From 6a600470e792a1613b1329ed40e80754ea6f3bec Mon Sep 17 00:00:00 2001 From: Dick Fickling Date: Sat, 23 Jun 2012 14:26:37 -0400 Subject: [PATCH] lnk parser, initial --- RecentActivity/nbproject/project.xml | 4 +++ .../release/modules/ext/JLnkParser.jar | Bin 0 -> 33329 bytes .../autopsy/recentactivity/ExtractIE.java | 32 ++++-------------- 3 files changed, 11 insertions(+), 25 deletions(-) create mode 100644 RecentActivity/release/modules/ext/JLnkParser.jar diff --git a/RecentActivity/nbproject/project.xml b/RecentActivity/nbproject/project.xml index 70b71da333..c4bb24dbba 100644 --- a/RecentActivity/nbproject/project.xml +++ b/RecentActivity/nbproject/project.xml @@ -111,6 +111,10 @@ ext/sqlite-jdbc-3.7.6.3-20110609.081603-3.jar release/modules/ext/sqlite-jdbc-3.7.6.3-20110609.081603-3.jar + + ext/JLnkParser.jar + release/modules/ext/JLnkParser.jar + ext/gson-2.1.jar release/modules/ext/gson-2.1.jar diff --git a/RecentActivity/release/modules/ext/JLnkParser.jar b/RecentActivity/release/modules/ext/JLnkParser.jar new file mode 100644 index 0000000000000000000000000000000000000000..e1061b5cb76dedae9f077f9ad595f959172345fc GIT binary patch literal 33329 zcmeHw34B!bwg36eo#ft3ZpdVk2}}rNAwU>N*d)pzN>&&M2_}KCDH)Oh2EzoiAZY8- zYOB6lck3=%71yfK1S(qX=CiHsd);66<+ZP^t=;UVZRLH>xwB=sft31x&(G)o(42G6 zZ{N?k=bYc2b!#-Ii^w3_aKSfMP|Ck7a?;wyj@qhVOVj+fKTotSk#s$hJ``#3eizC4 zuK<6Eq-$$if=!L>9o1`_)`p^y9pQn&stw`(fksL5{07ni5jGH`Ki=T#7J6 zo>9Fx$5r1S4h@ETs_G7K`qQfyY+JCTD$*V984QQ2wl7*(TG`qk>h2Af*7x=A?duN> zqU1Tq)*Bias9F~q+!ZLzac!)sZ(X~#v85wWx;7MvR!MB>g^}Lg((U2WP)|>|r!+J) z*tZASyFuXEvuyCYC^BbZE~&MI!&Qvru~ej!18~c5tvivVCYUJRr@` z>2*Xj9Uq}+*@UXF$tsm)cJ~iP_JlDas}*Hn{ql3h9t#`XlJ>|&2+E3d_eF!zp74G} z*#o=!F0Aj{vnLeo;W6zSToXQk65172?g|a8k0NbPxVaBop)NEKu8sC^;=XA6(2gCE z{jEE841@=fe6ymQ-gqM3YKlBoUwT8)o%7o<0MVTo4|liZ<`h;5iVDW$i&dy-a(c={ zj58YIj+y=8Ui5Ka*s9KTVPF6GsH7o+iO&l4?;P5Lg@9=@xwqT_J`NP+_4Ff8d$>Om z>TMa?vz^yTmV|X2*o!srYmg0`gh@puwv(JlfG%b4>+3~b&7tk#UPaTbX19a~xjk*M zCh}T~&HZnX#u~!o(j=B?