsPanel(self, settings):
|
||||
if not isinstance(settings, SampleIngestModuleSettings):
|
||||
raise IllegalArgumentException("Expected settings argument to be instanceof SampleIngestModuleSettings")
|
||||
self.settings = settings
|
||||
return SampleIngestModuleSettingsPanel(self.settings)
|
||||
|
||||
# Return true if module wants to get passed in a data source
|
||||
def isDataSourceIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isDataSourceIngestModuleFactory returns false
|
||||
def createDataSourceIngestModule(self, ingestOptions):
|
||||
return SampleJythonDataSourceIngestModule(self.settings)
|
||||
|
||||
# Return true if module wants to get called for each file
|
||||
|
||||
def isFileIngestModuleFactory(self):
|
||||
return True
|
||||
|
||||
# can return null if isFileIngestModuleFactory returns false
|
||||
def createFileIngestModule(self, ingestOptions):
|
||||
return SampleJythonFileIngestModule(self.settings)
|
||||
|
||||
def hasGlobalSettingsPanel(self):
|
||||
return True
|
||||
|
||||
def getGlobalSettingsPanel(self):
|
||||
globalSettingsPanel = SampleIngestModuleGlobalSettingsPanel();
|
||||
return globalSettingsPanel
|
||||
|
||||
|
||||
class SampleIngestModuleGlobalSettingsPanel(IngestModuleGlobalSettingsPanel):
|
||||
def __init__(self):
|
||||
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
|
||||
checkbox = JCheckBox("Flag inside the Global Settings Panel")
|
||||
self.add(checkbox)
|
||||
|
||||
|
||||
class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
|
||||
'''
|
||||
Data Source-level ingest module. One gets created per data source.
|
||||
Queries for various files. If you don't need a data source-level module,
|
||||
delete this class.
|
||||
'''
|
||||
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
self.context = None
|
||||
|
||||
def startUp(self, context):
|
||||
# Used to verify if the GUI checkbox event been recorded or not.
|
||||
logger = Logger.getLogger("SampleJythonFileIngestModule")
|
||||
if self.local_settings.getFlag():
|
||||
logger.info("flag is set")
|
||||
else:
|
||||
logger.info("flag is not set")
|
||||
|
||||
self.context = context
|
||||
|
||||
def process(self, dataSource, progressBar):
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Configure progress bar for 2 tasks
|
||||
progressBar.switchToDeterminate(2)
|
||||
|
||||
autopsyCase = Case.getCurrentCase()
|
||||
sleuthkitCase = autopsyCase.getSleuthkitCase()
|
||||
services = Services(sleuthkitCase)
|
||||
fileManager = services.getFileManager()
|
||||
|
||||
# Get count of files with "test" in name.
|
||||
fileCount = 0;
|
||||
files = fileManager.findFiles(dataSource, "%test%")
|
||||
for file in files:
|
||||
fileCount += 1
|
||||
progressBar.progress(1)
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
# Get files by creation time.
|
||||
currentTime = System.currentTimeMillis() / 1000
|
||||
minTime = currentTime - (14 * 24 * 60 * 60) # Go back two weeks.
|
||||
otherFiles = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
|
||||
for otherFile in otherFiles:
|
||||
fileCount += 1
|
||||
progressBar.progress(1);
|
||||
|
||||
if self.context.isJobCancelled():
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
# Post a message to the ingest messages in box.
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA,
|
||||
"Sample Jython Data Source Ingest Module", "Found %d files" % fileCount)
|
||||
IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK;
|
||||
|
||||
|
||||
class SampleJythonFileIngestModule(FileIngestModule):
|
||||
'''
|
||||
File-level ingest module. One gets created per thread. Looks at the
|
||||
attributes of the passed in file. if you don't need a file-level module,
|
||||
delete this class.
|
||||
'''
|
||||
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
|
||||
def startUp(self, context):
|
||||
# Used to verify if the GUI checkbox event been recorded or not.
|
||||
logger = Logger.getLogger("SampleJythonFileIngestModule")
|
||||
if self.local_settings.getFlag():
|
||||
logger.info("flag is set")
|
||||
else:
|
||||
logger.info("flag is not set")
|
||||
pass
|
||||
|
||||
def process(self, file):
|
||||
# If the file has a txt extension, post an artifact to the blackboard.
|
||||
if file.getName().find("test") != -1:
|
||||
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
|
||||
att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(),
|
||||
"Sample Jython File Ingest Module", "Text Files")
|
||||
art.addAttribute(att)
|
||||
|
||||
# Read the contents of the file.
|
||||
inputStream = ReadContentInputStream(file)
|
||||
buffer = jarray.zeros(1024, "b")
|
||||
totLen = 0
|
||||
len = inputStream.read(buffer)
|
||||
while (len != -1):
|
||||
totLen = totLen + len
|
||||
len = inputStream.read(buffer)
|
||||
|
||||
# Send the size of the file to the ingest messages in box.
|
||||
msgText = "Size of %s is %d bytes" % ((file.getName(), totLen))
|
||||
message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "Sample Jython File IngestModule",
|
||||
msgText)
|
||||
ingestServices = IngestServices.getInstance().postMessage(message)
|
||||
|
||||
return IngestModule.ProcessResult.OK
|
||||
|
||||
def shutDown(self):
|
||||
pass
|
||||
|
||||
|
||||
class SampleIngestModuleSettings(IngestModuleIngestJobSettings):
|
||||
serialVersionUID = 1L
|
||||
|
||||
def __init__(self):
|
||||
self.flag = False
|
||||
|
||||
def getVersionNumber(self):
|
||||
return serialVersionUID
|
||||
|
||||
def getFlag(self):
|
||||
return self.flag
|
||||
|
||||
def setFlag(self, flag):
|
||||
self.flag = flag
|
||||
|
||||
|
||||
class SampleIngestModuleSettingsPanel(IngestModuleIngestJobSettingsPanel):
|
||||
# self.settings instance variable not used. Rather, self.local_settings is used.
|
||||
# https://wiki.python.org/jython/UserGuide#javabean-properties
|
||||
# Jython Introspector generates a property - 'settings' on the basis
|
||||
# of getSettings() defined in this class. Since only getter function
|
||||
# is present, it creates a read-only 'settings' property. This auto-
|
||||
# generated read-only property overshadows the instance-variable -
|
||||
# 'settings'
|
||||
|
||||
def checkBoxEvent(self, event):
|
||||
if self.checkbox.isSelected():
|
||||
self.local_settings.setFlag(True)
|
||||
else:
|
||||
self.local_settings.setFlag(False)
|
||||
|
||||
def initComponents(self):
|
||||
self.setLayout(BoxLayout(self, BoxLayout.Y_AXIS))
|
||||
self.checkbox = JCheckBox("Flag", actionPerformed=self.checkBoxEvent)
|
||||
self.add(self.checkbox)
|
||||
|
||||
def customizeComponents(self):
|
||||
self.checkbox.setSelected(self.local_settings.getFlag())
|
||||
|
||||
def __init__(self, settings):
|
||||
self.local_settings = settings
|
||||
self.initComponents()
|
||||
self.customizeComponents()
|
||||
|
||||
def getSettings(self):
|
||||
return self.local_settings
|
||||
Reference in New Issue
Block a user