From 9882be06f64497c6ca522a99683fa80887e0491b Mon Sep 17 00:00:00 2001 From: Jason Letourneau Date: Fri, 6 Sep 2013 17:34:55 -0400 Subject: [PATCH 1/7] adding update notification checking - this requires autopsy-updates.xml to be uploaded to sleuthkit.org --- Core/autopsy-updates.xml | 16 ++++++++++++++++ .../org/sleuthkit/autopsy/core/Bundle.properties | 2 ++ Core/src/org/sleuthkit/autopsy/core/layer.xml | 7 +++++++ ...uthkit_autopsy_core_update_centerSettings.xml | 13 +++++++++++++ 4 files changed, 38 insertions(+) create mode 100644 Core/autopsy-updates.xml create mode 100644 Core/src/org/sleuthkit/autopsy/core/org_sleuthkit_autopsy_core_update_centerSettings.xml diff --git a/Core/autopsy-updates.xml b/Core/autopsy-updates.xml new file mode 100644 index 0000000000..48a2898d70 --- /dev/null +++ b/Core/autopsy-updates.xml @@ -0,0 +1,16 @@ + + + + + + + + + + Visit http://sleuthkit.org/autopsy to download the latest version of Autopsy. + + + + + \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/core/Bundle.properties b/Core/src/org/sleuthkit/autopsy/core/Bundle.properties index b049fd4d82..1fef6eb2f5 100644 --- a/Core/src/org/sleuthkit/autopsy/core/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/core/Bundle.properties @@ -8,3 +8,5 @@ OpenIDE-Module-Long-Description=\ For more information, see http://www.sleuthkit.org/autopsy/ OpenIDE-Module-Name=Autopsy-Core OpenIDE-Module-Short-Description=Autopsy Core Module +org_sleuthkit_autopsy_core_update_center=http://sleuthkit.org/autopsy-updates.xml +Services/AutoupdateType/org_sleuthkit_autopsy_core_update_center.settings=Autopsy Update Center diff --git a/Core/src/org/sleuthkit/autopsy/core/layer.xml b/Core/src/org/sleuthkit/autopsy/core/layer.xml index f72ce99565..f2f926fc60 100644 --- a/Core/src/org/sleuthkit/autopsy/core/layer.xml +++ b/Core/src/org/sleuthkit/autopsy/core/layer.xml @@ -270,6 +270,13 @@ Services ====================================================== --> + + + + + + + diff --git a/Core/src/org/sleuthkit/autopsy/core/org_sleuthkit_autopsy_core_update_centerSettings.xml b/Core/src/org/sleuthkit/autopsy/core/org_sleuthkit_autopsy_core_update_centerSettings.xml new file mode 100644 index 0000000000..c1dbc1e41e --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/core/org_sleuthkit_autopsy_core_update_centerSettings.xml @@ -0,0 +1,13 @@ + + + + + + + + + + From df97fdf3bcda3803a04ab16393a03bab59b198a0 Mon Sep 17 00:00:00 2001 From: Jason Letourneau Date: Thu, 12 Sep 2013 10:00:56 -0400 Subject: [PATCH 2/7] adding simple event log views filters --- .../datamodel/AbstractContentChildren.java | 6 + .../autopsy/datamodel/AutopsyItemVisitor.java | 14 + .../datamodel/DisplayableItemNodeVisitor.java | 16 + .../autopsy/datamodel/EventLogs.java | 311 ++++++++++++++++++ .../autopsy/datamodel/ViewsNode.java | 1 + 5 files changed, 348 insertions(+) create mode 100644 Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java b/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java index 76ad367ace..1ec27eec0f 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java @@ -135,6 +135,12 @@ abstract class AbstractContentChildren extends Keys { public AbstractNode visit(DeletedContent dc) { return new DeletedContent.DeletedContentsNode(dc.getSleuthkitCase()); } + + @Override + public AbstractNode visit(EventLogs evt) { + return new EventLogs.EventLogsNode(evt.getSleuthkitCase()); + } + @Override public AbstractNode visit(FileSize dc) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java b/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java index 431c9adf27..64ea97057f 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java @@ -39,6 +39,10 @@ public interface AutopsyItemVisitor { T visit(RecentFiles.RecentFilesFilter rff); T visit(DeletedContent dc); + + T visit(EventLogs.EventLogFilter evt); + + T visit(EventLogs evt); T visit(DeletedContent.DeletedContentFilter dcf); @@ -93,6 +97,16 @@ public interface AutopsyItemVisitor { public T visit(DeletedContent dc) { return