Autopsy  4.15.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
RAImageIngestModule.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2019 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.io.File;
26 import java.nio.file.Paths;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.logging.Level;
30 import org.openide.util.NbBundle;
39 import org.sleuthkit.datamodel.Content;
42 
46 public final class RAImageIngestModule implements DataSourceIngestModule {
47 
48  private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName());
49  private final List<Extract> extractors = new ArrayList<>();
50  private final List<Extract> browserExtractors = new ArrayList<>();
53  private StringBuilder subCompleted = new StringBuilder();
54 
56  }
57 
58  @Override
59  public void startUp(IngestJobContext context) throws IngestModuleException {
60  this.context = context;
61 
62  Extract iexplore;
63  Extract edge;
64  try {
65  iexplore = new ExtractIE();
66  edge = new ExtractEdge();
67  } catch (NoCurrentCaseException ex) {
68  throw new IngestModuleException(ex.getMessage(), ex);
69  }
70 
71  Extract registry = new ExtractRegistry();
72  Extract recentDocuments = new RecentDocumentsByLnk();
73  Extract chrome = new Chrome();
74  Extract firefox = new Firefox();
75  Extract SEUQA = new SearchEngineURLQueryAnalyzer();
76  Extract osExtract = new ExtractOs();
77  Extract dataSourceAnalyzer = new DataSourceUsageAnalyzer();
78  Extract safari = new ExtractSafari();
79  Extract zoneInfo = new ExtractZoneIdentifier();
80  Extract recycleBin = new ExtractRecycleBin();
81  Extract sru = new ExtractSru();
82  Extract prefetch = new ExtractPrefetch();
83 
84  extractors.add(chrome);
85  extractors.add(firefox);
86  extractors.add(iexplore);
87  extractors.add(edge);
88  extractors.add(safari);
89  extractors.add(recentDocuments);
90  extractors.add(SEUQA); // this needs to run after the web browser modules
91  extractors.add(registry); // this should run after quicker modules like the browser modules and needs to run before the DataSourceUsageAnalyzer
92  extractors.add(osExtract); // this needs to run before the DataSourceUsageAnalyzer
93  extractors.add(dataSourceAnalyzer); //this needs to run after ExtractRegistry and ExtractOs
94  extractors.add(zoneInfo); // this needs to run after the web browser modules
95  extractors.add(recycleBin); // this needs to run after ExtractRegistry and ExtractOS
96  extractors.add(sru);
97  extractors.add(prefetch);
98 
99  browserExtractors.add(chrome);
100  browserExtractors.add(firefox);
101  browserExtractors.add(iexplore);
102  browserExtractors.add(edge);
103  browserExtractors.add(safari);
104 
105  for (Extract extractor : extractors) {
106  extractor.init();
107  }
108  }
109 
110  @Override
111  public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
113  NbBundle.getMessage(this.getClass(),
114  "RAImageIngestModule.process.started",
115  dataSource.getName())));
116 
117  progressBar.switchToDeterminate(extractors.size());
118 
119  ArrayList<String> errors = new ArrayList<>();
120 
121  for (int i = 0; i < extractors.size(); i++) {
122  Extract extracter = extractors.get(i);
123  if (context.dataSourceIngestIsCancelled()) {
124  logger.log(Level.INFO, "Recent Activity has been canceled, quitting before {0}", extracter.getName()); //NON-NLS
125  break;
126  }
127 
128  progressBar.progress(extracter.getName(), i);
129 
130  try {
131  extracter.process(dataSource, context, progressBar);
132  } catch (Exception ex) {
133  logger.log(Level.SEVERE, "Exception occurred in " + extracter.getName(), ex); //NON-NLS
134  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModFailed",
135  extracter.getName()));
136  errors.add(
137  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModErrs", RecentActivityExtracterModuleFactory.getModuleName()));
138  }
139  progressBar.progress(i + 1);
140  errors.addAll(extracter.getErrorMessages());
141  }
142 
143  // create the final message for inbox
144  StringBuilder errorMessage = new StringBuilder();
145  String errorMsgSubject;
146  MessageType msgLevel = MessageType.INFO;
147  if (errors.isEmpty() == false) {
148  msgLevel = MessageType.ERROR;
149  errorMessage.append(
150  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.errsEncountered"));
151  for (String msg : errors) {
152  errorMessage.append("<li>").append(msg).append("</li>\n"); //NON-NLS
153  }
154  errorMessage.append("</ul>\n"); //NON-NLS
155 
156  if (errors.size() == 1) {
157  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.oneErr");
158  } else {
159  errorMsgSubject = NbBundle.getMessage(this.getClass(),
160  "RAImageIngestModule.process.errMsgSub.nErrs", errors.size());
161  }
162  } else {
163  errorMessage.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.noErrs"));
164  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.noErrs");
165  }
167  NbBundle.getMessage(this.getClass(),
168  "RAImageIngestModule.process.ingestMsg.finished",
169  dataSource.getName(), errorMsgSubject),
170  errorMessage.toString());
171  services.postMessage(msg);
172 
173  StringBuilder historyMsg = new StringBuilder();
174  historyMsg.append(
175  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.title", dataSource.getName()));
176  for (Extract module : browserExtractors) {
177  historyMsg.append("<li>").append(module.getName()); //NON-NLS
178  historyMsg.append(": ").append((module.foundData()) ? NbBundle
179  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.found") : NbBundle
180  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.notFnd"));
181  historyMsg.append("</li>"); //NON-NLS
182  }
183  historyMsg.append("</ul>"); //NON-NLS
185  NbBundle.getMessage(this.getClass(),
186  "RAImageIngestModule.process.ingestMsg.results",
187  dataSource.getName()),
188  historyMsg.toString());
189  services.postMessage(inboxMsg);
190 
191  if (context.dataSourceIngestIsCancelled()) {
192  return ProcessResult.OK;
193  }
194 
195  for (int i = 0; i < extractors.size(); i++) {
196  Extract extracter = extractors.get(i);
197  try {
198  extracter.complete();
199  } catch (Exception ex) {
200  logger.log(Level.SEVERE, "Exception occurred when completing " + extracter.getName(), ex); //NON-NLS
201  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.complete.errMsg.failed",
202  extracter.getName()));
203  }
204  }
205 
206  return ProcessResult.OK;
207  }
208 
219  protected static String getRATempPath(Case a_case, String mod) {
220  String tmpDir = a_case.getTempDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
221  File dir = new File(tmpDir);
222  if (dir.exists() == false) {
223  dir.mkdirs();
224  }
225  return tmpDir;
226  }
227 
238  protected static String getRAOutputPath(Case a_case, String mod) {
239  String tmpDir = a_case.getModuleDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
240  File dir = new File(tmpDir);
241  if (dir.exists() == false) {
242  dir.mkdirs();
243  }
244  return tmpDir;
245  }
246 
253  static String getRelModuleOutputPath() throws NoCurrentCaseException {
255  "RecentActivity").normalize().toString() ; //NON-NLS
256  }
257 }
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar)
void postMessage(final IngestMessage message)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static synchronized IngestServices getInstance()

Copyright © 2012-2020 Basis Technology. Generated on: Mon Jul 6 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.