mirror of
https://github.com/elisspace/autopsy.git
synced 2026-10-05 16:56:16 +00:00
853: Android python modules create accounts & relationships
- fix Codacy issues in previous commit
This commit is contained in:
Raman
@@ -48,6 +48,8 @@ from org.sleuthkit.datamodel import Account
|
||||
import traceback
|
||||
import general
|
||||
|
||||
deviceAccount = None
|
||||
|
||||
"""
|
||||
Locates a variety of different call log databases, parses them, and populates the blackboard.
|
||||
"""
|
||||
@@ -83,15 +85,14 @@ class CallLogAnalyzer(general.AndroidComponentAnalyzer):
|
||||
def analyze(self, dataSource, fileManager, context):
|
||||
try:
|
||||
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
|
||||
global deviceAccount
|
||||
global deviceAccount
|
||||
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
|
||||
|
||||
|
||||
|
||||
absFiles = fileManager.findFiles(dataSource, "logs.db")
|
||||
absFiles.addAll(fileManager.findFiles(dataSource, "contacts.db"))
|
||||
absFiles.addAll(fileManager.findFiles(dataSource, "contacts2.db"))
|
||||
@@ -141,11 +142,11 @@ class CallLogAnalyzer(general.AndroidComponentAnalyzer):
|
||||
artifact.addAttribute(BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DIRECTION, general.MODULE_NAME, directionString))
|
||||
artifact.addAttribute(BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, general.MODULE_NAME, name))
|
||||
|
||||
# Create an account
|
||||
calllogAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.PHONE, number, general.MODULE_NAME, abstractFile);
|
||||
# Create an account
|
||||
calllogAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.PHONE, number, general.MODULE_NAME, abstractFile);
|
||||
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [calllogAccount], artifact);
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [calllogAccount], artifact);
|
||||
|
||||
bbartifacts.append(artifact)
|
||||
|
||||
|
||||
@@ -46,6 +46,7 @@ from org.sleuthkit.datamodel import Account
|
||||
import traceback
|
||||
import general
|
||||
|
||||
deviceAccount = None
|
||||
|
||||
"""
|
||||
Locates a variety of different contacts databases, parses them, and populates the blackboard.
|
||||
@@ -57,13 +58,13 @@ class ContactAnalyzer(general.AndroidComponentAnalyzer):
|
||||
|
||||
def analyze(self, dataSource, fileManager, context):
|
||||
try:
|
||||
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
|
||||
global deviceAccount
|
||||
global deviceAccount
|
||||
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
|
||||
|
||||
absFiles = fileManager.findFiles(dataSource, "contacts.db")
|
||||
@@ -140,17 +141,17 @@ class ContactAnalyzer(general.AndroidComponentAnalyzer):
|
||||
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, general.MODULE_NAME, name))
|
||||
if mimetype == "vnd.android.cursor.item/phone_v2":
|
||||
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, general.MODULE_NAME, data1))
|
||||
acctType = Account.Type.PHONE
|
||||
acctType = Account.Type.PHONE
|
||||
else:
|
||||
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, general.MODULE_NAME, data1))
|
||||
acctType = Account.Type.EMAIL
|
||||
acctType = Account.Type.EMAIL
|
||||
|
||||
|
||||
# Create an account
|
||||
contactAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(acctType, data1, general.MODULE_NAME, abstractFile);
|
||||
|
||||
# Create an account
|
||||
contactAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(acctType, data1, general.MODULE_NAME, abstractFile);
|
||||
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [contactAccount], artifact);
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [contactAccount], artifact);
|
||||
|
||||
oldName = name
|
||||
|
||||
|
||||
@@ -45,6 +45,8 @@ from org.sleuthkit.datamodel import TskCoreException
|
||||
import traceback
|
||||
import general
|
||||
|
||||
deviceAccount = None
|
||||
|
||||
"""
|
||||
Locates database for the Tango app and adds info to blackboard.