defaultVisit(dc); } + + @Override + public T visit(EventLogs.EventLogFilter evt) { + return defaultVisit(evt); + } + + @Override + public T visit(EventLogs evt) { + return defaultVisit(evt); + } @Override public T visit(DeletedContent.DeletedContentFilter dcf) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java b/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java index 9072a35689..6e32215937 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java @@ -20,6 +20,8 @@ package org.sleuthkit.autopsy.datamodel; import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsChildren.DeletedContentNode; import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsNode; +import org.sleuthkit.autopsy.datamodel.EventLogs.EventLogsChildren.EventLogNode; +import org.sleuthkit.autopsy.datamodel.EventLogs.EventLogsNode; import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedAccountNode; import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedFolderNode; import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedRootNode; @@ -58,6 +60,10 @@ public interface DisplayableItemNodeVisitor { T visit(DeletedContentNode dcn); T visit(DeletedContentsNode dcn); + + T visit(EventLogsNode evt); + + T visit(EventLogNode evt); T visit(FileSizeRootNode fsrn); @@ -163,6 +169,16 @@ public interface DisplayableItemNodeVisitor { public T visit(DeletedContentNode dcn) { return defaultVisit(dcn); } + + @Override + public T visit(EventLogsNode evt) { + return defaultVisit(evt); + } + + @Override + public T visit(EventLogNode evt) { + return defaultVisit(evt); + } @Override public T visit(DeletedContentsNode dcn) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java b/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java new file mode 100644 index 0000000000..00e1786000 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java @@ -0,0 +1,311 @@ +/* + * Autopsy Forensic Browser + * + * Copyright 2013 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.sleuthkit.autopsy.datamodel; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; +import java.util.logging.Level; +import org.openide.nodes.AbstractNode; +import org.openide.nodes.ChildFactory; +import org.openide.nodes.Children; +import org.openide.nodes.Node; +import org.openide.nodes.Sheet; +import org.openide.util.lookup.Lookups; +import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.Content; +import org.sleuthkit.datamodel.ContentVisitor; +import org.sleuthkit.datamodel.Directory; +import org.sleuthkit.datamodel.File; +import org.sleuthkit.datamodel.FsContent; +import org.sleuthkit.datamodel.LayoutFile; +import org.sleuthkit.datamodel.SleuthkitCase; +import org.sleuthkit.datamodel.TskCoreException; + + +/** + * event logs view nodes + */ +public class EventLogs implements AutopsyVisitableItem { + + private SleuthkitCase skCase; + + public enum EventLogFilter implements AutopsyVisitableItem { + + FS_EVENT_LOG_FILTER(0, "FS_EVENT_LOG_FILTER", "Windows"), + ALL_EVENT_LOG_FILTER(1, "ALL_EVENT_LOG_FILTER", "Other"); + private int id; + private String name; + private String displayName; + + private EventLogFilter(int id, String name, String displayName) { + this.id = id; + this.name = name; + this.displayName = displayName; + + } + + public String getName() { + return this.name; + } + + public int getId() { + return this.id; + } + + public String getDisplayName() { + return this.displayName; + } + + @Override + public T accept(AutopsyItemVisitor v) { + return v.visit(this); + } + } + + public EventLogs(SleuthkitCase skCase) { + this.skCase = skCase; + } + + @Override + public T accept(AutopsyItemVisitor v) { + return v.visit(this); + } + + public SleuthkitCase getSleuthkitCase() { + return this.skCase; + } + + public static class EventLogsNode extends DisplayableItemNode { + + private static final String NAME = "Event Logs"; + private SleuthkitCase skCase; + + EventLogsNode(SleuthkitCase skCase) { + super(Children.create(new