Autopsy  4.12.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
RAImageIngestModule.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2019 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.io.File;
26 import java.nio.file.Paths;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.logging.Level;
30 import org.openide.util.NbBundle;
39 import org.sleuthkit.datamodel.Content;
42 
46 public final class RAImageIngestModule implements DataSourceIngestModule {
47 
48  private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName());
49  private final List<Extract> extractors = new ArrayList<>();
50  private final List<Extract> browserExtractors = new ArrayList<>();
53  private StringBuilder subCompleted = new StringBuilder();
54 
56  }
57 
58  @Override
59  public void startUp(IngestJobContext context) throws IngestModuleException {
60  this.context = context;
61 
62  Extract iexplore;
63  Extract edge;
64  try {
65  iexplore = new ExtractIE();
66  edge = new ExtractEdge();
67  } catch (NoCurrentCaseException ex) {
68  throw new IngestModuleException(ex.getMessage(), ex);
69  }
70 
71  Extract registry = new ExtractRegistry();
72  Extract recentDocuments = new RecentDocumentsByLnk();
73  Extract chrome = new Chrome();
74  Extract firefox = new Firefox();
75  Extract SEUQA = new SearchEngineURLQueryAnalyzer();
76  Extract osExtract = new ExtractOs();
77  Extract dataSourceAnalyzer = new DataSourceUsageAnalyzer();
78  Extract safari = new ExtractSafari();
79  Extract zoneInfo = new ExtractZoneIdentifier();
80 
81  extractors.add(chrome);
82  extractors.add(firefox);
83  extractors.add(iexplore);
84  extractors.add(edge);
85  extractors.add(safari);
86  extractors.add(recentDocuments);
87  extractors.add(SEUQA); // this needs to run after the web browser modules
88  extractors.add(registry); // this should run after quicker modules like the browser modules and needs to run before the DataSourceUsageAnalyzer
89  extractors.add(osExtract); // this needs to run before the DataSourceUsageAnalyzer
90  extractors.add(dataSourceAnalyzer); //this needs to run after ExtractRegistry and ExtractOs
91  extractors.add(zoneInfo); // this needs to run after the web browser modules
92 
93  browserExtractors.add(chrome);
94  browserExtractors.add(firefox);
95  browserExtractors.add(iexplore);
96  browserExtractors.add(edge);
97  browserExtractors.add(safari);
98 
99  for (Extract extractor : extractors) {
100  extractor.init();
101  }
102  }
103 
104  @Override
105  public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
107  NbBundle.getMessage(this.getClass(),
108  "RAImageIngestModule.process.started",
109  dataSource.getName())));
110 
111  progressBar.switchToDeterminate(extractors.size());
112 
113  ArrayList<String> errors = new ArrayList<>();
114 
115  for (int i = 0; i < extractors.size(); i++) {
116  Extract extracter = extractors.get(i);
117  if (context.dataSourceIngestIsCancelled()) {
118  logger.log(Level.INFO, "Recent Activity has been canceled, quitting before {0}", extracter.getName()); //NON-NLS
119  break;
120  }
121 
122  progressBar.progress(extracter.getName(), i);
123 
124  try {
125  extracter.process(dataSource, context, progressBar);
126  } catch (Exception ex) {
127  logger.log(Level.SEVERE, "Exception occurred in " + extracter.getName(), ex); //NON-NLS
128  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModFailed",
129  extracter.getName()));
130  errors.add(
131  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModErrs", RecentActivityExtracterModuleFactory.getModuleName()));
132  }
133  progressBar.progress(i + 1);
134  errors.addAll(extracter.getErrorMessages());
135  }
136 
137  // create the final message for inbox
138  StringBuilder errorMessage = new StringBuilder();
139  String errorMsgSubject;
140  MessageType msgLevel = MessageType.INFO;
141  if (errors.isEmpty() == false) {
142  msgLevel = MessageType.ERROR;
143  errorMessage.append(
144  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.errsEncountered"));
145  for (String msg : errors) {
146  errorMessage.append("<li>").append(msg).append("</li>\n"); //NON-NLS
147  }
148  errorMessage.append("</ul>\n"); //NON-NLS
149 
150  if (errors.size() == 1) {
151  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.oneErr");
152  } else {
153  errorMsgSubject = NbBundle.getMessage(this.getClass(),
154  "RAImageIngestModule.process.errMsgSub.nErrs", errors.size());
155  }
156  } else {
157  errorMessage.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.noErrs"));
158  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.noErrs");
159  }
161  NbBundle.getMessage(this.getClass(),
162  "RAImageIngestModule.process.ingestMsg.finished",
163  dataSource.getName(), errorMsgSubject),
164  errorMessage.toString());
165  services.postMessage(msg);
166 
167  StringBuilder historyMsg = new StringBuilder();
168  historyMsg.append(
169  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.title", dataSource.getName()));
170  for (Extract module : browserExtractors) {
171  historyMsg.append("<li>").append(module.getName()); //NON-NLS
172  historyMsg.append(": ").append((module.foundData()) ? NbBundle
173  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.found") : NbBundle
174  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.notFnd"));
175  historyMsg.append("</li>"); //NON-NLS
176  }
177  historyMsg.append("</ul>"); //NON-NLS
179  NbBundle.getMessage(this.getClass(),
180  "RAImageIngestModule.process.ingestMsg.results",
181  dataSource.getName()),
182  historyMsg.toString());
183  services.postMessage(inboxMsg);
184 
185  if (context.dataSourceIngestIsCancelled()) {
186  return ProcessResult.OK;
187  }
188 
189  for (int i = 0; i < extractors.size(); i++) {
190  Extract extracter = extractors.get(i);
191  try {
192  extracter.complete();
193  } catch (Exception ex) {
194  logger.log(Level.SEVERE, "Exception occurred when completing " + extracter.getName(), ex); //NON-NLS
195  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.complete.errMsg.failed",
196  extracter.getName()));
197  }
198  }
199 
200  return ProcessResult.OK;
201  }
202 
213  protected static String getRATempPath(Case a_case, String mod) {
214  String tmpDir = a_case.getTempDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
215  File dir = new File(tmpDir);
216  if (dir.exists() == false) {
217  dir.mkdirs();
218  }
219  return tmpDir;
220  }
221 
232  protected static String getRAOutputPath(Case a_case, String mod) {
233  String tmpDir = a_case.getModuleDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
234  File dir = new File(tmpDir);
235  if (dir.exists() == false) {
236  dir.mkdirs();
237  }
238  return tmpDir;
239  }
240 
247  static String getRelModuleOutputPath() throws NoCurrentCaseException {
249  "RecentActivity").normalize().toString() ; //NON-NLS
250  }
251 }
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar)
void postMessage(final IngestMessage message)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static synchronized IngestServices getInstance()

Copyright © 2012-2018 Basis Technology. Generated on: Wed Sep 18 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.