From 159524427c41521f60ad0ad5ed69fb93df0e4765 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Fri, 15 Feb 2019 15:28:57 -0500 Subject: [PATCH 1/2] Renamed parseHistory function to getHistoryArtifact and put a little error checking into createHistoryAttribute 1190-edge-History --- .../autopsy/recentactivity/ExtractEdge.java | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java index 66099f4e10..a94d550232 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java @@ -234,7 +234,7 @@ final class ExtractEdge extends Extract { } if (line.contains(EDGE_KEYWORD_VISIT)) { - BlackboardArtifact b = parseHistoryLine(origFile, headers, line); + BlackboardArtifact b = getHistoryArtifact(origFile, headers, line); if (b != null) { bbartifacts.add(b); this.indexArtifact(b); @@ -325,7 +325,7 @@ final class ExtractEdge extends Extract { @Messages({ "ExtractEdge_programName=Microsoft Edge" }) - private BlackboardArtifact parseHistoryLine(AbstractFile origFile, List headers, String line) throws TskCoreException { + private BlackboardArtifact getHistoryArtifact(AbstractFile origFile, List headers, String line) throws TskCoreException { String[] rowSplit = line.split(","); int index = headers.indexOf(EDGE_HEAD_URL); @@ -347,20 +347,21 @@ final class ExtractEdge extends Extract { BlackboardArtifact bbart = origFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY); - bbart.addAttributes(createHistoryAttributes(url, ftime, - "", "", + bbart.addAttributes(createHistoryAttribute(url, ftime, + null, null, Bundle.ExtractEdge_programName(), NetworkUtils.extractDomain(url), user)); return bbart; } - private Collection createHistoryAttributes(String url, Long accessTime, + private Collection createHistoryAttribute(String url, Long accessTime, String referrer, String title, String programName, String domain, String user) throws TskCoreException { Collection bbattributes = new ArrayList<>(); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, - RecentActivityExtracterModuleFactory.getModuleName(), url)); + RecentActivityExtracterModuleFactory.getModuleName(), + (url != null) ? url : "")); if (accessTime != null) { bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, @@ -368,19 +369,24 @@ final class ExtractEdge extends Extract { } bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER, - RecentActivityExtracterModuleFactory.getModuleName(), referrer)); + RecentActivityExtracterModuleFactory.getModuleName(), + (referrer != null) ? referrer : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE, - RecentActivityExtracterModuleFactory.getModuleName(), title)); + RecentActivityExtracterModuleFactory.getModuleName(), + (title != null) ? title : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, - RecentActivityExtracterModuleFactory.getModuleName(), programName)); + RecentActivityExtracterModuleFactory.getModuleName(), + (programName != null) ? programName : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, - RecentActivityExtracterModuleFactory.getModuleName(), domain)); //NON-NLS + RecentActivityExtracterModuleFactory.getModuleName(), + (domain != null) ? domain : "")); bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME, - RecentActivityExtracterModuleFactory.getModuleName(), user)); + RecentActivityExtracterModuleFactory.getModuleName(), + (user != null) ? user : "")); return bbattributes; } From c0469192f46c209345011ee2066aa2061f3300d4 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Tue, 19 Feb 2019 11:26:04 -0500 Subject: [PATCH 2/2] Updated based on second round of Richard's comments 1190-basic-edge-module --- .../autopsy/recentactivity/Extract.java | 4 ++ .../autopsy/recentactivity/ExtractEdge.java | 52 ++++++++++--------- 2 files changed, 32 insertions(+), 24 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java index f934a420e3..466fbb6997 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java @@ -204,4 +204,8 @@ abstract class Extract { public boolean foundData() { return dataFound; } + + protected void setFoundData(boolean b){ + dataFound = b; + } } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java index 6dcddf9ed0..fa02e99428 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractEdge.java @@ -26,7 +26,6 @@ import java.util.ArrayList; import java.util.List; import java.util.logging.Level; import org.openide.modules.InstalledFileLocator; -import org.openide.util.NbBundle; import org.openide.util.NbBundle.Messages; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; @@ -36,22 +35,18 @@ import org.sleuthkit.autopsy.coreutils.PlatformUtil; import