EventLogsChildren(skCase), true), Lookups.singleton(NAME)); + super.setName(NAME); + super.setDisplayName(NAME); + this.skCase = skCase; + this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/text-file.png"); + } + + @Override + public TYPE getDisplayableItemNodeType() { + return TYPE.META; + } + + @Override + public T accept(DisplayableItemNodeVisitor v) { + return v.visit(this); + } + + @Override + protected Sheet createSheet() { + Sheet s = super.createSheet(); + Sheet.Set ss = s.get(Sheet.PROPERTIES); + if (ss == null) { + ss = Sheet.createPropertiesSet(); + s.put(ss); + } + + ss.put(new NodeProperty("Name", + "Name", + "no description", + NAME)); + return s; + } + } + + public static class EventLogsChildren extends ChildFactory { + + private SleuthkitCase skCase; + + public EventLogsChildren(SleuthkitCase skCase) { + this.skCase = skCase; + + } + + @Override + protected boolean createKeys(List list) { + list.addAll(Arrays.asList(EventLogs.EventLogFilter.values())); + return true; + } + + @Override + protected Node createNodeForKey(EventLogs.EventLogFilter key) { + return new EventLogNode(skCase, key); + } + + public class EventLogNode extends DisplayableItemNode { + + private SleuthkitCase skCase; + private EventLogs.EventLogFilter filter; + private final Logger logger = Logger.getLogger(EventLogNode.class.getName()); + + EventLogNode(SleuthkitCase skCase, EventLogs.EventLogFilter filter) { + super(Children.create(new EventLogChildren(filter, skCase), true), Lookups.singleton(filter.getDisplayName())); + super.setName(filter.getName()); + this.skCase = skCase; + this.filter = filter; + + String tooltip = filter.getDisplayName(); + this.setShortDescription(tooltip); + this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/text-file.png.png"); + + //get count of children without preloading all children nodes + final long count = new EventLogChildren(filter, skCase).calculateItems(); + //final long count = getChildren().getNodesCount(true); + super.setDisplayName(filter.getDisplayName() + " (" + count + ")"); + } + + @Override + public T accept(DisplayableItemNodeVisitor v) { + return v.visit(this); + } + + @Override + protected Sheet createSheet() { + Sheet s = super.createSheet(); + Sheet.Set ss = s.get(Sheet.PROPERTIES); + if (ss == null) { + ss = Sheet.createPropertiesSet(); + s.put(ss); + } + + ss.put(new NodeProperty("Filter Type", + "Filter Type", + "no description", + filter.getDisplayName())); + + return s; + } + + @Override + public TYPE getDisplayableItemNodeType() { + return TYPE.META; + } + + @Override + public boolean isLeafTypeNode() { + return true; + } + } + + class EventLogChildren extends ChildFactory { + + private SleuthkitCase skCase; + private EventLogs.EventLogFilter filter; + private final Logger logger = Logger.getLogger(EventLogsChildren.class.getName()); + + EventLogChildren(EventLogs.EventLogFilter filter, SleuthkitCase skCase) { + this.skCase = skCase; + this.filter = filter; + } + + @Override + protected boolean createKeys(List list) { + list.addAll(runFsQuery()); + return true; + } + + private String makeQuery() { + String query = ""; + switch (filter) { + case FS_EVENT_LOG_FILTER: + query = "name like '%.evt'"; + + + break; + case ALL_EVENT_LOG_FILTER: + query = query = "name like '%.log'"; + + break; + + default: + logger.log(Level.SEVERE, "Unsupported filter type to get log content: " + filter); + + } + + return query; + } + + private List runFsQuery() { + List ret = new ArrayList(); + + String query = makeQuery(); + try { + ret = skCase.findAllFilesWhere(query); + } catch (TskCoreException e) { + logger.log(Level.SEVERE, "Error getting files for the event log content view using: " + query, e); + } + + return ret; + + } + + /** + * Get children count without actually loading all nodes + * + * @return + */ + long calculateItems() { + try { + return skCase.countFilesWhere(makeQuery()); + } catch (TskCoreException ex) { + logger.log(Level.SEVERE, "Error getting event log files search view count", ex); + return 0; + } + } + + @Override + protected