(}b46iA%ATU({;Hy8ga>5o{K#i@(M4i&dT)p=ge6XKj+A z+mnZ^rGZ#1iiYq$9Ko+ibf5>w~uNlBNNBoYZS&x}MPgJ&t#SsC0?7Ywdm zy*d~Swr@UuExp@9g0^FqTqwu4*FJ~cXuo6KpR+-cvmP5-Q7#Uuu(bg?Lfd;0;*njx zA%vX)Iu@vhajI*l)d37QaU04_KVK$j8o*dFWNrw zX|~Nc$*xhf#J-M`=5r42ir~1(ORbeTH}*R?v#Va)H9@D44o)Lf{#DHQ5<9d9=*hVQ&h&iO$cf8 z6AU_$1QSz;EH;Zr(eeonl}%xUhpF(l{C?-jK@W zdAW9`$QwM}b$Fk#%8pa9KDPG_^>>GPrC?e`mgh}vQj~sg(&==DNlPgJmYft#Yy0~{ z2Uun>X&Ieq(i`*#lm1Az==3L({!D){sm=<1)1)R^Y0@eNK?bY2yfqA(8LXuilUiw= zN#{_TN$m_e7_4Wofk7vOjSMz1*vw!H=iN%%OzL7XWYzYTNnzS$QiRLf%@OA_=w+~n z+Hj(o^jEqIvO)T(Rmbm7;eM0;Mt_I2xYeY$>1sttJx${yyygAAE0y>HqTP7Oti>`FTEnK@4N zHj8yk_bjm)<5bCvJ9A&CcZgp^%CU!SkG4d2vE+G^vB;@tQgUJOnnH1S%T?s9Okpn8 zKrZ8xXWn?F+YA=!Ieon3Cms=QVPv3j&)z}2ZDfY_?hW(%M^$Q@VlNHH^T60@LJ`Jb zUwn+lbSIt_qn2+oTU3Tu${M^#mym;ZAf6n&2?b-vVL2_A=URkgt0m}0(AaPihdn14 z+fFcco?vV~!PtL-u>}QV7YfEk6pXzn7~4@WcBEizO2OEdg0VFPV|NP11{I7wDj3^T zFm|e7Y}Q13d(d8NSqaCk6^xB57<*SRwy$99VBm7(jZz=rULxluq|t05^*;Y$QvRtU ztWh#95qOYt z{m)XSZ`Q{t%R!x2%v6VteJxpx>j-717c(zbjMvE}m{N{umE#&y&R6|~Xi1L0P#>X5 z{=%#g)aA_{A-CUaj!>T8n=?Wlzjx9I<@>$4BUIq`xkt$B_vMXHq2K2jp~-$<{s>L+ z`wB+L=l6L>sL1at9HFUx-{cW0_WP!c&@{i-H$v0>zM>H-@%u0qrOEb}9ij4Z+h5G> zpCRp^VYR<3t^K}fBUIt{P9LF}eqYH5&GP$7M`*U+S2jYGeqZ?r&3PJgqtOL`qf`Z0 z4{c8aWl{kw4ZUyQZ)F9`Vvp6|x|eiR(w5io!!kzxeL z|52R&pTyz+uQ>a^h@=0jIQhSYgZ~F~F8!3wqhDfe{SGDl87$!Mv|VY`t+J>`M?KKmH^29L+;Jr_ulo(kz;e zy*EVrXa@dUL>FQ`S0Hpg?Z?whw7nSV4j?29dWbGUs@=3WmTnI%u+pJ^PIocQQZpsp zduWF8$J42*csgFi^j^9IW5-Xt>y z#1o$ch4RE_!DM;j(_o4`@p<5rCq5C1Q#xI)l+)={{71mU#HUtt!K>8Rdls=7GYg5n}zc^-(;J4PI~4WY%||XwOoZCkS=J@X^BneU-{ZEDU>&-{dK=7Y91=cQ+U+BWljwu@z2`lyfCX1*T` z?fCiD(ldYDHuD3v^PQQV`30NI)_gyRx*xJ_zBj#)Pudis=#XvZ$?2ItYn%CD+x?xJ zzP~?bn;CCbHUsBNulb9%nIE;yJS#o(mu)jYW}A6-dgia&W`3NWuxWNhdggE0X8xFM z%|+>%zh|5IN!vBOEe_@+>*f#Uj^vti@X2y%S zHQMUE;G*EHDhKRm^2-pWfkw%H2O0eI6oA(X^(I2S96I}DI-ik*hVV4yWtz)K0?Llk zT)aihvr<%fsv+50kyWEKpYs>KOm{Gn-`&jKDqOCmpuWjiQo^5_qc&;CfW=}(Yz|BQFYzd!tQ=lkF3acDkX zpkwqMjOVW)IJuNFIru6kCc3b!Wl(0J_w4Gkt1rsTxlO=iz|HvEzrfX@X!4|qFpH}DSNohy7} z4b|V-)}xDcues3fuQPyQSkX5jR1;l#?AS4#{zIp4xzOKl zyC7hHhXD-3-=pulAhZ6!ML(n;>Gb0)1hYZdg%=Z8gM;)l4*9u@enGG4^h<+&#WAnD z=-2d{Ecz||j-P(d;0*?UVDLuRGCIkJ?doG!cqA;}{ugUL*e&>0vgMP;Epr5<)K^3qpN&F z6}V`b^6IKkSCctvii^%xK7J}Cmt-S z8Vn`MkD`5b2L{7+FwuwmF;=cf4=es+#{cbz8fb%QLD7^H)3s&FPbl6^D=J<~-f=0R zC+!wneoToOSFf`U(yA#ZYH9Z4P6F4mAN0t*u}7+hOR9g%q#a|tN|5&*aS1t}T|)jzcaV3&^W!AG8)_!b z>l8(On*WZy0XvZ%8)agy90@m#e5_ga@SR|r0RgK!hX z+z##vTh;2c23!