codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-06 02:24:30 +00:00
Code Issues Releases Wiki Activity

creates blackboard artifacts and attributes based on data from the xml file

Browse Source
This commit is contained in:
Samuel H. Kenyon
2014-04-28 01:29:53 -04:00
parent 138c57dd3e
commit f81cdd6830
4 changed files with 62 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java
View File

@@ -51,6 +51,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements
private String cmdPath;
private String cmdName;
String dataSourceLocalPath;
Content dataSource;
DataSourceIngestModuleProgress progressBar;
/**
@@ -77,7 +78,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements
}
///@todo use a standard name or search for an XML file
importFilePath = importPath + File.separator + "ext-test3.xml";
importFilePath = importPath + File.separator + "ext-test4.xml";
}
}
@@ -91,6 +92,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements
public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress statusHelper) {
progressBar = statusHelper;
progressBar.switchToDeterminate(2);
this.dataSource = dataSource;
try {
dataSourceLocalPath = dataSource.getImage().getPaths()[0];
@@ -155,7 +157,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements
private void importResults() {
// execution is done, look for results to import
ExternalResultsXML parser = new ExternalResultsXML(importFilePath);
ExternalResultsUtility.importResults(parser);
ExternalResultsUtility.importResults(parser, dataSource);
progressBar.progress(1);
}

45
Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java
View File

@@ -20,15 +20,58 @@
package org.sleuthkit.autopsy.modules.externalresults;
import java.util.ArrayList;
import java.util.Collection;
import org.openide.util.Exceptions;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.TskCoreException;
/**
*
*/
public class ExternalResultsUtility {
static public void importResults(ExternalResultsParser parser) {
private static final Logger logger = Logger.getLogger(ExternalResultsUtility.class.getName());
static public void importResults(ExternalResultsParser parser, Content defaultDataSource) {
// Create temporary data object
ResultsData resultsData = parser.parse();
// Use that data object to import the externally-generated information into the case
generateBlackboardItems(resultsData, defaultDataSource);
}
static private void generateBlackboardItems(ResultsData resultsData, Content defaultDataSource) {
for (ResultsData.ArtifactData art : resultsData.getArtifacts()) {
Content currContent = defaultDataSource;
///@todo get associated file (if any) to use as the content
BlackboardArtifact.ARTIFACT_TYPE bbArtType = BlackboardArtifact.ARTIFACT_TYPE.fromLabel(art.typeStr);
try {
Collection<BlackboardAttribute> bbAttributes = new ArrayList<>();
for (ResultsData.AttributeData attr : art.attributes) {
BlackboardAttribute.ATTRIBUTE_TYPE bbAttrType = BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel(attr.typeStr);
BlackboardAttribute bbAttr = null;
if (attr.valueType.equals("text")) {
bbAttr = new BlackboardAttribute(bbAttrType.getTypeID(), attr.source, attr.context, attr.valueStr);
}
if (bbAttr != null) {
bbAttributes.add(bbAttr);
}
}
BlackboardArtifact bbArt = currContent.newArtifact(bbArtType);
bbArt.addAttributes(bbAttributes);
IngestServices.getInstance().fireModuleDataEvent(new ModuleDataEvent("External Results Importer", bbArtType));
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
}
}
}
}

26
Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java
View File

@@ -113,30 +113,30 @@ public class ResultsData {
// Data structures
public static class ArtifactData {
private String typeStr;
private List<AttributeData> attributes = new ArrayList<>();
private List<FileData> files = new ArrayList<>();
public String typeStr;
public List<AttributeData> attributes = new ArrayList<>();
public List<FileData> files = new ArrayList<>();
}
public static class AttributeData {
private String typeStr;
private String valueType = "text"; //default if not specified
private String valueStr; //valueType determines how to interpret it
private String source;
private String context;
public String typeStr;
public String valueType = "text"; //default if not specified
public String valueStr; //valueType determines how to interpret it
public String source;
public String context;
}
public static class FileData {
private String path;
public String path;
}
public static class ReportData {
private String name;
private String displayName;
private String localPath;
public String name;
public String displayName;
public String localPath;
}
public static class DerivedFileData {
private String localPath;
public String localPath;
}
}

2
Core/src/org/sleuthkit/autopsy/modules/externalresults/autopsy_external_results.xsd
View File

@@ -2,7 +2,7 @@
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="autopsy_results">
<xs:complexType>
<xs:sequence>
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element minOccurs="0" maxOccurs="unbounded" name="data_source" type="xs:string" />
<xs:element minOccurs="0" maxOccurs="unbounded" name="artifacts">
<xs:complexType>