Node createNodeForKey(AbstractFile key) { + return key.accept(new ContentVisitor.Default() { + public FileNode visit(AbstractFile f) { + return new FileNode(f, false); + } + + public FileNode visit(FsContent f) { + return new FileNode(f, false); + } + + @Override + public FileNode visit(LayoutFile f) { + return new FileNode(f, false); + } + + @Override + public FileNode visit(File f) { + return new FileNode(f, false); + } + + @Override + public FileNode visit(Directory f) { + return new FileNode(f, false); + } + + @Override + protected AbstractNode defaultVisit(Content di) { + throw new UnsupportedOperationException("Not supported for this type of Displayable Item: " + di.toString()); + } + }); + } + } + } +} \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java index eea33be974..55c6447765 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java @@ -37,6 +37,7 @@ public class ViewsNode extends DisplayableItemNode { new SearchFilters(sleuthkitCase), new RecentFiles(sleuthkitCase), new DeletedContent(sleuthkitCase), + new EventLogs(sleuthkitCase), new FileSize(sleuthkitCase) )), Lookups.singleton(NAME)); From 9eb8c7e5ca7378c071af8e8ff3bda998ea692098 Mon Sep 17 00:00:00 2001 From: Jason Letourneau Date: Thu, 12 Sep 2013 10:09:29 -0400 Subject: [PATCH 3/7] fixed redundant assignment --- Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java b/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java index 00e1786000..b7e770ceda 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java @@ -234,7 +234,7 @@ public class EventLogs implements AutopsyVisitableItem { break; case ALL_EVENT_LOG_FILTER: - query = query = "name like '%.log'"; + query = "name like '%.log'"; break; From f1b26f7a43d7596aa59167d628b7fe447d245782 Mon Sep 17 00:00:00 2001 From: Jason Letourneau Date: Wed, 30 Oct 2013 21:56:26 -0400 Subject: [PATCH 4/7] added patterns for linkedin, twitter, and facebook to search history module xml --- .../autopsy/recentactivity/SEUQAMappings.xml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SEUQAMappings.xml b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SEUQAMappings.xml index 786192b39b..fea8cea8d8 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SEUQAMappings.xml +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SEUQAMappings.xml @@ -33,6 +33,19 @@ splitToken: + + + + + + + + + + + + + From e924e5ca1178de90428ea570a0a2fd5e3e25bc77 Mon Sep 17 00:00:00 2001 From: Jason Letourneau Date: Wed, 30 Oct 2013 22:20:33 -0400 Subject: [PATCH 5/7] backing out eventlog node changes --- .../datamodel/AbstractContentChildren.java | 6 - .../autopsy/datamodel/AutopsyItemVisitor.java | 14 - .../datamodel/DisplayableItemNodeVisitor.java | 16 - .../autopsy/datamodel/EventLogs.java | 311 ------------------ .../autopsy/datamodel/ViewsNode.java | 1 - 5 files changed, 348 deletions(-) delete mode 100644 Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java b/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java index fa1fedc761..97d9e99524 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/AbstractContentChildren.java @@ -135,12 +135,6 @@ abstract class AbstractContentChildren extends Keys { public AbstractNode visit(DeletedContent dc) { return new DeletedContent.DeletedContentsNode(dc.getSleuthkitCase()); } - - @Override - public AbstractNode visit(EventLogs evt) { - return new EventLogs.EventLogsNode(evt.getSleuthkitCase()); - } - @Override public AbstractNode visit(FileSize dc) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java b/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java index 5d25675469..428db99c76 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/AutopsyItemVisitor.java @@ -39,10 +39,6 @@ public interface AutopsyItemVisitor { T visit(RecentFiles.RecentFilesFilter rff); T visit(DeletedContent dc); - - T visit(EventLogs.EventLogFilter evt); - - T visit(EventLogs evt); T visit(DeletedContent.DeletedContentFilter dcf); @@ -97,16 +93,6 @@ public interface AutopsyItemVisitor { public T