*pCg-FT1}0P)+#Iy6RCR-m)MGpJ#T=IOA^!z6#<*ZDJyka){W%GWtJM;Y+JcUGNc(wO$ls?+dgxJOtpX;XLjSPVqch; z`Nx%NN6by~*lOmV$63*KsY+ALQGS@x)Lb+=#R`(l8n@KNm~RSGGojR-2S5=MlH`D{ zs!Ua_=9_APTBxf$AVh%|+8uJx1-_LcI|D~&MwEFBQ`%Yn?&O5uDGI$)|ZR3(6hqyKT)U0ZCwboRv zYMrUhQ7~=3M4vRF9e>pXtA*k7OZ2L)I!v`eb#j7@rrLxj`Zpw?FL0`6wb@i#P!@fh zo-@@}F7;dn=P}sEqDQ(>(^Opw7U5kAOEAT}8DH4O`i`cmg*DBMoCHg`B0laX+CuTk zJ$@~lst4UgQDGCZ6*|6C?c$M%m}<8=-&DOk$9qf_RSQkkr}mC%lVvGPovEZOqpJ%} zZa%d ||)pQQ0B#vUqI%62wFHjjq)L&(7~VL4C$!o?&nDYCKoav6(isRMjq0HPGK z^bJ9bPReKN;I0@K?{LbDvF?xKm1CLjv2s)LLPp=qCH3NXnIdy$Ba}mYi-`Q<IahuuQ0~^2JN&p%4WcK+~ z$J=~(%QQon>ws{MS{f{~wLSmlbRx{5CrO)kcB}+TGBoz~4MZ&W&$5(*aEzM(r;G`O zIb3E6J!OOVegqrf7Ls<1&q#gmu`iF?C6@bEyvLMRGK0b!k(~Ga_FhS|Eanp16RCnV z8j#9zPRSGDq~50{-2EawsNIsxPtlET-grH=+3FagY^l^@fLN)LncoX#NylGgbj+&d zRFjLR_`vXp;0+ETsV+Gt=oDW%&cGg1Jb%_o$Pk8s-6bAT|L1U;;v&549d$UJjC1Qa zu}V(jjNZte2u=tmrW*%yR)3ha6LRM9R%Y2x&KF2-IA!W^#>X8+iYx1nm$j0jT8dvt zuAGd*1jQN7Iwh=C#Ex~AW<*i79b2)QZF6X2#g5}xqC+*sS~dp@Hh3yxDG1mFRZssxLQL|fAic=EZ5GOR(wD8%$>F<;5G&o$` z{WNM{05ku&&HyTQExA&O>Cj@L)i1J%xuM8`ky7(AHYRFda={m8cW9 zPO{-&QGkJ%jKP@#!*MAtop84~c8YXyw=}p69qK?hDujl256a}HsC0}wQ9zDkC`8k# zPlp=>xB3DDsUS{U4bG~;z|Myf`F-5TBY5|iJ4{8RG_`Z?C>1ZC>vlhHjMB6grfQr5 zGXSTbo+;1}=#p?#V2;2^fF(7#bKNe<-syD?Q|Ty`U1Fhwv{(|jwVFJ6@OV9UP}UWB zjzi>|>-A*xNVY(}H_z+os>wTa?7LcxTLtn|z@q~BDp264@v1_s7hQJDeGX>7l zYG!LSm0tJllq&(V1y*{?hpA$eW};V&4$^iBpTqD7%?cC>=@sbr`rQTh!l%bu;+@gu z^>=CBIc|5)VVWJ7e2At=nz^yaxe{4mMRHh0mv)#c19@EG9IHY`2kEfnlL~95BK(TkqFd^|gbd=FS za(U++p{jt7BVaP&2u26tHDu*P7Y@_>z_irTs=2iJf$5xN7RN6Lc#a#wQXb{0oMbj9 zuMEIns>EB#&kF(tbMai-HA)LRRiK1td66~CjL<6oTv#FkB`Q$Lai>{vj1qCBDp1C8 zORP9XiMTQqDCf8uD~?eju3QCXaNOxu9HT_sjH7hMreYX?mU^AujKa)9qtN9wy*b`V z-dwNSm*?~N@_hxq5?