diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java index df0aec6e8d..2ce44b0003 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestManager.java @@ -814,8 +814,7 @@ public class IngestManager { final AbstractFile fileToProcess = fileTask.file; - //logger.log(Level.INFO, "NEXT FILE: " + fileToProcess.getName()); - + logger.log(Level.INFO, "IngestManager: Processing: {0}", fileToProcess.getName()); progress.progress(fileToProcess.getName(), processedFiles); for (IngestModuleAbstractFile module : fileTask.scheduledTask.modules) { @@ -857,7 +856,7 @@ public class IngestManager { //--totalEnqueuedFiles; } //end of this AbstractFile - logger.log(Level.INFO, "Done background processing"); + logger.log(Level.INFO, "IngestManager: Finished processing files"); return null; } diff --git a/Core/src/org/sleuthkit/autopsy/ingest/IngestScheduler.java b/Core/src/org/sleuthkit/autopsy/ingest/IngestScheduler.java index 482fdd9762..bc506eef97 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/IngestScheduler.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/IngestScheduler.java @@ -663,21 +663,31 @@ class IngestScheduler { enum Priority { - LOW, MEDIUM, HIGH + LAST, LOW, MEDIUM, HIGH }; + static final List LAST_PRI_PATHS = new ArrayList(); static final List LOW_PRI_PATHS = new ArrayList(); static final List MEDIUM_PRI_PATHS = new ArrayList(); static final List HIGH_PRI_PATHS = new ArrayList(); + /* prioritize root directory folders based on the assumption that we are + * looking for user content. Other types of investigations may want different + * priorities. */ static { + // these files have no structure, so they go last + LAST_PRI_PATHS.add(Pattern.compile("^\\$Unalloc", Pattern.CASE_INSENSITIVE)); + LAST_PRI_PATHS.add(Pattern.compile("^pagefile", Pattern.CASE_INSENSITIVE)); + LAST_PRI_PATHS.add(Pattern.compile("^hiberfil", Pattern.CASE_INSENSITIVE)); + + // orphan files are often corrupt and windows does not typically have + // user content, so put them towards the bottom + LOW_PRI_PATHS.add(Pattern.compile("^\\$OrphanFiles", Pattern.CASE_INSENSITIVE)); LOW_PRI_PATHS.add(Pattern.compile("^Windows", Pattern.CASE_INSENSITIVE)); + // all other files go into the medium category too MEDIUM_PRI_PATHS.add(Pattern.compile("^Program Files", Pattern.CASE_INSENSITIVE)); - MEDIUM_PRI_PATHS.add(Pattern.compile("^\\$OrphanFiles", Pattern.CASE_INSENSITIVE)); - MEDIUM_PRI_PATHS.add(Pattern.compile("^\\$Unalloc", Pattern.CASE_INSENSITIVE)); - MEDIUM_PRI_PATHS.add(Pattern.compile("^pagefile", Pattern.CASE_INSENSITIVE)); - MEDIUM_PRI_PATHS.add(Pattern.compile("^hiberfil", Pattern.CASE_INSENSITIVE)); + // user content is top priority HIGH_PRI_PATHS.add(Pattern.compile("^Users", Pattern.CASE_INSENSITIVE)); HIGH_PRI_PATHS.add(Pattern.compile("^Documents and Settings", Pattern.CASE_INSENSITIVE)); HIGH_PRI_PATHS.add(Pattern.compile("^home", Pattern.CASE_INSENSITIVE)); @@ -715,6 +725,13 @@ class IngestScheduler { return AbstractFilePriotity.Priority.LOW; } } + + for (Pattern p : LAST_PRI_PATHS) { + Matcher m = p.matcher(path); + if (m.find()) { + return AbstractFilePriotity.Priority.LAST; + } + } //default is medium return AbstractFilePriotity.Priority.MEDIUM;