org.sleuthkit.autopsy.datamodel.ContentUtils; import org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProcessTerminator; import org.sleuthkit.autopsy.ingest.IngestJobContext; -import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.TskCoreException; /** * Extract the bookmarks, cookies, downloads and history from the Microsoft Edge - * files - * - * @author kelly + * files. */ final class ExtractEdge extends Extract { - private static final Logger logger = Logger.getLogger(ExtractIE.class.getName()); - private final IngestServices services = IngestServices.getInstance(); - private final String moduleTempResultsDir; + private static final Logger logger = Logger.getLogger(ExtractEdge.class.getName()); + private final Path moduleTempResultPath; private Content dataSource; private IngestJobContext context; @@ -63,8 +58,7 @@ final class ExtractEdge extends Extract { private static final String EDGE_SPARTAN_NAME = "Spartan.edb"; ExtractEdge() throws NoCurrentCaseException { - moduleTempResultsDir = RAImageIngestModule.getRATempPath(Case.getCurrentCaseThrows(), EDGE) - + File.separator + "results"; //NON-NLS + moduleTempResultPath = Paths.get(RAImageIngestModule.getRATempPath(Case.getCurrentCaseThrows(), EDGE), "results"); } @Messages({ @@ -78,23 +72,30 @@ final class ExtractEdge extends Extract { @Messages({ "ExtractEdge_process_errMsg_unableFindESEViewer=Unable to find ESEDatabaseViewer", "ExtractEdge_process_errMsg_errGettingWebCacheFiles=Error trying to retrieving Edge WebCacheV01 file", - "ExtractEdge_process_errMsg_webcacheFail=Failure processing Microsoft Edge WebCache file" + "ExtractEdge_process_errMsg_webcacheFail=Failure processing Microsoft Edge WebCacheV01.dat file", + "ExtractEdge_process_errMsg_spartanFail=Failure processing Microsoft Edge spartan.edb file" }) @Override void process(Content dataSource, IngestJobContext context) { this.dataSource = dataSource; this.context = context; - dataFound = false; + this.setFoundData(false); + + List webCacheFiles = null; + List spartanFiles = null; - List webCacheFiles; - List spartanFiles; try { webCacheFiles = fetchWebCacheFiles(); - spartanFiles = fetchSpartanFiles(); // For later use with bookmarks } catch (TskCoreException ex) { this.addErrorMessage(Bundle.ExtractEdge_process_errMsg_errGettingWebCacheFiles()); - logger.log(Level.WARNING, "Error fetching 'WebCacheV01.dat' files for Microsoft Edge", ex); //NON-NLS - return; + logger.log(Level.SEVERE, "Error fetching 'WebCacheV01.dat' files for Microsoft Edge", ex); //NON-NLS + } + + try { + spartanFiles = fetchSpartanFiles(); // For later use with bookmarks + } catch (TskCoreException ex) { + this.addErrorMessage(Bundle.ExtractEdge_process_errMsg_spartanFail()); + logger.log(Level.SEVERE, "Error fetching 'spartan.edb' files for Microsoft Edge", ex); //NON-NLS } // No edge files found @@ -102,10 +103,10 @@ final class ExtractEdge extends Extract { return; } - dataFound = true; + this.setFoundData(true); if (!PlatformUtil.isWindowsOS()) { - logger.log(Level.INFO, "Microsoft Edge files found, unable to parse on Non-Windows system"); //NON-NLS + logger.log(Level.WARNING, "Microsoft Edge files found, unable to parse on Non-Windows system"); //NON-NLS return; } @@ -135,15 +136,18 @@ final class ExtractEdge extends Extract { this.getBookmark(); // Not implemented yet } - void processWebCache(String eseDumperPath, List webCachFiles) throws IOException { + void processWebCache(String eseDumperPath, List webCacheFiles) throws IOException { - for (AbstractFile webCacheFile : webCachFiles) { + for (AbstractFile webCacheFile : webCacheFiles) { + + if (context.dataSourceIngestIsCancelled()) { + return; + } //Run the dumper String tempWebCacheFileName = EDGE_WEBCACHE_PREFIX + Integer.toString((int) webCacheFile.getId()) + ".dat"; //NON-NLS - File tempWebCacheFile = new File(RAImageIngestModule.getRATempPath(currentCase, EDGE) - + File.separator + tempWebCacheFileName); + File tempWebCacheFile = new File(RAImageIngestModule.getRATempPath(currentCase, EDGE), tempWebCacheFileName); try { ContentUtils.writeToFile(webCacheFile, tempWebCacheFile, @@ -152,7 +156,7 @@ final class ExtractEdge extends Extract { throw new IOException("Error writingToFile: " + webCacheFile, ex); //NON-NLS } - File resultsDir = new File(moduleTempResultsDir + Integer.toString((int) webCacheFile.getId())); + File resultsDir = new File(moduleTempResultPath.toAbsolutePath() + Integer.toString((int) webCacheFile.getId())); resultsDir.mkdirs(); try { executeDumper(eseDumperPath, tempWebCacheFile.getAbsolutePath(),