visit(DeletedContent dc) { return defaultVisit(dc); } - - @Override - public T visit(EventLogs.EventLogFilter evt) { - return defaultVisit(evt); - } - - @Override - public T visit(EventLogs evt) { - return defaultVisit(evt); - } @Override public T visit(DeletedContent.DeletedContentFilter dcf) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java b/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java index 2e0bbb4f95..6e42c7d611 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/DisplayableItemNodeVisitor.java @@ -20,8 +20,6 @@ package org.sleuthkit.autopsy.datamodel; import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsChildren.DeletedContentNode; import org.sleuthkit.autopsy.datamodel.DeletedContent.DeletedContentsNode; -import org.sleuthkit.autopsy.datamodel.EventLogs.EventLogsChildren.EventLogNode; -import org.sleuthkit.autopsy.datamodel.EventLogs.EventLogsNode; import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedAccountNode; import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedFolderNode; import org.sleuthkit.autopsy.datamodel.EmailExtracted.EmailExtractedRootNode; @@ -60,10 +58,6 @@ public interface DisplayableItemNodeVisitor { T visit(DeletedContentNode dcn); T visit(DeletedContentsNode dcn); - - T visit(EventLogsNode evt); - - T visit(EventLogNode evt); T visit(FileSizeRootNode fsrn); @@ -169,16 +163,6 @@ public interface DisplayableItemNodeVisitor { public T visit(DeletedContentNode dcn) { return defaultVisit(dcn); } - - @Override - public T visit(EventLogsNode evt) { - return defaultVisit(evt); - } - - @Override - public T visit(EventLogNode evt) { - return defaultVisit(evt); - } @Override public T visit(DeletedContentsNode dcn) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java b/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java deleted file mode 100644 index b7e770ceda..0000000000 --- a/Core/src/org/sleuthkit/autopsy/datamodel/EventLogs.java +++ /dev/null @@ -1,311 +0,0 @@ -/* - * Autopsy Forensic Browser - * - * Copyright 2013 Basis Technology Corp. - * Contact: carrier sleuthkit org - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.sleuthkit.autopsy.datamodel; - -import java.util.ArrayList; -import java.util.Arrays; -import java.util.List; -import java.util.logging.Level; -import org.openide.nodes.AbstractNode; -import org.openide.nodes.ChildFactory; -import org.openide.nodes.Children; -import org.openide.nodes.Node; -import org.openide.nodes.Sheet; -import org.openide.util.lookup.Lookups; -import org.sleuthkit.autopsy.coreutils.Logger; -import org.sleuthkit.datamodel.AbstractFile; -import org.sleuthkit.datamodel.Content; -import org.sleuthkit.datamodel.ContentVisitor; -import org.sleuthkit.datamodel.Directory; -import org.sleuthkit.datamodel.File; -import org.sleuthkit.datamodel.FsContent; -import org.sleuthkit.datamodel.LayoutFile; -import org.sleuthkit.datamodel.SleuthkitCase; -import org.sleuthkit.datamodel.TskCoreException; - - -/** - * event logs view nodes - */ -public class EventLogs implements AutopsyVisitableItem { - - private SleuthkitCase skCase; - - public enum EventLogFilter implements AutopsyVisitableItem { - - FS_EVENT_LOG_FILTER(0, "FS_EVENT_LOG_FILTER", "Windows"), - ALL_EVENT_LOG_FILTER(1, "ALL_EVENT_LOG_FILTER", "Other"); - private int id; - private String name; - private String displayName; - - private EventLogFilter(int id, String name, String displayName) { - this.id = id; - this.name = name; - this.displayName = displayName; - - } - - public String getName() { - return this.name; - } - - public int getId() { - return this.id; - } - - public String getDisplayName() { - return this.displayName; - } - - @Override - public T accept(AutopsyItemVisitor v) { - return v.visit(this); - } - } - - public EventLogs(SleuthkitCase skCase) { - this.skCase = skCase; - } - - @Override - public T accept(AutopsyItemVisitor v) { - return v.visit(this); - } - - public SleuthkitCase getSleuthkitCase() { - return this.skCase; - } - - public static class EventLogsNode