|
||||
"""
|
||||
@@ -55,15 +57,14 @@ class TangoMessageAnalyzer(general.AndroidComponentAnalyzer):
|
||||
|
||||
def analyze(self, dataSource, fileManager, context):
|
||||
try:
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
|
||||
global deviceAccount
|
||||
global deviceAccount
|
||||
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
|
||||
|
||||
|
||||
|
||||
absFiles = fileManager.findFiles(dataSource, "tc.db")
|
||||
for abstractFile in absFiles:
|
||||
try:
|
||||
|
||||
@@ -47,6 +47,8 @@ from org.sleuthkit.datamodel import Account
|
||||
import traceback
|
||||
import general
|
||||
|
||||
deviceAccount = None
|
||||
|
||||
"""
|
||||
Finds database with SMS/MMS messages and adds them to blackboard.
|
||||
"""
|
||||
@@ -58,14 +60,14 @@ class TextMessageAnalyzer(general.AndroidComponentAnalyzer):
|
||||
def analyze(self, dataSource, fileManager, context):
|
||||
try:
|
||||
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
|
||||
global deviceAccount
|
||||
global deviceAccount
|
||||
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
|
||||
|
||||
|
||||
absFiles = fileManager.findFiles(dataSource, "mmssms.db")
|
||||
for abstractFile in absFiles:
|
||||
try:
|
||||
@@ -115,11 +117,11 @@ class TextMessageAnalyzer(general.AndroidComponentAnalyzer):
|
||||
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT, general.MODULE_NAME, body))
|
||||
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, general.MODULE_NAME, "SMS Message"))
|
||||
|
||||
# Create an account
|
||||
msgAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.PHONE, address, general.MODULE_NAME, abstractFile);
|
||||
# Create an account
|
||||
msgAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.PHONE, address, general.MODULE_NAME, abstractFile);
|
||||
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [msgAccount], artifact);
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [msgAccount], artifact);
|
||||
|
||||
bbartifacts.append(artifact)
|
||||
try:
|
||||
|
||||
@@ -42,6 +42,9 @@ from org.sleuthkit.datamodel import TskCoreException
|
||||
import traceback
|
||||
import general
|
||||
|
||||
wwfAccountType = None
|
||||
deviceAccount = None
|
||||
|
||||
"""
|
||||
Analyzes messages from Words With Friends
|
||||
"""
|
||||
@@ -53,17 +56,17 @@ class WWFMessageAnalyzer(general.AndroidComponentAnalyzer):
|
||||
def analyze(self, dataSource, fileManager, context):
|
||||
try:
|
||||
|
||||
global wwfAccountType
|
||||
wwfAccountType = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addAccountType("WWF", "Words with Friends")
|
||||
global wwfAccountType
|
||||
wwfAccountType = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addAccountType("WWF", "Words with Friends")
|
||||
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
# Create a 'Device' account using the data source device id
|
||||
datasourceObjId = dataSource.getDataSource().getId()
|
||||
ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId)
|
||||
deviceID = ds.getDeviceId()
|
||||
|
||||
global deviceAccount
|
||||
global deviceAccount
|
||||
deviceAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(Account.Type.DEVICE, deviceID, general.MODULE_NAME, dataSource)
|
||||
|
||||
|
||||
absFiles = fileManager.findFiles(dataSource, "WordsFramework")
|
||||
for abstractFile in absFiles:
|
||||
try:
|
||||
@@ -107,11 +110,11 @@ class WWFMessageAnalyzer(general.AndroidComponentAnalyzer):
|
||||
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT, general.MODULE_NAME, message))
|
||||
artifact.addAttribute(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, general.MODULE_NAME, "Words With Friends Message"))
|
||||
|
||||
# Create an account
|
||||
wwfAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(wwfAccountType, user_id, general.MODULE_NAME, abstractFile);
|
||||
# Create an account
|
||||
wwfAccount = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getOrCreateAccount(wwfAccountType, user_id, general.MODULE_NAME, abstractFile);
|
||||
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [wwfAccount], artifact);
|
||||
# create relationship between accounts
|
||||
Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(deviceAccount, [wwfAccount], artifact);
|
||||
|
||||
try:
|
||||
# index the artifact for keyword search
|
||||
|
||||
Reference in New Issue
Block a user