codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-03 14:30:01 +00:00
Code Issues Releases Wiki Activity

Merge branch '1191-edge-history' into 1193-edge-cookies

Browse Source
This commit is contained in:
Kelly Kelly
2019-02-19 11:41:36 -05:00
parent 36d31de802 213a332098
commit f19d052ef7
2 changed files with 48 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java
View File

@@ -204,4 +204,8 @@ abstract class Extract {
public boolean foundData() {
return dataFound;
}
protected void setFoundData(boolean b){
dataFound = b;
}
}

74
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java
View File

@@ -54,13 +54,12 @@ import org.sleuthkit.datamodel.TskCoreException;
/**
* Extract the bookmarks, cookies, downloads and history from the Microsoft Edge
* files
*/
final class ExtractEdge extends Extract {
private static final Logger logger = Logger.getLogger(ExtractIE.class.getName());
private static final Logger logger = Logger.getLogger(ExtractEdge.class.getName());
private final IngestServices services = IngestServices.getInstance();
private final String moduleTempResultsDir;
private final Path moduleTempResultPath;
private Content dataSource;
private IngestJobContext context;
@@ -77,8 +76,7 @@ final class ExtractEdge extends Extract {
private static final SimpleDateFormat DATE_FORMATTER = new SimpleDateFormat("MM/dd/yyyy hh:mm:ss a");
ExtractEdge() throws NoCurrentCaseException {
moduleTempResultsDir = RAImageIngestModule.getRATempPath(Case.getCurrentCaseThrows(), EDGE)
+ File.separator + "results"; //NON-NLS
moduleTempResultPath = Paths.get(RAImageIngestModule.getRATempPath(Case.getCurrentCaseThrows(), EDGE), "results");
}
@Messages({
@@ -92,23 +90,30 @@ final class ExtractEdge extends Extract {
@Messages({
"ExtractEdge_process_errMsg_unableFindESEViewer=Unable to find ESEDatabaseViewer",
"ExtractEdge_process_errMsg_errGettingWebCacheFiles=Error trying to retrieving Edge WebCacheV01 file",
"ExtractEdge_process_errMsg_webcacheFail=Failure processing Microsoft Edge WebCache file"
"ExtractEdge_process_errMsg_webcacheFail=Failure processing Microsoft Edge WebCacheV01.dat file",
"ExtractEdge_process_errMsg_spartanFail=Failure processing Microsoft Edge spartan.edb file"
})
@Override
void process(Content dataSource, IngestJobContext context) {
this.dataSource = dataSource;
this.context = context;
dataFound = false;
this.setFoundData(false);
List<AbstractFile> webCacheFiles = null;
List<AbstractFile> spartanFiles = null;
List<AbstractFile> webCacheFiles;
List<AbstractFile> spartanFiles;
try {
webCacheFiles = fetchWebCacheFiles();
spartanFiles = fetchSpartanFiles(); // For later use with bookmarks
} catch (TskCoreException ex) {
this.addErrorMessage(Bundle.ExtractEdge_process_errMsg_errGettingWebCacheFiles());
logger.log(Level.WARNING, "Error fetching 'WebCacheV01.dat' files for Microsoft Edge", ex); //NON-NLS
return;
logger.log(Level.SEVERE, "Error fetching 'WebCacheV01.dat' files for Microsoft Edge", ex); //NON-NLS
}
try {
spartanFiles = fetchSpartanFiles(); // For later use with bookmarks
} catch (TskCoreException ex) {
this.addErrorMessage(Bundle.ExtractEdge_process_errMsg_spartanFail());
logger.log(Level.SEVERE, "Error fetching 'spartan.edb' files for Microsoft Edge", ex); //NON-NLS
}
// No edge files found
@@ -116,10 +121,10 @@ final class ExtractEdge extends Extract {
return;
}
dataFound = true;
this.setFoundData(true);
if (!PlatformUtil.isWindowsOS()) {
logger.log(Level.INFO, "Microsoft Edge files found, unable to parse on Non-Windows system"); //NON-NLS
logger.log(Level.WARNING, "Microsoft Edge files found, unable to parse on Non-Windows system"); //NON-NLS
return;
}
@@ -151,15 +156,18 @@ final class ExtractEdge extends Extract {
this.getBookmark(); // Not implemented yet
}
void processWebCache(String eseDumperPath, List<AbstractFile> webCachFiles) throws IOException, TskCoreException {
void processWebCache(String eseDumperPath, List<AbstractFile> webCacheFiles) throws IOException, TskCoreException {