extends DisplayableItemNode { - - private static final String NAME = "Event Logs"; - private SleuthkitCase skCase; - - EventLogsNode(SleuthkitCase skCase) { - super(Children.create(new EventLogsChildren(skCase), true), Lookups.singleton(NAME)); - super.setName(NAME); - super.setDisplayName(NAME); - this.skCase = skCase; - this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/text-file.png"); - } - - @Override - public TYPE getDisplayableItemNodeType() { - return TYPE.META; - } - - @Override - public T accept(DisplayableItemNodeVisitor v) { - return v.visit(this); - } - - @Override - protected Sheet createSheet() { - Sheet s = super.createSheet(); - Sheet.Set ss = s.get(Sheet.PROPERTIES); - if (ss == null) { - ss = Sheet.createPropertiesSet(); - s.put(ss); - } - - ss.put(new NodeProperty("Name", - "Name", - "no description", - NAME)); - return s; - } - } - - public static class EventLogsChildren extends ChildFactory { - - private SleuthkitCase skCase; - - public EventLogsChildren(SleuthkitCase skCase) { - this.skCase = skCase; - - } - - @Override - protected boolean createKeys(List list) { - list.addAll(Arrays.asList(EventLogs.EventLogFilter.values())); - return true; - } - - @Override - protected Node createNodeForKey(EventLogs.EventLogFilter key) { - return new EventLogNode(skCase, key); - } - - public class EventLogNode extends DisplayableItemNode { - - private SleuthkitCase skCase; - private EventLogs.EventLogFilter filter; - private final Logger logger = Logger.getLogger(EventLogNode.class.getName()); - - EventLogNode(SleuthkitCase skCase, EventLogs.EventLogFilter filter) { - super(Children.create(new EventLogChildren(filter, skCase), true), Lookups.singleton(filter.getDisplayName())); - super.setName(filter.getName()); - this.skCase = skCase; - this.filter = filter; - - String tooltip = filter.getDisplayName(); - this.setShortDescription(tooltip); - this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/text-file.png.png"); - - //get count of children without preloading all children nodes - final long count = new EventLogChildren(filter, skCase).calculateItems(); - //final long count = getChildren().getNodesCount(true); - super.setDisplayName(filter.getDisplayName() + " (" + count + ")"); - } - - @Override - public T accept(DisplayableItemNodeVisitor v) { - return v.visit(this); - } - - @Override - protected Sheet createSheet() { - Sheet s = super.createSheet(); - Sheet.Set ss = s.get(Sheet.PROPERTIES); - if (ss == null) { - ss = Sheet.createPropertiesSet(); - s.put(ss); - } - - ss.put(new NodeProperty("Filter Type", - "Filter Type", - "no description", - filter.getDisplayName())); - - return s; - } - - @Override - public TYPE getDisplayableItemNodeType() { - return TYPE.META; - } - - @Override - public boolean isLeafTypeNode() { - return true; - } - } - - class EventLogChildren extends ChildFactory { - - private SleuthkitCase skCase; - private EventLogs.EventLogFilter filter; - private final Logger logger = Logger.getLogger(EventLogsChildren.class.getName()); - - EventLogChildren(EventLogs.EventLogFilter filter, SleuthkitCase skCase) { - this.skCase = skCase; - this.filter = filter; - } - - @Override - protected boolean createKeys(List list) { - list.addAll(runFsQuery()); - return true; - } - - private String makeQuery() { - String query = ""; - switch (filter) { - case FS_EVENT_LOG_FILTER: - query = "name like '%.evt'"; - - - break; - case ALL_EVENT_LOG_FILTER: - query = "name like '%.log'"; - - break; - - default: - logger.log(Level.SEVERE, "Unsupported filter type to get log content: " + filter); - - } - - return query; - } - - private List runFsQuery() { - List ret = new ArrayList(); - - String query = makeQuery(); - try { - ret = skCase.findAllFilesWhere(query); - } catch (TskCoreException e) { - logger.log(Level.SEVERE, "Error getting files for the event log content view using: " + query, e); - } - - return ret; - - } - - /** - * Get children count without actually loading all nodes - * - * @return - */ - long