`sW%vTPNGOw@DH`zPI=kpf%ruvF~(|pqpQ^2z2;6PN5!WRa% z4eawJ@YAV*=gsLj7TGgtDNcX@&V^+NJrn;ehiBkfI0(25tc(xC^Q81q-+z$M1tUS02VO`WSM54Cma_I4qyV5qcPh z=yNzgU%(Oi5{}PL;{bgbrGE|wMXx$sKoh9_1b z?N-HfzAAw?Ryn+}WoDlU zjvTtqQA{^Ds_7=j61v5)l0M?tK({%z(Cv=hbhl$4-Q&2H?sMEu_d6b>2OUq+A;&O1 z?Dz~l>i7aZ?)VZt;rJmv>G&Bv?Rbrb9e<-|HH}8KOggMhp^s}NbW|&+=e5)56WTKP zt>IL5EW+Gef*BgbsCzKNxJ>~Mv3yW|%t06Ca6iq47g-nOp??MNBI}~L7=caj80(@r z=zjyf2Ty+V_G2)Vao8)Eol7L_yKvyS6i;)}@2luCJk3MzucXWIRE05kAO7nCpZJOT z0%p1kK2)!%&(almDy8457m>1y%9K+*hBeSd<*@cWNFT)04CPk$qQow$fEw#|td1_4 zsfyK2a9QetCtHcS9^MIEG#hrFYw1IHs$@P9<2Z(P5xkNv1Q+pYd(c8=rPH+@x(;C) zRcPnIHJ}UJ%CBvt8}O7t3$!-6k!}KOuF;z5W;_{mrq+b zbiseE1*3c$o+eR;R!z5KJaaK?KZJwJofy*x9pA%B-U{~qu;bhCEZmB*f6Vbsx(84B z^fAZRu*SDyw4Zi-nGT{9FFlLdy$>tCkPc(6A42S8dd~3*d?32ORbOy?7CYfF^3h9< zPr*idC&Z>tJ6?pje=BT^FFSZ{wnD7lhBDdH;OD@#4#;9K*Tyjpf4sF2An=LUSva`b1L)T zqjWZ26JW|eOtpawttOL+x_c<#&75{08PgmGX@2qTl*7UGHTogS=BI`mYjm%E2W1|j zJYR+vZwif_S7hSV;4}Ox(Uf3=7#4PE_%4Rxd)V6F$Hx2t&4wl3Pd@_V`w5ucPtmEL zfqDG`%<464lV72OuR}QhHRSQ%$S_&&2^xJ03`|GL{MZw^l^C!-`V6)u7B|8^i*4_a zr*>|LEcuRJ+_V{80dIJ_LJh>b0f zCQOlrQVsvqVh2P%%Tt2ieJsz>H>9nlR+>b+j6}PPSi2mo0-j)*f0=NZP$o~X%)d{# zOlYDfRwfP=ez7@u-whnGUyhYI6PW+yOU{>~H?#>kf9RvvIX$ zqRt!Zi9*Zy>lO1{c*m>OsZgf{F07Y@3>I#x**@G%;2~b#g7* z*pCOCq82Sp7w6m|H+tBFpjT|DZC>99&FZOMSWVm~I`u0&s4%2peLS3 zXk2VBD93D?wqF}acy3I#X+%(TPBH(C%E$_q` zfwmF>qq%abpch2$A|4#j8DJHYAw|MO0;)WAK)HqqZ!wOSNc@4}7KJ$Lbh-rTr$U;v z(l5a&#Yb9pJ~{nIDB~q^T09~(11?O&ZWmgtuIQ%CCf2@d3Vkfo3zOGtpS?5I=F3Gzh1hs{#$0iF+1S15+atW2~%n-`Vcma{xFuB?{LCi4Q zpCQG~x5mtB{-v0M%P?kqBg|^#9GvRh*tvY41=0{U4zyXh=_mL@Z(Lb?6|`&o#~JNT z@PrRW+F`w&Pv4a;jBikpVX~7tuyExRLL8Xk> z8&t-4gF)qtI}Mt_c%wlTj5irHlksMqw!n(e&=%a#xNUvQnwHj1n9Tkucal7-u$I4wKZH;SNH`LZOH-fKNAx*)JjSVp4C*wPkk@XF2tuUp>TGv*)wjtP# zo3OU*V4Tk{B*qw9E^+dYdy_OZ^#l(2#Ws8Rv!cOrer@!yLY%eXdUDjbmI*lxN}%1y{Kj zQW!Pr5?(l1u51G=jrI+e?qIh}u#LqOVsM&?!=Qv& z2|yWxat1RPR4|xHCGS$sGM)>8a2)n%&H|@F=ZHBD`X?A&6pUU9Mn?ssuY%ECISnzs z!kI8bpfhnQVX$#F&I2_bXR4Bv%!8I7eYIRxu6trX4Zl;)j_$LI+0(;B6?IA^koGtj$0 zEc1gXlzG$qBV;6vU`1jC^Esa-z33n=3_G6^)78(8Qr0Gq>o8@%h%B01fi0BmL2%C1 zn65QwZxE}lMXKdj^nA2^8A6@-uM7&?IjC3%_g;?vI55z~c+2IU@$JB~dD>_N{xBwQ zQ*_LQN6M=gxFnX^Y%?j4MwPuIz5#lrc=6_D!