Updated python report module, added July2015 tutorial folder with code of final module

pythonExamples/July2015FileTutorial_BigRound/FindBigRoundFiles.py

@@ -0,0 +1,133 @@
+# Sample module in the public domain. Feel free to use this as a template
+# for your modules (and you can remove this header and take complete credit
+# and liability)
+#
+# Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+# Simple file-level ingest module for Autopsy.
+# Used as part of Python tutorials from Basis Technology - July 2015
+# http://www.basistech.com/python-autopsy-module-tutorial-1-the-file-ingest-module/
+#
+# Looks for big files that are a multiple of 4096 and makes artifacts
+
+
+import jarray
+import inspect
+from java.lang import System
+from java.util.logging import Level
+from org.sleuthkit.datamodel import SleuthkitCase
+from org.sleuthkit.datamodel import AbstractFile
+from org.sleuthkit.datamodel import ReadContentInputStream
+from org.sleuthkit.datamodel import BlackboardArtifact
+from org.sleuthkit.datamodel import BlackboardAttribute
+from org.sleuthkit.datamodel import TskData
+from org.sleuthkit.autopsy.ingest import IngestModule
+from org.sleuthkit.autopsy.ingest.IngestModule import IngestModuleException
+from org.sleuthkit.autopsy.ingest import DataSourceIngestModule
+from org.sleuthkit.autopsy.ingest import FileIngestModule
+from org.sleuthkit.autopsy.ingest import IngestModuleFactoryAdapter
+from org.sleuthkit.autopsy.ingest import IngestMessage
+from org.sleuthkit.autopsy.ingest import IngestServices
+from org.sleuthkit.autopsy.ingest import ModuleDataEvent
+from org.sleuthkit.autopsy.coreutils import Logger
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.casemodule.services import Services
+from org.sleuthkit.autopsy.casemodule.services import FileManager
+
+# Factory that defines the name and details of the module and allows Autopsy
+# to create instances of the modules that will do the anlaysis.
+class FindBigRoundFilesIngestModuleFactory(IngestModuleFactoryAdapter):
+
+    moduleName = "Big and Round File Finder"
+
+    def getModuleDisplayName(self):
+        return self.moduleName
+
+    def getModuleDescription(self):
+        return "Sample module that files large files that are a multiple of 4096."
+
+    def getModuleVersionNumber(self):
+        return "1.0"
+
+    # Return true if module wants to get called for each file
+    def isFileIngestModuleFactory(self):
+        return True
+
+    # can return null if isFileIngestModuleFactory returns false
+    def createFileIngestModule(self, ingestOptions):
+        return FindBigRoundFilesIngestModule()
+
+
+# File-level ingest module.  One gets created per thread.
+class FindBigRoundFilesIngestModule(FileIngestModule):
+
+    _logger = Logger.getLogger(FindBigRoundFilesIngestModuleFactory.moduleName)
+
+    def log(self, level, msg):
+        self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
+
+    # Where any setup and configuration is done
+    # 'context' is an instance of org.sleuthkit.autopsy.ingest.IngestJobContext.
+    # See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1ingest_1_1_ingest_job_context.html
+    # TODO: Add any setup code that you need here.
+    def startUp(self, context):
+        self.filesFound = 0
+
+        # Throw an IngestModule.IngestModuleException exception if there was a problem setting up
+        # raise IngestModuleException("Oh No!")
+        pass
+
+    # Where the analysis is done.  Each file will be passed into here.
+    # The 'file' object being passed in is of type org.sleuthkit.datamodel.AbstractFile.
+    # See: http://www.sleuthkit.org/sleuthkit/docs/jni-docs/classorg_1_1sleuthkit_1_1datamodel_1_1_abstract_file.html
+    def process(self, file):
+        # Skip non-files
+        if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) or 
+            (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) or 
+            (file.isFile() == False)):
+            return IngestModule.ProcessResult.OK
+
+        # Look for files bigger than 10MB that are a multiple of 4096            
+        if ((file.getSize() > 10485760) and ((file.getSize() % 4096) == 0)):
+
+            # Make an artifact on the blackboard.  TSK_INTERESTING_FILE_HIT is a generic type of
+            # artifact.  Refer to the developer docs for other examples.
+            art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
+            att = BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), 
+                  FindBigRoundFilesIngestModuleFactory.moduleName, "Big and Round Files")
+            art.addAttribute(att)
+  
+            # Fire an event to notify the UI and others that there is a new artifact  
+            IngestServices.getInstance().fireModuleDataEvent(
+                ModuleDataEvent(FindBigRoundFilesIngestModuleFactory.moduleName, 
+                    BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, None));
+
+        return IngestModule.ProcessResult.OK
+ 
+    # Where any shutdown code is run and resources are freed.
+    # TODO: Add any shutdown code that you need here.
+    def shutDown(self):
+        None

pythonExamples/July2015FileTutorial_BigRound/README.txt

@@ -0,0 +1,6 @@
+This folder contains files that were created for an July 2015 Tutorial from Basis Technology.
+
+It contains the following:
+- FindBigRoundFiles.py: Module to find files that are bigger than 10MB and multiple of 4k
+- bigRoundFile.dat: File that should be found if added as logical file and module is run on it
+- nonRoundfile.dat: File that should not be flagged if added as logical file and module is run on it. 

