Autopsy  4.13.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule Class Reference

Inherits org.sleuthkit.autopsy.ingest.FileIngestModule.


class  Indexer
enum  IngestStatus
enum  StringsExtractOptions
enum  UpdateFrequency

Public Member Functions

ProcessResult process (AbstractFile abstractFile)
void shutDown ()
void startUp (IngestJobContext context) throws IngestModuleException

Private Member Functions

void cleanup ()
void postIndexSummary ()

Static Private Member Functions

static void putIngestStatus (long ingestJobId, long fileId, IngestStatus status)

Private Attributes

IngestJobContext context
FileTypeDetector fileTypeDetector
Indexer indexer
Ingester ingester = null
boolean initialized = false
int instanceNum = 0
long jobId
final IngestServices services = IngestServices.getInstance()
final KeywordSearchJobSettings settings
boolean startedSearching = false
Lookup stringsExtractionContext

Static Private Attributes

static final List< String > ARCHIVE_MIME_TYPES
static final Map< Long, Map< Long, IngestStatus > > ingestStatus = new HashMap<>()
static final AtomicInteger instanceCount = new AtomicInteger(0)
static final Logger logger = Logger.getLogger(KeywordSearchIngestModule.class.getName())
static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter()

Detailed Description

An ingest module on a file level Performs indexing of allocated and Solr supported files, string extraction and indexing of unallocated and not Solr supported files Index commit is done periodically (determined by user set ingest update interval) Runs a periodic keyword / regular expression search on currently configured lists for ingest and writes results to blackboard Reports interesting events to Inbox and to viewers

Definition at line 76 of file

Member Function Documentation

void org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.cleanup ( )

Common cleanup code when module stops or final searcher completes

Definition at line 396 of file

void org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.postIndexSummary ( )
ProcessResult org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.process ( AbstractFile  file)

Processes a file. Called between calls to startUp() and shutDown(). Will be called for each file in a data source.

fileThe file to analyze.
A result code indicating success or failure of the processing.

Implements org.sleuthkit.autopsy.ingest.FileIngestModule.

Definition at line 311 of file

References org.sleuthkit.autopsy.ingest.IngestJobContext.fileIngestIsCancelled(), org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.Indexer.indexFile(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.OK, and org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.IngestStatus.SKIPPED_ERROR_INDEXING.

static void org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.putIngestStatus ( long  ingestJobId,
long  fileId,
IngestStatus  status 

Records the ingest status for a given file for a given ingest job. Used for final statistics at the end of the job.

ingestJobIdid of ingest job
fileIdid of file
statusingest status of the file

Definition at line 180 of file

void org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.shutDown ( )
void org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.startUp ( IngestJobContext  context) throws IngestModuleException

Member Data Documentation

final List<String> org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.ARCHIVE_MIME_TYPES

generally text extractors should ignore archives and let unpacking modules take care of them

Definition at line 83 of file

IngestJobContext org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.context
FileTypeDetector org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.fileTypeDetector

Definition at line 147 of file

Indexer org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.indexer

Definition at line 146 of file

Ingester org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.ingester = null

Definition at line 145 of file

final Map<Long, Map<Long, IngestStatus> > org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.ingestStatus = new HashMap<>()

Definition at line 170 of file

boolean org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.initialized = false

Definition at line 154 of file

final AtomicInteger org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.instanceCount = new AtomicInteger(0)

Definition at line 156 of file

int org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.instanceNum = 0

Definition at line 157 of file

long org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.jobId

Definition at line 155 of file

final Logger org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.logger = Logger.getLogger(KeywordSearchIngestModule.class.getName())

Definition at line 143 of file

final IngestModuleReferenceCounter org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.refCounter = new IngestModuleReferenceCounter()

Definition at line 158 of file

final IngestServices = IngestServices.getInstance()

Definition at line 144 of file

final KeywordSearchJobSettings org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.settings

Definition at line 153 of file

boolean org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.startedSearching = false

Definition at line 151 of file

Lookup org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.stringsExtractionContext

Definition at line 152 of file

The documentation for this class was generated from the following file:

Copyright © 2012-2019 Basis Technology. Generated on: Tue Jan 7 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.