(q6|`^ChpDiAlQB$F+Bdlo zRFq`eJO$;VKBz%&PDek_z#?1<7{FEGWl%Ps3B~b}#GE$Zoto#i31bsyA+IANjv0kU;I(51*@*5d!5-w~|CA07?Ol&o19^-Qj zs$zT|mJj1?2F+*OWzYh~A%hk&-fmbgaoq+jX1d3)-s8eh<}z-s+J>t2+P3;t5Jgf_EJC)H*0!~^%?L#1b**i+oHV!{BrVXE0dG@`v?Vl7vk3E_&-^R*(nYkIsT8__)7<(PhEtwP18yF#0YS z-4~1z5R5?(jByZ*p%9GG5R3s4j4=_6VUdFv!!0rd+Ze64+q1x+l(47qWQba%wBByp zz}hU9wE|(|$`Gj;8jvt9Lo|X9FgL(-19B1L%Me_KB}0T!`3}esJ7G>s$`C>65SPte z(!i&=xcxdLCUS0db~nK#L*)MN-*RcUGRm z3MiIL~@zRt>JOqYNXcXpm(1(ZrancK{BTLI+~FvFdbS84@RNWe_@q`VbYz$|xe z+8aB|29OgV2tZDNYydd{vH|1-mJJ{%xDm#Z0s@PGvWBS`2r824K-usN0W#sZ0h9xe z3ZO~DG%G1n@RZcai+($1yaO`DddL(Tu#-EnJ~jew!rX6$MQsa=nOk8dJQwD?^I!zo z2E93(tV3cIh_8WlqAYem|IA7ROL?$?=A_FUp2J(u{ZKX$|Ba_SNH~C|Ng7WuOMkx$ z*4Qg`KKnlC!pggf!POjdjlr4(C;bZ(A2Mhi<7=TwVEkc&+8AGFSjvR!4eDU}27}f! zzR{o!jBkR+6XTl=+Q|48!xCd|HE1)_A2BRR<~D=2GJU&2=Q6&-pz|PjUWTpeq&p4T zCYL&yxXYj}4Vy$_?lveSnkA08$Dr+E6=LFEgSs`I4<-&8)T2?UMcijlSmVvXG4~s^ zLqjz}eAJ+wn!<2%%mW7P(ol^M4;mEFoH61doen`hfWPGNF1V>qx@lt2$-Q&O`sBW& zzMNUX_{ZDu%G%V2&#kre#hrK|u%R!F`}fAZ=?mJ1@b%mFFkEo)IcZ$p=?)LTZCqa; z9U2JtKn~-EHiY^wj6{QwgR+pkc3?d|^bBFjDv2FQk*uX}U8JYCwl@+=W`~gGMuyG^ zK5)A$vZpz8fb+Ri+SGyjED$pb8l%={Hrd5_ZFn$bU8R}a5EZR+FisU;)h*-|27?aHm~?d`izrc#Ck65{$O9DG9qt&S!l$v@1qTs}J zPpJjJ%LKrQX^4^?IH}kt;@%z;UKNk%^yoMmqC|Oo$>%W>?jw)$hyBjyr~Q0=r`3e3 z62LhO+8DGm=wPs(!3GAM3^p>@#9%XnEey6YIG4eB47M@oVi01mok2H)9tL3sI~eR_ zu!}*2THnor;u;*8cu(emA{G=eR)R5Hf-z!(F=&D@Zh|p%f-!o6F@SiNe?lf^W=S?}p%fPvM6Kcs z7(*_#GCSU|1W`wyh-&};2%^&6+3s9Vr3klkg!a4L9(aR7*qtYIl{?QA#6BK&2d+Ps;Aic?*3-@7&)$U=M2b4EV^MO3@q6Nx_Q!G%y zFr5M99j0YKg~N0f(BxsN1%k701CVc+Rst0b)9R#f&danPB02AYNpRdLhG6K2VR0$! zrK_L@?SyG@Cv2trVRpP4meM<5D`j81=V6}wB8+L@M~>gXj(Ciwt6ZqAn{yzdZPVt`>2(0ZRtJ2P6M6 zSBq$hKf|fIS`0!47=jG2Ps)17TrCcyH0}STt3@9U@x3^bqc~t$>EVFoYC^6St8abc zp=V){YK{qD!8NV>-CJpvGiFwVSn>C1@Lg1TEx5x-_0lzZnR`|YKF|Ql+5e>FLN%m`l zZqs1I6yi4q-7cRr<~+YO=njqTv`qZYpgT1lXC{7c&|MlUFPV75pu07;rZVvdgYFUY zBNKl#=w1z?ro{Zopo1Ee;X?e`p!+noL~^pf7<9h|<+u=U8uU?(?X(>8mO&3_P?ihv zSA!nZpfnfaZw5W2L1-4@?*<(b3oPe(+n|RvDAOh8m_d(dP^vQl(-l3cf$IyQ40=q1 z-c<;PL62*!Rpw-xK~HF~0Se(X=wlk|nK>rIpeHq0MTN*T=qU|)XCZWho{npklwr`Y z29vSGWEu2~2Hl_#E(2FKU@jFRTUREu4V^75_1jt+JGRwsV0DW9FVCd0U3;6F&DsTD z^du^1XsurlTUb5JTggED>e$NG_SPnt!g3QSVRA!