Autopsy  4.14.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
RAImageIngestModule.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2019 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.io.File;
26 import java.nio.file.Paths;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.logging.Level;
30 import org.openide.util.NbBundle;
39 import org.sleuthkit.datamodel.Content;
42 
46 public final class RAImageIngestModule implements DataSourceIngestModule {
47 
48  private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName());
49  private final List<Extract> extractors = new ArrayList<>();
50  private final List<Extract> browserExtractors = new ArrayList<>();
53  private StringBuilder subCompleted = new StringBuilder();
54 
56  }
57 
58  @Override
59  public void startUp(IngestJobContext context) throws IngestModuleException {
60  this.context = context;
61 
62  Extract iexplore;
63  Extract edge;
64  try {
65  iexplore = new ExtractIE();
66  edge = new ExtractEdge();
67  } catch (NoCurrentCaseException ex) {
68  throw new IngestModuleException(ex.getMessage(), ex);
69  }
70 
71  Extract registry = new ExtractRegistry();
72  Extract recentDocuments = new RecentDocumentsByLnk();
73  Extract chrome = new Chrome();
74  Extract firefox = new Firefox();
75  Extract SEUQA = new SearchEngineURLQueryAnalyzer();
76  Extract osExtract = new ExtractOs();
77  Extract dataSourceAnalyzer = new DataSourceUsageAnalyzer();
78  Extract safari = new ExtractSafari();
79  Extract zoneInfo = new ExtractZoneIdentifier();
80  Extract recycleBin = new ExtractRecycleBin();
81 
82  extractors.add(chrome);
83  extractors.add(firefox);
84  extractors.add(iexplore);
85  extractors.add(edge);
86  extractors.add(safari);
87  extractors.add(recentDocuments);
88  extractors.add(SEUQA); // this needs to run after the web browser modules
89  extractors.add(registry); // this should run after quicker modules like the browser modules and needs to run before the DataSourceUsageAnalyzer
90  extractors.add(osExtract); // this needs to run before the DataSourceUsageAnalyzer
91  extractors.add(dataSourceAnalyzer); //this needs to run after ExtractRegistry and ExtractOs
92  extractors.add(zoneInfo); // this needs to run after the web browser modules
93  extractors.add(recycleBin); // this needs to run after ExtractRegistry and ExtractOS
94 
95  browserExtractors.add(chrome);
96  browserExtractors.add(firefox);
97  browserExtractors.add(iexplore);
98  browserExtractors.add(edge);
99  browserExtractors.add(safari);
100 
101  for (Extract extractor : extractors) {
102  extractor.init();
103  }
104  }
105 
106  @Override
107  public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
109  NbBundle.getMessage(this.getClass(),
110  "RAImageIngestModule.process.started",
111  dataSource.getName())));
112 
113  progressBar.switchToDeterminate(extractors.size());
114 
115  ArrayList<String> errors = new ArrayList<>();
116 
117  for (int i = 0; i < extractors.size(); i++) {
118  Extract extracter = extractors.get(i);
119  if (context.dataSourceIngestIsCancelled()) {
120  logger.log(Level.INFO, "Recent Activity has been canceled, quitting before {0}", extracter.getName()); //NON-NLS
121  break;
122  }
123 
124  progressBar.progress(extracter.getName(), i);
125 
126  try {
127  extracter.process(dataSource, context, progressBar);
128  } catch (Exception ex) {
129  logger.log(Level.SEVERE, "Exception occurred in " + extracter.getName(), ex); //NON-NLS
130  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModFailed",
131  extracter.getName()));
132  errors.add(
133  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModErrs", RecentActivityExtracterModuleFactory.getModuleName()));
134  }
135  progressBar.progress(i + 1);
136  errors.addAll(extracter.getErrorMessages());
137  }
138 
139  // create the final message for inbox
140  StringBuilder errorMessage = new StringBuilder();
141  String errorMsgSubject;
142  MessageType msgLevel = MessageType.INFO;
143  if (errors.isEmpty() == false) {
144  msgLevel = MessageType.ERROR;
145  errorMessage.append(
146  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.errsEncountered"));
147  for (String msg : errors) {
148  errorMessage.append("<li>").append(msg).append("</li>\n"); //NON-NLS
149  }
150  errorMessage.append("</ul>\n"); //NON-NLS
151 
152  if (errors.size() == 1) {
153  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.oneErr");
154  } else {
155  errorMsgSubject = NbBundle.getMessage(this.getClass(),
156  "RAImageIngestModule.process.errMsgSub.nErrs", errors.size());
157  }
158  } else {
159  errorMessage.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.noErrs"));
160  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.noErrs");
161  }
163  NbBundle.getMessage(this.getClass(),
164  "RAImageIngestModule.process.ingestMsg.finished",
165  dataSource.getName(), errorMsgSubject),
166  errorMessage.toString());
167  services.postMessage(msg);
168 
169  StringBuilder historyMsg = new StringBuilder();
170  historyMsg.append(
171  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.title", dataSource.getName()));
172  for (Extract module : browserExtractors) {
173  historyMsg.append("<li>").append(module.getName()); //NON-NLS
174  historyMsg.append(": ").append((module.foundData()) ? NbBundle
175  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.found") : NbBundle
176  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.notFnd"));
177  historyMsg.append("</li>"); //NON-NLS
178  }
179  historyMsg.append("</ul>"); //NON-NLS
181  NbBundle.getMessage(this.getClass(),
182  "RAImageIngestModule.process.ingestMsg.results",
183  dataSource.getName()),
184  historyMsg.toString());
185  services.postMessage(inboxMsg);
186 
187  if (context.dataSourceIngestIsCancelled()) {
188  return ProcessResult.OK;
189  }
190 
191  for (int i = 0; i < extractors.size(); i++) {
192  Extract extracter = extractors.get(i);
193  try {
194  extracter.complete();
195  } catch (Exception ex) {
196  logger.log(Level.SEVERE, "Exception occurred when completing " + extracter.getName(), ex); //NON-NLS
197  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.complete.errMsg.failed",
198  extracter.getName()));
199  }
200  }
201 
202  return ProcessResult.OK;
203  }
204 
215  protected static String getRATempPath(Case a_case, String mod) {
216  String tmpDir = a_case.getTempDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
217  File dir = new File(tmpDir);
218  if (dir.exists() == false) {
219  dir.mkdirs();
220  }
221  return tmpDir;
222  }
223 
234  protected static String getRAOutputPath(Case a_case, String mod) {
235  String tmpDir = a_case.getModuleDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
236  File dir = new File(tmpDir);
237  if (dir.exists() == false) {
238  dir.mkdirs();
239  }
240  return tmpDir;
241  }
242 
249  static String getRelModuleOutputPath() throws NoCurrentCaseException {
251  "RecentActivity").normalize().toString() ; //NON-NLS
252  }
253 }
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar)
void postMessage(final IngestMessage message)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static synchronized IngestServices getInstance()

Copyright © 2012-2020 Basis Technology. Generated on: Wed Apr 8 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.