diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java index f934a420e3..466fbb6997 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java @@ -204,4 +204,8 @@ abstract class Extract { public boolean foundData() { return dataFound; } + + protected void setFoundData(boolean b){ + dataFound = b; + } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java index 61a121ac4c..dd12961504 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java @@ -54,13 +54,12 @@ import org.sleuthkit.datamodel.TskCoreException; /** * Extract the bookmarks, cookies, downloads and history from the Microsoft Edge - * files */ final class ExtractEdge extends Extract { - private static final Logger logger = Logger.getLogger(ExtractIE.class.getName()); + private static final Logger logger = Logger.getLogger(ExtractEdge.class.getName()); private final IngestServices services = IngestServices.getInstance(); - private final String moduleTempResultsDir; + private final Path moduleTempResultPath; private Content dataSource; private IngestJobContext context; @@ -77,8 +76,7 @@ final class ExtractEdge extends Extract { private static final SimpleDateFormat DATE_FORMATTER = new SimpleDateFormat("MM/dd/yyyy hh:mm:ss a"); ExtractEdge() throws NoCurrentCaseException { - moduleTempResultsDir = RAImageIngestModule.getRATempPath(Case.getCurrentCaseThrows(), EDGE) - + File.separator + "results"; //NON-NLS + moduleTempResultPath = Paths.get(RAImageIngestModule.getRATempPath(Case.getCurrentCaseThrows(), EDGE), "results"); } @Messages({ @@ -92,23 +90,30 @@ final class ExtractEdge extends Extract { @Messages({ "ExtractEdge_process_errMsg_unableFindESEViewer=Unable to find ESEDatabaseViewer", "ExtractEdge_process_errMsg_errGettingWebCacheFiles=Error trying to retrieving Edge WebCacheV01 file", - "ExtractEdge_process_errMsg_webcacheFail=Failure processing Microsoft Edge WebCache file" + "ExtractEdge_process_errMsg_webcacheFail=Failure processing Microsoft Edge WebCacheV01.dat file", + "ExtractEdge_process_errMsg_spartanFail=Failure processing Microsoft Edge spartan.edb file" }) @Override void process(Content dataSource, IngestJobContext context) { this.dataSource = dataSource; this.context = context; - dataFound = false; + this.setFoundData(false); + + List webCacheFiles = null; + List spartanFiles = null; - List webCacheFiles; - List spartanFiles; try { webCacheFiles = fetchWebCacheFiles(); - spartanFiles = fetchSpartanFiles(); // For later use with bookmarks } catch (TskCoreException ex) { this.addErrorMessage(Bundle.ExtractEdge_process_errMsg_errGettingWebCacheFiles()); - logger.log(Level.WARNING, "Error fetching 'WebCacheV01.dat' files for Microsoft Edge", ex); //NON-NLS - return; + logger.log(Level.SEVERE, "Error fetching 'WebCacheV01.dat' files for Microsoft Edge", ex); //NON-NLS + } + + try { + spartanFiles = fetchSpartanFiles(); // For later use with bookmarks + } catch (TskCoreException ex) { + this.addErrorMessage(Bundle.ExtractEdge_process_errMsg_spartanFail()); + logger.log(Level.SEVERE, "Error fetching 'spartan.edb' files for Microsoft Edge", ex); //NON-NLS } // No edge files found @@ -116,10 +121,10 @@ final class ExtractEdge extends Extract { return; } - dataFound = true; + this.setFoundData(true); if (!PlatformUtil.isWindowsOS()) { - logger.log(Level.INFO, "Microsoft Edge files found, unable to parse on Non-Windows system"); //NON-NLS + logger.log(Level.WARNING, "Microsoft Edge files found, unable to parse on Non-Windows system"); //NON-NLS return; } @@ -151,15 +156,18 @@ final class ExtractEdge extends Extract { this.getBookmark(); // Not implemented yet } - void processWebCache(String eseDumperPath, List webCachFiles) throws IOException, TskCoreException { + void processWebCache(String eseDumperPath, List webCacheFiles) throws IOException, TskCoreException { - for (AbstractFile webCacheFile : webCachFiles) { + for (AbstractFile webCacheFile : webCacheFiles) { + + if (context.dataSourceIngestIsCancelled()) { + return; + } //Run the dumper String tempWebCacheFileName = EDGE_WEBCACHE_PREFIX + Integer.toString((int) webCacheFile.getId()) + ".dat"; //NON-NLS - File tempWebCacheFile = new File(RAImageIngestModule.getRATempPath(currentCase, EDGE) - + File.separator + tempWebCacheFileName); + File tempWebCacheFile = new File(RAImageIngestModule.getRATempPath(currentCase, EDGE), tempWebCacheFileName); try { ContentUtils.writeToFile(webCacheFile, tempWebCacheFile, @@ -168,7 +176,7 @@ final class ExtractEdge extends Extract { throw new IOException("Error writingToFile: " + webCacheFile, ex); //NON-NLS } - File resultsDir = new File(moduleTempResultsDir + Integer.toString((int) webCacheFile.getId())); + File resultsDir = new File(moduleTempResultPath.toAbsolutePath() + Integer.toString((int) webCacheFile.getId())); resultsDir.mkdirs(); try { executeDumper(eseDumperPath, tempWebCacheFile.getAbsolutePath(), @@ -235,7 +243,7 @@ final class ExtractEdge extends Extract { } if (line.contains(EDGE_KEYWORD_VISIT)) { - BlackboardArtifact b = parseHistoryLine(origFile, headers, line); + BlackboardArtifact b = getHistoryArtifact(origFile, headers, line); if (b != null) { bbartifacts.add(b); this.indexArtifact(b); @@ -411,7 +419,7 @@ final class ExtractEdge extends Extract { @Messages({ "ExtractEdge_programName=Microsoft Edge" }) - private BlackboardArtifact parseHistoryLine(AbstractFile origFile, List headers, String line) throws TskCoreException { + private BlackboardArtifact getHistoryArtifact(AbstractFile origFile, List headers, String line) throws TskCoreException { String[] rowSplit = line.split(","); int index = headers.indexOf(EDGE_HEAD_URL); @@ -433,8 +441,8 @@ final class ExtractEdge extends Extract { BlackboardArtifact bbart = origFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY); - bbart.addAttributes(createHistoryAttributes(url, ftime, - "", "", + bbart.addAttributes(createHistoryAttribute(url, ftime, + null, null, Bundle.ExtractEdge_programName(), NetworkUtils.extractDomain(url), user)); @@ -466,12 +474,13 @@ final class ExtractEdge extends Extract { return null; } - private Collection createHistoryAttributes(String url, Long accessTime, + private Collection createHistoryAttribute(String url, Long accessTime, String referrer, String title, String programName, String domain, String user) throws TskCoreException { Collection bbattributes = new ArrayList<>(); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, - RecentActivityExtracterModuleFactory.getModuleName(), url)); + RecentActivityExtracterModuleFactory.getModuleName(), + (url != null) ? url : "")); if (accessTime != null) { bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, @@ -479,19 +488,24 @@ final class ExtractEdge extends Extract { } bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER, - RecentActivityExtracterModuleFactory.getModuleName(), referrer)); + RecentActivityExtracterModuleFactory.getModuleName(), + (referrer != null) ? referrer : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE, - RecentActivityExtracterModuleFactory.getModuleName(), title)); + RecentActivityExtracterModuleFactory.getModuleName(), + (title != null) ? title : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, - RecentActivityExtracterModuleFactory.getModuleName(), programName)); + RecentActivityExtracterModuleFactory.getModuleName(), + (programName != null) ? programName : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, - RecentActivityExtracterModuleFactory.getModuleName(), domain)); //NON-NLS + RecentActivityExtracterModuleFactory.getModuleName(), + (domain != null) ? domain : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME, - RecentActivityExtracterModuleFactory.getModuleName(), user)); + RecentActivityExtracterModuleFactory.getModuleName(), + (user != null) ? user : "")); return bbattributes; }