@poB?;u-i{tQyUCoPypElL$Q<0 z-_Tg!+E$0p3ncQdYisRjhv_agtZDVOwnp*#Nv4D2PDc=06uj0Z@^*9vTj0l;p9pAc zXj{}?yLKJh^UOqOeS3ZCa4rtEpsC4@Hg1G1uR*$%9P{>$T4YK#ys33#UG134H`T6c z<(KS4HH{mCO=wNB-iBKKXhI^MJ)>&d(6ZzxwbreM-I5)g5S*-RZEbr~?Z(u+t6J-} zwQ%Xl>e^xDtW6CF)`^8P*@x!V`ZcMAbTqcDZEr)Hl1*%H8#BG$=94 z+OZY$a>M{83u)l^WVLHLTh^t{=H|wh&epayV z4DMiXCxg2f+|A$~2KO>J$lyK(_cQn?g9jKq$lxIchZsD};1LFoGI)%^;|!i)@G%BY zGI)x?(+q|gJj38w`VbDNq`Mqj=-(aY>Jz%MT?N^3F0_)E24d|bUnFFV$qCZQkwl!G`C5V}$5 zCg^Tg3cX6`Aau8@gDhL6}sDXLZ2ga8+5nrLU#zg9=h8NLgR`fhJGV- zxA;gj`mX15O@Zaq@sG z2OK)4ijxO>aKOo<3Qw0Pkj|D(*@>mQ6CyyE+IC(4uf^Pau zAn2yg27+$74hXvGMj+^>R{=pcy#@%n=@ua9rq2O_Zn^^qy6H|J=%zOVK{tIa(9~h- z0xBM+ZlGzyv;%1RFhzh$hN%~*beQ^p%7&>Q2;bKj0-7;Q`++Kk>0+Rn!*mJItYNww zX!bB&0aQ6mA53b$d5=FT3X%^)_kA6Xkn5rSxB)M?H^SHBCYU2{hSld5*nDoq?fQ>E zp12L^Z^sSdJ8;l9aMh0PX%yeaW#EZZKem*ZhBB%L=UNJ z;2LoUJ&dnJJffb1S@rYunEEz7u3n=j)LXds?!wm#is&haA2;6v_=3S|dd9ICci(r@ zh~pv}bzB2B5I=9fikroJ?tUFN{o`8mZ_zdBTJv?IEq8wjjvD;Oca3aR#bXsXG{c2D zigdn1jXT)WCiKdUllP>*ORKX-|5$yw4oiWpm#hx+LCWPB9hQVKKdqd&nTNY|c#|9V zO~d~E!1|?4e6H_!wfV_zPUMjXEw;&sx5cD{7yroN#J^Q|3fJ-!om`(hjtp<(2|A96 zKXD0UoOsrVi)#i{Y!0j&{)cZB!FuEY#BUKnJH<52zx*3uPvgPCm+zqN!-9lp0jDXL zmg0g+2KYXHm+flXk(wLJ+q7ue04KsgFD z*SJ4Gk5ci^O|L@@mGT?&*3Z!=v)cV2J!jy54_pofpY6}npQ!R|$;*H%Uy6}QSxo5} z(|^=Gp7(*vw~x&zKMUE-Kk=SkMEd9UlSO2gj;TBOSy$^kNG~Y;Ds{4;{m|Z}bRvEM zwc^AVa_wtLzwVc;C9ulAmc$CRFEIVuL9#$?oqd5eo5Q~7bnn7s(HCyCFFLVX>AWRb^hFoj79B4pgLgIFAMj3&BjeIb GnEG$lzi@{D literal 0 HcmV?d00001 diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java index 30ab5acb07..9884eff34f 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractIE.java @@ -42,6 +42,8 @@ import java.util.LinkedList; import java.util.Scanner; import java.util.regex.Matcher; import java.util.regex.Pattern; +import jlnkparser.JLNK; +import jlnkparser.JLnkParser; // TSK Imports import org.openide.modules.InstalledFileLocator; @@ -62,8 +64,7 @@ import org.sleuthkit.datamodel.FsContent; import org.sleuthkit.datamodel.SleuthkitCase; import org.sleuthkit.autopsy.coreutils.PlatformUtil; import org.sleuthkit.autopsy.ingest.IngestServiceImage; -import org.sleuthkit.datamodel.FileSystem; -import org.sleuthkit.datamodel.Image; +import org.sleuthkit.datamodel.