From f81cdd6830783fa2cdc645bd192599d310b2c6d1 Mon Sep 17 00:00:00 2001 From: "Samuel H. Kenyon" Date: Mon, 28 Apr 2014 01:29:53 -0400 Subject: [PATCH] creates blackboard artifacts and attributes based on data from the xml file --- .../ExternalResultsIngestModule.java | 6 ++- .../ExternalResultsUtility.java | 45 ++++++++++++++++++- .../modules/externalresults/ResultsData.java | 26 +++++------ .../autopsy_external_results.xsd | 2 +- 4 files changed, 62 insertions(+), 17 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java index f93561441f..032586e3af 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java @@ -51,6 +51,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements private String cmdPath; private String cmdName; String dataSourceLocalPath; + Content dataSource; DataSourceIngestModuleProgress progressBar; /** @@ -77,7 +78,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements } ///@todo use a standard name or search for an XML file - importFilePath = importPath + File.separator + "ext-test3.xml"; + importFilePath = importPath + File.separator + "ext-test4.xml"; } } @@ -91,6 +92,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress statusHelper) { progressBar = statusHelper; progressBar.switchToDeterminate(2); + this.dataSource = dataSource; try { dataSourceLocalPath = dataSource.getImage().getPaths()[0]; @@ -155,7 +157,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements private void importResults() { // execution is done, look for results to import ExternalResultsXML parser = new ExternalResultsXML(importFilePath); - ExternalResultsUtility.importResults(parser); + ExternalResultsUtility.importResults(parser, dataSource); progressBar.progress(1); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java index e6bc7576a6..5483f121a4 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java +++ b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java @@ -20,15 +20,58 @@ package org.sleuthkit.autopsy.modules.externalresults; +import java.util.ArrayList; +import java.util.Collection; +import org.openide.util.Exceptions; +import org.sleuthkit.autopsy.coreutils.Logger; +import org.sleuthkit.autopsy.ingest.IngestServices; +import org.sleuthkit.autopsy.ingest.ModuleDataEvent; +import org.sleuthkit.datamodel.BlackboardArtifact; +import org.sleuthkit.datamodel.BlackboardAttribute; +import org.sleuthkit.datamodel.Content; +import org.sleuthkit.datamodel.TskCoreException; /** * */ public class ExternalResultsUtility { - static public void importResults(ExternalResultsParser parser) { + private static final Logger logger = Logger.getLogger(ExternalResultsUtility.class.getName()); + + static public void importResults(ExternalResultsParser parser, Content defaultDataSource) { + // Create temporary data object ResultsData resultsData = parser.parse(); + + // Use that data object to import the externally-generated information into the case + generateBlackboardItems(resultsData, defaultDataSource); } + static private void generateBlackboardItems(ResultsData resultsData, Content defaultDataSource) { + for (ResultsData.ArtifactData art : resultsData.getArtifacts()) { + Content currContent = defaultDataSource; + ///@todo get associated file (if any) to use as the content + + BlackboardArtifact.ARTIFACT_TYPE bbArtType = BlackboardArtifact.ARTIFACT_TYPE.fromLabel(art.typeStr); + try { + Collection bbAttributes = new ArrayList<>(); + for (ResultsData.AttributeData attr : art.attributes) { + BlackboardAttribute.ATTRIBUTE_TYPE bbAttrType = BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel(attr.typeStr); + BlackboardAttribute bbAttr = null; + if (attr.valueType.equals("text")) { + bbAttr = new BlackboardAttribute(bbAttrType.getTypeID(), attr.source, attr.context, attr.valueStr); + } + if (bbAttr != null) { + bbAttributes.add(bbAttr); + } + } + BlackboardArtifact bbArt = currContent.newArtifact(bbArtType); + bbArt.addAttributes(bbAttributes); + IngestServices.getInstance().fireModuleDataEvent(new ModuleDataEvent("External Results Importer", bbArtType)); + } catch (TskCoreException ex) { + Exceptions.printStackTrace(ex); + } + } + + } } diff --git a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java index ea3de22692..5a872a5ec9 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java +++ b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java @@ -113,30 +113,30 @@ public class ResultsData { // Data structures public static class ArtifactData { - private String typeStr; - private List attributes = new ArrayList<>(); - private List files = new ArrayList<>(); + public String typeStr; + public List attributes = new ArrayList<>(); + public List files = new ArrayList<>(); } public static class AttributeData { - private String typeStr; - private String valueType = "text"; //default if not specified - private String valueStr; //valueType determines how to interpret it - private String source; - private String context; + public String typeStr; + public String valueType = "text"; //default if not specified + public String valueStr; //valueType determines how to interpret it + public String source; + public String context; } public static class FileData { - private String path; + public String path; } public static class ReportData { - private String name; - private String displayName; - private String localPath; + public String name; + public String displayName; + public String localPath; } public static class DerivedFileData { - private String localPath; + public String localPath; } } diff --git a/Core/src/org/sleuthkit/autopsy/modules/externalresults/autopsy_external_results.xsd b/Core/src/org/sleuthkit/autopsy/modules/externalresults/autopsy_external_results.xsd index 4357e0ad97..59ff9e9b12 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/externalresults/autopsy_external_results.xsd +++ b/Core/src/org/sleuthkit/autopsy/modules/externalresults/autopsy_external_results.xsd @@ -2,7 +2,7 @@ - +