pythonExamples/dataSourceIngestModule.py

@@ -114,6 +114,7 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
         # For our example, we will use FileManager to get all
         # files with the word "test"
         # in the name and then count and read them
+        # FileManager API: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1casemodule_1_1services_1_1_file_manager.html
         fileManager = Case.getCurrentCase().getServices().getFileManager()
         files = fileManager.findFiles(dataSource, "%test%")
 

pythonExamples/reportmodule.py

@@ -28,24 +28,36 @@
 # OTHER DEALINGS IN THE SOFTWARE.
 
 
-# Report module for Autopsy.
+# Sample report module for Autopsy.  Use as a starting point for new modules.
 #
 # Search for TODO for the things that you need to change
 # See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
 
-from java.lang import System
-from org.sleuthkit.autopsy.casemodule import Case
-from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
 import os
+from java.lang import System
+from java.util.logging import Level
+from org.sleuthkit.autopsy.casemodule import Case
+from org.sleuthkit.autopsy.coreutils import Logger
+from org.sleuthkit.autopsy.report import GeneralReportModuleAdapter
 
-# TODO: Rename this to something more specific
+
+# TODO: Rename the class to something more specific
 class SampleGeneralReportModule(GeneralReportModuleAdapter):
 
     # TODO: Rename this.  Will be shown to users when making a report
-    def getName(self):
-        return "Sample Jython Report Module"
+    moduleName = "Sample Report Module"
 
-    # TODO: rewrite this
+    _logger = None
+    def log(self, level, msg):
+        if _logger == None:
+            _logger = Logger.getLogger(self.moduleName)
+
+        self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
+
+    def getName(self):
+        return self.moduleName
+
+    # TODO: Give it a useful description
     def getDescription(self):
         return "A sample Jython report module"
 
@@ -54,30 +66,41 @@ class SampleGeneralReportModule(GeneralReportModuleAdapter):
         return "sampleReport.txt"
 
     # TODO: Update this method to make a report
+    # The 'baseReportDir' object being passed in is a string with the directory that reports are being stored in.   Report should go into baseReportDir + getRelativeFilePath().
+    # The 'progressBar' object is of type ReportProgressPanel.
+    #   See: http://sleuthkit.org/autopsy/docs/api-docs/3.1/classorg_1_1sleuthkit_1_1autopsy_1_1report_1_1_report_progress_panel.html
     def generateReport(self, baseReportDir, progressBar):
         
-            # For an example, we write a file with the number of files created in the past 2 weeks
-            # Configure progress bar for 2 tasks
-            progressBar.setIndeterminate(False)
-            progressBar.start()
-            progressBar.setMaximumProgress(2)
+        # For an example, we write a file with the number of files created in the past 2 weeks
+        # Configure progress bar for 2 tasks
+        progressBar.setIndeterminate(False)
+        progressBar.start()
+        progressBar.setMaximumProgress(2)
 
-            # Get files by created in last two weeks.
-            fileCount = 0
-            autopsyCase = Case.getCurrentCase()
-            sleuthkitCase = autopsyCase.getSleuthkitCase()
-            currentTime = System.currentTimeMillis() / 1000
-            minTime = currentTime - (14 * 24 * 60 * 60)
-            otherFiles = sleuthkitCase.findFilesWhere("crtime > %d" % minTime)
-            for otherFile in otherFiles:
-                    fileCount += 1
-            progressBar.increment()
-            
-            # Write the result to the report file.
-            report = open(os.path.join(baseReportDir, self.getRelativeFilePath()), 'w')
-            report.write("file count = %d" % fileCount)
-            Case.getCurrentCase().addReport(report.name, "SampleGeneralReportModule", "Sample Python Report");
-            report.close()
-            
-            progressBar.increment()
-            progressBar.complete()
+        # Find epoch time of when 2 weeks ago was
+        currentTime = System.currentTimeMillis() / 1000
+        minTime = currentTime - (14 * 24 * 60 * 60) # (days * hours * minutes * seconds)
+
+        # Query the database for files that meet our criteria
+        sleuthkitCase = Case.getCurrentCase().getSleuthkitCase()
+        files = sleuthkitCase.findAllFilesWhere("crtime > %d" % minTime)
+
+        fileCount = 0
+        for file in files:
+            fileCount += 1
+            # Could do something else here and write it to HTML, CSV, etc.
+
+        # Increment since we are done with step #1
+        progressBar.increment()
+
+        # Write the count to the report file.
+        fileName = os.path.join(baseReportDir, self.getRelativeFilePath())
+        report = open(fileName, 'w')
+        report.write("file count = %d" % fileCount)
+        report.close()
+
+        # Add the report to the Case, so it is shown in the tree
+        Case.getCurrentCase().addReport(fileName, self.moduleName, "File Count Report");
+
+        progressBar.increment()
+        progressBar.complete()