for (AbstractFile webCacheFile : webCachFiles) {
for (AbstractFile webCacheFile : webCacheFiles) {
if (context.dataSourceIngestIsCancelled()) {
return;
}
//Run the dumper
String tempWebCacheFileName = EDGE_WEBCACHE_PREFIX
+ Integer.toString((int) webCacheFile.getId()) + ".dat"; //NON-NLS
File tempWebCacheFile = new File(RAImageIngestModule.getRATempPath(currentCase, EDGE)
+ File.separator + tempWebCacheFileName);
File tempWebCacheFile = new File(RAImageIngestModule.getRATempPath(currentCase, EDGE), tempWebCacheFileName);
try {
ContentUtils.writeToFile(webCacheFile, tempWebCacheFile,
@@ -168,7 +176,7 @@ final class ExtractEdge extends Extract {
throw new IOException("Error writingToFile: " + webCacheFile, ex); //NON-NLS
}
File resultsDir = new File(moduleTempResultsDir + Integer.toString((int) webCacheFile.getId()));
File resultsDir = new File(moduleTempResultPath.toAbsolutePath() + Integer.toString((int) webCacheFile.getId()));
resultsDir.mkdirs();
try {
executeDumper(eseDumperPath, tempWebCacheFile.getAbsolutePath(),
@@ -235,7 +243,7 @@ final class ExtractEdge extends Extract {
}
if (line.contains(EDGE_KEYWORD_VISIT)) {
BlackboardArtifact b = parseHistoryLine(origFile, headers, line);
BlackboardArtifact b = getHistoryArtifact(origFile, headers, line);
if (b != null) {
bbartifacts.add(b);
this.indexArtifact(b);
@@ -411,7 +419,7 @@ final class ExtractEdge extends Extract {
@Messages({
"ExtractEdge_programName=Microsoft Edge"
})
private BlackboardArtifact parseHistoryLine(AbstractFile origFile, List<String> headers, String line) throws TskCoreException {
private BlackboardArtifact getHistoryArtifact(AbstractFile origFile, List<String> headers, String line) throws TskCoreException {
String[] rowSplit = line.split(",");
int index = headers.indexOf(EDGE_HEAD_URL);
@@ -433,8 +441,8 @@ final class ExtractEdge extends Extract {
BlackboardArtifact bbart = origFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY);
bbart.addAttributes(createHistoryAttributes(url, ftime,
"", "",
bbart.addAttributes(createHistoryAttribute(url, ftime,
null, null,
Bundle.ExtractEdge_programName(),
NetworkUtils.extractDomain(url), user));
@@ -466,12 +474,13 @@ final class ExtractEdge extends Extract {
return null;
}
private Collection<BlackboardAttribute> createHistoryAttributes(String url, Long accessTime,
private Collection<BlackboardAttribute> createHistoryAttribute(String url, Long accessTime,
String referrer, String title, String programName, String domain, String user) throws TskCoreException {
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL,
RecentActivityExtracterModuleFactory.getModuleName(), url));
RecentActivityExtracterModuleFactory.getModuleName(),
(url != null) ? url : ""));
if (accessTime != null) {
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED,
@@ -479,19 +488,24 @@ final class ExtractEdge extends Extract {
}
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER,
RecentActivityExtracterModuleFactory.getModuleName(), referrer));
RecentActivityExtracterModuleFactory.getModuleName(),
(referrer != null) ? referrer : ""));
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE,
RecentActivityExtracterModuleFactory.getModuleName(), title));
RecentActivityExtracterModuleFactory.getModuleName(),
(title != null) ? title : ""));
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
RecentActivityExtracterModuleFactory.getModuleName(), programName));
RecentActivityExtracterModuleFactory.getModuleName(),
(programName != null) ? programName : ""));
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN,
RecentActivityExtracterModuleFactory.getModuleName(), domain)); //NON-NLS
RecentActivityExtracterModuleFactory.getModuleName(),
(domain != null) ? domain : ""));
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME,
RecentActivityExtracterModuleFactory.getModuleName(), user));
RecentActivityExtracterModuleFactory.getModuleName(),
(user != null) ? user : ""));
return bbattributes;
}