codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-06 02:24:30 +00:00
Code Issues Releases Wiki Activity

Merge branch 'new-features-20120503' of https://github.com/sleuthkit/autopsy

Browse Source
This commit is contained in:
Alex Ebadirad
2012-06-25 09:34:45 -07:00
parent 1d3e3b88e4 6a600470e7
commit c5986e2d2b
3 changed files with 11 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
RecentActivity/nbproject/project.xml
View File

@@ -111,6 +111,10 @@
<runtime-relative-path>ext/sqlite-jdbc-3.7.6.3-20110609.081603-3.jar</runtime-relative-path>
<binary-origin>release/modules/ext/sqlite-jdbc-3.7.6.3-20110609.081603-3.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/JLnkParser.jar</runtime-relative-path>
<binary-origin>release/modules/ext/JLnkParser.jar</binary-origin>
</class-path-extension>
<class-path-extension>
<runtime-relative-path>ext/gson-2.1.jar</runtime-relative-path>
<binary-origin>release/modules/ext/gson-2.1.jar</binary-origin>

BIN
RecentActivity/release/modules/ext/JLnkParser.jar Normal file
View File

Binary file not shown.

32
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java
View File

@@ -42,6 +42,8 @@ import java.util.LinkedList;
import java.util.Scanner;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import jlnkparser.JLNK;
import jlnkparser.JLnkParser;
// TSK Imports
import org.openide.modules.InstalledFileLocator;
@@ -62,8 +64,7 @@ import org.sleuthkit.datamodel.FsContent;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.autopsy.coreutils.PlatformUtil;
import org.sleuthkit.autopsy.ingest.IngestServiceImage;
import org.sleuthkit.datamodel.FileSystem;
import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.*;
public class ExtractIE extends Extract implements IngestServiceImage {
@@ -206,34 +207,15 @@ public class ExtractIE extends Extract implements IngestServiceImage {
break;
}
Content fav = Recent;
byte[] t = new byte[(int) fav.getSize()];
int bytesRead = 0;
if (fav.getSize() > 0) {
try {
bytesRead = fav.read(t, 0, fav.getSize()); // read the data
} catch (Exception ex) {
logger.log(Level.WARNING, "Error while trying to retrieve content from the TSK .", ex);
}
}
// set the data on the bottom and show it
String recentString = new String();
if (bytesRead > 0) {
recentString = DataConversion.getString(t, bytesRead, 4);
}
String path = Util.getPath(recentString);
String name = Util.getFileName(path);
JLNK lnk = new JLnkParser(new ReadContentInputStream(fav), (int) fav.getSize()).parse();
String path = lnk.getBestPath();
Long datetime = Recent.getCrtime();
String Tempdate = datetime.toString();
datetime = Long.valueOf(Tempdate);
try {
Collection<BlackboardAttribute> bbattributes = new ArrayList<BlackboardAttribute>();
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(), "RecentActivity", "Last Visited", path));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", "", name));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(), "RecentActivity", "", path));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", "", Util.getFileName(path)));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID(), "RecentActivity", "", Util.findID(path)));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), "RecentActivity", "Date Created", datetime));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), "RecentActivity", "", "Windows Explorer"));
this.addArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT, Recent, bbattributes);
} catch (Exception ex) {
logger.log(Level.WARNING, "Error while trying to read into a sqlite db.{0}", ex);