codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-10-04 00:09:53 +00:00
Code Issues Releases Wiki Activity

updates to sample code

Browse Source
This commit is contained in:
Greg DiCristofaro
2021-07-20 12:02:02 -04:00
parent 48ec3d7aa7
commit 8279df1a3b
5 changed files with 47 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pythonExamples/fileIngestModule.py
+6 -12
View File
@@ -55,8 +55,7 @@ from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.casemodule.services import Services
from org.sleuthkit.autopsy.casemodule.services import FileManager
from org.sleuthkit.autopsy.casemodule.services import Blackboard
from org.sleuthkit.datamodel import Score
from java.util import ArrayList
from java.util import Arrays
# Factory that defines the name and details of the module and allows Autopsy
# to create instances of the modules that will do the anlaysis.
@@ -128,23 +127,18 @@ class SampleJythonFileIngestModule(FileIngestModule):
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
# artifact. Refer to the developer docs for other examples.
attrs = ArrayList()
attrs.add(BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME,
attrs = Arrays.asList(BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME,
SampleJythonFileIngestModuleFactory.moduleName, "Text Files"))
art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, None, "Text Files", None, attrs).getAnalysisResult()
art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE,
None, "Text Files", None, attrs).getAnalysisResult()
try:
# index the artifact for keyword search
blackboard.indexArtifact(art)
# post the artifact for listeners of artifact events
blackboard.postArtifact(art)
except Blackboard.BlackboardException as e:
self.log(Level.SEVERE, "Error indexing artifact " + art.getDisplayName())
# Fire an event to notify the UI and others that there is a new artifact
IngestServices.getInstance().fireModuleDataEvent(
ModuleDataEvent(SampleJythonFileIngestModuleFactory.moduleName,
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, None))
# For the example (this wouldn't be needed normally), we'll query the blackboard for data that was added
# by other modules. We then iterate over its attributes. We'll just print them, but you would probably
# want to do something with them.