*; public class ExtractIE extends Extract implements IngestServiceImage { @@ -206,34 +207,15 @@ public class ExtractIE extends Extract implements IngestServiceImage { break; } Content fav = Recent; - byte[] t = new byte[(int) fav.getSize()]; - - int bytesRead = 0; - if (fav.getSize() > 0) { - try { - bytesRead = fav.read(t, 0, fav.getSize()); // read the data - } catch (Exception ex) { - logger.log(Level.WARNING, "Error while trying to retrieve content from the TSK .", ex); - } - } - - // set the data on the bottom and show it - String recentString = new String(); - if (bytesRead > 0) { - recentString = DataConversion.getString(t, bytesRead, 4); - } - String path = Util.getPath(recentString); - String name = Util.getFileName(path); + JLNK lnk = new JLnkParser(new ReadContentInputStream(fav), (int) fav.getSize()).parse(); + String path = lnk.getBestPath(); Long datetime = Recent.getCrtime(); - String Tempdate = datetime.toString(); - datetime = Long.valueOf(Tempdate); try { Collection bbattributes = new ArrayList(); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(), "RecentActivity", "Last Visited", path)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", "", name)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(), "RecentActivity", "", path)); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), "RecentActivity", "", Util.getFileName(path))); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID(), "RecentActivity", "", Util.findID(path))); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), "RecentActivity", "Date Created", datetime)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), "RecentActivity", "", "Windows Explorer")); this.addArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT, Recent, bbattributes); } catch (Exception ex) { logger.log(Level.WARNING, "Error while trying to read into a sqlite db.{0}", ex);