calculateItems() { - try { - return skCase.countFilesWhere(makeQuery()); - } catch (TskCoreException ex) { - logger.log(Level.SEVERE, "Error getting event log files search view count", ex); - return 0; - } - } - - @Override - protected Node createNodeForKey(AbstractFile key) { - return key.accept(new ContentVisitor.Default() { - public FileNode visit(AbstractFile f) { - return new FileNode(f, false); - } - - public FileNode visit(FsContent f) { - return new FileNode(f, false); - } - - @Override - public FileNode visit(LayoutFile f) { - return new FileNode(f, false); - } - - @Override - public FileNode visit(File f) { - return new FileNode(f, false); - } - - @Override - public FileNode visit(Directory f) { - return new FileNode(f, false); - } - - @Override - protected AbstractNode defaultVisit(Content di) { - throw new UnsupportedOperationException("Not supported for this type of Displayable Item: " + di.toString()); - } - }); - } - } - } -} \ No newline at end of file diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java index 51f45497bf..652ae959a2 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ViewsNode.java @@ -37,7 +37,6 @@ public class ViewsNode extends DisplayableItemNode { new FileTypeExtensionFilters(sleuthkitCase), new RecentFiles(sleuthkitCase), new DeletedContent(sleuthkitCase), - new EventLogs(sleuthkitCase), new FileSize(sleuthkitCase) )), Lookups.singleton(NAME)); From 4142c879191d8bd65d4dcda9ddfc643e892cd966 Mon Sep 17 00:00:00 2001 From: Jeff Wallace Date: Thu, 31 Oct 2013 14:21:16 -0400 Subject: [PATCH 6/7] Fixed issue with column resizing when only one column. --- .../autopsy/corecomponents/DataResultViewerTable.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/DataResultViewerTable.java b/Core/src/org/sleuthkit/autopsy/corecomponents/DataResultViewerTable.java index f7a0caf935..5b59f12812 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/DataResultViewerTable.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/DataResultViewerTable.java @@ -343,10 +343,11 @@ public class DataResultViewerTable extends AbstractDataResultViewer { //int scrollWidth = ttv.getWidth(); int margin = 4; int startColumn = 1; - if (props.size() > 0) { - ov.getOutline().setAutoResizeMode(JTable.AUTO_RESIZE_OFF); - } - + + // If there is only one column (which was removed from props above) + // Just let the table resize itself. + ov.getOutline().setAutoResizeMode((props.size() > 0) ? JTable.AUTO_RESIZE_OFF : JTable.AUTO_RESIZE_ALL_COLUMNS); + // get first 100 rows values for the table From 8313f18dabc1498d5ab7f5cbb0c63a29fdbc3661 Mon Sep 17 00:00:00 2001 From: Jeff Wallace Date: Thu, 31 Oct 2013 14:44:55 -0400 Subject: [PATCH 7/7] Replace Thunderbird Parser with MBox Parser while loading ingest properties. --- .../sleuthkit/autopsy/ingest/GeneralIngestConfigurator.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/ingest/GeneralIngestConfigurator.java b/Core/src/org/sleuthkit/autopsy/ingest/GeneralIngestConfigurator.java index 75c0c1c75f..3d4f792e87 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/GeneralIngestConfigurator.java +++ b/Core/src/org/sleuthkit/autopsy/ingest/GeneralIngestConfigurator.java @@ -65,6 +65,9 @@ public class GeneralIngestConfigurator implements IngestConfigurator { String[] enabledModuleNames = ModuleSettings.getConfigSetting(moduleContext, ENABLED_INGEST_MODULES_KEY).split(", "); List enabledModules = new ArrayList<>(); for (String moduleName : enabledModuleNames) { + if (moduleName.equals("Thunderbird Parser")) { + moduleName = "MBox Parser"; + } IngestModuleAbstract moduleFound = null; for (IngestModuleAbstract module : allModules) { if (moduleName.equals(module.getName())) { @@ -76,7 +79,7 @@ public class GeneralIngestConfigurator implements IngestConfigurator { enabledModules.add(moduleFound); } else { - messages.add("Unable to load " + moduleName + " module"); + messages.add("Unable to enable ingest module: " + moduleName); } } ingestDialogPanel.setEnabledIngestModules(enabledModules);