|
Autopsy
4.12.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Inherits org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Public Member Functions | |
| DataSourceIngestModule | createDataSourceIngestModule (IngestModuleIngestJobSettings settings) |
| FileIngestModule | createFileIngestModule (IngestModuleIngestJobSettings settings) |
| IngestModuleIngestJobSettings | getDefaultIngestJobSettings () |
| IngestModuleGlobalSettingsPanel | getGlobalSettingsPanel () |
| IngestModuleIngestJobSettingsPanel | getIngestJobSettingsPanel (IngestModuleIngestJobSettings settings) |
| String | getModuleDescription () |
| String | getModuleDisplayName () |
| String | getModuleVersionNumber () |
| boolean | hasGlobalSettingsPanel () |
| boolean | hasIngestJobSettingsPanel () |
| boolean | isDataSourceIngestModuleFactory () |
| boolean | isFileIngestModuleFactory () |
Static Private Attributes | |
| static final String | VERSION_NUMBER = "1.0.0" |
A factory that creates sample data source and file ingest modules.
This factory implements an interface that must be implemented by all providers of Autopsy ingest modules. An ingest module factory is used to create instances of a type of data source ingest module, a type of file ingest module, or both.
Autopsy will generally use the factory to create several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.
Autopsy may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances.
An ingest module factory may provide global and per ingest job settings user interface panels. The global settings should apply to all module instances. The per ingest job settings should apply to all module instances working on a particular ingest job. Autopsy supports context-sensitive and persistent per ingest job settings, so per ingest job settings must be serializable.
To be discovered at runtime by the ingest framework, IngestModuleFactory implementations must be marked with the following NetBeans Service provider annotation (see below).
IMPORTANT TIP: This sample ingest module factory directly implements IngestModuleFactory. A practical alternative, recommended if you do not need to provide implementations of all of the IngestModuleFactory methods, is to extend the abstract class IngestModuleFactoryAdapter to get default implementations of most of the IngestModuleFactory methods.
Definition at line 91 of file SampleIngestModuleFactory.java.
| DataSourceIngestModule org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.createDataSourceIngestModule | ( | IngestModuleIngestJobSettings | settings | ) |
Creates a data source ingest module instance.
Autopsy will generally use the factory to several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.
The ingest framework may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. modules.
If the module family does not include data source ingest modules, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that throws an UnsupportedOperationException.
| settings | The settings for the ingest job. |
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 273 of file SampleIngestModuleFactory.java.
| FileIngestModule org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.createFileIngestModule | ( | IngestModuleIngestJobSettings | settings | ) |
Creates a file ingest module instance.
Autopsy will generally use the factory to several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.
The ingest framework may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. modules.
If the module family does not include file ingest modules, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that throws an UnsupportedOperationException.
| settings | The settings for the ingest job. |
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 323 of file SampleIngestModuleFactory.java.
| IngestModuleIngestJobSettings org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.getDefaultIngestJobSettings | ( | ) |
Gets the default per ingest job settings for instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest modules family uses hash databases imported or created using its global settings panel. All of the hash databases are enabled by default for an ingest job. If the module family does not have per ingest job settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns an instance of the NoIngestModuleJobSettings class.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 187 of file SampleIngestModuleFactory.java.
| IngestModuleGlobalSettingsPanel org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.getGlobalSettingsPanel | ( | ) |
Gets a user interface panel that allows a user to change settings that are used by all instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest module factory provides a global settings panel to import and create hash databases. The imported hash databases are then enabled or disabled per ingest job using ingest an ingest job settings panel. If the module family does not have a global settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that throws an UnsupportedOperationException.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 170 of file SampleIngestModuleFactory.java.
| IngestModuleIngestJobSettingsPanel org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.getIngestJobSettingsPanel | ( | IngestModuleIngestJobSettings | settings | ) |
Gets a user interface panel that can be used to set per ingest job settings for instances of the family of ingest modules the factory creates. For example, the core hash lookup ingest module factory provides an ingest job settings panel to enable or disable hash databases per ingest job. If the module family does not have per ingest job settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that throws an UnsupportedOperationException.
| settings | Per ingest job settings to initialize the panel. |
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 223 of file SampleIngestModuleFactory.java.
| String org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.getModuleDescription | ( | ) |
Gets a brief, user-friendly description of the family of ingest modules the factory creates. Autopsy uses this string to describe the module in user interface components.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 123 of file SampleIngestModuleFactory.java.
| String org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.getModuleDisplayName | ( | ) |
Gets the display name that identifies the family of ingest modules the factory creates. Autopsy uses this string to identify the module in user interface components and log messages. The module name must be unique. so a brief but distinctive name is recommended.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 111 of file SampleIngestModuleFactory.java.
| String org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.getModuleVersionNumber | ( | ) |
Gets the version number of the family of ingest modules the factory creates.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 134 of file SampleIngestModuleFactory.java.
| boolean org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.hasGlobalSettingsPanel | ( | ) |
Queries the factory to determine if it provides a user interface panel to allow a user to change settings that are used by all instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest module factory provides a global settings panel to import and create hash databases. The hash databases are then enabled or disabled per ingest job using an ingest job settings panel. If the module family does not have global settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 152 of file SampleIngestModuleFactory.java.
| boolean org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.hasIngestJobSettingsPanel | ( | ) |
Queries the factory to determine if it provides user a interface panel to allow a user to make per ingest job settings for instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest module factory provides an ingest job settings panels to enable or disable hash databases per ingest job. If the module family does not have per ingest job settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 204 of file SampleIngestModuleFactory.java.
| boolean org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.isDataSourceIngestModuleFactory | ( | ) |
Queries the factory to determine if it is capable of creating data source ingest modules. If the module family does not include data source ingest modules, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 239 of file SampleIngestModuleFactory.java.
| boolean org.sleuthkit.autopsy.examples.SampleIngestModuleFactory.isFileIngestModuleFactory | ( | ) |
Queries the factory to determine if it is capable of creating file ingest modules. If the module family does not include file ingest modules, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
Implements org.sleuthkit.autopsy.ingest.IngestModuleFactory.
Definition at line 289 of file SampleIngestModuleFactory.java.
|
staticprivate |
Definition at line 93 of file SampleIngestModuleFactory.java.
Copyright © 2012-2018 Basis Technology. Generated on: Wed Sep 18 2019
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.